ssl/t1_lib.c

   1 /* ssl/t1_lib.c */
   2 /* Copyright (C) 1995-1998 Eric Young (eay@cryptsoft.com)
   3  * All rights reserved.
   4  *
   5  * This package is an SSL implementation written
   6  * by Eric Young (eay@cryptsoft.com).
   7  * The implementation was written so as to conform with Netscapes SSL.
   8  *
   9  * This library is free for commercial and non-commercial use as long as
  10  * the following conditions are aheared to.  The following conditions
  11  * apply to all code found in this distribution, be it the RC4, RSA,
  12  * lhash, DES, etc., code; not just the SSL code.  The SSL documentation
  13  * included with this distribution is covered by the same copyright terms
  14  * except that the holder is Tim Hudson (tjh@cryptsoft.com).
  15  *
  16  * Copyright remains Eric Young's, and as such any Copyright notices in
  17  * the code are not to be removed.
  18  * If this package is used in a product, Eric Young should be given attribution
  19  * as the author of the parts of the library used.
  20  * This can be in the form of a textual message at program startup or
  21  * in documentation (online or textual) provided with the package.
  22  *
  23  * Redistribution and use in source and binary forms, with or without
  24  * modification, are permitted provided that the following conditions
  25  * are met:
  26  * 1. Redistributions of source code must retain the copyright
  27  *    notice, this list of conditions and the following disclaimer.
  28  * 2. Redistributions in binary form must reproduce the above copyright
  29  *    notice, this list of conditions and the following disclaimer in the
  30  *    documentation and/or other materials provided with the distribution.
  31  * 3. All advertising materials mentioning features or use of this software
  32  *    must display the following acknowledgement:
  33  *    "This product includes cryptographic software written by
  34  *     Eric Young (eay@cryptsoft.com)"
  35  *    The word 'cryptographic' can be left out if the rouines from the library
  36  *    being used are not cryptographic related :-).
  37  * 4. If you include any Windows specific code (or a derivative thereof) from
  38  *    the apps directory (application code) you must include an acknowledgement:
  39  *    "This product includes software written by Tim Hudson (tjh@cryptsoft.com)"
  40  *
  41  * THIS SOFTWARE IS PROVIDED BY ERIC YOUNG ``AS IS'' AND
  42  * ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
  43  * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE
  44  * ARE DISCLAIMED.  IN NO EVENT SHALL THE AUTHOR OR CONTRIBUTORS BE LIABLE
  45  * FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL
  46  * DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS
  47  * OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION)
  48  * HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT
  49  * LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY
  50  * OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF
  51  * SUCH DAMAGE.
  52  *
  53  * The licence and distribution terms for any publically available version or
  54  * derivative of this code cannot be changed.  i.e. this code cannot simply be
  55  * copied and put under another distribution licence
  56  * [including the GNU Public Licence.]
  57  */
  58 /* ====================================================================
  59  * Copyright (c) 1998-2007 The OpenSSL Project.  All rights reserved.
  60  *
  61  * Redistribution and use in source and binary forms, with or without
  62  * modification, are permitted provided that the following conditions
  63  * are met:
  64  *
  65  * 1. Redistributions of source code must retain the above copyright
  66  *    notice, this list of conditions and the following disclaimer.
  67  *
  68  * 2. Redistributions in binary form must reproduce the above copyright
  69  *    notice, this list of conditions and the following disclaimer in
  70  *    the documentation and/or other materials provided with the
  71  *    distribution.
  72  *
  73  * 3. All advertising materials mentioning features or use of this
  74  *    software must display the following acknowledgment:
  75  *    "This product includes software developed by the OpenSSL Project
  76  *    for use in the OpenSSL Toolkit. (http://www.openssl.org/)"
  77  *
  78  * 4. The names "OpenSSL Toolkit" and "OpenSSL Project" must not be used to
  79  *    endorse or promote products derived from this software without
  80  *    prior written permission. For written permission, please contact
  81  *    openssl-core@openssl.org.
  82  *
  83  * 5. Products derived from this software may not be called "OpenSSL"
  84  *    nor may "OpenSSL" appear in their names without prior written
  85  *    permission of the OpenSSL Project.
  86  *
  87  * 6. Redistributions of any form whatsoever must retain the following
  88  *    acknowledgment:
  89  *    "This product includes software developed by the OpenSSL Project
  90  *    for use in the OpenSSL Toolkit (http://www.openssl.org/)"
  91  *
  92  * THIS SOFTWARE IS PROVIDED BY THE OpenSSL PROJECT ``AS IS'' AND ANY
  93  * EXPRESSED OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
  94  * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
  95  * PURPOSE ARE DISCLAIMED.  IN NO EVENT SHALL THE OpenSSL PROJECT OR
  96  * ITS CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL,
  97  * SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT
  98  * NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES;
  99  * LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION)
 100  * HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT,
 101  * STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE)
 102  * ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED
 103  * OF THE POSSIBILITY OF SUCH DAMAGE.
 104  * ====================================================================
 105  *
 106  * This product includes cryptographic software written by Eric Young
 107  * (eay@cryptsoft.com).  This product includes software written by Tim
 108  * Hudson (tjh@cryptsoft.com).
 109  *
 110  */
 111
 112 #include <stdio.h>
 113 #include <openssl/objects.h>
 114 #include <openssl/evp.h>
 115 #include <openssl/hmac.h>
 116 #include <openssl/ocsp.h>
 117 #include <openssl/rand.h>
 118 #include "ssl_locl.h"
 119
 120 const char tls1_version_str[]="TLSv1" OPENSSL_VERSION_PTEXT;
 121
 122 #ifndef OPENSSL_NO_TLSEXT
 123 static int tls_decrypt_ticket(SSL *s, const unsigned char *tick, int ticklen,
 124                                 const unsigned char *sess_id, int sesslen,
 125                                 SSL_SESSION **psess);
 126 static int ssl_check_clienthello_tlsext_early(SSL *s);
 127 int ssl_check_serverhello_tlsext(SSL *s);
 128 #endif
 129
 130 SSL3_ENC_METHOD TLSv1_enc_data={
 131         tls1_enc,
 132         tls1_mac,
 133         tls1_setup_key_block,
 134         tls1_generate_master_secret,
 135         tls1_change_cipher_state,
 136         tls1_final_finish_mac,
 137         TLS1_FINISH_MAC_LENGTH,
 138         tls1_cert_verify_mac,
 139         TLS_MD_CLIENT_FINISH_CONST,TLS_MD_CLIENT_FINISH_CONST_SIZE,
 140         TLS_MD_SERVER_FINISH_CONST,TLS_MD_SERVER_FINISH_CONST_SIZE,
 141         tls1_alert_code,
 142         tls1_export_keying_material,
 143         0,
 144         SSL3_HM_HEADER_LENGTH,
 145         ssl3_set_handshake_header,
 146         ssl3_handshake_write
 147         };
 148
 149 SSL3_ENC_METHOD TLSv1_1_enc_data={
 150         tls1_enc,
 151         tls1_mac,
 152         tls1_setup_key_block,
 153         tls1_generate_master_secret,
 154         tls1_change_cipher_state,
 155         tls1_final_finish_mac,
 156         TLS1_FINISH_MAC_LENGTH,
 157         tls1_cert_verify_mac,
 158         TLS_MD_CLIENT_FINISH_CONST,TLS_MD_CLIENT_FINISH_CONST_SIZE,
 159         TLS_MD_SERVER_FINISH_CONST,TLS_MD_SERVER_FINISH_CONST_SIZE,
 160         tls1_alert_code,
 161         tls1_export_keying_material,
 162         SSL_ENC_FLAG_EXPLICIT_IV,
 163         SSL3_HM_HEADER_LENGTH,
 164         ssl3_set_handshake_header,
 165         ssl3_handshake_write
 166         };
 167
 168 SSL3_ENC_METHOD TLSv1_2_enc_data={
 169         tls1_enc,
 170         tls1_mac,
 171         tls1_setup_key_block,
 172         tls1_generate_master_secret,
 173         tls1_change_cipher_state,
 174         tls1_final_finish_mac,
 175         TLS1_FINISH_MAC_LENGTH,
 176         tls1_cert_verify_mac,
 177         TLS_MD_CLIENT_FINISH_CONST,TLS_MD_CLIENT_FINISH_CONST_SIZE,
 178         TLS_MD_SERVER_FINISH_CONST,TLS_MD_SERVER_FINISH_CONST_SIZE,
 179         tls1_alert_code,
 180         tls1_export_keying_material,
 181         SSL_ENC_FLAG_EXPLICIT_IV|SSL_ENC_FLAG_SIGALGS|SSL_ENC_FLAG_SHA256_PRF
 182                 |SSL_ENC_FLAG_TLS1_2_CIPHERS,
 183         SSL3_HM_HEADER_LENGTH,
 184         ssl3_set_handshake_header,
 185         ssl3_handshake_write
 186         };
 187
 188 long tls1_default_timeout(void)
 189         {
 190         /* 2 hours, the 24 hours mentioned in the TLSv1 spec
 191          * is way too long for http, the cache would over fill */
 192         return(60*60*2);
 193         }
 194
 195 int tls1_new(SSL *s)
 196         {
 197         if (!ssl3_new(s)) return(0);
 198         s->method->ssl_clear(s);
 199         return(1);
 200         }
 201
 202 void tls1_free(SSL *s)
 203         {
 204 #ifndef OPENSSL_NO_TLSEXT
 205         if (s->tlsext_session_ticket)
 206                 {
 207                 OPENSSL_free(s->tlsext_session_ticket);
 208                 }
 209 #endif /* OPENSSL_NO_TLSEXT */
 210         ssl3_free(s);
 211         }
 212
 213 void tls1_clear(SSL *s)
 214         {
 215         ssl3_clear(s);
 216         s->version = s->method->version;
 217         }
 218
 219 #ifndef OPENSSL_NO_EC
 220
 221 static int nid_list[] =
 222         {
 223                 NID_sect163k1, /* sect163k1 (1) */
 224                 NID_sect163r1, /* sect163r1 (2) */
 225                 NID_sect163r2, /* sect163r2 (3) */
 226                 NID_sect193r1, /* sect193r1 (4) */
 227                 NID_sect193r2, /* sect193r2 (5) */
 228                 NID_sect233k1, /* sect233k1 (6) */
