ssl/t1_lib.c

   1 /* ssl/t1_lib.c */
   2 /* Copyright (C) 1995-1998 Eric Young (eay@cryptsoft.com)
   3  * All rights reserved.
   4  *
   5  * This package is an SSL implementation written
   6  * by Eric Young (eay@cryptsoft.com).
   7  * The implementation was written so as to conform with Netscapes SSL.
   8  *
   9  * This library is free for commercial and non-commercial use as long as
  10  * the following conditions are aheared to.  The following conditions
  11  * apply to all code found in this distribution, be it the RC4, RSA,
  12  * lhash, DES, etc., code; not just the SSL code.  The SSL documentation
  13  * included with this distribution is covered by the same copyright terms
  14  * except that the holder is Tim Hudson (tjh@cryptsoft.com).
  15  *
  16  * Copyright remains Eric Young's, and as such any Copyright notices in
  17  * the code are not to be removed.
  18  * If this package is used in a product, Eric Young should be given attribution
  19  * as the author of the parts of the library used.
  20  * This can be in the form of a textual message at program startup or
  21  * in documentation (online or textual) provided with the package.
  22  *
  23  * Redistribution and use in source and binary forms, with or without
  24  * modification, are permitted provided that the following conditions
  25  * are met:
  26  * 1. Redistributions of source code must retain the copyright
  27  *    notice, this list of conditions and the following disclaimer.
  28  * 2. Redistributions in binary form must reproduce the above copyright
  29  *    notice, this list of conditions and the following disclaimer in the
  30  *    documentation and/or other materials provided with the distribution.
  31  * 3. All advertising materials mentioning features or use of this software
  32  *    must display the following acknowledgement:
  33  *    "This product includes cryptographic software written by
  34  *     Eric Young (eay@cryptsoft.com)"
  35  *    The word 'cryptographic' can be left out if the rouines from the library
  36  *    being used are not cryptographic related :-).
  37  * 4. If you include any Windows specific code (or a derivative thereof) from
  38  *    the apps directory (application code) you must include an acknowledgement:
  39  *    "This product includes software written by Tim Hudson (tjh@cryptsoft.com)"
  40  *
  41  * THIS SOFTWARE IS PROVIDED BY ERIC YOUNG ``AS IS'' AND
  42  * ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
  43  * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE
  44  * ARE DISCLAIMED.  IN NO EVENT SHALL THE AUTHOR OR CONTRIBUTORS BE LIABLE
  45  * FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL
  46  * DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS
  47  * OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION)
  48  * HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT
  49  * LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY
  50  * OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF
  51  * SUCH DAMAGE.
  52  *
  53  * The licence and distribution terms for any publically available version or
  54  * derivative of this code cannot be changed.  i.e. this code cannot simply be
  55  * copied and put under another distribution licence
  56  * [including the GNU Public Licence.]
  57  */
  58 /* ====================================================================
  59  * Copyright (c) 1998-2007 The OpenSSL Project.  All rights reserved.
  60  *
  61  * Redistribution and use in source and binary forms, with or without
  62  * modification, are permitted provided that the following conditions
  63  * are met:
  64  *
  65  * 1. Redistributions of source code must retain the above copyright
  66  *    notice, this list of conditions and the following disclaimer.
  67  *
  68  * 2. Redistributions in binary form must reproduce the above copyright
  69  *    notice, this list of conditions and the following disclaimer in
  70  *    the documentation and/or other materials provided with the
  71  *    distribution.
  72  *
  73  * 3. All advertising materials mentioning features or use of this
  74  *    software must display the following acknowledgment:
  75  *    "This product includes software developed by the OpenSSL Project
  76  *    for use in the OpenSSL Toolkit. (http://www.openssl.org/)"
  77  *
  78  * 4. The names "OpenSSL Toolkit" and "OpenSSL Project" must not be used to
  79  *    endorse or promote products derived from this software without
  80  *    prior written permission. For written permission, please contact
  81  *    openssl-core@openssl.org.
  82  *
  83  * 5. Products derived from this software may not be called "OpenSSL"
  84  *    nor may "OpenSSL" appear in their names without prior written
  85  *    permission of the OpenSSL Project.
  86  *
  87  * 6. Redistributions of any form whatsoever must retain the following
  88  *    acknowledgment:
  89  *    "This product includes software developed by the OpenSSL Project
  90  *    for use in the OpenSSL Toolkit (http://www.openssl.org/)"
  91  *
  92  * THIS SOFTWARE IS PROVIDED BY THE OpenSSL PROJECT ``AS IS'' AND ANY
  93  * EXPRESSED OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
  94  * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
  95  * PURPOSE ARE DISCLAIMED.  IN NO EVENT SHALL THE OpenSSL PROJECT OR
  96  * ITS CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL,
  97  * SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT
  98  * NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES;
  99  * LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION)
 100  * HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT,
 101  * STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE)
 102  * ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED
 103  * OF THE POSSIBILITY OF SUCH DAMAGE.
 104  * ====================================================================
 105  *
 106  * This product includes cryptographic software written by Eric Young
 107  * (eay@cryptsoft.com).  This product includes software written by Tim
 108  * Hudson (tjh@cryptsoft.com).
 109  *
 110  */
 111
 112 #include <stdio.h>
 113 #include <openssl/objects.h>
 114 #include <openssl/evp.h>
 115 #include <openssl/hmac.h>
 116 #include <openssl/ocsp.h>
 117 #include <openssl/rand.h>
 118 #include "ssl_locl.h"
 119
 120 const char tls1_version_str[]="TLSv1" OPENSSL_VERSION_PTEXT;
 121
 122 #ifndef OPENSSL_NO_TLSEXT
 123 static int tls_decrypt_ticket(SSL *s, const unsigned char *tick, int ticklen,
 124                                 const unsigned char *sess_id, int sesslen,
 125                                 SSL_SESSION **psess);
 126 #endif
 127
 128 SSL3_ENC_METHOD TLSv1_enc_data={
 129         tls1_enc,
 130         tls1_mac,
 131         tls1_setup_key_block,
 132         tls1_generate_master_secret,
 133         tls1_change_cipher_state,
 134         tls1_final_finish_mac,
 135         TLS1_FINISH_MAC_LENGTH,
 136         tls1_cert_verify_mac,
 137         TLS_MD_CLIENT_FINISH_CONST,TLS_MD_CLIENT_FINISH_CONST_SIZE,
 138         TLS_MD_SERVER_FINISH_CONST,TLS_MD_SERVER_FINISH_CONST_SIZE,
 139         tls1_alert_code,
 140         tls1_export_keying_material,
 141         };
 142
 143 long tls1_default_timeout(void)
 144         {
 145         /* 2 hours, the 24 hours mentioned in the TLSv1 spec
 146          * is way too long for http, the cache would over fill */
 147         return(60*60*2);
 148         }
 149
 150 int tls1_new(SSL *s)
 151         {
 152         if (!ssl3_new(s)) return(0);
 153         s->method->ssl_clear(s);
 154         return(1);
 155         }
 156
 157 void tls1_free(SSL *s)
 158         {
 159 #ifndef OPENSSL_NO_TLSEXT
 160         if (s->tlsext_session_ticket)
 161                 {
 162                 OPENSSL_free(s->tlsext_session_ticket);
 163                 }
 164 #endif /* OPENSSL_NO_TLSEXT */
 165         ssl3_free(s);
 166         }
 167
 168 void tls1_clear(SSL *s)
 169         {
 170         ssl3_clear(s);
 171         s->version = s->method->version;
 172         }
 173
 174 #ifndef OPENSSL_NO_EC
 175
 176 static int nid_list[] =
 177         {
 178                 NID_sect163k1, /* sect163k1 (1) */
 179                 NID_sect163r1, /* sect163r1 (2) */
 180                 NID_sect163r2, /* sect163r2 (3) */
 181                 NID_sect193r1, /* sect193r1 (4) */
 182                 NID_sect193r2, /* sect193r2 (5) */
 183                 NID_sect233k1, /* sect233k1 (6) */
 184                 NID_sect233r1, /* sect233r1 (7) */
 185                 NID_sect239k1, /* sect239k1 (8) */
 186                 NID_sect283k1, /* sect283k1 (9) */
 187                 NID_sect283r1, /* sect283r1 (10) */
 188                 NID_sect409k1, /* sect409k1 (11) */
 189                 NID_sect409r1, /* sect409r1 (12) */
 190                 NID_sect571k1, /* sect571k1 (13) */
 191                 NID_sect571r1, /* sect571r1 (14) */
 192                 NID_secp160k1, /* secp160k1 (15) */
 193                 NID_secp160r1, /* secp160r1 (16) */
 194                 NID_secp160r2, /* secp160r2 (17) */
 195                 NID_secp192k1, /* secp192k1 (18) */
 196                 NID_X9_62_prime192v1, /* secp192r1 (19) */
 197                 NID_secp224k1, /* secp224k1 (20) */
 198                 NID_secp224r1, /* secp224r1 (21) */
 199                 NID_secp256k1, /* secp256k1 (22) */
 200                 NID_X9_62_prime256v1, /* secp256r1 (23) */
 201                 NID_secp384r1, /* secp384r1 (24) */
 202                 NID_secp521r1  /* secp521r1 (25) */
 203         };
 204
 205 static int pref_list[] =
 206         {
 207                 NID_sect571r1, /* sect571r1 (14) */
 208                 NID_sect571k1, /* sect571k1 (13) */
 209                 NID_secp521r1, /* secp521r1 (25) */
 210                 NID_sect409k1, /* sect409k1 (11) */
 211                 NID_sect409r1, /* sect409r1 (12) */
 212                 NID_secp384r1, /* secp384r1 (24) */
 213                 NID_sect283k1, /* sect283k1 (9) */
 214                 NID_sect283r1, /* sect283r1 (10) */
 215                 NID_secp256k1, /* secp256k1 (22) */
 216                 NID_X9_62_prime256v1, /* secp256r1 (23) */
 217                 NID_sect239k1, /* sect239k1 (8) */
 218                 NID_sect233k1, /* sect233k1 (6) */
 219                 NID_sect233r1, /* sect233r1 (7) */
 220                 NID_secp224k1, /* secp224k1 (20) */
 221                 NID_secp224r1, /* secp224r1 (21) */
 222                 NID_sect193r1, /* sect193r1 (4) */
 223                 NID_sect193r2, /* sect193r2 (5) */
 224                 NID_secp192k1, /* secp192k1 (18) */
 225                 NID_X9_62_prime192v1, /* secp192r1 (19) */
 226                 NID_sect163k1, /* sect163k1 (1) */
 227                 NID_sect163r1, /* sect163r1 (2) */
 228                 NID_sect163r2, /* sect163r2 (3) */
 229                 NID_secp160k1, /* secp160k1 (15) */
 230                 NID_secp160r1, /* secp160r1 (16) */
 231                 NID_secp160r2, /* secp160r2 (17) */
 232         };
 233
 234 int tls1_ec_curve_id2nid(int curve_id)
 235         {
 236         /* ECC curves from draft-ietf-tls-ecc-12.txt (Oct. 17, 2005) */
 237         if ((curve_id < 1) || ((unsigned int)curve_id >
 238                                 sizeof(nid_list)/sizeof(nid_list[0])))
 239                 return 0;
 240         return nid_list[curve_id-1];
 241         }
 242
 243 int tls1_ec_nid2curve_id(int nid)
 244         {
 245         /* ECC curves from draft-ietf-tls-ecc-12.txt (Oct. 17, 2005) */
 246         switch (nid)
 247                 {
 248         case NID_sect163k1: /* sect163k1 (1) */
 249                 return 1;
 250         case NID_sect163r1: /* sect163r1 (2) */
 251                 return 2;
 252         case NID_sect163r2: /* sect163r2 (3) */
 253                 return 3;
 254         case NID_sect193r1: /* sect193r1 (4) */
 255                 return 4;
 256         case NID_sect193r2: /* sect193r2 (5) */
 257                 return 5;
 258         case NID_sect233k1: /* sect233k1 (6) */
 259                 return 6;
 260         case NID_sect233r1: /* sect233r1 (7) */
 261                 return 7;
 262         case NID_sect239k1: /* sect239k1 (8) */
 263                 return 8;
 264         case NID_sect283k1: /* sect283k1 (9) */
 265                 return 9;
 266         case NID_sect283r1: /* sect283r1 (10) */
 267                 return 10;
 268         case NID_sect409k1: /* sect409k1 (11) */
 269                 return 11;
 270         case NID_sect409r1: /* sect409r1 (12) */
 271                 return 12;
 272         case NID_sect571k1: /* sect571k1 (13) */
 273                 return 13;
 274         case NID_sect571r1: /* sect571r1 (14) */
 275                 return 14;
 276         case NID_secp160k1: /* secp160k1 (15) */
 277                 return 15;
 278         case NID_secp160r1: /* secp160r1 (16) */
 279                 return 16;
 280         case NID_secp160r2: /* secp160r2 (17) */
 281                 return 17;
 282         case NID_secp192k1: /* secp192k1 (18) */
 283                 return 18;
 284         case NID_X9_62_prime192v1: /* secp192r1 (19) */
 285                 return 19;
 286         case NID_secp224k1: /* secp224k1 (20) */
 287                 return 20;
 288         case NID_secp224r1: /* secp224r1 (21) */
 289                 return 21;
 290         case NID_secp256k1: /* secp256k1 (22) */
 291                 return 22;
 292         case NID_X9_62_prime256v1: /* secp256r1 (23) */
 293                 return 23;
 294         case NID_secp384r1: /* secp384r1 (24) */
 295                 return 24;
 296         case NID_secp521r1:  /* secp521r1 (25) */
 297                 return 25;
 298         default:
 299                 return 0;
 300                 }
 301         }
 302 #endif /* OPENSSL_NO_EC */
 303
 304 #ifndef OPENSSL_NO_TLSEXT
 305
 306 /* List of supported signature algorithms and hashes. Should make this
 307  * customisable at some point, for now include everything we support.