 229                 NID_sect233r1, /* sect233r1 (7) */
 230                 NID_sect239k1, /* sect239k1 (8) */
 231                 NID_sect283k1, /* sect283k1 (9) */
 232                 NID_sect283r1, /* sect283r1 (10) */
 233                 NID_sect409k1, /* sect409k1 (11) */
 234                 NID_sect409r1, /* sect409r1 (12) */
 235                 NID_sect571k1, /* sect571k1 (13) */
 236                 NID_sect571r1, /* sect571r1 (14) */
 237                 NID_secp160k1, /* secp160k1 (15) */
 238                 NID_secp160r1, /* secp160r1 (16) */
 239                 NID_secp160r2, /* secp160r2 (17) */
 240                 NID_secp192k1, /* secp192k1 (18) */
 241                 NID_X9_62_prime192v1, /* secp192r1 (19) */
 242                 NID_secp224k1, /* secp224k1 (20) */
 243                 NID_secp224r1, /* secp224r1 (21) */
 244                 NID_secp256k1, /* secp256k1 (22) */
 245                 NID_X9_62_prime256v1, /* secp256r1 (23) */
 246                 NID_secp384r1, /* secp384r1 (24) */
 247                 NID_secp521r1,  /* secp521r1 (25) */
 248                 NID_brainpoolP256r1,  /* brainpoolP256r1 (26) */
 249                 NID_brainpoolP384r1,  /* brainpoolP384r1 (27) */
 250                 NID_brainpoolP512r1  /* brainpool512r1 (28) */
 251         };
 252
 253
 254 static const unsigned char ecformats_default[] =
 255         {
 256         TLSEXT_ECPOINTFORMAT_uncompressed,
 257         TLSEXT_ECPOINTFORMAT_ansiX962_compressed_prime,
 258         TLSEXT_ECPOINTFORMAT_ansiX962_compressed_char2
 259         };
 260
 261 static const unsigned char eccurves_default[] =
 262         {
 263                 0,14, /* sect571r1 (14) */
 264                 0,13, /* sect571k1 (13) */
 265                 0,25, /* secp521r1 (25) */
 266                 0,28, /* brainpool512r1 (28) */
 267                 0,11, /* sect409k1 (11) */
 268                 0,12, /* sect409r1 (12) */
 269                 0,27, /* brainpoolP384r1 (27) */
 270                 0,24, /* secp384r1 (24) */
 271                 0,9,  /* sect283k1 (9) */
 272                 0,10, /* sect283r1 (10) */
 273                 0,26, /* brainpoolP256r1 (26) */
 274                 0,22, /* secp256k1 (22) */
 275                 0,23, /* secp256r1 (23) */
 276                 0,8,  /* sect239k1 (8) */
 277                 0,6,  /* sect233k1 (6) */
 278                 0,7,  /* sect233r1 (7) */
 279                 0,20, /* secp224k1 (20) */
 280                 0,21, /* secp224r1 (21) */
 281                 0,4,  /* sect193r1 (4) */
 282                 0,5,  /* sect193r2 (5) */
 283                 0,18, /* secp192k1 (18) */
 284                 0,19, /* secp192r1 (19) */
 285                 0,1,  /* sect163k1 (1) */
 286                 0,2,  /* sect163r1 (2) */
 287                 0,3,  /* sect163r2 (3) */
 288                 0,15, /* secp160k1 (15) */
 289                 0,16, /* secp160r1 (16) */
 290                 0,17, /* secp160r2 (17) */
 291         };
 292
 293 static const unsigned char suiteb_curves[] =
 294         {
 295                 0, TLSEXT_curve_P_256,
 296                 0, TLSEXT_curve_P_384
 297         };
 298
 299 int tls1_ec_curve_id2nid(int curve_id)
 300         {
 301         /* ECC curves from draft-ietf-tls-ecc-12.txt (Oct. 17, 2005) */
 302         if ((curve_id < 1) || ((unsigned int)curve_id >
 303                                 sizeof(nid_list)/sizeof(nid_list[0])))
 304                 return 0;
 305         return nid_list[curve_id-1];
 306         }
 307
 308 int tls1_ec_nid2curve_id(int nid)
 309         {
 310         /* ECC curves from draft-ietf-tls-ecc-12.txt (Oct. 17, 2005) */
 311         switch (nid)
 312                 {
 313         case NID_sect163k1: /* sect163k1 (1) */
 314                 return 1;
 315         case NID_sect163r1: /* sect163r1 (2) */
 316                 return 2;
 317         case NID_sect163r2: /* sect163r2 (3) */
 318                 return 3;
 319         case NID_sect193r1: /* sect193r1 (4) */
 320                 return 4;
 321         case NID_sect193r2: /* sect193r2 (5) */
 322                 return 5;
 323         case NID_sect233k1: /* sect233k1 (6) */
 324                 return 6;
 325         case NID_sect233r1: /* sect233r1 (7) */
 326                 return 7;
 327         case NID_sect239k1: /* sect239k1 (8) */
 328                 return 8;
 329         case NID_sect283k1: /* sect283k1 (9) */
 330                 return 9;
 331         case NID_sect283r1: /* sect283r1 (10) */
 332                 return 10;
 333         case NID_sect409k1: /* sect409k1 (11) */
 334                 return 11;
 335         case NID_sect409r1: /* sect409r1 (12) */
 336                 return 12;
 337         case NID_sect571k1: /* sect571k1 (13) */
 338                 return 13;
 339         case NID_sect571r1: /* sect571r1 (14) */
 340                 return 14;
 341         case NID_secp160k1: /* secp160k1 (15) */
 342                 return 15;
 343         case NID_secp160r1: /* secp160r1 (16) */
 344                 return 16;
 345         case NID_secp160r2: /* secp160r2 (17) */
 346                 return 17;
 347         case NID_secp192k1: /* secp192k1 (18) */
 348                 return 18;
 349         case NID_X9_62_prime192v1: /* secp192r1 (19) */
 350                 return 19;
 351         case NID_secp224k1: /* secp224k1 (20) */
 352                 return 20;
 353         case NID_secp224r1: /* secp224r1 (21) */
 354                 return 21;
 355         case NID_secp256k1: /* secp256k1 (22) */
 356                 return 22;
 357         case NID_X9_62_prime256v1: /* secp256r1 (23) */
 358                 return 23;
 359         case NID_secp384r1: /* secp384r1 (24) */
 360                 return 24;
 361         case NID_secp521r1:  /* secp521r1 (25) */
 362                 return 25;
 363         case NID_brainpoolP256r1:  /* brainpoolP256r1 (26) */
 364                 return 26;
 365         case NID_brainpoolP384r1:  /* brainpoolP384r1 (27) */
 366                 return 27;
 367         case NID_brainpoolP512r1:  /* brainpool512r1 (28) */
 368                 return 28;
 369         default:
 370                 return 0;
 371                 }
 372         }
 373 /* Get curves list, if "sess" is set return client curves otherwise
 374  * preferred list
 375  */
 376 static void tls1_get_curvelist(SSL *s, int sess,
 377                                         const unsigned char **pcurves,
 378                                         size_t *pcurveslen)
 379         {
 380         if (sess)
 381                 {
 382                 *pcurves = s->session->tlsext_ellipticcurvelist;
 383                 *pcurveslen = s->session->tlsext_ellipticcurvelist_length;
 384                 return;
 385                 }
 386         /* For Suite B mode only include P-256, P-384 */
 387         switch (tls1_suiteb(s))
 388                 {
 389         case SSL_CERT_FLAG_SUITEB_128_LOS:
 390                 *pcurves = suiteb_curves;
 391                 *pcurveslen = sizeof(suiteb_curves);
 392                 break;
 393
 394         case SSL_CERT_FLAG_SUITEB_128_LOS_ONLY:
 395                 *pcurves = suiteb_curves;
 396                 *pcurveslen = 2;
 397                 break;
 398
 399         case SSL_CERT_FLAG_SUITEB_192_LOS:
 400                 *pcurves = suiteb_curves + 2;
 401                 *pcurveslen = 2;
 402                 break;
 403         default:
 404                 *pcurves = s->tlsext_ellipticcurvelist;
 405                 *pcurveslen = s->tlsext_ellipticcurvelist_length;
 406                 }
 407         if (!*pcurves)
 408                 {
 409                 *pcurves = eccurves_default;
 410                 *pcurveslen = sizeof(eccurves_default);
 411                 }
 412         }
 413 /* Check a curve is one of our preferences */
 414 int tls1_check_curve(SSL *s, const unsigned char *p, size_t len)
 415         {
 416         const unsigned char *curves;
 417         size_t curveslen, i;
 418         unsigned int suiteb_flags = tls1_suiteb(s);
 419         if (len != 3 || p[0] != NAMED_CURVE_TYPE)
 420                 return 0;
 421         /* Check curve matches Suite B preferences */
 422         if (suiteb_flags)
 423                 {
 424                 unsigned long cid = s->s3->tmp.new_cipher->id;
 425                 if (p[1])
 426                         return 0;
 427                 if (cid == TLS1_CK_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256)
 428                         {
 429                         if (p[2] != TLSEXT_curve_P_256)
 430                                 return 0;
 431                         }
 432                 else if (cid == TLS1_CK_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384)
 433                         {
 434                         if (p[2] != TLSEXT_curve_P_384)
 435                                 return 0;
 436                         }
 437                 else    /* Should never happen */
 438                         return 0;
 439                 }
 440         tls1_get_curvelist(s, 0, &curves, &curveslen);
 441         for (i = 0; i < curveslen; i += 2, curves += 2)
 442                 {
 443                 if (p[1] == curves[0] && p[2] == curves[1])
 444                         return 1;
 445                 }
 446         return 0;
 447         }
 448
 449 /* Return nth shared curve. If nmatch == -1 return number of
 450  * matches. For nmatch == -2 return the NID of the curve to use for
 451  * an EC tmp key.
 452  */
 453
 454 int tls1_shared_curve(SSL *s, int nmatch)
 455         {
 456         const unsigned char *pref, *supp;
 457         size_t preflen, supplen, i, j;
 458         int k;
 459         /* Can't do anything on client side */
 460         if (s->server == 0)
 461                 return -1;
 462         if (nmatch == -2)
 463                 {
 464                 if (tls1_suiteb(s))
 465                         {
 466                         /* For Suite B ciphersuite determines curve: we
 467                          * already know these are acceptable due to previous
 468                          * checks.