 308  */
 309
 310 #ifdef OPENSSL_NO_RSA
 311 #define tlsext_sigalg_rsa(md) /* */
 312 #else
 313 #define tlsext_sigalg_rsa(md) md, TLSEXT_signature_rsa,
 314 #endif
 315
 316 #ifdef OPENSSL_NO_DSA
 317 #define tlsext_sigalg_dsa(md) /* */
 318 #else
 319 #define tlsext_sigalg_dsa(md) md, TLSEXT_signature_dsa,
 320 #endif
 321
 322 #ifdef OPENSSL_NO_ECDSA
 323 #define tlsext_sigalg_ecdsa(md) /* */
 324 #else
 325 #define tlsext_sigalg_ecdsa(md) md, TLSEXT_signature_ecdsa,
 326 #endif
 327
 328 #define tlsext_sigalg(md) \
 329                 tlsext_sigalg_rsa(md) \
 330                 tlsext_sigalg_dsa(md) \
 331                 tlsext_sigalg_ecdsa(md)
 332
 333 static unsigned char tls12_sigalgs[] = {
 334 #ifndef OPENSSL_NO_SHA512
 335         tlsext_sigalg(TLSEXT_hash_sha512)
 336         tlsext_sigalg(TLSEXT_hash_sha384)
 337 #endif
 338 #ifndef OPENSSL_NO_SHA256
 339         tlsext_sigalg(TLSEXT_hash_sha256)
 340         tlsext_sigalg(TLSEXT_hash_sha224)
 341 #endif
 342 #ifndef OPENSSL_NO_SHA
 343         tlsext_sigalg(TLSEXT_hash_sha1)
 344 #endif
 345 #ifndef OPENSSL_NO_MD5
 346         tlsext_sigalg_rsa(TLSEXT_hash_md5)
 347 #endif
 348 };
 349
 350 int tls12_get_req_sig_algs(SSL *s, unsigned char *p)
 351         {
 352         size_t slen = sizeof(tls12_sigalgs);
 353 #ifdef OPENSSL_FIPS
 354         /* If FIPS mode don't include MD5 which is last */
 355         if (FIPS_mode())
 356                 slen -= 2;
 357 #endif
 358         if (p)
 359                 memcpy(p, tls12_sigalgs, slen);
 360         return (int)slen;
 361         }
 362
 363 unsigned char *ssl_add_clienthello_tlsext(SSL *s, unsigned char *p, unsigned char *limit)
 364         {
 365         int extdatalen=0;
 366         unsigned char *ret = p;
 367
 368         /* don't add extensions for SSLv3 unless doing secure renegotiation */
 369         if (s->client_version == SSL3_VERSION
 370                                         && !s->s3->send_connection_binding)
 371                 return p;
 372
 373         ret+=2;
 374
 375         if (ret>=limit) return NULL; /* this really never occurs, but ... */
 376
 377         if (s->tlsext_hostname != NULL)
 378                 {
 379                 /* Add TLS extension servername to the Client Hello message */
 380                 unsigned long size_str;
 381                 long lenmax;
 382
 383                 /* check for enough space.
 384                    4 for the servername type and entension length
 385                    2 for servernamelist length
 386                    1 for the hostname type
 387                    2 for hostname length
 388                    + hostname length
 389                 */
 390
 391                 if ((lenmax = limit - ret - 9) < 0
 392                     || (size_str = strlen(s->tlsext_hostname)) > (unsigned long)lenmax)
 393                         return NULL;
 394
 395                 /* extension type and length */
 396                 s2n(TLSEXT_TYPE_server_name,ret);
 397                 s2n(size_str+5,ret);
 398
 399                 /* length of servername list */
 400                 s2n(size_str+3,ret);
 401
 402                 /* hostname type, length and hostname */
 403                 *(ret++) = (unsigned char) TLSEXT_NAMETYPE_host_name;
 404                 s2n(size_str,ret);
 405                 memcpy(ret, s->tlsext_hostname, size_str);
 406                 ret+=size_str;
 407                 }
 408
 409         /* Add RI if renegotiating */
 410         if (s->renegotiate)
 411           {
 412           int el;
 413
 414           if(!ssl_add_clienthello_renegotiate_ext(s, 0, &el, 0))
 415               {
 416               SSLerr(SSL_F_SSL_ADD_CLIENTHELLO_TLSEXT, ERR_R_INTERNAL_ERROR);
 417               return NULL;
 418               }
 419
 420           if((limit - p - 4 - el) < 0) return NULL;
 421
 422           s2n(TLSEXT_TYPE_renegotiate,ret);
 423           s2n(el,ret);
 424
 425           if(!ssl_add_clienthello_renegotiate_ext(s, ret, &el, el))
 426               {
 427               SSLerr(SSL_F_SSL_ADD_CLIENTHELLO_TLSEXT, ERR_R_INTERNAL_ERROR);
 428               return NULL;
 429               }
 430
 431           ret += el;
 432         }
 433
 434 #ifndef OPENSSL_NO_SRP
 435         /* Add SRP username if there is one */
 436         if (s->srp_ctx.login != NULL)
 437                 { /* Add TLS extension SRP username to the Client Hello message */
 438
 439                 int login_len = strlen(s->srp_ctx.login);
 440                 if (login_len > 255 || login_len == 0)
 441                         {
 442                         SSLerr(SSL_F_SSL_ADD_CLIENTHELLO_TLSEXT, ERR_R_INTERNAL_ERROR);
 443                         return NULL;
 444                         }
 445
 446                 /* check for enough space.
 447                    4 for the srp type type and entension length
 448                    1 for the srp user identity
 449                    + srp user identity length
 450                 */
 451                 if ((limit - ret - 5 - login_len) < 0) return NULL;
 452
 453                 /* fill in the extension */
 454                 s2n(TLSEXT_TYPE_srp,ret);
 455                 s2n(login_len+1,ret);
 456                 (*ret++) = (unsigned char) login_len;
 457                 memcpy(ret, s->srp_ctx.login, login_len);
 458                 ret+=login_len;
 459                 }
 460 #endif
 461
 462 #ifndef OPENSSL_NO_EC
 463         if (s->tlsext_ecpointformatlist != NULL &&
 464             s->version != DTLS1_VERSION)
 465                 {
 466                 /* Add TLS extension ECPointFormats to the ClientHello message */
 467                 long lenmax;
 468
 469                 if ((lenmax = limit - ret - 5) < 0) return NULL;
 470                 if (s->tlsext_ecpointformatlist_length > (unsigned long)lenmax) return NULL;
 471                 if (s->tlsext_ecpointformatlist_length > 255)
 472                         {
 473                         SSLerr(SSL_F_SSL_ADD_CLIENTHELLO_TLSEXT, ERR_R_INTERNAL_ERROR);
 474                         return NULL;
 475                         }
 476
 477                 s2n(TLSEXT_TYPE_ec_point_formats,ret);
 478                 s2n(s->tlsext_ecpointformatlist_length + 1,ret);
 479                 *(ret++) = (unsigned char) s->tlsext_ecpointformatlist_length;
 480                 memcpy(ret, s->tlsext_ecpointformatlist, s->tlsext_ecpointformatlist_length);
 481                 ret+=s->tlsext_ecpointformatlist_length;
 482                 }
 483         if (s->tlsext_ellipticcurvelist != NULL &&
 484             s->version != DTLS1_VERSION)
 485                 {
 486                 /* Add TLS extension EllipticCurves to the ClientHello message */
 487                 long lenmax;
 488
 489                 if ((lenmax = limit - ret - 6) < 0) return NULL;
 490                 if (s->tlsext_ellipticcurvelist_length > (unsigned long)lenmax) return NULL;
 491                 if (s->tlsext_ellipticcurvelist_length > 65532)
 492                         {
 493                         SSLerr(SSL_F_SSL_ADD_CLIENTHELLO_TLSEXT, ERR_R_INTERNAL_ERROR);
 494                         return NULL;
 495                         }
 496
 497                 s2n(TLSEXT_TYPE_elliptic_curves,ret);
 498                 s2n(s->tlsext_ellipticcurvelist_length + 2, ret);
 499
 500                 /* NB: draft-ietf-tls-ecc-12.txt uses a one-byte prefix for
 501                  * elliptic_curve_list, but the examples use two bytes.
 502                  * http://www1.ietf.org/mail-archive/web/tls/current/msg00538.html
 503                  * resolves this to two bytes.
 504                  */
 505                 s2n(s->tlsext_ellipticcurvelist_length, ret);
 506                 memcpy(ret, s->tlsext_ellipticcurvelist, s->tlsext_ellipticcurvelist_length);
 507                 ret+=s->tlsext_ellipticcurvelist_length;
 508                 }
 509 #endif /* OPENSSL_NO_EC */
 510
 511         if (!(SSL_get_options(s) & SSL_OP_NO_TICKET))
 512                 {
 513                 int ticklen;
 514                 if (!s->new_session && s->session && s->session->tlsext_tick)
 515                         ticklen = s->session->tlsext_ticklen;
 516                 else if (s->session && s->tlsext_session_ticket &&
 517                          s->tlsext_session_ticket->data)
 518                         {
 519                         ticklen = s->tlsext_session_ticket->length;
 520                         s->session->tlsext_tick = OPENSSL_malloc(ticklen);
 521                         if (!s->session->tlsext_tick)
 522                                 return NULL;
 523                         memcpy(s->session->tlsext_tick,
 524                                s->tlsext_session_ticket->data,
 525                                ticklen);
 526                         s->session->tlsext_ticklen = ticklen;
 527                         }
 528                 else
 529                         ticklen = 0;
 530                 if (ticklen == 0 && s->tlsext_session_ticket &&
 531                     s->tlsext_session_ticket->data == NULL)
 532                         goto skip_ext;
 533                 /* Check for enough room 2 for extension type, 2 for len
 534                  * rest for ticket
 535                  */
 536                 if ((long)(limit - ret - 4 - ticklen) < 0) return NULL;
 537                 s2n(TLSEXT_TYPE_session_ticket,ret);
 538                 s2n(ticklen,ret);
 539                 if (ticklen)
 540                         {
 541                         memcpy(ret, s->session->tlsext_tick, ticklen);
 542                         ret += ticklen;
 543                         }
 544                 }
 545                 skip_ext:
 546
 547         if (TLS1_get_client_version(s) >= TLS1_2_VERSION)
 548                 {
 549                 if ((size_t)(limit - ret) < sizeof(tls12_sigalgs) + 6)
 550                         return NULL;
 551                 s2n(TLSEXT_TYPE_signature_algorithms,ret);
 552                 s2n(sizeof(tls12_sigalgs) + 2, ret);
 553                 s2n(sizeof(tls12_sigalgs), ret);
 554                 memcpy(ret, tls12_sigalgs, sizeof(tls12_sigalgs));
 555                 ret += sizeof(tls12_sigalgs);
 556                 }
 557
 558 #ifdef TLSEXT_TYPE_opaque_prf_input
 559         if (s->s3->client_opaque_prf_input != NULL &&
 560             s->version != DTLS1_VERSION)
 561                 {
 562                 size_t col = s->s3->client_opaque_prf_input_len;
 563
 564                 if ((long)(limit - ret - 6 - col < 0))
 565                         return NULL;
 566                 if (col > 0xFFFD) /* can't happen */
 567                         return NULL;
 568
 569                 s2n(TLSEXT_TYPE_opaque_prf_input, ret);
 570                 s2n(col + 2, ret);
 571                 s2n(col, ret);
 572                 memcpy(ret, s->s3->client_opaque_prf_input, col);
 573                 ret += col;
 574                 }
 575 #endif
 576
 577         if (s->tlsext_status_type == TLSEXT_STATUSTYPE_ocsp &&
 578             s->version != DTLS1_VERSION)
 579                 {
 580                 int i;
 581                 long extlen, idlen, itmp;
 582                 OCSP_RESPID *id;
 583
 584                 idlen = 0;
 585                 for (i = 0; i < sk_OCSP_RESPID_num(s->tlsext_ocsp_ids); i++)
 586                         {
 587                         id = sk_OCSP_RESPID_value(s->tlsext_ocsp_ids, i);
 588                         itmp = i2d_OCSP_RESPID(id, NULL);
 589                         if (itmp <= 0)
 590                                 return NULL;
 591                         idlen += itmp + 2;
 592                         }
 593
 594                 if (s->tlsext_ocsp_exts)
 595                         {
 596                         extlen = i2d_X509_EXTENSIONS(s->tlsext_ocsp_exts, NULL);
 597                         if (extlen < 0)
 598                                 return NULL;
 599                         }
 600                 else
 601                         extlen = 0;
 602
 603                 if ((long)(limit - ret - 7 - extlen - idlen) < 0) return NULL;
 604                 s2n(TLSEXT_TYPE_status_request, ret);
 605                 if (extlen + idlen > 0xFFF0)
 606                         return NULL;
 607                 s2n(extlen + idlen + 5, ret);
 608                 *(ret++) = TLSEXT_STATUSTYPE_ocsp;
 609                 s2n(idlen, ret);
 610                 for (i = 0; i < sk_OCSP_RESPID_num(s->tlsext_ocsp_ids); i++)
 611                         {
 612                         /* save position of id len */
 613                         unsigned char *q = ret;
 614                         id = sk_OCSP_RESPID_value(s->tlsext_ocsp_ids, i);
 615                         /* skip over id len */
 616                         ret += 2;
 617                         itmp = i2d_OCSP_RESPID(id, &ret);
 618                         /* write id len */
 619                         s2n(itmp, q);
 620                         }
 621                 s2n(extlen, ret);
 622                 if (extlen > 0)
 623                         i2d_X509_EXTENSIONS(s->tlsext_ocsp_exts, &ret);
 624                 }
 625
 626 #ifndef OPENSSL_NO_HEARTBEATS
 627         /* Add Heartbeat extension */
 628         s2n(TLSEXT_TYPE_heartbeat,ret);
 629         s2n(1,ret);
 630         /* Set mode:
 631          * 1: peer may send requests
 632          * 2: peer not allowed to send requests
 633          */
 634         if (s->tlsext_heartbeat & SSL_TLSEXT_HB_DONT_RECV_REQUESTS)
 635                 *(ret++) = SSL_TLSEXT_HB_DONT_SEND_REQUESTS;
 636         else
 637                 *(ret++) = SSL_TLSEXT_HB_ENABLED;
 638 #endif
 639
 640 #ifndef OPENSSL_NO_NEXTPROTONEG
 641         if (s->ctx->next_proto_select_cb && !s->s3->tmp.finish_md_len)
 642                 {
 643                 /* The client advertises an emtpy extension to indicate its
 644                  * support for Next Protocol Negotiation */
 645                 if (limit - ret - 4 < 0)
 646                         return NULL;
 647                 s2n(TLSEXT_TYPE_next_proto_neg,ret);
 648                 s2n(0,ret);
 649                 }
 650 #endif
 651
 652 #ifndef OPENSSL_NO_SRTP
 653         if(SSL_get_srtp_profiles(s))
 654                 {
 655                 int el;
 656
 657                 ssl_add_clienthello_use_srtp_ext(s, 0, &el, 0);
 658
 659                 if((limit - p - 4 - el) < 0) return NULL;
 660
 661                 s2n(TLSEXT_TYPE_use_srtp,ret);
 662                 s2n(el,ret);
 663
 664                 if(ssl_add_clienthello_use_srtp_ext(s, ret, &el, el))
 665                         {
 666                         SSLerr(SSL_F_SSL_ADD_CLIENTHELLO_TLSEXT, ERR_R_INTERNAL_ERROR);
 667                         return NULL;
 668                         }
 669                 ret += el;
 670                 }
 671 #endif
 672
 673         if ((extdatalen = ret-p-2)== 0)
 674                 return p;
 675
 676         s2n(extdatalen,p);
 677         return ret;
 678         }
 679
 680 unsigned char *ssl_add_serverhello_tlsext(SSL *s, unsigned char *p, unsigned char *limit)
 681         {
 682         int extdatalen=0;
 683         unsigned char *ret = p;
 684 #ifndef OPENSSL_NO_NEXTPROTONEG
 685         int next_proto_neg_seen;
 686 #endif
 687
 688         /* don't add extensions for SSLv3, unless doing secure renegotiation */
 689         if (s->version == SSL3_VERSION && !s->s3->send_connection_binding)
 690                 return p;
 691
 692         ret+=2;
 693         if (ret>=limit) return NULL; /* this really never occurs, but ... */
 694
 695         if (!s->hit && s->servername_done == 1 && s->session->tlsext_hostname != NULL)
 696                 {
 697                 if ((long)(limit - ret - 4) < 0) return NULL;
 698
 699                 s2n(TLSEXT_TYPE_server_name,ret);
 700                 s2n(0,ret);
 701                 }
 702
 703         if(s->s3->send_connection_binding)
 704         {
 705           int el;
 706
 707           if(!ssl_add_serverhello_renegotiate_ext(s, 0, &el, 0))
 708               {
 709               SSLerr(SSL_F_SSL_ADD_SERVERHELLO_TLSEXT, ERR_R_INTERNAL_ERROR);
 710               return NULL;
 711               }
 712
 713           if((limit - p - 4 - el) < 0) return NULL;
 714
 715           s2n(TLSEXT_TYPE_renegotiate,ret);
 716           s2n(el,ret);
 717
 718           if(!ssl_add_serverhello_renegotiate_ext(s, ret, &el, el))
 719               {
 720               SSLerr(SSL_F_SSL_ADD_SERVERHELLO_TLSEXT, ERR_R_INTERNAL_ERROR);
 721               return NULL;
 722               }
 723
 724           ret += el;
 725         }
 726
 727 #ifndef OPENSSL_NO_EC
 728         if (s->tlsext_ecpointformatlist != NULL &&
 729             s->version != DTLS1_VERSION)
 730                 {
 731                 /* Add TLS extension ECPointFormats to the ServerHello message */
 732                 long lenmax;
 733
 734                 if ((lenmax = limit - ret - 5) < 0) return NULL;
 735                 if (s->tlsext_ecpointformatlist_length > (unsigned long)lenmax) return NULL;
 736                 if (s->tlsext_ecpointformatlist_length > 255)
 737                         {
 738                         SSLerr(SSL_F_SSL_ADD_SERVERHELLO_TLSEXT, ERR_R_INTERNAL_ERROR);
 739                         return NULL;
 740                         }
 741
 742                 s2n(TLSEXT_TYPE_ec_point_formats,ret);
 743                 s2n(s->tlsext_ecpointformatlist_length + 1,ret);
 744                 *(ret++) = (unsigned char) s->tlsext_ecpointformatlist_length;
 745                 memcpy(ret, s->tlsext_ecpointformatlist, s->tlsext_ecpointformatlist_length);
 746                 ret+=s->tlsext_ecpointformatlist_length;
 747
 748                 }
 749         /* Currently the server should not respond with a SupportedCurves extension */
 750 #endif /* OPENSSL_NO_EC */
 751
 752         if (s->tlsext_ticket_expected
 753                 && !(SSL_get_options(s) & SSL_OP_NO_TICKET))
 754                 {
 755                 if ((long)(limit - ret - 4) < 0) return NULL;
 756                 s2n(TLSEXT_TYPE_session_ticket,ret);
 757                 s2n(0,ret);
 758                 }
 759
 760         if (s->tlsext_status_expected)
 761                 {
 762                 if ((long)(limit - ret - 4) < 0) return NULL;
 763                 s2n(TLSEXT_TYPE_status_request,ret);
 764                 s2n(0,ret);
 765                 }
 766
 767 #ifdef TLSEXT_TYPE_opaque_prf_input
 768         if (s->s3->server_opaque_prf_input != NULL &&
 769             s->version != DTLS1_VERSION)
 770                 {
 771                 size_t sol = s->s3->server_opaque_prf_input_len;
 772
 773                 if ((long)(limit - ret - 6 - sol) < 0)
 774                         return NULL;
 775                 if (sol > 0xFFFD) /* can't happen */
 776                         return NULL;
 777
 778                 s2n(TLSEXT_TYPE_opaque_prf_input, ret);
 779                 s2n(sol + 2, ret);
 780                 s2n(sol, ret);
 781                 memcpy(ret, s->s3->server_opaque_prf_input, sol);
 782                 ret += sol;
 783                 }
 784 #endif
 785
 786 #ifndef OPENSSL_NO_SRTP
 787         if(s->srtp_profile)
 788                 {
 789                 int el;
 790
 791                 ssl_add_serverhello_use_srtp_ext(s, 0, &el, 0);
 792
 793                 if((limit - p - 4 - el) < 0) return NULL;
 794
 795                 s2n(TLSEXT_TYPE_use_srtp,ret);
 796                 s2n(el,ret);
 797
 798                 if(ssl_add_serverhello_use_srtp_ext(s, ret, &el, el))
 799                         {
 800                         SSLerr(SSL_F_SSL_ADD_SERVERHELLO_TLSEXT, ERR_R_INTERNAL_ERROR);
 801                         return NULL;
 802                         }
 803                 ret+=el;
 804                 }
 805 #endif
 806
 807         if (((s->s3->tmp.new_cipher->id & 0xFFFF)==0x80 || (s->s3->tmp.new_cipher->id & 0xFFFF)==0x81)
 808                 && (SSL_get_options(s) & SSL_OP_CRYPTOPRO_TLSEXT_BUG))
 809                 { const unsigned char cryptopro_ext[36] = {
 810                         0xfd, 0xe8, /*65000*/
 811                         0x00, 0x20, /*32 bytes length*/
 812                         0x30, 0x1e, 0x30, 0x08, 0x06, 0x06, 0x2a, 0x85,
 813                         0x03,   0x02, 0x02, 0x09, 0x30, 0x08, 0x06, 0x06,
 814                         0x2a, 0x85, 0x03, 0x02, 0x02, 0x16, 0x30, 0x08,
 815                         0x06, 0x06, 0x2a, 0x85, 0x03, 0x02, 0x02, 0x17};
 816                         if (limit-ret<36) return NULL;
 817                         memcpy(ret,cryptopro_ext,36);
 818                         ret+=36;
 819
 820                 }
 821
 822 #ifndef OPENSSL_NO_HEARTBEATS
 823         /* Add Heartbeat extension if we've received one */
 824         if (s->tlsext_heartbeat & SSL_TLSEXT_HB_ENABLED)
 825                 {
 826                 s2n(TLSEXT_TYPE_heartbeat,ret);
 827                 s2n(1,ret);
 828                 /* Set mode:
 829                  * 1: peer may send requests
 830                  * 2: peer not allowed to send requests
 831                  */
 832                 if (s->tlsext_heartbeat & SSL_TLSEXT_HB_DONT_RECV_REQUESTS)
 833                         *(ret++) = SSL_TLSEXT_HB_DONT_SEND_REQUESTS;
 834                 else
 835                         *(ret++) = SSL_TLSEXT_HB_ENABLED;
 836
 837                 }
 838 #endif
 839
 840 #ifndef OPENSSL_NO_NEXTPROTONEG
 841         next_proto_neg_seen = s->s3->next_proto_neg_seen;
 842         s->s3->next_proto_neg_seen = 0;
 843         if (next_proto_neg_seen && s->ctx->next_protos_advertised_cb)
 844                 {
 845                 const unsigned char *npa;
 846                 unsigned int npalen;
 847                 int r;
 848
 849                 r = s->ctx->next_protos_advertised_cb(s, &npa, &npalen, s->ctx->next_protos_advertised_cb_arg);
 850                 if (r == SSL_TLSEXT_ERR_OK)
 851                         {
 852                         if ((long)(limit - ret - 4 - npalen) < 0) return NULL;
 853                         s2n(TLSEXT_TYPE_next_proto_neg,ret);
 854                         s2n(npalen,ret);
 855                         memcpy(ret, npa, npalen);
 856                         ret += npalen;
 857                         s->s3->next_proto_neg_seen = 1;
 858                         }
 859                 }
 860 #endif
 861
 862         if ((extdatalen = ret-p-2)== 0)
 863                 return p;
 864
 865         s2n(extdatalen,p);
 866         return ret;
 867         }
 868
 869 #ifndef OPENSSL_NO_EC
 870 /* ssl_check_for_safari attempts to fingerprint Safari using OS X
 871  * SecureTransport using the TLS extension block in |d|, of length |n|.
 872  * Safari, since 10.6, sends exactly these extensions, in this order:
 873  *   SNI,
 874  *   elliptic_curves
 875  *   ec_point_formats
 876  *
 877  * We wish to fingerprint Safari because they broke ECDHE-ECDSA support in 10.8,
 878  * but they advertise support. So enabling ECDHE-ECDSA ciphers breaks them.
 879  * Sadly we cannot differentiate 10.6, 10.7 and 10.8.4 (which work), from
 880  * 10.8..10.8.3 (which don't work).
 881  */
 882 static void ssl_check_for_safari(SSL *s, const unsigned char *data, const unsigned char *d, int n) {
 883         unsigned short type, size;
 884         static const unsigned char kSafariExtensionsBlock[] = {
 885                 0x00, 0x0a,  /* elliptic_curves extension */
 886                 0x00, 0x08,  /* 8 bytes */
 887                 0x00, 0x06,  /* 6 bytes of curve ids */
 888                 0x00, 0x17,  /* P-256 */
 889                 0x00, 0x18,  /* P-384 */
 890                 0x00, 0x19,  /* P-521 */
 891
 892                 0x00, 0x0b,  /* ec_point_formats */
 893                 0x00, 0x02,  /* 2 bytes */
 894                 0x01,        /* 1 point format */
 895                 0x00,        /* uncompressed */
 896         };
 897
 898         /* The following is only present in TLS 1.2 */
 899         static const unsigned char kSafariTLS12ExtensionsBlock[] = {
 900                 0x00, 0x0d,  /* signature_algorithms */
 901                 0x00, 0x0c,  /* 12 bytes */
 902                 0x00, 0x0a,  /* 10 bytes */
 903                 0x05, 0x01,  /* SHA-384/RSA */
 904                 0x04, 0x01,  /* SHA-256/RSA */
 905                 0x02, 0x01,  /* SHA-1/RSA */
 906                 0x04, 0x03,  /* SHA-256/ECDSA */
 907                 0x02, 0x03,  /* SHA-1/ECDSA */
 908         };
 909
 910         if (data >= (d+n-2))
 911                 return;
 912         data += 2;
 913
 914         if (data > (d+n-4))
 915                 return;
 916         n2s(data,type);
 917         n2s(data,size);
 918
 919         if (type != TLSEXT_TYPE_server_name)
 920                 return;
 921
 922         if (data+size > d+n)
 923                 return;
 924         data += size;
 925
 926         if (TLS1_get_client_version(s) >= TLS1_2_VERSION)
 927                 {
 928                 const size_t len1 = sizeof(kSafariExtensionsBlock);
 929                 const size_t len2 = sizeof(kSafariTLS12ExtensionsBlock);
 930
 931                 if (data + len1 + len2 != d+n)
 932                         return;
 933                 if (memcmp(data, kSafariExtensionsBlock, len1) != 0)
 934                         return;
 935                 if (memcmp(data + len1, kSafariTLS12ExtensionsBlock, len2) != 0)
 936                         return;
 937                 }
 938         else
 939                 {
 940                 const size_t len = sizeof(kSafariExtensionsBlock);
 941
 942                 if (data + len != d+n)
 943                         return;
 944                 if (memcmp(data, kSafariExtensionsBlock, len) != 0)
 945                         return;
 946                 }
 947
 948         s->s3->is_probably_safari = 1;
 949 }
 950 #endif /* !OPENSSL_NO_EC */
 951
 952 int ssl_parse_clienthello_tlsext(SSL *s, unsigned char **p, unsigned char *d, int n, int *al)
 953         {
 954         unsigned short type;
 955         unsigned short size;
 956         unsigned short len;
 957         unsigned char *data = *p;
 958         int renegotiate_seen = 0;
 959         int sigalg_seen = 0;
 960
 961         s->servername_done = 0;
 962         s->tlsext_status_type = -1;
 963 #ifndef OPENSSL_NO_NEXTPROTONEG
 964         s->s3->next_proto_neg_seen = 0;
 965 #endif
 966
 967 #ifndef OPENSSL_NO_HEARTBEATS
 968         s->tlsext_heartbeat &= ~(SSL_TLSEXT_HB_ENABLED |
 969                                SSL_TLSEXT_HB_DONT_SEND_REQUESTS);
 970 #endif
 971
 972 #ifndef OPENSSL_NO_EC
 973         if (s->options & SSL_OP_SAFARI_ECDHE_ECDSA_BUG)
 974                 ssl_check_for_safari(s, data, d, n);
 975 #endif /* !OPENSSL_NO_EC */
 976
 977         if (data >= (d+n-2))
 978                 goto ri_check;
 979         n2s(data,len);
 980
 981         if (data > (d+n-len))
 982                 goto ri_check;
 983
 984         while (data <= (d+n-4))
 985                 {
 986                 n2s(data,type);
 987                 n2s(data,size);
 988
 989                 if (data+size > (d+n))
 990                         goto ri_check;
 991 #if 0
 992                 fprintf(stderr,"Received extension type %d size %d\n",type,size);
 993 #endif
 994                 if (s->tlsext_debug_cb)
 995                         s->tlsext_debug_cb(s, 0, type, data, size,
 996                                                 s->tlsext_debug_arg);
 997 /* The servername extension is treated as follows:
 998
 999    - Only the hostname type is supported with a maximum length of 255.