 469                          */
 470                         unsigned long cid = s->s3->tmp.new_cipher->id;
 471                         if (cid == TLS1_CK_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256)
 472                                 return NID_X9_62_prime256v1; /* P-256 */
 473                         if (cid == TLS1_CK_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384)
 474                                 return NID_secp384r1; /* P-384 */
 475                         /* Should never happen */
 476                         return NID_undef;
 477                         }
 478                 /* If not Suite B just return first preference shared curve */
 479                 nmatch = 0;
 480                 }
 481         tls1_get_curvelist(s, !!(s->options & SSL_OP_CIPHER_SERVER_PREFERENCE),
 482                                 &supp, &supplen);
 483         tls1_get_curvelist(s, !(s->options & SSL_OP_CIPHER_SERVER_PREFERENCE),
 484                                 &pref, &preflen);
 485         preflen /= 2;
 486         supplen /= 2;
 487         k = 0;
 488         for (i = 0; i < preflen; i++, pref+=2)
 489                 {
 490                 const unsigned char *tsupp = supp;
 491                 for (j = 0; j < supplen; j++, tsupp+=2)
 492                         {
 493                         if (pref[0] == tsupp[0] && pref[1] == tsupp[1])
 494                                 {
 495                                 if (nmatch == k)
 496                                         {
 497                                         int id = (pref[0] << 8) | pref[1];
 498                                         return tls1_ec_curve_id2nid(id);
 499                                         }
 500                                 k++;
 501                                 }
 502                         }
 503                 }
 504         if (nmatch == -1)
 505                 return k;
 506         return 0;
 507         }
 508
 509 int tls1_set_curves(unsigned char **pext, size_t *pextlen,
 510                         int *curves, size_t ncurves)
 511         {
 512         unsigned char *clist, *p;
 513         size_t i;
 514         /* Bitmap of curves included to detect duplicates: only works
 515          * while curve ids < 32
 516          */
 517         unsigned long dup_list = 0;
 518         clist = OPENSSL_malloc(ncurves * 2);
 519         if (!clist)
 520                 return 0;
 521         for (i = 0, p = clist; i < ncurves; i++)
 522                 {
 523                 unsigned long idmask;
 524                 int id;
 525                 id = tls1_ec_nid2curve_id(curves[i]);
 526                 idmask = 1L << id;
 527                 if (!id || (dup_list & idmask))
 528                         {
 529                         OPENSSL_free(clist);
 530                         return 0;
 531                         }
 532                 dup_list |= idmask;
 533                 s2n(id, p);
 534                 }
 535         if (*pext)
 536                 OPENSSL_free(*pext);
 537         *pext = clist;
 538         *pextlen = ncurves * 2;
 539         return 1;
 540         }
 541
 542 #define MAX_CURVELIST   25
 543
 544 typedef struct
 545         {
 546         size_t nidcnt;
 547         int nid_arr[MAX_CURVELIST];
 548         } nid_cb_st;
 549
 550 static int nid_cb(const char *elem, int len, void *arg)
 551         {
 552         nid_cb_st *narg = arg;
 553         size_t i;
 554         int nid;
 555         char etmp[20];
 556         if (narg->nidcnt == MAX_CURVELIST)
 557                 return 0;
 558         if (len > (int)(sizeof(etmp) - 1))
 559                 return 0;
 560         memcpy(etmp, elem, len);
 561         etmp[len] = 0;
 562         nid = EC_curve_nist2nid(etmp);
 563         if (nid == NID_undef)
 564                 nid = OBJ_sn2nid(etmp);
 565         if (nid == NID_undef)
 566                 nid = OBJ_ln2nid(etmp);
 567         if (nid == NID_undef)
 568                 return 0;
 569         for (i = 0; i < narg->nidcnt; i++)
 570                 if (narg->nid_arr[i] == nid)
 571                         return 0;
 572         narg->nid_arr[narg->nidcnt++] = nid;
 573         return 1;
 574         }
 575 /* Set curves based on a colon separate list */
 576 int tls1_set_curves_list(unsigned char **pext, size_t *pextlen,
 577                                 const char *str)
 578         {
 579         nid_cb_st ncb;
 580         ncb.nidcnt = 0;
 581         if (!CONF_parse_list(str, ':', 1, nid_cb, &ncb))
 582                 return 0;
 583         if (pext == NULL)
 584                 return 1;
 585         return tls1_set_curves(pext, pextlen, ncb.nid_arr, ncb.nidcnt);
 586         }
 587 /* For an EC key set TLS id and required compression based on parameters */
 588 static int tls1_set_ec_id(unsigned char *curve_id, unsigned char *comp_id,
 589                                 EC_KEY *ec)
 590         {
 591         int is_prime, id;
 592         const EC_GROUP *grp;
 593         const EC_POINT *pt;
 594         const EC_METHOD *meth;
 595         if (!ec)
 596                 return 0;
 597         /* Determine if it is a prime field */
 598         grp = EC_KEY_get0_group(ec);
 599         pt = EC_KEY_get0_public_key(ec);
 600         if (!grp || !pt)
 601                 return 0;
 602         meth = EC_GROUP_method_of(grp);
 603         if (!meth)
 604                 return 0;
 605         if (EC_METHOD_get_field_type(meth) == NID_X9_62_prime_field)
 606                 is_prime = 1;
 607         else
 608                 is_prime = 0;
 609         /* Determine curve ID */
 610         id = EC_GROUP_get_curve_name(grp);
 611         id = tls1_ec_nid2curve_id(id);
 612         /* If we have an ID set it, otherwise set arbitrary explicit curve */
 613         if (id)
 614                 {
 615                 curve_id[0] = 0;
 616                 curve_id[1] = (unsigned char)id;
 617                 }
 618         else
 619                 {
 620                 curve_id[0] = 0xff;
 621                 if (is_prime)
 622                         curve_id[1] = 0x01;
 623                 else
 624                         curve_id[1] = 0x02;
 625                 }
 626         if (comp_id)
 627                 {
 628                 if (EC_KEY_get_conv_form(ec) == POINT_CONVERSION_COMPRESSED)
 629                         {
 630                         if (is_prime)
 631                                 *comp_id = TLSEXT_ECPOINTFORMAT_ansiX962_compressed_prime;
 632                         else
 633                                 *comp_id = TLSEXT_ECPOINTFORMAT_ansiX962_compressed_char2;
 634                         }
 635                 else
 636                         *comp_id = TLSEXT_ECPOINTFORMAT_uncompressed;
 637                 }
 638         return 1;
 639         }
 640 /* Check an EC key is compatible with extensions */
 641 static int tls1_check_ec_key(SSL *s,
 642                         unsigned char *curve_id, unsigned char *comp_id)
 643         {
 644         const unsigned char *p;
 645         size_t plen, i;
 646         int j;
 647         /* If point formats extension present check it, otherwise everything
 648          * is supported (see RFC4492).
 649          */
 650         if (comp_id && s->session->tlsext_ecpointformatlist)
 651                 {
 652                 p = s->session->tlsext_ecpointformatlist;
 653                 plen = s->session->tlsext_ecpointformatlist_length;
 654                 for (i = 0; i < plen; i++, p++)
 655                         {
 656                         if (*comp_id == *p)
 657                                 break;
 658                         }
 659                 if (i == plen)
 660                         return 0;
 661                 }
 662         if (!curve_id)
 663                 return 1;
 664         /* Check curve is consistent with client and server preferences */
 665         for (j = 0; j <= 1; j++)
 666                 {
 667                 tls1_get_curvelist(s, j, &p, &plen);
 668                 for (i = 0; i < plen; i+=2, p+=2)
 669                         {
 670                         if (p[0] == curve_id[0] && p[1] == curve_id[1])
 671                                 break;
 672                         }
 673                 if (i == plen)
 674                         return 0;
 675                 /* For clients can only check sent curve list */
 676                 if (!s->server)
 677                         return 1;
 678                 }
 679         return 1;
 680         }
 681
 682 static void tls1_get_formatlist(SSL *s, const unsigned char **pformats,
 683                                         size_t *pformatslen)
 684         {
 685         /* If we have a custom point format list use it otherwise
 686          * use default */
 687         if (s->tlsext_ecpointformatlist)
 688                 {
 689                 *pformats = s->tlsext_ecpointformatlist;
 690                 *pformatslen = s->tlsext_ecpointformatlist_length;
 691                 }
 692         else
 693                 {
 694                 *pformats = ecformats_default;
 695                 /* For Suite B we don't support char2 fields */
 696                 if (tls1_suiteb(s))
 697                         *pformatslen = sizeof(ecformats_default) - 1;
 698                 else
 699                         *pformatslen = sizeof(ecformats_default);
 700                 }
 701         }
 702
 703 /* Check cert parameters compatible with extensions: currently just checks
 704  * EC certificates have compatible curves and compression.
 705  */
 706 static int tls1_check_cert_param(SSL *s, X509 *x, int set_ee_md)
 707         {
 708         unsigned char comp_id, curve_id[2];
 709         EVP_PKEY *pkey;
 710         int rv;
 711         pkey = X509_get_pubkey(x);
 712         if (!pkey)
 713                 return 0;
 714         /* If not EC nothing to do */
 715         if (pkey->type != EVP_PKEY_EC)
 716                 {
 717                 EVP_PKEY_free(pkey);
 718                 return 1;
 719                 }
 720         rv = tls1_set_ec_id(curve_id, &comp_id, pkey->pkey.ec);
 721         EVP_PKEY_free(pkey);
 722         if (!rv)
 723                 return 0;
 724         /* Can't check curve_id for client certs as we don't have a
 725          * supported curves extension.
 726          */
 727         rv = tls1_check_ec_key(s, s->server ? curve_id : NULL, &comp_id);
 728         if (!rv)
 729                 return 0;
 730         /* Special case for suite B. We *MUST* sign using SHA256+P-256 or
 731          * SHA384+P-384, adjust digest if necessary.
 732          */
 733         if (set_ee_md && tls1_suiteb(s))
 734                 {
 735                 int check_md;
 736                 size_t i;
 737                 CERT *c = s->cert;
 738                 if (curve_id[0])
 739                         return 0;
 740                 /* Check to see we have necessary signing algorithm */
 741                 if (curve_id[1] == TLSEXT_curve_P_256)
 742                         check_md = NID_ecdsa_with_SHA256;
 743                 else if (curve_id[1] == TLSEXT_curve_P_384)
 744                         check_md = NID_ecdsa_with_SHA384;
 745                 else
 746                         return 0; /* Should never happen */
 747                 for (i = 0; i < c->shared_sigalgslen; i++)
 748                         if (check_md == c->shared_sigalgs[i].signandhash_nid)
 749                                 break;
 750                 if (i == c->shared_sigalgslen)
 751                         return 0;
 752                 if (set_ee_md == 2)
 753                         {
 754                         if (check_md == NID_ecdsa_with_SHA256)
 755                                 c->pkeys[SSL_PKEY_ECC].digest = EVP_sha256();
 756                         else
 757                                 c->pkeys[SSL_PKEY_ECC].digest = EVP_sha384();
 758                         }
 759                 }
 760         return rv;
 761         }
 762 /* Check EC temporary key is compatible with client extensions */
 763 int tls1_check_ec_tmp_key(SSL *s, unsigned long cid)
 764         {
 765         unsigned char curve_id[2];
 766         EC_KEY *ec = s->cert->ecdh_tmp;
 767 #ifdef OPENSSL_SSL_DEBUG_BROKEN_PROTOCOL
 768         /* Allow any curve: not just those peer supports */
 769         if (s->cert->cert_flags & SSL_CERT_FLAG_BROKEN_PROTOCOL)
 770                 return 1;
 771 #endif
 772         /* If Suite B, AES128 MUST use P-256 and AES256 MUST use P-384,
 773          * no other curves permitted.