1000    - The servername is rejected if too long or if it contains zeros,
1001      in which case an fatal alert is generated.
1002    - The servername field is maintained together with the session cache.
1003    - When a session is resumed, the servername call back invoked in order
1004      to allow the application to position itself to the right context.
1005    - The servername is acknowledged if it is new for a session or when
1006      it is identical to a previously used for the same session.
1007      Applications can control the behaviour.  They can at any time
1008      set a 'desirable' servername for a new SSL object. This can be the
1009      case for example with HTTPS when a Host: header field is received and
1010      a renegotiation is requested. In this case, a possible servername
1011      presented in the new client hello is only acknowledged if it matches
1012      the value of the Host: field.
1013    - Applications must  use SSL_OP_NO_SESSION_RESUMPTION_ON_RENEGOTIATION
1014      if they provide for changing an explicit servername context for the session,
1015      i.e. when the session has been established with a servername extension.
1016    - On session reconnect, the servername extension may be absent.
1017
1018 */
1019
1020                 if (type == TLSEXT_TYPE_server_name)
1021                         {
1022                         unsigned char *sdata;
1023                         int servname_type;
1024                         int dsize;
1025
1026                         if (size < 2)
1027                                 {
1028                                 *al = SSL_AD_DECODE_ERROR;
1029                                 return 0;
1030                                 }
1031                         n2s(data,dsize);
1032                         size -= 2;
1033                         if (dsize > size  )
1034                                 {
1035                                 *al = SSL_AD_DECODE_ERROR;
1036                                 return 0;
1037                                 }
1038
1039                         sdata = data;
1040                         while (dsize > 3)
1041                                 {
1042                                 servname_type = *(sdata++);
1043                                 n2s(sdata,len);
1044                                 dsize -= 3;
1045
1046                                 if (len > dsize)
1047                                         {
1048                                         *al = SSL_AD_DECODE_ERROR;
1049                                         return 0;
1050                                         }
1051                                 if (s->servername_done == 0)
1052                                 switch (servname_type)
1053                                         {
1054                                 case TLSEXT_NAMETYPE_host_name:
1055                                         if (!s->hit)
1056                                                 {
1057                                                 if(s->session->tlsext_hostname)
1058                                                         {
1059                                                         *al = SSL_AD_DECODE_ERROR;
1060                                                         return 0;
1061                                                         }
1062                                                 if (len > TLSEXT_MAXLEN_host_name)
1063                                                         {
1064                                                         *al = TLS1_AD_UNRECOGNIZED_NAME;
1065                                                         return 0;
1066                                                         }
1067                                                 if ((s->session->tlsext_hostname = OPENSSL_malloc(len+1)) == NULL)
1068                                                         {
1069                                                         *al = TLS1_AD_INTERNAL_ERROR;
1070                                                         return 0;
1071                                                         }
1072                                                 memcpy(s->session->tlsext_hostname, sdata, len);
1073                                                 s->session->tlsext_hostname[len]='\0';
1074                                                 if (strlen(s->session->tlsext_hostname) != len) {
1075                                                         OPENSSL_free(s->session->tlsext_hostname);
1076                                                         s->session->tlsext_hostname = NULL;
1077                                                         *al = TLS1_AD_UNRECOGNIZED_NAME;
1078                                                         return 0;
1079                                                 }
1080                                                 s->servername_done = 1;
1081
1082                                                 }
1083                                         else
1084                                                 s->servername_done = s->session->tlsext_hostname
1085                                                         && strlen(s->session->tlsext_hostname) == len
1086                                                         && strncmp(s->session->tlsext_hostname, (char *)sdata, len) == 0;
1087
1088                                         break;
1089
1090                                 default:
1091                                         break;
1092                                         }
1093
1094                                 dsize -= len;
1095                                 }
1096                         if (dsize != 0)
1097                                 {
1098                                 *al = SSL_AD_DECODE_ERROR;
1099                                 return 0;
1100                                 }
1101
1102                         }
1103 #ifndef OPENSSL_NO_SRP
1104                 else if (type == TLSEXT_TYPE_srp)
1105                         {
1106                         if (size <= 0 || ((len = data[0])) != (size -1))
1107                                 {
1108                                 *al = SSL_AD_DECODE_ERROR;
1109                                 return 0;
1110                                 }
1111                         if (s->srp_ctx.login != NULL)
1112                                 {
1113                                 *al = SSL_AD_DECODE_ERROR;
1114                                 return 0;
1115                                 }
1116                         if ((s->srp_ctx.login = OPENSSL_malloc(len+1)) == NULL)
1117                                 return -1;
1118                         memcpy(s->srp_ctx.login, &data[1], len);
1119                         s->srp_ctx.login[len]='\0';
1120
1121                         if (strlen(s->srp_ctx.login) != len)
1122                                 {
1123                                 *al = SSL_AD_DECODE_ERROR;
1124                                 return 0;
1125                                 }
1126                         }
1127 #endif
1128
1129 #ifndef OPENSSL_NO_EC
1130                 else if (type == TLSEXT_TYPE_ec_point_formats &&
1131                      s->version != DTLS1_VERSION)
1132                         {
1133                         unsigned char *sdata = data;
1134                         int ecpointformatlist_length = *(sdata++);
1135
1136                         if (ecpointformatlist_length != size - 1)
1137                                 {
1138                                 *al = TLS1_AD_DECODE_ERROR;
1139                                 return 0;
1140                                 }
1141                         if (!s->hit)
1142                                 {
1143                                 if(s->session->tlsext_ecpointformatlist)
1144                                         {
1145                                         OPENSSL_free(s->session->tlsext_ecpointformatlist);
1146                                         s->session->tlsext_ecpointformatlist = NULL;
1147                                         }
1148                                 s->session->tlsext_ecpointformatlist_length = 0;
1149                                 if ((s->session->tlsext_ecpointformatlist = OPENSSL_malloc(ecpointformatlist_length)) == NULL)
1150                                         {
1151                                         *al = TLS1_AD_INTERNAL_ERROR;
1152                                         return 0;
1153                                         }
1154                                 s->session->tlsext_ecpointformatlist_length = ecpointformatlist_length;
1155                                 memcpy(s->session->tlsext_ecpointformatlist, sdata, ecpointformatlist_length);
1156                                 }
1157 #if 0
1158                         fprintf(stderr,"ssl_parse_clienthello_tlsext s->session->tlsext_ecpointformatlist (length=%i) ", s->session->tlsext_ecpointformatlist_length);
1159                         sdata = s->session->tlsext_ecpointformatlist;
1160                         for (i = 0; i < s->session->tlsext_ecpointformatlist_length; i++)
1161                                 fprintf(stderr,"%i ",*(sdata++));
1162                         fprintf(stderr,"\n");
1163 #endif
1164                         }
1165                 else if (type == TLSEXT_TYPE_elliptic_curves &&
1166                      s->version != DTLS1_VERSION)
1167                         {
1168                         unsigned char *sdata = data;
1169                         int ellipticcurvelist_length = (*(sdata++) << 8);
1170                         ellipticcurvelist_length += (*(sdata++));
1171
1172                         if (ellipticcurvelist_length != size - 2 ||
1173                                 ellipticcurvelist_length < 1)
1174                                 {
1175                                 *al = TLS1_AD_DECODE_ERROR;
1176                                 return 0;
1177                                 }
1178                         if (!s->hit)
1179                                 {
1180                                 if(s->session->tlsext_ellipticcurvelist)
1181                                         {
1182                                         *al = TLS1_AD_DECODE_ERROR;
1183                                         return 0;
1184                                         }
1185                                 s->session->tlsext_ellipticcurvelist_length = 0;
1186                                 if ((s->session->tlsext_ellipticcurvelist = OPENSSL_malloc(ellipticcurvelist_length)) == NULL)
1187                                         {
1188                                         *al = TLS1_AD_INTERNAL_ERROR;
1189                                         return 0;
1190                                         }
1191                                 s->session->tlsext_ellipticcurvelist_length = ellipticcurvelist_length;
1192                                 memcpy(s->session->tlsext_ellipticcurvelist, sdata, ellipticcurvelist_length);
1193                                 }
1194 #if 0
1195                         fprintf(stderr,"ssl_parse_clienthello_tlsext s->session->tlsext_ellipticcurvelist (length=%i) ", s->session->tlsext_ellipticcurvelist_length);
1196                         sdata = s->session->tlsext_ellipticcurvelist;
1197                         for (i = 0; i < s->session->tlsext_ellipticcurvelist_length; i++)
1198                                 fprintf(stderr,"%i ",*(sdata++));
1199                         fprintf(stderr,"\n");
1200 #endif
1201                         }
1202 #endif /* OPENSSL_NO_EC */
1203 #ifdef TLSEXT_TYPE_opaque_prf_input
1204                 else if (type == TLSEXT_TYPE_opaque_prf_input &&
1205                      s->version != DTLS1_VERSION)
1206                         {
1207                         unsigned char *sdata = data;
1208
1209                         if (size < 2)
1210                                 {
1211                                 *al = SSL_AD_DECODE_ERROR;
1212                                 return 0;
1213                                 }
1214                         n2s(sdata, s->s3->client_opaque_prf_input_len);
1215                         if (s->s3->client_opaque_prf_input_len != size - 2)
1216                                 {
1217                                 *al = SSL_AD_DECODE_ERROR;
1218                                 return 0;
1219                                 }
1220
1221                         if (s->s3->client_opaque_prf_input != NULL) /* shouldn't really happen */
1222                                 OPENSSL_free(s->s3->client_opaque_prf_input);
1223                         if (s->s3->client_opaque_prf_input_len == 0)
1224                                 s->s3->client_opaque_prf_input = OPENSSL_malloc(1); /* dummy byte just to get non-NULL */
1225                         else
1226                                 s->s3->client_opaque_prf_input = BUF_memdup(sdata, s->s3->client_opaque_prf_input_len);
1227                         if (s->s3->client_opaque_prf_input == NULL)
1228                                 {
1229                                 *al = TLS1_AD_INTERNAL_ERROR;
1230                                 return 0;
1231                                 }
1232                         }
1233 #endif
1234                 else if (type == TLSEXT_TYPE_session_ticket)
1235                         {
1236                         if (s->tls_session_ticket_ext_cb &&
1237                             !s->tls_session_ticket_ext_cb(s, data, size, s->tls_session_ticket_ext_cb_arg))
1238                                 {
1239                                 *al = TLS1_AD_INTERNAL_ERROR;
1240                                 return 0;
1241                                 }
1242                         }
1243                 else if (type == TLSEXT_TYPE_renegotiate)
1244                         {
1245                         if(!ssl_parse_clienthello_renegotiate_ext(s, data, size, al))
1246                                 return 0;
1247                         renegotiate_seen = 1;
1248                         }
1249                 else if (type == TLSEXT_TYPE_signature_algorithms)
1250                         {
1251                         int dsize;
1252                         if (sigalg_seen || size < 2)
1253                                 {
1254                                 *al = SSL_AD_DECODE_ERROR;
1255                                 return 0;
1256                                 }
1257                         sigalg_seen = 1;
1258                         n2s(data,dsize);
1259                         size -= 2;
1260                         if (dsize != size || dsize & 1)
1261                                 {
1262                                 *al = SSL_AD_DECODE_ERROR;
1263                                 return 0;
1264                                 }
1265                         if (!tls1_process_sigalgs(s, data, dsize))
1266                                 {
1267                                 *al = SSL_AD_DECODE_ERROR;
1268                                 return 0;
1269                                 }
1270                         }
1271                 else if (type == TLSEXT_TYPE_status_request &&
1272                          s->version != DTLS1_VERSION && s->ctx->tlsext_status_cb)
1273                         {
1274
1275                         if (size < 5)
1276                                 {
1277                                 *al = SSL_AD_DECODE_ERROR;
1278                                 return 0;
1279                                 }
1280
1281                         s->tlsext_status_type = *data++;
1282                         size--;
1283                         if (s->tlsext_status_type == TLSEXT_STATUSTYPE_ocsp)
1284                                 {
1285                                 const unsigned char *sdata;
1286                                 int dsize;
1287                                 /* Read in responder_id_list */
1288                                 n2s(data,dsize);
1289                                 size -= 2;
1290                                 if (dsize > size  )
1291                                         {
1292                                         *al = SSL_AD_DECODE_ERROR;
1293                                         return 0;
1294                                         }
1295                                 while (dsize > 0)
1296                                         {
1297                                         OCSP_RESPID *id;
1298                                         int idsize;
1299                                         if (dsize < 4)
1300                                                 {
1301                                                 *al = SSL_AD_DECODE_ERROR;
1302                                                 return 0;
1303                                                 }
1304                                         n2s(data, idsize);
1305                                         dsize -= 2 + idsize;
1306                                         size -= 2 + idsize;
1307                                         if (dsize < 0)
1308                                                 {
1309                                                 *al = SSL_AD_DECODE_ERROR;
1310                                                 return 0;
1311                                                 }
1312                                         sdata = data;
1313                                         data += idsize;
1314                                         id = d2i_OCSP_RESPID(NULL,
1315                                                                 &sdata, idsize);
1316                                         if (!id)
1317                                                 {
1318                                                 *al = SSL_AD_DECODE_ERROR;
1319                                                 return 0;
1320                                                 }
1321                                         if (data != sdata)
1322                                                 {
1323                                                 OCSP_RESPID_free(id);
1324                                                 *al = SSL_AD_DECODE_ERROR;
1325                                                 return 0;
1326                                                 }
1327                                         if (!s->tlsext_ocsp_ids
1328                                                 && !(s->tlsext_ocsp_ids =
1329                                                 sk_OCSP_RESPID_new_null()))
1330                                                 {
1331                                                 OCSP_RESPID_free(id);
1332                                                 *al = SSL_AD_INTERNAL_ERROR;
1333                                                 return 0;
1334                                                 }
1335                                         if (!sk_OCSP_RESPID_push(
1336                                                         s->tlsext_ocsp_ids, id))
1337                                                 {
1338                                                 OCSP_RESPID_free(id);
1339                                                 *al = SSL_AD_INTERNAL_ERROR;
1340                                                 return 0;
1341                                                 }
1342                                         }
1343
1344                                 /* Read in request_extensions */
1345                                 if (size < 2)
1346                                         {
1347                                         *al = SSL_AD_DECODE_ERROR;
1348                                         return 0;
1349                                         }
1350                                 n2s(data,dsize);
1351                                 size -= 2;
1352                                 if (dsize != size)
1353                                         {
1354                                         *al = SSL_AD_DECODE_ERROR;
1355                                         return 0;
1356                                         }
1357                                 sdata = data;
1358                                 if (dsize > 0)
1359                                         {
1360                                         if (s->tlsext_ocsp_exts)
1361                                                 {
1362                                                 sk_X509_EXTENSION_pop_free(s->tlsext_ocsp_exts,
1363                                                                            X509_EXTENSION_free);
1364                                                 }
1365
1366                                         s->tlsext_ocsp_exts =
1367                                                 d2i_X509_EXTENSIONS(NULL,
1368                                                         &sdata, dsize);
1369                                         if (!s->tlsext_ocsp_exts
1370                                                 || (data + dsize != sdata))
1371                                                 {
1372                                                 *al = SSL_AD_DECODE_ERROR;
1373                                                 return 0;
1374                                                 }
1375                                         }
1376                                 }
1377                                 /* We don't know what to do with any other type
1378                                 * so ignore it.
1379                                 */
1380                                 else
1381                                         s->tlsext_status_type = -1;
1382                         }
1383 #ifndef OPENSSL_NO_HEARTBEATS
1384                 else if (type == TLSEXT_TYPE_heartbeat)
1385                         {
1386                         switch(data[0])
1387                                 {
1388                                 case 0x01:      /* Client allows us to send HB requests */
1389                                                         s->tlsext_heartbeat |= SSL_TLSEXT_HB_ENABLED;
1390                                                         break;
1391                                 case 0x02:      /* Client doesn't accept HB requests */
1392                                                         s->tlsext_heartbeat |= SSL_TLSEXT_HB_ENABLED;
1393                                                         s->tlsext_heartbeat |= SSL_TLSEXT_HB_DONT_SEND_REQUESTS;
1394                                                         break;
1395                                 default:        *al = SSL_AD_ILLEGAL_PARAMETER;
1396                                                         return 0;
1397                                 }
1398                         }
1399 #endif
1400 #ifndef OPENSSL_NO_NEXTPROTONEG
1401                 else if (type == TLSEXT_TYPE_next_proto_neg &&
1402                          s->s3->tmp.finish_md_len == 0)
1403                         {
1404                         /* We shouldn't accept this extension on a
1405                          * renegotiation.
1406                          *
1407                          * s->new_session will be set on renegotiation, but we
1408                          * probably shouldn't rely that it couldn't be set on
1409                          * the initial renegotation too in certain cases (when
1410                          * there's some other reason to disallow resuming an
1411                          * earlier session -- the current code won't be doing
1412                          * anything like that, but this might change).
1413
1414                          * A valid sign that there's been a previous handshake
1415                          * in this connection is if s->s3->tmp.finish_md_len >
1416                          * 0.  (We are talking about a check that will happen
1417                          * in the Hello protocol round, well before a new
1418                          * Finished message could have been computed.) */
1419                         s->s3->next_proto_neg_seen = 1;
1420                         }
1421 #endif
1422
1423                 /* session ticket processed earlier */
1424 #ifndef OPENSSL_NO_SRTP
1425                 else if (type == TLSEXT_TYPE_use_srtp)
1426                         {
1427                         if(ssl_parse_clienthello_use_srtp_ext(s, data, size,
1428                                                               al))
1429                                 return 0;
1430                         }
1431 #endif
1432
1433                 data+=size;
1434                 }
1435
1436         *p = data;
1437
1438         ri_check:
1439
1440         /* Need RI if renegotiating */
1441
1442         if (!renegotiate_seen && s->renegotiate &&
1443                 !(s->options & SSL_OP_ALLOW_UNSAFE_LEGACY_RENEGOTIATION))
1444                 {
1445                 *al = SSL_AD_HANDSHAKE_FAILURE;
1446                 SSLerr(SSL_F_SSL_PARSE_CLIENTHELLO_TLSEXT,
1447                                 SSL_R_UNSAFE_LEGACY_RENEGOTIATION_DISABLED);
1448                 return 0;
1449                 }
1450
1451         return 1;
1452         }
1453
1454 #ifndef OPENSSL_NO_NEXTPROTONEG
1455 /* ssl_next_proto_validate validates a Next Protocol Negotiation block. No
1456  * elements of zero length are allowed and the set of elements must exactly fill
1457  * the length of the block. */
1458 static char ssl_next_proto_validate(unsigned char *d, unsigned len)
1459         {
1460         unsigned int off = 0;
1461
1462         while (off < len)
1463                 {
1464                 if (d[off] == 0)
1465                         return 0;
1466                 off += d[off];
1467                 off++;
1468                 }
1469
1470         return off == len;
1471         }
1472 #endif
1473
1474 int ssl_parse_serverhello_tlsext(SSL *s, unsigned char **p, unsigned char *d, int n, int *al)
1475         {
1476         unsigned short length;
1477         unsigned short type;
1478         unsigned short size;
1479         unsigned char *data = *p;
1480         int tlsext_servername = 0;
1481         int renegotiate_seen = 0;
1482
1483 #ifndef OPENSSL_NO_NEXTPROTONEG
1484         s->s3->next_proto_neg_seen = 0;
1485 #endif
1486
1487 #ifndef OPENSSL_NO_HEARTBEATS
1488         s->tlsext_heartbeat &= ~(SSL_TLSEXT_HB_ENABLED |
1489                                SSL_TLSEXT_HB_DONT_SEND_REQUESTS);
1490 #endif
1491
1492         if (data >= (d+n-2))
1493                 goto ri_check;
1494
1495         n2s(data,length);
1496         if (data+length != d+n)
1497                 {
1498                 *al = SSL_AD_DECODE_ERROR;
1499                 return 0;
1500                 }
1501
1502         while(data <= (d+n-4))
1503                 {
1504                 n2s(data,type);
1505                 n2s(data,size);
1506
1507                 if (data+size > (d+n))
1508                         goto ri_check;
1509
1510                 if (s->tlsext_debug_cb)
1511                         s->tlsext_debug_cb(s, 1, type, data, size,
1512                                                 s->tlsext_debug_arg);
1513
1514                 if (type == TLSEXT_TYPE_server_name)
1515                         {
1516                         if (s->tlsext_hostname == NULL || size > 0)
1517                                 {
1518                                 *al = TLS1_AD_UNRECOGNIZED_NAME;
1519                                 return 0;
1520                                 }
1521                         tlsext_servername = 1;
1522                         }
1523
1524 #ifndef OPENSSL_NO_EC
1525                 else if (type == TLSEXT_TYPE_ec_point_formats &&
1526                      s->version != DTLS1_VERSION)
1527                         {
1528                         unsigned char *sdata = data;
1529                         int ecpointformatlist_length = *(sdata++);
1530
1531                         if (ecpointformatlist_length != size - 1 ||
1532                                 ecpointformatlist_length < 1)
1533                                 {
1534                                 *al = TLS1_AD_DECODE_ERROR;
1535                                 return 0;
1536                                 }
1537                         s->session->tlsext_ecpointformatlist_length = 0;
1538                         if (s->session->tlsext_ecpointformatlist != NULL) OPENSSL_free(s->session->tlsext_ecpointformatlist);
1539                         if ((s->session->tlsext_ecpointformatlist = OPENSSL_malloc(ecpointformatlist_length)) == NULL)
1540                                 {
1541                                 *al = TLS1_AD_INTERNAL_ERROR;
1542                                 return 0;
1543                                 }
1544                         s->session->tlsext_ecpointformatlist_length = ecpointformatlist_length;
1545                         memcpy(s->session->tlsext_ecpointformatlist, sdata, ecpointformatlist_length);
1546 #if 0
1547                         fprintf(stderr,"ssl_parse_serverhello_tlsext s->session->tlsext_ecpointformatlist ");
1548                         sdata = s->session->tlsext_ecpointformatlist;
1549                         for (i = 0; i < s->session->tlsext_ecpointformatlist_length; i++)
1550                                 fprintf(stderr,"%i ",*(sdata++));
1551                         fprintf(stderr,"\n");
1552 #endif
1553                         }
1554 #endif /* OPENSSL_NO_EC */
1555
1556                 else if (type == TLSEXT_TYPE_session_ticket)
1557                         {
1558                         if (s->tls_session_ticket_ext_cb &&
1559                             !s->tls_session_ticket_ext_cb(s, data, size, s->tls_session_ticket_ext_cb_arg))
1560                                 {
1561                                 *al = TLS1_AD_INTERNAL_ERROR;
1562                                 return 0;
1563                                 }
1564                         if ((SSL_get_options(s) & SSL_OP_NO_TICKET)
1565                                 || (size > 0))
1566                                 {
1567                                 *al = TLS1_AD_UNSUPPORTED_EXTENSION;
1568                                 return 0;
1569                                 }
1570                         s->tlsext_ticket_expected = 1;
1571                         }
1572 #ifdef TLSEXT_TYPE_opaque_prf_input
1573                 else if (type == TLSEXT_TYPE_opaque_prf_input &&
1574                      s->version != DTLS1_VERSION)
1575                         {
1576                         unsigned char *sdata = data;
1577
1578                         if (size < 2)
1579                                 {
1580                                 *al = SSL_AD_DECODE_ERROR;
1581                                 return 0;
1582                                 }
1583                         n2s(sdata, s->s3->server_opaque_prf_input_len);
1584                         if (s->s3->server_opaque_prf_input_len != size - 2)
1585                                 {
1586                                 *al = SSL_AD_DECODE_ERROR;
1587                                 return 0;
1588                                 }
1589
1590                         if (s->s3->server_opaque_prf_input != NULL) /* shouldn't really happen */
1591                                 OPENSSL_free(s->s3->server_opaque_prf_input);
1592                         if (s->s3->server_opaque_prf_input_len == 0)
1593                                 s->s3->server_opaque_prf_input = OPENSSL_malloc(1); /* dummy byte just to get non-NULL */
1594                         else
1595                                 s->s3->server_opaque_prf_input = BUF_memdup(sdata, s->s3->server_opaque_prf_input_len);
1596
1597                         if (s->s3->server_opaque_prf_input == NULL)
1598                                 {
1599                                 *al = TLS1_AD_INTERNAL_ERROR;
1600                                 return 0;
1601                                 }
1602                         }
1603 #endif
1604                 else if (type == TLSEXT_TYPE_status_request &&
1605                          s->version != DTLS1_VERSION)
1606                         {
1607                         /* MUST be empty and only sent if we've requested
1608                          * a status request message.
1609                          */
1610                         if ((s->tlsext_status_type == -1) || (size > 0))
1611                                 {
1612                                 *al = TLS1_AD_UNSUPPORTED_EXTENSION;
1613                                 return 0;
1614                                 }
1615                         /* Set flag to expect CertificateStatus message */
1616                         s->tlsext_status_expected = 1;
1617                         }
1618 #ifndef OPENSSL_NO_NEXTPROTONEG
1619                 else if (type == TLSEXT_TYPE_next_proto_neg &&
1620                          s->s3->tmp.finish_md_len == 0)
1621                         {
1622                         unsigned char *selected;
1623                         unsigned char selected_len;
1624
1625                         /* We must have requested it. */
1626                         if (s->ctx->next_proto_select_cb == NULL)
1627                                 {
1628                                 *al = TLS1_AD_UNSUPPORTED_EXTENSION;
1629                                 return 0;
1630                                 }
1631                         /* The data must be valid */
1632                         if (!ssl_next_proto_validate(data, size))
1633                                 {
1634                                 *al = TLS1_AD_DECODE_ERROR;
1635                                 return 0;
1636                                 }
1637                         if (s->ctx->next_proto_select_cb(s, &selected, &selected_len, data, size, s->ctx->next_proto_select_cb_arg) != SSL_TLSEXT_ERR_OK)
1638                                 {
1639                                 *al = TLS1_AD_INTERNAL_ERROR;
1640                                 return 0;
1641                                 }
1642                         s->next_proto_negotiated = OPENSSL_malloc(selected_len);
1643                         if (!s->next_proto_negotiated)
1644                                 {
1645                                 *al = TLS1_AD_INTERNAL_ERROR;
1646                                 return 0;
1647                                 }
1648                         memcpy(s->next_proto_negotiated, selected, selected_len);
1649                         s->next_proto_negotiated_len = selected_len;
1650                         s->s3->next_proto_neg_seen = 1;
1651                         }
1652 #endif
1653                 else if (type == TLSEXT_TYPE_renegotiate)
1654                         {
1655                         if(!ssl_parse_serverhello_renegotiate_ext(s, data, size, al))
1656                                 return 0;
1657                         renegotiate_seen = 1;
1658                         }
1659 #ifndef OPENSSL_NO_HEARTBEATS
1660                 else if (type == TLSEXT_TYPE_heartbeat)
1661                         {
1662                         switch(data[0])
1663                                 {
1664                                 case 0x01:      /* Server allows us to send HB requests */
1665                                                         s->tlsext_heartbeat |= SSL_TLSEXT_HB_ENABLED;
1666                                                         break;
1667                                 case 0x02:      /* Server doesn't accept HB requests */
1668                                                         s->tlsext_heartbeat |= SSL_TLSEXT_HB_ENABLED;
1669                                                         s->tlsext_heartbeat |= SSL_TLSEXT_HB_DONT_SEND_REQUESTS;
1670                                                         break;
1671                                 default:        *al = SSL_AD_ILLEGAL_PARAMETER;
1672                                                         return 0;
1673                                 }
1674                         }
1675 #endif
1676 #ifndef OPENSSL_NO_SRTP
1677                 else if (type == TLSEXT_TYPE_use_srtp)
1678                         {
1679                         if(ssl_parse_serverhello_use_srtp_ext(s, data, size,
1680                                                               al))
1681                                 return 0;
1682                         }
1683 #endif
1684
1685                 data+=size;
1686                 }
1687
1688         if (data != d+n)
1689                 {
1690                 *al = SSL_AD_DECODE_ERROR;
1691                 return 0;
1692                 }
1693
1694         if (!s->hit && tlsext_servername == 1)
1695                 {
1696                 if (s->tlsext_hostname)
1697                         {
1698                         if (s->session->tlsext_hostname == NULL)
1699                                 {
1700                                 s->session->tlsext_hostname = BUF_strdup(s->tlsext_hostname);
1701                                 if (!s->session->tlsext_hostname)
1702                                         {
1703                                         *al = SSL_AD_UNRECOGNIZED_NAME;
1704                                         return 0;
1705                                         }
1706                                 }
1707                         else
1708                                 {
1709                                 *al = SSL_AD_DECODE_ERROR;
1710                                 return 0;
1711                                 }
1712                         }
1713                 }
1714
1715         *p = data;
1716
1717         ri_check:
1718
1719         /* Determine if we need to see RI. Strictly speaking if we want to
1720          * avoid an attack we should *always* see RI even on initial server
1721          * hello because the client doesn't see any renegotiation during an
1722          * attack. However this would mean we could not connect to any server
1723          * which doesn't support RI so for the immediate future tolerate RI
1724          * absence on initial connect only.