 774          */
 775         if (tls1_suiteb(s))
 776                 {
 777                 /* Curve to check determined by ciphersuite */
 778                 if (cid == TLS1_CK_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256)
 779                         curve_id[1] = TLSEXT_curve_P_256;
 780                 else if (cid == TLS1_CK_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384)
 781                         curve_id[1] = TLSEXT_curve_P_384;
 782                 else
 783                         return 0;
 784                 curve_id[0] = 0;
 785                 /* Check this curve is acceptable */
 786                 if (!tls1_check_ec_key(s, curve_id, NULL))
 787                         return 0;
 788                 /* If auto or setting curve from callback assume OK */
 789                 if (s->cert->ecdh_tmp_auto || s->cert->ecdh_tmp_cb)
 790                         return 1;
 791                 /* Otherwise check curve is acceptable */
 792                 else
 793                         {
 794                         unsigned char curve_tmp[2];
 795                         if (!ec)
 796                                 return 0;
 797                         if (!tls1_set_ec_id(curve_tmp, NULL, ec))
 798                                 return 0;
 799                         if (!curve_tmp[0] || curve_tmp[1] == curve_id[1])
 800                                 return 1;
 801                         return 0;
 802                         }
 803
 804                 }
 805         if (s->cert->ecdh_tmp_auto)
 806                 {
 807                 /* Need a shared curve */
 808                 if (tls1_shared_curve(s, 0))
 809                         return 1;
 810                 else return 0;
 811                 }
 812         if (!ec)
 813                 {
 814                 if (s->cert->ecdh_tmp_cb)
 815                         return 1;
 816                 else
 817                         return 0;
 818                 }
 819         if (!tls1_set_ec_id(curve_id, NULL, ec))
 820                 return 0;
 821 /* Set this to allow use of invalid curves for testing */
 822 #if 0
 823         return 1;
 824 #else
 825         return tls1_check_ec_key(s, curve_id, NULL);
 826 #endif
 827         }
 828
 829 #else
 830
 831 static int tls1_check_cert_param(SSL *s, X509 *x, int set_ee_md)
 832         {
 833         return 1;
 834         }
 835
 836 #endif /* OPENSSL_NO_EC */
 837
 838 #ifndef OPENSSL_NO_TLSEXT
 839
 840 /* List of supported signature algorithms and hashes. Should make this
 841  * customisable at some point, for now include everything we support.
 842  */
 843
 844 #ifdef OPENSSL_NO_RSA
 845 #define tlsext_sigalg_rsa(md) /* */
 846 #else
 847 #define tlsext_sigalg_rsa(md) md, TLSEXT_signature_rsa,
 848 #endif
 849
 850 #ifdef OPENSSL_NO_DSA
 851 #define tlsext_sigalg_dsa(md) /* */
 852 #else
 853 #define tlsext_sigalg_dsa(md) md, TLSEXT_signature_dsa,
 854 #endif
 855
 856 #ifdef OPENSSL_NO_ECDSA
 857 #define tlsext_sigalg_ecdsa(md) /* */
 858 #else
 859 #define tlsext_sigalg_ecdsa(md) md, TLSEXT_signature_ecdsa,
 860 #endif
 861
 862 #define tlsext_sigalg(md) \
 863                 tlsext_sigalg_rsa(md) \
 864                 tlsext_sigalg_dsa(md) \
 865                 tlsext_sigalg_ecdsa(md)
 866
 867 static unsigned char tls12_sigalgs[] = {
 868 #ifndef OPENSSL_NO_SHA512
 869         tlsext_sigalg(TLSEXT_hash_sha512)
 870         tlsext_sigalg(TLSEXT_hash_sha384)
 871 #endif
 872 #ifndef OPENSSL_NO_SHA256
 873         tlsext_sigalg(TLSEXT_hash_sha256)
 874         tlsext_sigalg(TLSEXT_hash_sha224)
 875 #endif
 876 #ifndef OPENSSL_NO_SHA
 877         tlsext_sigalg(TLSEXT_hash_sha1)
 878 #endif
 879 #ifndef OPENSSL_NO_MD5
 880         tlsext_sigalg_rsa(TLSEXT_hash_md5)
 881 #endif
 882 };
 883 #ifndef OPENSSL_NO_ECDSA
 884 static unsigned char suiteb_sigalgs[] = {
 885         tlsext_sigalg_ecdsa(TLSEXT_hash_sha256)
 886         tlsext_sigalg_ecdsa(TLSEXT_hash_sha384)
 887 };
 888 #endif
 889 size_t tls12_get_psigalgs(SSL *s, const unsigned char **psigs)
 890         {
 891         /* If Suite B mode use Suite B sigalgs only, ignore any other
 892          * preferences.
 893          */
 894 #ifndef OPENSSL_NO_EC
 895         switch (tls1_suiteb(s))
 896                 {
 897         case SSL_CERT_FLAG_SUITEB_128_LOS:
 898                 *psigs = suiteb_sigalgs;
 899                 return sizeof(suiteb_sigalgs);
 900
 901         case SSL_CERT_FLAG_SUITEB_128_LOS_ONLY:
 902                 *psigs = suiteb_sigalgs;
 903                 return 2;
 904
 905         case SSL_CERT_FLAG_SUITEB_192_LOS:
 906                 *psigs = suiteb_sigalgs + 2;
 907                 return 2;
 908                 }
 909 #endif
 910         /* If server use client authentication sigalgs if not NULL */
 911         if (s->server && s->cert->client_sigalgs)
 912                 {
 913                 *psigs = s->cert->client_sigalgs;
 914                 return s->cert->client_sigalgslen;
 915                 }
 916         else if (s->cert->conf_sigalgs)
 917                 {
 918                 *psigs = s->cert->conf_sigalgs;
 919                 return s->cert->conf_sigalgslen;
 920                 }
 921         else
 922                 {
 923                 *psigs = tls12_sigalgs;
 924 #ifdef OPENSSL_FIPS
 925                 /* If FIPS mode don't include MD5 which is last */
 926                 if (FIPS_mode())
 927                         return sizeof(tls12_sigalgs) - 2;
 928                 else
 929 #endif
 930                         return sizeof(tls12_sigalgs);
 931                 }
 932         }
 933 /* Check signature algorithm is consistent with sent supported signature
 934  * algorithms and if so return relevant digest.
 935  */
 936 int tls12_check_peer_sigalg(const EVP_MD **pmd, SSL *s,
 937                                 const unsigned char *sig, EVP_PKEY *pkey)
 938         {
 939         const unsigned char *sent_sigs;
 940         size_t sent_sigslen, i;
 941         int sigalg = tls12_get_sigid(pkey);
 942         /* Should never happen */
 943         if (sigalg == -1)
 944                 return -1;
 945         /* Check key type is consistent with signature */
 946         if (sigalg != (int)sig[1])
 947                 {
 948                 SSLerr(SSL_F_TLS12_CHECK_PEER_SIGALG,SSL_R_WRONG_SIGNATURE_TYPE);
 949                 return 0;
 950                 }
 951 #ifndef OPENSSL_NO_EC
 952         if (pkey->type == EVP_PKEY_EC)
 953                 {
 954                 unsigned char curve_id[2], comp_id;
 955                 /* Check compression and curve matches extensions */
 956                 if (!tls1_set_ec_id(curve_id, &comp_id, pkey->pkey.ec))
 957                         return 0;
 958                 if (!s->server && !tls1_check_ec_key(s, curve_id, &comp_id))
 959                         {
 960                         SSLerr(SSL_F_TLS12_CHECK_PEER_SIGALG,SSL_R_WRONG_CURVE);
 961                         return 0;
 962                         }
 963                 /* If Suite B only P-384+SHA384 or P-256+SHA-256 allowed */
 964                 if (tls1_suiteb(s))
 965                         {
 966                         if (curve_id[0])
 967                                 return 0;
 968                         if (curve_id[1] == TLSEXT_curve_P_256)
 969                                 {
 970                                 if (sig[0] != TLSEXT_hash_sha256)
 971                                         {
 972                                         SSLerr(SSL_F_TLS12_CHECK_PEER_SIGALG,
 973                                                 SSL_R_ILLEGAL_SUITEB_DIGEST);
 974                                         return 0;
 975                                         }
 976                                 }
 977                         else if (curve_id[1] == TLSEXT_curve_P_384)
 978                                 {
 979                                 if (sig[0] != TLSEXT_hash_sha384)
 980                                         {
 981                                         SSLerr(SSL_F_TLS12_CHECK_PEER_SIGALG,
 982                                                 SSL_R_ILLEGAL_SUITEB_DIGEST);
 983                                         return 0;
 984                                         }
 985                                 }
 986                         else
 987                                 return 0;
 988                         }
 989                 }
 990         else if (tls1_suiteb(s))
 991                 return 0;
 992 #endif
 993
 994         /* Check signature matches a type we sent */
 995         sent_sigslen = tls12_get_psigalgs(s, &sent_sigs);
 996         for (i = 0; i < sent_sigslen; i+=2, sent_sigs+=2)
 997                 {
 998                 if (sig[0] == sent_sigs[0] && sig[1] == sent_sigs[1])
 999                         break;
1000                 }
1001         /* Allow fallback to SHA1 if not strict mode */
1002         if (i == sent_sigslen && (sig[0] != TLSEXT_hash_sha1 || s->cert->cert_flags & SSL_CERT_FLAGS_CHECK_TLS_STRICT))
1003                 {
1004                 SSLerr(SSL_F_TLS12_CHECK_PEER_SIGALG,SSL_R_WRONG_SIGNATURE_TYPE);
1005                 return 0;
1006                 }
1007         *pmd = tls12_get_hash(sig[0]);
1008         if (*pmd == NULL)
1009                 {
1010                 SSLerr(SSL_F_TLS12_CHECK_PEER_SIGALG,SSL_R_UNKNOWN_DIGEST);
1011                 return 0;
1012                 }
1013         /* Store the digest used so applications can retrieve it if they
1014          * wish.
1015          */
1016         if (s->session && s->session->sess_cert)
1017                 s->session->sess_cert->peer_key->digest = *pmd;
1018         return 1;
1019         }
1020 /* Get a mask of disabled algorithms: an algorithm is disabled
1021  * if it isn't supported or doesn't appear in supported signature
1022  * algorithms. Unlike ssl_cipher_get_disabled this applies to a specific
1023  * session and not global settings.
1024  *
1025  */
1026 void ssl_set_client_disabled(SSL *s)
1027         {
1028         CERT *c = s->cert;
1029         const unsigned char *sigalgs;
1030         size_t i, sigalgslen;
1031         int have_rsa = 0, have_dsa = 0, have_ecdsa = 0;
1032         c->mask_a = 0;
1033         c->mask_k = 0;
1034         /* Don't allow TLS 1.2 only ciphers if we don't suppport them */
1035         if (!SSL_CLIENT_USE_TLS1_2_CIPHERS(s))
1036                 c->mask_ssl = SSL_TLSV1_2;
1037         else
1038                 c->mask_ssl = 0;
1039         /* Now go through all signature algorithms seeing if we support
1040          * any for RSA, DSA, ECDSA. Do this for all versions not just
1041          * TLS 1.2.
1042          */
1043         sigalgslen = tls12_get_psigalgs(s, &sigalgs);
1044         for (i = 0; i < sigalgslen; i += 2, sigalgs += 2)
1045                 {
1046                 switch(sigalgs[1])
1047                         {
1048 #ifndef OPENSSL_NO_RSA
1049                 case TLSEXT_signature_rsa:
1050                         have_rsa = 1;
1051                         break;
1052 #endif
1053 #ifndef OPENSSL_NO_DSA
1054                 case TLSEXT_signature_dsa:
1055                         have_dsa = 1;
1056                         break;
1057 #endif
1058 #ifndef OPENSSL_NO_ECDSA
1059                 case TLSEXT_signature_ecdsa:
1060                         have_ecdsa = 1;
1061                         break;
1062 #endif
1063                         }
1064                 }
1065         /* Disable auth and static DH if we don't include any appropriate
1066          * signature algorithms.
1067          */
1068         if (!have_rsa)
1069                 {
1070                 c->mask_a |= SSL_aRSA;
1071                 c->mask_k |= SSL_kDHr|SSL_kECDHr;
1072                 }
1073         if (!have_dsa)
1074                 {
1075                 c->mask_a |= SSL_aDSS;
1076                 c->mask_k |= SSL_kDHd;
1077                 }
1078         if (!have_ecdsa)
1079                 {
1080                 c->mask_a |= SSL_aECDSA;
1081                 c->mask_k |= SSL_kECDHe;
1082                 }
1083 #ifndef OPENSSL_NO_KRB5
1084         if (!kssl_tgt_is_available(s->kssl_ctx))
1085                 {
1086                 c->mask_a |= SSL_aKRB5;
1087                 c->mask_k |= SSL_kKRB5;
1088                 }
1089 #endif
1090 #ifndef OPENSSL_NO_PSK
1091         /* with PSK there must be client callback set */
1092         if (!s->psk_client_callback)
1093                 {
1094                 c->mask_a |= SSL_aPSK;
1095                 c->mask_k |= SSL_kPSK;
1096                 }
1097 #endif /* OPENSSL_NO_PSK */
1098         c->valid = 1;
1099         }
1100
1101 unsigned char *ssl_add_clienthello_tlsext(SSL *s, unsigned char *p, unsigned char *limit)
1102         {
1103         int extdatalen=0;
1104         unsigned char *ret = p;
1105 #ifndef OPENSSL_NO_EC
1106         /* See if we support any ECC ciphersuites */
1107         int using_ecc = 0;
1108         if (s->version >= TLS1_VERSION || SSL_IS_DTLS(s))
1109                 {
1110                 int i;
1111                 unsigned long alg_k, alg_a;
1112                 STACK_OF(SSL_CIPHER) *cipher_stack = SSL_get_ciphers(s);
1113
1114                 for (i = 0; i < sk_SSL_CIPHER_num(cipher_stack); i++)
1115                         {
1116                         SSL_CIPHER *c = sk_SSL_CIPHER_value(cipher_stack, i);
1117
1118                         alg_k = c->algorithm_mkey;
1119                         alg_a = c->algorithm_auth;
1120                         if ((alg_k & (SSL_kEECDH|SSL_kECDHr|SSL_kECDHe)
1121                                 || (alg_a & SSL_aECDSA)))
1122                                 {
1123                                 using_ecc = 1;
1124                                 break;
1125                                 }
1126                         }
1127                 }
1128 #endif
1129
1130         /* don't add extensions for SSLv3 unless doing secure renegotiation */
1131         if (s->client_version == SSL3_VERSION
1132                                         && !s->s3->send_connection_binding)
1133                 return p;
1134
1135         ret+=2;
1136
1137         if (ret>=limit) return NULL; /* this really never occurs, but ... */
1138
1139         if (s->tlsext_hostname != NULL)
1140                 {
1141                 /* Add TLS extension servername to the Client Hello message */
1142                 unsigned long size_str;
1143                 long lenmax;
1144
1145                 /* check for enough space.
1146                    4 for the servername type and entension length
1147                    2 for servernamelist length
1148                    1 for the hostname type
1149                    2 for hostname length
1150                    + hostname length
1151                 */
1152
1153                 if ((lenmax = limit - ret - 9) < 0
1154                     || (size_str = strlen(s->tlsext_hostname)) > (unsigned long)lenmax)
1155                         return NULL;
1156
1157                 /* extension type and length */
1158                 s2n(TLSEXT_TYPE_server_name,ret);
1159                 s2n(size_str+5,ret);
1160
1161                 /* length of servername list */
1162                 s2n(size_str+3,ret);
1163
1164                 /* hostname type, length and hostname */
1165                 *(ret++) = (unsigned char) TLSEXT_NAMETYPE_host_name;
1166                 s2n(size_str,ret);
1167                 memcpy(ret, s->tlsext_hostname, size_str);
1168                 ret+=size_str;
1169                 }
1170
1171         /* Add RI if renegotiating */
1172         if (s->renegotiate)
1173           {
1174           int el;
1175
1176           if(!ssl_add_clienthello_renegotiate_ext(s, 0, &el, 0))
1177               {
1178               SSLerr(SSL_F_SSL_ADD_CLIENTHELLO_TLSEXT, ERR_R_INTERNAL_ERROR);
1179               return NULL;
1180               }
1181
1182           if((limit - p - 4 - el) < 0) return NULL;
1183
1184           s2n(TLSEXT_TYPE_renegotiate,ret);
1185           s2n(el,ret);
1186
1187           if(!ssl_add_clienthello_renegotiate_ext(s, ret, &el, el))
1188               {
1189               SSLerr(SSL_F_SSL_ADD_CLIENTHELLO_TLSEXT, ERR_R_INTERNAL_ERROR);
1190               return NULL;
1191               }
1192
1193           ret += el;
1194         }
1195
1196 #ifndef OPENSSL_NO_SRP
1197         /* Add SRP username if there is one */
1198         if (s->srp_ctx.login != NULL)
1199                 { /* Add TLS extension SRP username to the Client Hello message */
1200
1201                 int login_len = strlen(s->srp_ctx.login);
1202                 if (login_len > 255 || login_len == 0)
1203                         {
1204                         SSLerr(SSL_F_SSL_ADD_CLIENTHELLO_TLSEXT, ERR_R_INTERNAL_ERROR);
1205                         return NULL;
1206                         }
1207
1208                 /* check for enough space.
1209                    4 for the srp type type and entension length
1210                    1 for the srp user identity
1211                    + srp user identity length
1212                 */
1213                 if ((limit - ret - 5 - login_len) < 0) return NULL;
1214
1215                 /* fill in the extension */
1216                 s2n(TLSEXT_TYPE_srp,ret);
1217                 s2n(login_len+1,ret);
1218                 (*ret++) = (unsigned char) login_len;
1219                 memcpy(ret, s->srp_ctx.login, login_len);
1220                 ret+=login_len;
1221                 }
1222 #endif
1223
1224 #ifndef OPENSSL_NO_EC
1225         if (using_ecc)
1226                 {
1227                 /* Add TLS extension ECPointFormats to the ClientHello message */
1228                 long lenmax;
1229                 const unsigned char *plist;
1230                 size_t plistlen;
1231
1232                 tls1_get_formatlist(s, &plist, &plistlen);
1233
1234                 if ((lenmax = limit - ret - 5) < 0) return NULL;
1235                 if (plistlen > (size_t)lenmax) return NULL;
1236                 if (plistlen > 255)
1237                         {
1238                         SSLerr(SSL_F_SSL_ADD_CLIENTHELLO_TLSEXT, ERR_R_INTERNAL_ERROR);
1239                         return NULL;
1240                         }
1241
1242                 s2n(TLSEXT_TYPE_ec_point_formats,ret);
1243                 s2n(plistlen + 1,ret);
1244                 *(ret++) = (unsigned char)plistlen ;
1245                 memcpy(ret, plist, plistlen);
1246                 ret+=plistlen;
1247
1248                 /* Add TLS extension EllipticCurves to the ClientHello message */
1249                 plist = s->tlsext_ellipticcurvelist;
1250                 tls1_get_curvelist(s, 0, &plist, &plistlen);
1251
1252                 if ((lenmax = limit - ret - 6) < 0) return NULL;
1253                 if (plistlen > (size_t)lenmax) return NULL;
1254                 if (plistlen > 65532)
1255                         {
1256                         SSLerr(SSL_F_SSL_ADD_CLIENTHELLO_TLSEXT, ERR_R_INTERNAL_ERROR);
1257                         return NULL;
1258                         }
1259
1260                 s2n(TLSEXT_TYPE_elliptic_curves,ret);
1261                 s2n(plistlen + 2, ret);
1262
1263                 /* NB: draft-ietf-tls-ecc-12.txt uses a one-byte prefix for
1264                  * elliptic_curve_list, but the examples use two bytes.
1265                  * http://www1.ietf.org/mail-archive/web/tls/current/msg00538.html
1266                  * resolves this to two bytes.