1725          */
1726         if (!renegotiate_seen
1727                 && !(s->options & SSL_OP_LEGACY_SERVER_CONNECT)
1728                 && !(s->options & SSL_OP_ALLOW_UNSAFE_LEGACY_RENEGOTIATION))
1729                 {
1730                 *al = SSL_AD_HANDSHAKE_FAILURE;
1731                 SSLerr(SSL_F_SSL_PARSE_SERVERHELLO_TLSEXT,
1732                                 SSL_R_UNSAFE_LEGACY_RENEGOTIATION_DISABLED);
1733                 return 0;
1734                 }
1735
1736         return 1;
1737         }
1738
1739
1740 int ssl_prepare_clienthello_tlsext(SSL *s)
1741         {
1742 #ifndef OPENSSL_NO_EC
1743         /* If we are client and using an elliptic curve cryptography cipher suite, send the point formats
1744          * and elliptic curves we support.
1745          */
1746         int using_ecc = 0;
1747         int i;
1748         unsigned char *j;
1749         unsigned long alg_k, alg_a;
1750         STACK_OF(SSL_CIPHER) *cipher_stack = SSL_get_ciphers(s);
1751
1752         for (i = 0; i < sk_SSL_CIPHER_num(cipher_stack); i++)
1753                 {
1754                 SSL_CIPHER *c = sk_SSL_CIPHER_value(cipher_stack, i);
1755
1756                 alg_k = c->algorithm_mkey;
1757                 alg_a = c->algorithm_auth;
1758                 if ((alg_k & (SSL_kEECDH|SSL_kECDHr|SSL_kECDHe) || (alg_a & SSL_aECDSA)))
1759                         {
1760                         using_ecc = 1;
1761                         break;
1762                         }
1763                 }
1764         using_ecc = using_ecc && (s->version >= TLS1_VERSION);
1765         if (using_ecc)
1766                 {
1767                 if (s->tlsext_ecpointformatlist != NULL) OPENSSL_free(s->tlsext_ecpointformatlist);
1768                 if ((s->tlsext_ecpointformatlist = OPENSSL_malloc(3)) == NULL)
1769                         {
1770                         SSLerr(SSL_F_SSL_PREPARE_CLIENTHELLO_TLSEXT,ERR_R_MALLOC_FAILURE);
1771                         return -1;
1772                         }
1773                 s->tlsext_ecpointformatlist_length = 3;
1774                 s->tlsext_ecpointformatlist[0] = TLSEXT_ECPOINTFORMAT_uncompressed;
1775                 s->tlsext_ecpointformatlist[1] = TLSEXT_ECPOINTFORMAT_ansiX962_compressed_prime;
1776                 s->tlsext_ecpointformatlist[2] = TLSEXT_ECPOINTFORMAT_ansiX962_compressed_char2;
1777
1778                 /* we support all named elliptic curves in draft-ietf-tls-ecc-12 */
1779                 if (s->tlsext_ellipticcurvelist != NULL) OPENSSL_free(s->tlsext_ellipticcurvelist);
1780                 s->tlsext_ellipticcurvelist_length = sizeof(pref_list)/sizeof(pref_list[0]) * 2;
1781                 if ((s->tlsext_ellipticcurvelist = OPENSSL_malloc(s->tlsext_ellipticcurvelist_length)) == NULL)
1782                         {
1783                         s->tlsext_ellipticcurvelist_length = 0;
1784                         SSLerr(SSL_F_SSL_PREPARE_CLIENTHELLO_TLSEXT,ERR_R_MALLOC_FAILURE);
1785                         return -1;
1786                         }
1787                 for (i = 0, j = s->tlsext_ellipticcurvelist; (unsigned int)i <
1788                                 sizeof(pref_list)/sizeof(pref_list[0]); i++)
1789                         {
1790                         int id = tls1_ec_nid2curve_id(pref_list[i]);
1791                         s2n(id,j);
1792                         }
1793                 }
1794 #endif /* OPENSSL_NO_EC */
1795
1796 #ifdef TLSEXT_TYPE_opaque_prf_input
1797         {
1798                 int r = 1;
1799
1800                 if (s->ctx->tlsext_opaque_prf_input_callback != 0)
1801                         {
1802                         r = s->ctx->tlsext_opaque_prf_input_callback(s, NULL, 0, s->ctx->tlsext_opaque_prf_input_callback_arg);
1803                         if (!r)
1804                                 return -1;
1805                         }
1806
1807                 if (s->tlsext_opaque_prf_input != NULL)
1808                         {
1809                         if (s->s3->client_opaque_prf_input != NULL) /* shouldn't really happen */
1810                                 OPENSSL_free(s->s3->client_opaque_prf_input);
1811
1812                         if (s->tlsext_opaque_prf_input_len == 0)
1813                                 s->s3->client_opaque_prf_input = OPENSSL_malloc(1); /* dummy byte just to get non-NULL */
1814                         else
1815                                 s->s3->client_opaque_prf_input = BUF_memdup(s->tlsext_opaque_prf_input, s->tlsext_opaque_prf_input_len);
1816                         if (s->s3->client_opaque_prf_input == NULL)
1817                                 {
1818                                 SSLerr(SSL_F_SSL_PREPARE_CLIENTHELLO_TLSEXT,ERR_R_MALLOC_FAILURE);
1819                                 return -1;
1820                                 }
1821                         s->s3->client_opaque_prf_input_len = s->tlsext_opaque_prf_input_len;
1822                         }
1823
1824                 if (r == 2)
1825                         /* at callback's request, insist on receiving an appropriate server opaque PRF input */
1826                         s->s3->server_opaque_prf_input_len = s->tlsext_opaque_prf_input_len;
1827         }
1828 #endif
1829
1830         return 1;
1831         }
1832
1833 int ssl_prepare_serverhello_tlsext(SSL *s)
1834         {
1835 #ifndef OPENSSL_NO_EC
1836         /* If we are server and using an ECC cipher suite, send the point formats we support
1837          * if the client sent us an ECPointsFormat extension.  Note that the server is not
1838          * supposed to send an EllipticCurves extension.
1839          */
1840
1841         unsigned long alg_k = s->s3->tmp.new_cipher->algorithm_mkey;
1842         unsigned long alg_a = s->s3->tmp.new_cipher->algorithm_auth;
1843         int using_ecc = (alg_k & (SSL_kEECDH|SSL_kECDHr|SSL_kECDHe)) || (alg_a & SSL_aECDSA);
1844         using_ecc = using_ecc && (s->session->tlsext_ecpointformatlist != NULL);
1845
1846         if (using_ecc)
1847                 {
1848                 if (s->tlsext_ecpointformatlist != NULL) OPENSSL_free(s->tlsext_ecpointformatlist);
1849                 if ((s->tlsext_ecpointformatlist = OPENSSL_malloc(3)) == NULL)
1850                         {
1851                         SSLerr(SSL_F_SSL_PREPARE_SERVERHELLO_TLSEXT,ERR_R_MALLOC_FAILURE);
1852                         return -1;
1853                         }
1854                 s->tlsext_ecpointformatlist_length = 3;
1855                 s->tlsext_ecpointformatlist[0] = TLSEXT_ECPOINTFORMAT_uncompressed;
1856                 s->tlsext_ecpointformatlist[1] = TLSEXT_ECPOINTFORMAT_ansiX962_compressed_prime;
1857                 s->tlsext_ecpointformatlist[2] = TLSEXT_ECPOINTFORMAT_ansiX962_compressed_char2;
1858                 }
1859 #endif /* OPENSSL_NO_EC */
1860
1861         return 1;
1862         }
1863
1864 int ssl_check_clienthello_tlsext_early(SSL *s)
1865         {
1866         int ret=SSL_TLSEXT_ERR_NOACK;
1867         int al = SSL_AD_UNRECOGNIZED_NAME;
1868
1869 #ifndef OPENSSL_NO_EC
1870         /* The handling of the ECPointFormats extension is done elsewhere, namely in
1871          * ssl3_choose_cipher in s3_lib.c.
1872          */
1873         /* The handling of the EllipticCurves extension is done elsewhere, namely in
1874          * ssl3_choose_cipher in s3_lib.c.
1875          */
1876 #endif
1877
1878         if (s->ctx != NULL && s->ctx->tlsext_servername_callback != 0)
1879                 ret = s->ctx->tlsext_servername_callback(s, &al, s->ctx->tlsext_servername_arg);
1880         else if (s->initial_ctx != NULL && s->initial_ctx->tlsext_servername_callback != 0)
1881                 ret = s->initial_ctx->tlsext_servername_callback(s, &al, s->initial_ctx->tlsext_servername_arg);
1882
1883 #ifdef TLSEXT_TYPE_opaque_prf_input
1884         {
1885                 /* This sort of belongs into ssl_prepare_serverhello_tlsext(),
1886                  * but we might be sending an alert in response to the client hello,
1887                  * so this has to happen here in
1888                  * ssl_check_clienthello_tlsext_early(). */
1889
1890                 int r = 1;
1891
1892                 if (s->ctx->tlsext_opaque_prf_input_callback != 0)
1893                         {
1894                         r = s->ctx->tlsext_opaque_prf_input_callback(s, NULL, 0, s->ctx->tlsext_opaque_prf_input_callback_arg);
1895                         if (!r)
1896                                 {
1897                                 ret = SSL_TLSEXT_ERR_ALERT_FATAL;
1898                                 al = SSL_AD_INTERNAL_ERROR;
1899                                 goto err;
1900                                 }
1901                         }
1902
1903                 if (s->s3->server_opaque_prf_input != NULL) /* shouldn't really happen */
1904                         OPENSSL_free(s->s3->server_opaque_prf_input);
1905                 s->s3->server_opaque_prf_input = NULL;
1906
1907                 if (s->tlsext_opaque_prf_input != NULL)
1908                         {
1909                         if (s->s3->client_opaque_prf_input != NULL &&
1910                                 s->s3->client_opaque_prf_input_len == s->tlsext_opaque_prf_input_len)
1911                                 {
1912                                 /* can only use this extension if we have a server opaque PRF input
1913                                  * of the same length as the client opaque PRF input! */
1914
1915                                 if (s->tlsext_opaque_prf_input_len == 0)
1916                                         s->s3->server_opaque_prf_input = OPENSSL_malloc(1); /* dummy byte just to get non-NULL */
1917                                 else
1918                                         s->s3->server_opaque_prf_input = BUF_memdup(s->tlsext_opaque_prf_input, s->tlsext_opaque_prf_input_len);
1919                                 if (s->s3->server_opaque_prf_input == NULL)
1920                                         {
1921                                         ret = SSL_TLSEXT_ERR_ALERT_FATAL;
1922                                         al = SSL_AD_INTERNAL_ERROR;
1923                                         goto err;
1924                                         }
1925                                 s->s3->server_opaque_prf_input_len = s->tlsext_opaque_prf_input_len;
1926                                 }
1927                         }
1928
1929                 if (r == 2 && s->s3->server_opaque_prf_input == NULL)
1930                         {
1931                         /* The callback wants to enforce use of the extension,
1932                          * but we can't do that with the client opaque PRF input;
1933                          * abort the handshake.
1934                          */
1935                         ret = SSL_TLSEXT_ERR_ALERT_FATAL;
1936                         al = SSL_AD_HANDSHAKE_FAILURE;
1937                         }
1938         }
1939
1940  err:
1941 #endif
1942         switch (ret)
1943                 {
1944                 case SSL_TLSEXT_ERR_ALERT_FATAL:
1945                         ssl3_send_alert(s,SSL3_AL_FATAL,al);
1946                         return -1;
1947
1948                 case SSL_TLSEXT_ERR_ALERT_WARNING:
1949                         ssl3_send_alert(s,SSL3_AL_WARNING,al);
1950                         return 1;
1951
1952                 case SSL_TLSEXT_ERR_NOACK:
1953                         s->servername_done=0;
1954                         default:
1955                 return 1;
1956                 }
1957         }
1958
1959 int ssl_check_clienthello_tlsext_late(SSL *s)
1960         {
1961         int ret = SSL_TLSEXT_ERR_OK;
1962         int al;
1963
1964         /* If status request then ask callback what to do.
1965          * Note: this must be called after servername callbacks in case
1966          * the certificate has changed, and must be called after the cipher
1967          * has been chosen because this may influence which certificate is sent
1968          */
1969         if ((s->tlsext_status_type != -1) && s->ctx && s->ctx->tlsext_status_cb)
1970                 {
1971                 int r;
1972                 CERT_PKEY *certpkey;
1973                 certpkey = ssl_get_server_send_pkey(s);
1974                 /* If no certificate can't return certificate status */
1975                 if (certpkey == NULL)
1976                         {
1977                         s->tlsext_status_expected = 0;
1978                         return 1;
1979                         }
1980                 /* Set current certificate to one we will use so
1981                  * SSL_get_certificate et al can pick it up.