1267                  */
1268                 s2n(plistlen, ret);
1269                 memcpy(ret, plist, plistlen);
1270                 ret+=plistlen;
1271                 }
1272 #endif /* OPENSSL_NO_EC */
1273
1274         if (!(SSL_get_options(s) & SSL_OP_NO_TICKET))
1275                 {
1276                 int ticklen;
1277                 if (!s->new_session && s->session && s->session->tlsext_tick)
1278                         ticklen = s->session->tlsext_ticklen;
1279                 else if (s->session && s->tlsext_session_ticket &&
1280                          s->tlsext_session_ticket->data)
1281                         {
1282                         ticklen = s->tlsext_session_ticket->length;
1283                         s->session->tlsext_tick = OPENSSL_malloc(ticklen);
1284                         if (!s->session->tlsext_tick)
1285                                 return NULL;
1286                         memcpy(s->session->tlsext_tick,
1287                                s->tlsext_session_ticket->data,
1288                                ticklen);
1289                         s->session->tlsext_ticklen = ticklen;
1290                         }
1291                 else
1292                         ticklen = 0;
1293                 if (ticklen == 0 && s->tlsext_session_ticket &&
1294                     s->tlsext_session_ticket->data == NULL)
1295                         goto skip_ext;
1296                 /* Check for enough room 2 for extension type, 2 for len
1297                  * rest for ticket
1298                  */
1299                 if ((long)(limit - ret - 4 - ticklen) < 0) return NULL;
1300                 s2n(TLSEXT_TYPE_session_ticket,ret);
1301                 s2n(ticklen,ret);
1302                 if (ticklen)
1303                         {
1304                         memcpy(ret, s->session->tlsext_tick, ticklen);
1305                         ret += ticklen;
1306                         }
1307                 }
1308                 skip_ext:
1309
1310         if (SSL_USE_SIGALGS(s))
1311                 {
1312                 size_t salglen;
1313                 const unsigned char *salg;
1314                 salglen = tls12_get_psigalgs(s, &salg);
1315                 if ((size_t)(limit - ret) < salglen + 6)
1316                         return NULL;
1317                 s2n(TLSEXT_TYPE_signature_algorithms,ret);
1318                 s2n(salglen + 2, ret);
1319                 s2n(salglen, ret);
1320                 memcpy(ret, salg, salglen);
1321                 ret += salglen;
1322                 }
1323
1324 #ifdef TLSEXT_TYPE_opaque_prf_input
1325         if (s->s3->client_opaque_prf_input != NULL)
1326                 {
1327                 size_t col = s->s3->client_opaque_prf_input_len;
1328
1329                 if ((long)(limit - ret - 6 - col < 0))
1330                         return NULL;
1331                 if (col > 0xFFFD) /* can't happen */
1332                         return NULL;
1333
1334                 s2n(TLSEXT_TYPE_opaque_prf_input, ret);
1335                 s2n(col + 2, ret);
1336                 s2n(col, ret);
1337                 memcpy(ret, s->s3->client_opaque_prf_input, col);
1338                 ret += col;
1339                 }
1340 #endif
1341
1342         if (s->tlsext_status_type == TLSEXT_STATUSTYPE_ocsp)
1343                 {
1344                 int i;
1345                 long extlen, idlen, itmp;
1346                 OCSP_RESPID *id;
1347
1348                 idlen = 0;
1349                 for (i = 0; i < sk_OCSP_RESPID_num(s->tlsext_ocsp_ids); i++)
1350                         {
1351                         id = sk_OCSP_RESPID_value(s->tlsext_ocsp_ids, i);
1352                         itmp = i2d_OCSP_RESPID(id, NULL);
1353                         if (itmp <= 0)
1354                                 return NULL;
1355                         idlen += itmp + 2;
1356                         }
1357
1358                 if (s->tlsext_ocsp_exts)
1359                         {
1360                         extlen = i2d_X509_EXTENSIONS(s->tlsext_ocsp_exts, NULL);
1361                         if (extlen < 0)
1362                                 return NULL;
1363                         }
1364                 else
1365                         extlen = 0;
1366
1367                 if ((long)(limit - ret - 7 - extlen - idlen) < 0) return NULL;
1368                 s2n(TLSEXT_TYPE_status_request, ret);
1369                 if (extlen + idlen > 0xFFF0)
1370                         return NULL;
1371                 s2n(extlen + idlen + 5, ret);
1372                 *(ret++) = TLSEXT_STATUSTYPE_ocsp;
1373                 s2n(idlen, ret);
1374                 for (i = 0; i < sk_OCSP_RESPID_num(s->tlsext_ocsp_ids); i++)
1375                         {
1376                         /* save position of id len */
1377                         unsigned char *q = ret;
1378                         id = sk_OCSP_RESPID_value(s->tlsext_ocsp_ids, i);
1379                         /* skip over id len */
1380                         ret += 2;
1381                         itmp = i2d_OCSP_RESPID(id, &ret);
1382                         /* write id len */
1383                         s2n(itmp, q);
1384                         }
1385                 s2n(extlen, ret);
1386                 if (extlen > 0)
1387                         i2d_X509_EXTENSIONS(s->tlsext_ocsp_exts, &ret);
1388                 }
1389
1390 #ifndef OPENSSL_NO_HEARTBEATS
1391         /* Add Heartbeat extension */
1392         s2n(TLSEXT_TYPE_heartbeat,ret);
1393         s2n(1,ret);
1394         /* Set mode:
1395          * 1: peer may send requests
1396          * 2: peer not allowed to send requests
1397          */
1398         if (s->tlsext_heartbeat & SSL_TLSEXT_HB_DONT_RECV_REQUESTS)
1399                 *(ret++) = SSL_TLSEXT_HB_DONT_SEND_REQUESTS;
1400         else
1401                 *(ret++) = SSL_TLSEXT_HB_ENABLED;
1402 #endif
1403
1404 #ifndef OPENSSL_NO_NEXTPROTONEG
1405         if (s->ctx->next_proto_select_cb && !s->s3->tmp.finish_md_len)
1406                 {
1407                 /* The client advertises an emtpy extension to indicate its
1408                  * support for Next Protocol Negotiation */
1409                 if (limit - ret - 4 < 0)
1410                         return NULL;
1411                 s2n(TLSEXT_TYPE_next_proto_neg,ret);
1412                 s2n(0,ret);
1413                 }
1414 #endif
1415
1416         if (s->alpn_client_proto_list && !s->s3->tmp.finish_md_len)
1417                 {
1418                 if ((size_t)(limit - ret) < 6 + s->alpn_client_proto_list_len)
1419                         return NULL;
1420                 s2n(TLSEXT_TYPE_application_layer_protocol_negotiation,ret);
1421                 s2n(2 + s->alpn_client_proto_list_len,ret);
1422                 s2n(s->alpn_client_proto_list_len,ret);
1423                 memcpy(ret, s->alpn_client_proto_list,
1424                        s->alpn_client_proto_list_len);
1425                 ret += s->alpn_client_proto_list_len;
1426                 }
1427
1428         if(SSL_get_srtp_profiles(s))
1429                 {
1430                 int el;
1431
1432                 ssl_add_clienthello_use_srtp_ext(s, 0, &el, 0);
1433
1434                 if((limit - p - 4 - el) < 0) return NULL;
1435
1436                 s2n(TLSEXT_TYPE_use_srtp,ret);
1437                 s2n(el,ret);
1438
1439                 if(ssl_add_clienthello_use_srtp_ext(s, ret, &el, el))
1440                         {
1441                         SSLerr(SSL_F_SSL_ADD_CLIENTHELLO_TLSEXT, ERR_R_INTERNAL_ERROR);
1442                         return NULL;
1443                         }
1444                 ret += el;
1445                 }
1446
1447         /* Add custom TLS Extensions to ClientHello */
1448         if (s->ctx->custom_cli_ext_records_count)
1449                 {
1450                 size_t i;
1451                 custom_cli_ext_record* record;
1452
1453                 for (i = 0; i < s->ctx->custom_cli_ext_records_count; i++)
1454                         {
1455                         const unsigned char* out = NULL;
1456                         unsigned short outlen = 0;
1457
1458                         record = &s->ctx->custom_cli_ext_records[i];
1459                         /* NULL callback sends empty extension */
1460                         /* -1 from callback omits extension */
1461                         if (record->fn1)
1462                                 {
1463                                 int cb_retval = 0;
1464                                 cb_retval = record->fn1(s, record->ext_type,
1465                                                         &out, &outlen,
1466                                                         record->arg);
1467                                 if (cb_retval == 0)
1468                                         return NULL; /* error */
1469                                 if (cb_retval == -1)
1470                                         continue; /* skip this extension */
1471                                 }
1472                         if (limit < ret + 4 + outlen)
1473                                 return NULL;
1474                         s2n(record->ext_type, ret);
1475                         s2n(outlen, ret);
1476                         memcpy(ret, out, outlen);
1477                         ret += outlen;
1478                         }
1479                 }
1480 #ifdef TLSEXT_TYPE_encrypt_then_mac
1481         s2n(TLSEXT_TYPE_encrypt_then_mac,ret);
1482         s2n(0,ret);
1483 #endif
1484
1485         if ((extdatalen = ret-p-2) == 0)
1486                 return p;
1487
1488         s2n(extdatalen,p);
1489         return ret;
1490         }
1491
1492 unsigned char *ssl_add_serverhello_tlsext(SSL *s, unsigned char *p, unsigned char *limit)
1493         {
1494         int extdatalen=0;
1495         unsigned char *ret = p;
1496 #ifndef OPENSSL_NO_NEXTPROTONEG
1497         int next_proto_neg_seen;
1498 #endif
1499 #ifndef OPENSSL_NO_EC
1500         unsigned long alg_k = s->s3->tmp.new_cipher->algorithm_mkey;
1501         unsigned long alg_a = s->s3->tmp.new_cipher->algorithm_auth;
1502         int using_ecc = (alg_k & (SSL_kEECDH|SSL_kECDHr|SSL_kECDHe)) || (alg_a & SSL_aECDSA);
1503         using_ecc = using_ecc && (s->session->tlsext_ecpointformatlist != NULL);
1504 #endif
1505         /* don't add extensions for SSLv3, unless doing secure renegotiation */
1506         if (s->version == SSL3_VERSION && !s->s3->send_connection_binding)
1507                 return p;
1508
1509         ret+=2;
1510         if (ret>=limit) return NULL; /* this really never occurs, but ... */
1511
1512         if (!s->hit && s->servername_done == 1 && s->session->tlsext_hostname != NULL)
1513                 {
1514                 if ((long)(limit - ret - 4) < 0) return NULL;
1515
1516                 s2n(TLSEXT_TYPE_server_name,ret);
1517                 s2n(0,ret);
1518                 }
1519
1520         if(s->s3->send_connection_binding)
1521         {
1522           int el;
1523
1524           if(!ssl_add_serverhello_renegotiate_ext(s, 0, &el, 0))
1525               {
1526               SSLerr(SSL_F_SSL_ADD_SERVERHELLO_TLSEXT, ERR_R_INTERNAL_ERROR);
1527               return NULL;
1528               }
1529
1530           if((limit - p - 4 - el) < 0) return NULL;
1531
1532           s2n(TLSEXT_TYPE_renegotiate,ret);
1533           s2n(el,ret);
1534
1535           if(!ssl_add_serverhello_renegotiate_ext(s, ret, &el, el))
1536               {
1537               SSLerr(SSL_F_SSL_ADD_SERVERHELLO_TLSEXT, ERR_R_INTERNAL_ERROR);
1538               return NULL;
1539               }
1540
1541           ret += el;
1542         }
1543
1544 #ifndef OPENSSL_NO_EC
1545         if (using_ecc)
1546                 {
1547                 const unsigned char *plist;
1548                 size_t plistlen;
1549                 /* Add TLS extension ECPointFormats to the ServerHello message */
1550                 long lenmax;
1551
1552                 tls1_get_formatlist(s, &plist, &plistlen);
1553
1554                 if ((lenmax = limit - ret - 5) < 0) return NULL;