1982                  */
1983                 s->cert->key = certpkey;
1984                 r = s->ctx->tlsext_status_cb(s, s->ctx->tlsext_status_arg);
1985                 switch (r)
1986                         {
1987                         /* We don't want to send a status request response */
1988                         case SSL_TLSEXT_ERR_NOACK:
1989                                 s->tlsext_status_expected = 0;
1990                                 break;
1991                         /* status request response should be sent */
1992                         case SSL_TLSEXT_ERR_OK:
1993                                 if (s->tlsext_ocsp_resp)
1994                                         s->tlsext_status_expected = 1;
1995                                 else
1996                                         s->tlsext_status_expected = 0;
1997                                 break;
1998                         /* something bad happened */
1999                         case SSL_TLSEXT_ERR_ALERT_FATAL:
2000                                 ret = SSL_TLSEXT_ERR_ALERT_FATAL;
2001                                 al = SSL_AD_INTERNAL_ERROR;
2002                                 goto err;
2003                         }
2004                 }
2005         else
2006                 s->tlsext_status_expected = 0;
2007
2008  err:
2009         switch (ret)
2010                 {
2011                 case SSL_TLSEXT_ERR_ALERT_FATAL:
2012                         ssl3_send_alert(s,SSL3_AL_FATAL,al);
2013                         return -1;
2014
2015                 case SSL_TLSEXT_ERR_ALERT_WARNING:
2016                         ssl3_send_alert(s,SSL3_AL_WARNING,al);
2017                         return 1;
2018
2019                 default:
2020                         return 1;
2021                 }
2022         }
2023
2024 int ssl_check_serverhello_tlsext(SSL *s)
2025         {
2026         int ret=SSL_TLSEXT_ERR_NOACK;
2027         int al = SSL_AD_UNRECOGNIZED_NAME;
2028
2029 #ifndef OPENSSL_NO_EC
2030         /* If we are client and using an elliptic curve cryptography cipher
2031          * suite, then if server returns an EC point formats lists extension
2032          * it must contain uncompressed.
2033          */
2034         unsigned long alg_k = s->s3->tmp.new_cipher->algorithm_mkey;
2035         unsigned long alg_a = s->s3->tmp.new_cipher->algorithm_auth;
2036         if ((s->tlsext_ecpointformatlist != NULL) && (s->tlsext_ecpointformatlist_length > 0) &&
2037             (s->session->tlsext_ecpointformatlist != NULL) && (s->session->tlsext_ecpointformatlist_length > 0) &&
2038             ((alg_k & (SSL_kEECDH|SSL_kECDHr|SSL_kECDHe)) || (alg_a & SSL_aECDSA)))
2039                 {
2040                 /* we are using an ECC cipher */
2041                 size_t i;
2042                 unsigned char *list;
2043                 int found_uncompressed = 0;
2044                 list = s->session->tlsext_ecpointformatlist;
2045                 for (i = 0; i < s->session->tlsext_ecpointformatlist_length; i++)
2046                         {
2047                         if (*(list++) == TLSEXT_ECPOINTFORMAT_uncompressed)
2048                                 {
2049                                 found_uncompressed = 1;
2050                                 break;
2051                                 }
2052                         }
2053                 if (!found_uncompressed)
2054                         {
2055                         SSLerr(SSL_F_SSL_CHECK_SERVERHELLO_TLSEXT,SSL_R_TLS_INVALID_ECPOINTFORMAT_LIST);
2056                         return -1;
2057                         }
2058                 }
2059         ret = SSL_TLSEXT_ERR_OK;
2060 #endif /* OPENSSL_NO_EC */
2061
2062         if (s->ctx != NULL && s->ctx->tlsext_servername_callback != 0)
2063                 ret = s->ctx->tlsext_servername_callback(s, &al, s->ctx->tlsext_servername_arg);
2064         else if (s->initial_ctx != NULL && s->initial_ctx->tlsext_servername_callback != 0)
2065                 ret = s->initial_ctx->tlsext_servername_callback(s, &al, s->initial_ctx->tlsext_servername_arg);
2066
2067 #ifdef TLSEXT_TYPE_opaque_prf_input
2068         if (s->s3->server_opaque_prf_input_len > 0)
2069                 {
2070                 /* This case may indicate that we, as a client, want to insist on using opaque PRF inputs.
2071                  * So first verify that we really have a value from the server too. */
2072
2073                 if (s->s3->server_opaque_prf_input == NULL)
2074                         {
2075                         ret = SSL_TLSEXT_ERR_ALERT_FATAL;
2076                         al = SSL_AD_HANDSHAKE_FAILURE;
2077                         }
2078
2079                 /* Anytime the server *has* sent an opaque PRF input, we need to check
2080                  * that we have a client opaque PRF input of the same size. */
2081                 if (s->s3->client_opaque_prf_input == NULL ||
2082                     s->s3->client_opaque_prf_input_len != s->s3->server_opaque_prf_input_len)
2083                         {
2084                         ret = SSL_TLSEXT_ERR_ALERT_FATAL;
2085                         al = SSL_AD_ILLEGAL_PARAMETER;
2086                         }
2087                 }
2088 #endif
2089
2090         /* If we've requested certificate status and we wont get one
2091          * tell the callback
2092          */
2093         if ((s->tlsext_status_type != -1) && !(s->tlsext_status_expected)
2094                         && s->ctx && s->ctx->tlsext_status_cb)
2095                 {
2096                 int r;
2097                 /* Set resp to NULL, resplen to -1 so callback knows
2098                  * there is no response.
2099                  */
2100                 if (s->tlsext_ocsp_resp)
2101                         {
2102                         OPENSSL_free(s->tlsext_ocsp_resp);
2103                         s->tlsext_ocsp_resp = NULL;
2104                         }
2105                 s->tlsext_ocsp_resplen = -1;
2106                 r = s->ctx->tlsext_status_cb(s, s->ctx->tlsext_status_arg);
2107                 if (r == 0)
2108                         {
2109                         al = SSL_AD_BAD_CERTIFICATE_STATUS_RESPONSE;
2110                         ret = SSL_TLSEXT_ERR_ALERT_FATAL;
2111                         }
2112                 if (r < 0)
2113                         {
2114                         al = SSL_AD_INTERNAL_ERROR;
2115                         ret = SSL_TLSEXT_ERR_ALERT_FATAL;
2116                         }
2117                 }
2118
2119         switch (ret)
2120                 {
2121                 case SSL_TLSEXT_ERR_ALERT_FATAL:
2122                         ssl3_send_alert(s,SSL3_AL_FATAL,al);
2123                         return -1;
2124
2125                 case SSL_TLSEXT_ERR_ALERT_WARNING:
2126                         ssl3_send_alert(s,SSL3_AL_WARNING,al);
2127                         return 1;
2128
2129                 case SSL_TLSEXT_ERR_NOACK:
2130                         s->servername_done=0;
2131                         default:
2132                 return 1;
2133                 }
2134         }
2135
2136 /* Since the server cache lookup is done early on in the processing of the
2137  * ClientHello, and other operations depend on the result, we need to handle
2138  * any TLS session ticket extension at the same time.
2139  *
2140  *   session_id: points at the session ID in the ClientHello. This code will
2141  *       read past the end of this in order to parse out the session ticket
2142  *       extension, if any.
2143  *   len: the length of the session ID.
2144  *   limit: a pointer to the first byte after the ClientHello.
2145  *   ret: (output) on return, if a ticket was decrypted, then this is set to
2146  *       point to the resulting session.
2147  *
2148  * If s->tls_session_secret_cb is set then we are expecting a pre-shared key
2149  * ciphersuite, in which case we have no use for session tickets and one will
2150  * never be decrypted, nor will s->tlsext_ticket_expected be set to 1.
2151  *
2152  * Returns:
2153  *   -1: fatal error, either from parsing or decrypting the ticket.
2154  *    0: no ticket was found (or was ignored, based on settings).
2155  *    1: a zero length extension was found, indicating that the client supports
2156  *       session tickets but doesn't currently have one to offer.
2157  *    2: either s->tls_session_secret_cb was set, or a ticket was offered but
2158  *       couldn't be decrypted because of a non-fatal error.
2159  *    3: a ticket was successfully decrypted and *ret was set.
2160  *
2161  * Side effects:
2162  *   Sets s->tlsext_ticket_expected to 1 if the server will have to issue
2163  *   a new session ticket to the client because the client indicated support
2164  *   (and s->tls_session_secret_cb is NULL) but the client either doesn't have
2165  *   a session ticket or we couldn't use the one it gave us, or if
2166  *   s->ctx->tlsext_ticket_key_cb asked to renew the client's ticket.
2167  *   Otherwise, s->tlsext_ticket_expected is set to 0.
2168  */
2169 int tls1_process_ticket(SSL *s, unsigned char *session_id, int len,
2170                         const unsigned char *limit, SSL_SESSION **ret)
2171         {
2172         /* Point after session ID in client hello */
2173         const unsigned char *p = session_id + len;
2174         unsigned short i;
2175
2176         *ret = NULL;
2177         s->tlsext_ticket_expected = 0;
2178
2179         /* If tickets disabled behave as if no ticket present
2180          * to permit stateful resumption.
2181          */
2182         if (SSL_get_options(s) & SSL_OP_NO_TICKET)
2183                 return 0;
2184         if ((s->version <= SSL3_VERSION) || !limit)
2185                 return 0;
2186         if (p >= limit)
2187                 return -1;
2188         /* Skip past DTLS cookie */
2189         if (s->version == DTLS1_VERSION || s->version == DTLS1_BAD_VER)
2190                 {
2191                 i = *(p++);
2192                 p+= i;
2193                 if (p >= limit)
2194                         return -1;
2195                 }
2196         /* Skip past cipher list */
2197         n2s(p, i);
2198         p+= i;
2199         if (p >= limit)
2200                 return -1;
2201         /* Skip past compression algorithm list */
2202         i = *(p++);
2203         p += i;
2204         if (p > limit)
2205                 return -1;
2206         /* Now at start of extensions */
2207         if ((p + 2) >= limit)
2208                 return 0;
2209         n2s(p, i);
2210         while ((p + 4) <= limit)
2211                 {
2212                 unsigned short type, size;
2213                 n2s(p, type);
2214                 n2s(p, size);
2215                 if (p + size > limit)
2216                         return 0;
2217                 if (type == TLSEXT_TYPE_session_ticket)
2218                         {
2219                         int r;
2220                         if (size == 0)
2221                                 {
2222                                 /* The client will accept a ticket but doesn't
2223                                  * currently have one. */
2224                                 s->tlsext_ticket_expected = 1;
2225                                 return 1;
2226                                 }
2227                         if (s->tls_session_secret_cb)
2228                                 {
2229                                 /* Indicate that the ticket couldn't be
2230                                  * decrypted rather than generating the session
2231                                  * from ticket now, trigger abbreviated
2232                                  * handshake based on external mechanism to
2233                                  * calculate the master secret later. */
2234                                 return 2;
2235                                 }
2236                         r = tls_decrypt_ticket(s, p, size, session_id, len, ret);
2237                         switch (r)
2238                                 {
2239                                 case 2: /* ticket couldn't be decrypted */
2240                                         s->tlsext_ticket_expected = 1;
2241                                         return 2;
2242                                 case 3: /* ticket was decrypted */
2243                                         return r;
2244                                 case 4: /* ticket decrypted but need to renew */
2245                                         s->tlsext_ticket_expected = 1;
2246                                         return 3;
2247                                 default: /* fatal error */
2248                                         return -1;
2249                                 }
2250                         }
2251                 p += size;
2252                 }
2253         return 0;
2254         }
2255
2256 /* tls_decrypt_ticket attempts to decrypt a session ticket.
2257  *
2258  *   etick: points to the body of the session ticket extension.
2259  *   eticklen: the length of the session tickets extenion.
2260  *   sess_id: points at the session ID.
2261  *   sesslen: the length of the session ID.
2262  *   psess: (output) on return, if a ticket was decrypted, then this is set to
2263  *       point to the resulting session.
2264  *
2265  * Returns:
2266  *   -1: fatal error, either from parsing or decrypting the ticket.
2267  *    2: the ticket couldn't be decrypted.
2268  *    3: a ticket was successfully decrypted and *psess was set.
2269  *    4: same as 3, but the ticket needs to be renewed.
2270  */
2271 static int tls_decrypt_ticket(SSL *s, const unsigned char *etick, int eticklen,
2272                                 const unsigned char *sess_id, int sesslen,
2273                                 SSL_SESSION **psess)
2274         {
2275         SSL_SESSION *sess;
2276         unsigned char *sdec;
2277         const unsigned char *p;
2278         int slen, mlen, renew_ticket = 0;
2279         unsigned char tick_hmac[EVP_MAX_MD_SIZE];
2280         HMAC_CTX hctx;
2281         EVP_CIPHER_CTX ctx;
2282         SSL_CTX *tctx = s->initial_ctx;
2283         /* Need at least keyname + iv + some encrypted data */
2284         if (eticklen < 48)
2285                 return 2;
2286         /* Initialize session ticket encryption and HMAC contexts */
2287         HMAC_CTX_init(&hctx);
2288         EVP_CIPHER_CTX_init(&ctx);
2289         if (tctx->tlsext_ticket_key_cb)
2290                 {
2291                 unsigned char *nctick = (unsigned char *)etick;
2292                 int rv = tctx->tlsext_ticket_key_cb(s, nctick, nctick + 16,
2293                                                         &ctx, &hctx, 0);
2294                 if (rv < 0)
2295                         return -1;
2296                 if (rv == 0)
2297                         return 2;
2298                 if (rv == 2)
2299                         renew_ticket = 1;
2300                 }
2301         else
2302                 {
2303                 /* Check key name matches */
2304                 if (memcmp(etick, tctx->tlsext_tick_key_name, 16))
2305                         return 2;
2306                 HMAC_Init_ex(&hctx, tctx->tlsext_tick_hmac_key, 16,
2307                                         tlsext_tick_md(), NULL);
2308                 EVP_DecryptInit_ex(&ctx, EVP_aes_128_cbc(), NULL,
2309                                 tctx->tlsext_tick_aes_key, etick + 16);
2310                 }
2311         /* Attempt to process session ticket, first conduct sanity and
2312          * integrity checks on ticket.
2313          */
2314         mlen = HMAC_size(&hctx);
2315         if (mlen < 0)
2316                 {
2317                 EVP_CIPHER_CTX_cleanup(&ctx);
2318                 return -1;
2319                 }
2320         eticklen -= mlen;
2321         /* Check HMAC of encrypted ticket */
2322         HMAC_Update(&hctx, etick, eticklen);
2323         HMAC_Final(&hctx, tick_hmac, NULL);
2324         HMAC_CTX_cleanup(&hctx);
2325         if (CRYPTO_memcmp(tick_hmac, etick + eticklen, mlen))
2326                 return 2;
2327         /* Attempt to decrypt session data */
2328         /* Move p after IV to start of encrypted ticket, update length */
2329         p = etick + 16 + EVP_CIPHER_CTX_iv_length(&ctx);
2330         eticklen -= 16 + EVP_CIPHER_CTX_iv_length(&ctx);
2331         sdec = OPENSSL_malloc(eticklen);
2332         if (!sdec)
2333                 {
2334                 EVP_CIPHER_CTX_cleanup(&ctx);
2335                 return -1;
2336                 }
2337         EVP_DecryptUpdate(&ctx, sdec, &slen, p, eticklen);
2338         if (EVP_DecryptFinal(&ctx, sdec + slen, &mlen) <= 0)
2339                 return 2;
2340         slen += mlen;
2341         EVP_CIPHER_CTX_cleanup(&ctx);
2342         p = sdec;
2343
2344         sess = d2i_SSL_SESSION(NULL, &p, slen);
2345         OPENSSL_free(sdec);
2346         if (sess)
2347                 {
2348                 /* The session ID, if non-empty, is used by some clients to
2349                  * detect that the ticket has been accepted. So we copy it to
2350                  * the session structure. If it is empty set length to zero
2351                  * as required by standard.
2352                  */
2353                 if (sesslen)
2354                         memcpy(sess->session_id, sess_id, sesslen);
2355                 sess->session_id_length = sesslen;
2356                 *psess = sess;
2357                 if (renew_ticket)
2358                         return 4;
2359                 else
2360                         return 3;
2361                 }
2362         ERR_clear_error();
2363         /* For session parse failure, indicate that we need to send a new
2364          * ticket. */
2365         return 2;
2366         }
2367
2368 /* Tables to translate from NIDs to TLS v1.2 ids */
2369
2370 typedef struct
2371         {
2372         int nid;
2373         int id;
2374         } tls12_lookup;
2375
2376 static tls12_lookup tls12_md[] = {
2377 #ifndef OPENSSL_NO_MD5
2378         {NID_md5, TLSEXT_hash_md5},
2379 #endif
2380 #ifndef OPENSSL_NO_SHA
2381         {NID_sha1, TLSEXT_hash_sha1},
2382 #endif
2383 #ifndef OPENSSL_NO_SHA256
2384         {NID_sha224, TLSEXT_hash_sha224},
2385         {NID_sha256, TLSEXT_hash_sha256},
2386 #endif
2387 #ifndef OPENSSL_NO_SHA512
2388         {NID_sha384, TLSEXT_hash_sha384},
2389         {NID_sha512, TLSEXT_hash_sha512}
2390 #endif
2391 };
2392
2393 static tls12_lookup tls12_sig[] = {
2394 #ifndef OPENSSL_NO_RSA
2395         {EVP_PKEY_RSA, TLSEXT_signature_rsa},
2396 #endif
2397 #ifndef OPENSSL_NO_DSA
2398         {EVP_PKEY_DSA, TLSEXT_signature_dsa},
2399 #endif
2400 #ifndef OPENSSL_NO_ECDSA
2401         {EVP_PKEY_EC, TLSEXT_signature_ecdsa}
2402 #endif
2403 };
2404
2405 static int tls12_find_id(int nid, tls12_lookup *table, size_t tlen)
2406         {
2407         size_t i;
2408         for (i = 0; i < tlen; i++)
2409                 {
2410                 if (table[i].nid == nid)
2411                         return table[i].id;
2412                 }
2413         return -1;
2414         }
2415 #if 0
2416 static int tls12_find_nid(int id, tls12_lookup *table, size_t tlen)
2417         {
2418         size_t i;
2419         for (i = 0; i < tlen; i++)
2420                 {
2421                 if (table[i].id == id)
2422                         return table[i].nid;
2423                 }
2424         return -1;
2425         }
2426 #endif
2427
2428 int tls12_get_sigandhash(unsigned char *p, const EVP_PKEY *pk, const EVP_MD *md)
2429         {
2430         int sig_id, md_id;
2431         if (!md)
2432                 return 0;
2433         md_id = tls12_find_id(EVP_MD_type(md), tls12_md,
2434                                 sizeof(tls12_md)/sizeof(tls12_lookup));
2435         if (md_id == -1)
2436                 return 0;
2437         sig_id = tls12_get_sigid(pk);
2438         if (sig_id == -1)
2439                 return 0;
2440         p[0] = (unsigned char)md_id;
2441         p[1] = (unsigned char)sig_id;
2442         return 1;
2443         }
2444
2445 int tls12_get_sigid(const EVP_PKEY *pk)
2446         {
2447         return tls12_find_id(pk->type, tls12_sig,
2448                                 sizeof(tls12_sig)/sizeof(tls12_lookup));
2449         }
2450
2451 const EVP_MD *tls12_get_hash(unsigned char hash_alg)
2452         {
2453         switch(hash_alg)
2454                 {
2455 #ifndef OPENSSL_NO_MD5
2456                 case TLSEXT_hash_md5:
2457 #ifdef OPENSSL_FIPS
2458                 if (FIPS_mode())
2459                         return NULL;
2460 #endif
2461                 return EVP_md5();
2462 #endif
2463 #ifndef OPENSSL_NO_SHA
2464                 case TLSEXT_hash_sha1:
2465                 return EVP_sha1();
2466 #endif
2467 #ifndef OPENSSL_NO_SHA256
2468                 case TLSEXT_hash_sha224:
2469                 return EVP_sha224();
2470
2471                 case TLSEXT_hash_sha256:
2472                 return EVP_sha256();
2473 #endif
2474 #ifndef OPENSSL_NO_SHA512
2475                 case TLSEXT_hash_sha384:
2476                 return EVP_sha384();
2477
2478                 case TLSEXT_hash_sha512:
2479                 return EVP_sha512();
2480 #endif
2481                 default:
2482                 return NULL;
2483
2484                 }
2485         }
2486
2487 /* Set preferred digest for each key type */
2488
2489 int tls1_process_sigalgs(SSL *s, const unsigned char *data, int dsize)
2490         {
2491         int i, idx;
2492         const EVP_MD *md;
2493         CERT *c = s->cert;
2494         /* Extension ignored for TLS versions below 1.2 */
2495         if (TLS1_get_version(s) < TLS1_2_VERSION)
2496                 return 1;
2497         /* Should never happen */
2498         if (!c)
2499                 return 0;
2500
2501         c->pkeys[SSL_PKEY_DSA_SIGN].digest = NULL;
2502         c->pkeys[SSL_PKEY_RSA_SIGN].digest = NULL;
2503         c->pkeys[SSL_PKEY_RSA_ENC].digest = NULL;
2504         c->pkeys[SSL_PKEY_ECC].digest = NULL;
2505
2506         for (i = 0; i < dsize; i += 2)
2507                 {
2508                 unsigned char hash_alg = data[i], sig_alg = data[i+1];
2509
2510                 switch(sig_alg)
2511                         {
2512 #ifndef OPENSSL_NO_RSA
2513                         case TLSEXT_signature_rsa:
2514                         idx = SSL_PKEY_RSA_SIGN;
2515                         break;
2516 #endif
2517 #ifndef OPENSSL_NO_DSA
2518                         case TLSEXT_signature_dsa:
2519                         idx = SSL_PKEY_DSA_SIGN;
2520                         break;
2521 #endif
2522 #ifndef OPENSSL_NO_ECDSA
2523                         case TLSEXT_signature_ecdsa:
2524                         idx = SSL_PKEY_ECC;
2525                         break;
2526 #endif
2527                         default:
2528                         continue;
2529                         }
2530
2531                 if (c->pkeys[idx].digest == NULL)
2532                         {
2533                         md = tls12_get_hash(hash_alg);
2534                         if (md)
2535                                 {
2536                                 c->pkeys[idx].digest = md;
2537                                 if (idx == SSL_PKEY_RSA_SIGN)
2538                                         c->pkeys[SSL_PKEY_RSA_ENC].digest = md;
2539                                 }
2540                         }
2541
2542                 }
2543
2544
2545         /* Set any remaining keys to default values. NOTE: if alg is not
2546          * supported it stays as NULL.
2547          */
2548 #ifndef OPENSSL_NO_DSA
2549         if (!c->pkeys[SSL_PKEY_DSA_SIGN].digest)
2550                 c->pkeys[SSL_PKEY_DSA_SIGN].digest = EVP_sha1();
2551 #endif
2552 #ifndef OPENSSL_NO_RSA
2553         if (!c->pkeys[SSL_PKEY_RSA_SIGN].digest)
2554                 {
2555                 c->pkeys[SSL_PKEY_RSA_SIGN].digest = EVP_sha1();
2556                 c->pkeys[SSL_PKEY_RSA_ENC].digest = EVP_sha1();
2557                 }
2558 #endif
2559 #ifndef OPENSSL_NO_ECDSA
2560         if (!c->pkeys[SSL_PKEY_ECC].digest)
2561                 c->pkeys[SSL_PKEY_ECC].digest = EVP_sha1();
2562 #endif
2563         return 1;
2564         }
2565
2566 #endif
2567
2568 #ifndef OPENSSL_NO_HEARTBEATS
2569 int
2570 tls1_process_heartbeat(SSL *s)
2571         {
2572         unsigned char *p = &s->s3->rrec.data[0], *pl;
2573         unsigned short hbtype;
2574         unsigned int payload;
2575         unsigned int padding = 16; /* Use minimum padding */
2576
2577         /* Read type and payload length first */
2578         hbtype = *p++;
2579         n2s(p, payload);
2580         pl = p;
2581
2582         if (s->msg_callback)
2583                 s->msg_callback(0, s->version, TLS1_RT_HEARTBEAT,
2584                         &s->s3->rrec.data[0], s->s3->rrec.length,
2585                         s, s->msg_callback_arg);
2586
2587         if (hbtype == TLS1_HB_REQUEST)
2588                 {
2589                 unsigned char *buffer, *bp;
2590                 int r;
2591
2592                 /* Allocate memory for the response, size is 1 bytes
2593                  * message type, plus 2 bytes payload length, plus
2594                  * payload, plus padding
2595                  */
2596                 buffer = OPENSSL_malloc(1 + 2 + payload + padding);
2597                 bp = buffer;
2598
2599                 /* Enter response type, length and copy payload */
2600                 *bp++ = TLS1_HB_RESPONSE;
2601                 s2n(payload, bp);
2602                 memcpy(bp, pl, payload);
2603                 bp += payload;
2604                 /* Random padding */
2605                 RAND_pseudo_bytes(bp, padding);
2606
2607                 r = ssl3_write_bytes(s, TLS1_RT_HEARTBEAT, buffer, 3 + payload + padding);
2608
2609                 if (r >= 0 && s->msg_callback)
2610                         s->msg_callback(1, s->version, TLS1_RT_HEARTBEAT,
2611                                 buffer, 3 + payload + padding,
2612                                 s, s->msg_callback_arg);
2613
2614                 OPENSSL_free(buffer);
2615
2616                 if (r < 0)
2617                         return r;
2618                 }
2619         else if (hbtype == TLS1_HB_RESPONSE)
2620                 {
2621                 unsigned int seq;
2622
2623                 /* We only send sequence numbers (2 bytes unsigned int),
2624                  * and 16 random bytes, so we just try to read the
2625                  * sequence number */
2626                 n2s(pl, seq);
2627
2628                 if (payload == 18 && seq == s->tlsext_hb_seq)
2629                         {
2630                         s->tlsext_hb_seq++;
2631                         s->tlsext_hb_pending = 0;
2632                         }
2633                 }
2634
2635         return 0;
2636         }
2637
2638 int
2639 tls1_heartbeat(SSL *s)
2640         {
2641         unsigned char *buf, *p;
2642         int ret;
2643         unsigned int payload = 18; /* Sequence number + random bytes */
2644         unsigned int padding = 16; /* Use minimum padding */
2645
2646         /* Only send if peer supports and accepts HB requests... */
2647         if (!(s->tlsext_heartbeat & SSL_TLSEXT_HB_ENABLED) ||
2648             s->tlsext_heartbeat & SSL_TLSEXT_HB_DONT_SEND_REQUESTS)
2649                 {
2650                 SSLerr(SSL_F_TLS1_HEARTBEAT,SSL_R_TLS_HEARTBEAT_PEER_DOESNT_ACCEPT);
2651                 return -1;
2652                 }
2653
2654         /* ...and there is none in flight yet... */
2655         if (s->tlsext_hb_pending)
2656                 {
2657                 SSLerr(SSL_F_TLS1_HEARTBEAT,SSL_R_TLS_HEARTBEAT_PENDING);
2658                 return -1;
2659                 }
2660
2661         /* ...and no handshake in progress. */
2662         if (SSL_in_init(s) || s->in_handshake)
2663                 {
2664                 SSLerr(SSL_F_TLS1_HEARTBEAT,SSL_R_UNEXPECTED_MESSAGE);
2665                 return -1;
2666                 }
2667
2668         /* Check if padding is too long, payload and padding
2669          * must not exceed 2^14 - 3 = 16381 bytes in total.
2670          */
2671         OPENSSL_assert(payload + padding <= 16381);
2672
2673         /* Create HeartBeat message, we just use a sequence number
2674          * as payload to distuingish different messages and add
2675          * some random stuff.
2676          *  - Message Type, 1 byte
2677          *  - Payload Length, 2 bytes (unsigned int)
2678          *  - Payload, the sequence number (2 bytes uint)
2679          *  - Payload, random bytes (16 bytes uint)
2680          *  - Padding
2681          */
2682         buf = OPENSSL_malloc(1 + 2 + payload + padding);
2683         p = buf;
2684         /* Message Type */
2685         *p++ = TLS1_HB_REQUEST;
2686         /* Payload length (18 bytes here) */
2687         s2n(payload, p);
2688         /* Sequence number */
2689         s2n(s->tlsext_hb_seq, p);
2690         /* 16 random bytes */
2691         RAND_pseudo_bytes(p, 16);
2692         p += 16;
2693         /* Random padding */
2694         RAND_pseudo_bytes(p, padding);
2695
2696         ret = ssl3_write_bytes(s, TLS1_RT_HEARTBEAT, buf, 3 + payload + padding);
2697         if (ret >= 0)
2698                 {
2699                 if (s->msg_callback)
2700                         s->msg_callback(1, s->version, TLS1_RT_HEARTBEAT,
2701                                 buf, 3 + payload + padding,
2702                                 s, s->msg_callback_arg);
2703
2704                 s->tlsext_hb_pending = 1;
2705                 }
2706
2707         OPENSSL_free(buf);
2708
2709         return ret;
2710         }
2711 #endif