1555                 if (plistlen > (size_t)lenmax) return NULL;
1556                 if (plistlen > 255)
1557                         {
1558                         SSLerr(SSL_F_SSL_ADD_SERVERHELLO_TLSEXT, ERR_R_INTERNAL_ERROR);
1559                         return NULL;
1560                         }
1561
1562                 s2n(TLSEXT_TYPE_ec_point_formats,ret);
1563                 s2n(plistlen + 1,ret);
1564                 *(ret++) = (unsigned char) plistlen;
1565                 memcpy(ret, plist, plistlen);
1566                 ret+=plistlen;
1567
1568                 }
1569         /* Currently the server should not respond with a SupportedCurves extension */
1570 #endif /* OPENSSL_NO_EC */
1571
1572         if (s->tlsext_ticket_expected
1573                 && !(SSL_get_options(s) & SSL_OP_NO_TICKET))
1574                 {
1575                 if ((long)(limit - ret - 4) < 0) return NULL;
1576                 s2n(TLSEXT_TYPE_session_ticket,ret);
1577                 s2n(0,ret);
1578                 }
1579
1580         if (s->tlsext_status_expected)
1581                 {
1582                 if ((long)(limit - ret - 4) < 0) return NULL;
1583                 s2n(TLSEXT_TYPE_status_request,ret);
1584                 s2n(0,ret);
1585                 }
1586
1587 #ifdef TLSEXT_TYPE_opaque_prf_input
1588         if (s->s3->server_opaque_prf_input != NULL)
1589                 {
1590                 size_t sol = s->s3->server_opaque_prf_input_len;
1591
1592                 if ((long)(limit - ret - 6 - sol) < 0)
1593                         return NULL;
1594                 if (sol > 0xFFFD) /* can't happen */
1595                         return NULL;
1596
1597                 s2n(TLSEXT_TYPE_opaque_prf_input, ret);
1598                 s2n(sol + 2, ret);
1599                 s2n(sol, ret);
1600                 memcpy(ret, s->s3->server_opaque_prf_input, sol);
1601                 ret += sol;
1602                 }
1603 #endif
1604
1605         if(s->srtp_profile)
1606                 {
1607                 int el;
1608
1609                 ssl_add_serverhello_use_srtp_ext(s, 0, &el, 0);
1610
1611                 if((limit - p - 4 - el) < 0) return NULL;
1612
1613                 s2n(TLSEXT_TYPE_use_srtp,ret);
1614                 s2n(el,ret);
1615
1616                 if(ssl_add_serverhello_use_srtp_ext(s, ret, &el, el))
1617                         {
1618                         SSLerr(SSL_F_SSL_ADD_SERVERHELLO_TLSEXT, ERR_R_INTERNAL_ERROR);
1619                         return NULL;
1620                         }
1621                 ret+=el;
1622                 }
1623
1624         if (((s->s3->tmp.new_cipher->id & 0xFFFF)==0x80 || (s->s3->tmp.new_cipher->id & 0xFFFF)==0x81)
1625                 && (SSL_get_options(s) & SSL_OP_CRYPTOPRO_TLSEXT_BUG))
1626                 { const unsigned char cryptopro_ext[36] = {
1627                         0xfd, 0xe8, /*65000*/
1628                         0x00, 0x20, /*32 bytes length*/
1629                         0x30, 0x1e, 0x30, 0x08, 0x06, 0x06, 0x2a, 0x85,
1630                         0x03,   0x02, 0x02, 0x09, 0x30, 0x08, 0x06, 0x06,
1631                         0x2a, 0x85, 0x03, 0x02, 0x02, 0x16, 0x30, 0x08,
1632                         0x06, 0x06, 0x2a, 0x85, 0x03, 0x02, 0x02, 0x17};
1633                         if (limit-ret<36) return NULL;
1634                         memcpy(ret,cryptopro_ext,36);
1635                         ret+=36;
1636
1637                 }
1638
1639 #ifndef OPENSSL_NO_HEARTBEATS
1640         /* Add Heartbeat extension if we've received one */
1641         if (s->tlsext_heartbeat & SSL_TLSEXT_HB_ENABLED)
1642                 {
1643                 s2n(TLSEXT_TYPE_heartbeat,ret);
1644                 s2n(1,ret);
1645                 /* Set mode:
1646                  * 1: peer may send requests
1647                  * 2: peer not allowed to send requests
1648                  */
1649                 if (s->tlsext_heartbeat & SSL_TLSEXT_HB_DONT_RECV_REQUESTS)
1650                         *(ret++) = SSL_TLSEXT_HB_DONT_SEND_REQUESTS;
1651                 else
1652                         *(ret++) = SSL_TLSEXT_HB_ENABLED;
1653
1654                 }
1655 #endif
1656
1657 #ifndef OPENSSL_NO_NEXTPROTONEG
1658         next_proto_neg_seen = s->s3->next_proto_neg_seen;
1659         s->s3->next_proto_neg_seen = 0;
1660         if (next_proto_neg_seen && s->ctx->next_protos_advertised_cb)
1661                 {
1662                 const unsigned char *npa;
1663                 unsigned int npalen;
1664                 int r;
1665
1666                 r = s->ctx->next_protos_advertised_cb(s, &npa, &npalen, s->ctx->next_protos_advertised_cb_arg);
1667                 if (r == SSL_TLSEXT_ERR_OK)
1668                         {
1669                         if ((long)(limit - ret - 4 - npalen) < 0) return NULL;
1670                         s2n(TLSEXT_TYPE_next_proto_neg,ret);
1671                         s2n(npalen,ret);
1672                         memcpy(ret, npa, npalen);
1673                         ret += npalen;
1674                         s->s3->next_proto_neg_seen = 1;
1675                         }
1676                 }
1677 #endif
1678
1679         /* If custom types were sent in ClientHello, add ServerHello responses */
1680         if (s->s3->tlsext_custom_types_count)
1681                 {
1682                 size_t i;
1683
1684                 for (i = 0; i < s->s3->tlsext_custom_types_count; i++)
1685                         {
1686                         size_t j;
1687                         custom_srv_ext_record *record;
1688
1689                         for (j = 0; j < s->ctx->custom_srv_ext_records_count; j++)
1690                                 {
1691                                 record = &s->ctx->custom_srv_ext_records[j];
1692                                 if (s->s3->tlsext_custom_types[i] == record->ext_type)
1693                                         {
1694                                         const unsigned char *out = NULL;
1695                                         unsigned short outlen = 0;
1696                                         int cb_retval = 0;
1697
1698                                         /* NULL callback or -1 omits extension */
1699                                         if (!record->fn2)
1700                                                 break;
1701                                         cb_retval = record->fn2(s, record->ext_type,
1702                                                                 &out, &outlen,
1703                                                                 record->arg);
1704                                         if (cb_retval == 0)
1705                                                 return NULL; /* error */
1706                                         if (cb_retval == -1)
1707                                                 break; /* skip this extension */
1708                                         if (limit < ret + 4 + outlen)
1709                                                 return NULL;
1710                                         s2n(record->ext_type, ret);
1711                                         s2n(outlen, ret);
1712                                         memcpy(ret, out, outlen);
1713                                         ret += outlen;
1714                                         break;
1715                                         }
1716                                 }
1717                         }
1718                 }
1719 #ifdef TLSEXT_TYPE_encrypt_then_mac
1720         if (s->s3->flags & TLS1_FLAGS_ENCRYPT_THEN_MAC)
1721                 {
1722                 /* Don't use encrypt_then_mac if AEAD: might want
1723                  * to disable for other ciphersuites too.
1724                  */
1725                 if (s->s3->tmp.new_cipher->algorithm_mac == SSL_AEAD)
1726                         s->s3->flags &= ~TLS1_FLAGS_ENCRYPT_THEN_MAC;
1727                 else
1728                         {
1729                         s2n(TLSEXT_TYPE_encrypt_then_mac,ret);
1730                         s2n(0,ret);
1731                         }
1732                 }
1733 #endif
1734
1735         if (s->s3->alpn_selected)
1736                 {
1737                 const unsigned char *selected = s->s3->alpn_selected;
1738                 unsigned len = s->s3->alpn_selected_len;
1739
1740                 if ((long)(limit - ret - 4 - 2 - 1 - len) < 0)
1741                         return NULL;
1742                 s2n(TLSEXT_TYPE_application_layer_protocol_negotiation,ret);
1743                 s2n(3 + len,ret);
1744                 s2n(1 + len,ret);
1745                 *ret++ = len;
1746                 memcpy(ret, selected, len);
1747                 ret += len;
1748                 }
1749
1750         if ((extdatalen = ret-p-2)== 0)
1751                 return p;
1752
1753         s2n(extdatalen,p);
1754         return ret;
1755         }
1756
1757 /* tls1_alpn_handle_client_hello is called to process the ALPN extension in a
1758  * ClientHello.
1759  *   data: the contents of the extension, not including the type and length.
1760  *   data_len: the number of bytes in |data|
1761  *   al: a pointer to the alert value to send in the event of a non-zero
1762  *       return.
1763  *
1764  *   returns: 0 on success. */
1765 static int tls1_alpn_handle_client_hello(SSL *s, const unsigned char *data,
1766                                          unsigned data_len, int *al)
1767         {
1768         unsigned i;
1769         unsigned proto_len;
1770         const unsigned char *selected;
1771         unsigned char selected_len;
1772         int r;
1773
1774         if (s->ctx->alpn_select_cb == NULL)
1775                 return 0;
1776
1777         if (data_len < 2)
1778                 goto parse_error;
1779
1780         /* data should contain a uint16 length followed by a series of 8-bit,
1781          * length-prefixed strings. */
1782         i = ((unsigned) data[0]) << 8 |
1783             ((unsigned) data[1]);
1784         data_len -= 2;
1785         data += 2;
1786         if (data_len != i)
1787                 goto parse_error;
1788
1789         if (data_len < 2)
1790                 goto parse_error;
1791
1792         for (i = 0; i < data_len;)
1793                 {
1794                 proto_len = data[i];
1795                 i++;
1796
1797                 if (proto_len == 0)
1798                         goto parse_error;
1799
1800                 if (i + proto_len < i || i + proto_len > data_len)
1801                         goto parse_error;
1802
1803                 i += proto_len;
1804                 }
1805
1806         r = s->ctx->alpn_select_cb(s, &selected, &selected_len, data, data_len,
1807                                    s->ctx->alpn_select_cb_arg);
1808         if (r == SSL_TLSEXT_ERR_OK) {
1809                 if (s->s3->alpn_selected)
1810                         OPENSSL_free(s->s3->alpn_selected);
1811                 s->s3->alpn_selected = OPENSSL_malloc(selected_len);
1812                 if (!s->s3->alpn_selected)
1813                         {
1814                         *al = SSL_AD_INTERNAL_ERROR;
1815                         return -1;
1816                         }
1817                 memcpy(s->s3->alpn_selected, selected, selected_len);
1818                 s->s3->alpn_selected_len = selected_len;
1819         }
1820         return 0;
1821
1822 parse_error:
1823         *al = SSL_AD_DECODE_ERROR;
1824         return -1;
1825         }
1826
1827 #ifndef OPENSSL_NO_EC
1828 /* ssl_check_for_safari attempts to fingerprint Safari using OS X
1829  * SecureTransport using the TLS extension block in |d|, of length |n|.
1830  * Safari, since 10.6, sends exactly these extensions, in this order:
1831  *   SNI,
1832  *   elliptic_curves
1833  *   ec_point_formats
1834  *
1835  * We wish to fingerprint Safari because they broke ECDHE-ECDSA support in 10.8,
1836  * but they advertise support. So enabling ECDHE-ECDSA ciphers breaks them.
1837  * Sadly we cannot differentiate 10.6, 10.7 and 10.8.4 (which work), from
1838  * 10.8..10.8.3 (which don't work).
1839  */
1840 static void ssl_check_for_safari(SSL *s, const unsigned char *data, const unsigned char *d, int n) {
1841         unsigned short type, size;
1842         static const unsigned char kSafariExtensionsBlock[] = {
1843                 0x00, 0x0a,  /* elliptic_curves extension */
1844                 0x00, 0x08,  /* 8 bytes */
1845                 0x00, 0x06,  /* 6 bytes of curve ids */
1846                 0x00, 0x17,  /* P-256 */
1847                 0x00, 0x18,  /* P-384 */
1848                 0x00, 0x19,  /* P-521 */
1849
1850                 0x00, 0x0b,  /* ec_point_formats */
1851                 0x00, 0x02,  /* 2 bytes */
1852                 0x01,        /* 1 point format */
1853                 0x00,        /* uncompressed */
1854         };
1855
1856         /* The following is only present in TLS 1.2 */
1857         static const unsigned char kSafariTLS12ExtensionsBlock[] = {
1858                 0x00, 0x0d,  /* signature_algorithms */
1859                 0x00, 0x0c,  /* 12 bytes */
1860                 0x00, 0x0a,  /* 10 bytes */
1861                 0x05, 0x01,  /* SHA-384/RSA */
1862                 0x04, 0x01,  /* SHA-256/RSA */
1863                 0x02, 0x01,  /* SHA-1/RSA */
1864                 0x04, 0x03,  /* SHA-256/ECDSA */
1865                 0x02, 0x03,  /* SHA-1/ECDSA */
1866         };
1867
1868         if (data >= (d+n-2))
1869                 return;
1870         data += 2;
1871
1872         if (data > (d+n-4))
1873                 return;
1874         n2s(data,type);
1875         n2s(data,size);
1876
1877         if (type != TLSEXT_TYPE_server_name)
1878                 return;
1879
1880         if (data+size > d+n)
1881                 return;
1882         data += size;
1883
1884         if (TLS1_get_client_version(s) >= TLS1_2_VERSION)
1885                 {
1886                 const size_t len1 = sizeof(kSafariExtensionsBlock);
1887                 const size_t len2 = sizeof(kSafariTLS12ExtensionsBlock);
1888
1889                 if (data + len1 + len2 != d+n)
1890                         return;
1891                 if (memcmp(data, kSafariExtensionsBlock, len1) != 0)
1892                         return;
1893                 if (memcmp(data + len1, kSafariTLS12ExtensionsBlock, len2) != 0)
1894                         return;
1895                 }
1896         else
1897                 {
1898                 const size_t len = sizeof(kSafariExtensionsBlock);
1899
1900                 if (data + len != d+n)
1901                         return;
1902                 if (memcmp(data, kSafariExtensionsBlock, len) != 0)
1903                         return;
1904                 }
1905
1906         s->s3->is_probably_safari = 1;
1907 }
1908 #endif /* !OPENSSL_NO_EC */
1909
1910 static int ssl_scan_clienthello_tlsext(SSL *s, unsigned char **p, unsigned char *d, int n, int *al)
1911         {
1912         unsigned short type;
1913         unsigned short size;
1914         unsigned short len;
1915         unsigned char *data = *p;
1916         int renegotiate_seen = 0;
1917         size_t i;
1918
1919         s->servername_done = 0;
1920         s->tlsext_status_type = -1;
1921 #ifndef OPENSSL_NO_NEXTPROTONEG
1922         s->s3->next_proto_neg_seen = 0;
1923 #endif
1924
1925         if (s->s3->alpn_selected)
1926                 {
1927                 OPENSSL_free(s->s3->alpn_selected);
1928                 s->s3->alpn_selected = NULL;
1929                 }
1930
1931         /* Clear observed custom extensions */
1932         s->s3->tlsext_custom_types_count = 0;
1933         if (s->s3->tlsext_custom_types != NULL)
1934                 {
1935                 OPENSSL_free(s->s3->tlsext_custom_types);
1936                 s->s3->tlsext_custom_types = NULL;
1937                 }
1938
1939 #ifndef OPENSSL_NO_HEARTBEATS
1940         s->tlsext_heartbeat &= ~(SSL_TLSEXT_HB_ENABLED |
1941                                SSL_TLSEXT_HB_DONT_SEND_REQUESTS);
1942 #endif
1943
1944 #ifndef OPENSSL_NO_EC
1945         if (s->options & SSL_OP_SAFARI_ECDHE_ECDSA_BUG)
1946                 ssl_check_for_safari(s, data, d, n);
1947 #endif /* !OPENSSL_NO_EC */
1948
1949         /* Clear any signature algorithms extension received */
1950         if (s->cert->peer_sigalgs)
1951                 {
1952                 OPENSSL_free(s->cert->peer_sigalgs);
1953                 s->cert->peer_sigalgs = NULL;
1954                 }
1955         /* Clear any shared sigtnature algorithms */
1956         if (s->cert->shared_sigalgs)
1957                 {
1958                 OPENSSL_free(s->cert->shared_sigalgs);
1959                 s->cert->shared_sigalgs = NULL;
1960                 }
1961         /* Clear certificate digests and validity flags */
1962         for (i = 0; i < SSL_PKEY_NUM; i++)
1963                 {
1964                 s->cert->pkeys[i].digest = NULL;
1965                 s->cert->pkeys[i].valid_flags = 0;
1966                 }
1967
1968 #ifdef TLSEXT_TYPE_encrypt_then_mac
1969         s->s3->flags &= ~TLS1_FLAGS_ENCRYPT_THEN_MAC;
1970 #endif
1971
1972         if (data >= (d+n-2))
1973                 goto ri_check;
1974         n2s(data,len);
1975
1976         if (data > (d+n-len))
1977                 goto ri_check;
1978
1979         while (data <= (d+n-4))
1980                 {
1981                 n2s(data,type);
1982                 n2s(data,size);
1983
1984                 if (data+size > (d+n))
1985                         goto ri_check;
1986 #if 0
1987                 fprintf(stderr,"Received extension type %d size %d\n",type,size);
1988 #endif
1989                 if (s->tlsext_debug_cb)
1990                         s->tlsext_debug_cb(s, 0, type, data, size,
1991                                                 s->tlsext_debug_arg);
1992 /* The servername extension is treated as follows:
1993
1994    - Only the hostname type is supported with a maximum length of 255.
1995    - The servername is rejected if too long or if it contains zeros,
1996      in which case an fatal alert is generated.
1997    - The servername field is maintained together with the session cache.
1998    - When a session is resumed, the servername call back invoked in order
1999      to allow the application to position itself to the right context.
2000    - The servername is acknowledged if it is new for a session or when
2001      it is identical to a previously used for the same session.
2002      Applications can control the behaviour.  They can at any time
2003      set a 'desirable' servername for a new SSL object. This can be the
2004      case for example with HTTPS when a Host: header field is received and
2005      a renegotiation is requested. In this case, a possible servername
2006      presented in the new client hello is only acknowledged if it matches
2007      the value of the Host: field.
2008    - Applications must  use SSL_OP_NO_SESSION_RESUMPTION_ON_RENEGOTIATION
2009      if they provide for changing an explicit servername context for the session,
2010      i.e. when the session has been established with a servername extension.
2011    - On session reconnect, the servername extension may be absent.
2012
2013 */
2014
2015                 if (type == TLSEXT_TYPE_server_name)
2016                         {
2017                         unsigned char *sdata;
2018                         int servname_type;
2019                         int dsize;
2020
2021                         if (size < 2)
2022                                 {
2023                                 *al = SSL_AD_DECODE_ERROR;
2024                                 return 0;
2025                                 }
2026                         n2s(data,dsize);
2027                         size -= 2;
2028                         if (dsize > size  )
2029                                 {
2030                                 *al = SSL_AD_DECODE_ERROR;
2031                                 return 0;
2032                                 }
2033
2034                         sdata = data;
2035                         while (dsize > 3)
2036                                 {
2037                                 servname_type = *(sdata++);
2038                                 n2s(sdata,len);
2039                                 dsize -= 3;
2040
2041                                 if (len > dsize)
2042                                         {
2043                                         *al = SSL_AD_DECODE_ERROR;
2044                                         return 0;
2045                                         }
2046                                 if (s->servername_done == 0)
2047                                 switch (servname_type)
2048                                         {
2049                                 case TLSEXT_NAMETYPE_host_name:
2050                                         if (!s->hit)
2051                                                 {
2052                                                 if(s->session->tlsext_hostname)
2053                                                         {
2054                                                         *al = SSL_AD_DECODE_ERROR;
2055                                                         return 0;
2056                                                         }
2057                                                 if (len > TLSEXT_MAXLEN_host_name)
2058                                                         {
2059                                                         *al = TLS1_AD_UNRECOGNIZED_NAME;
2060                                                         return 0;
2061                                                         }
2062                                                 if ((s->session->tlsext_hostname = OPENSSL_malloc(len+1)) == NULL)
2063                                                         {
2064                                                         *al = TLS1_AD_INTERNAL_ERROR;
2065                                                         return 0;
2066                                                         }
2067                                                 memcpy(s->session->tlsext_hostname, sdata, len);
2068                                                 s->session->tlsext_hostname[len]='\0';
2069                                                 if (strlen(s->session->tlsext_hostname) != len) {
2070                                                         OPENSSL_free(s->session->tlsext_hostname);
2071                                                         s->session->tlsext_hostname = NULL;
2072                                                         *al = TLS1_AD_UNRECOGNIZED_NAME;
2073                                                         return 0;
2074                                                 }
2075                                                 s->servername_done = 1;
2076
2077                                                 }
2078                                         else
2079                                                 s->servername_done = s->session->tlsext_hostname
2080                                                         && strlen(s->session->tlsext_hostname) == len
2081                                                         && strncmp(s->session->tlsext_hostname, (char *)sdata, len) == 0;
2082
2083                                         break;
2084
2085                                 default:
2086                                         break;
2087                                         }
2088
2089                                 dsize -= len;
2090                                 }
2091                         if (dsize != 0)
2092                                 {
2093                                 *al = SSL_AD_DECODE_ERROR;
2094                                 return 0;
2095                                 }
2096
2097                         }
2098 #ifndef OPENSSL_NO_SRP
2099                 else if (type == TLSEXT_TYPE_srp)
2100                         {
2101                         if (size <= 0 || ((len = data[0])) != (size -1))
2102                                 {
2103                                 *al = SSL_AD_DECODE_ERROR;
2104                                 return 0;
2105                                 }
2106                         if (s->srp_ctx.login != NULL)
2107                                 {
2108                                 *al = SSL_AD_DECODE_ERROR;
2109                                 return 0;
2110                                 }
2111                         if ((s->srp_ctx.login = OPENSSL_malloc(len+1)) == NULL)
2112                                 return -1;
2113                         memcpy(s->srp_ctx.login, &data[1], len);
2114                         s->srp_ctx.login[len]='\0';
2115
2116                         if (strlen(s->srp_ctx.login) != len)
2117                                 {
2118                                 *al = SSL_AD_DECODE_ERROR;
2119                                 return 0;
2120                                 }
2121                         }
2122 #endif
2123
2124 #ifndef OPENSSL_NO_EC
2125                 else if (type == TLSEXT_TYPE_ec_point_formats)
2126                         {
2127                         unsigned char *sdata = data;
2128                         int ecpointformatlist_length = *(sdata++);
2129
2130                         if (ecpointformatlist_length != size - 1 ||
2131                                 ecpointformatlist_length < 1)
2132                                 {
2133                                 *al = TLS1_AD_DECODE_ERROR;
2134                                 return 0;
2135                                 }
2136                         if (!s->hit)
2137                                 {
2138                                 if(s->session->tlsext_ecpointformatlist)
2139                                         {
2140                                         OPENSSL_free(s->session->tlsext_ecpointformatlist);
2141                                         s->session->tlsext_ecpointformatlist = NULL;
2142                                         }
2143                                 s->session->tlsext_ecpointformatlist_length = 0;
2144                                 if ((s->session->tlsext_ecpointformatlist = OPENSSL_malloc(ecpointformatlist_length)) == NULL)
2145                                         {
2146                                         *al = TLS1_AD_INTERNAL_ERROR;
2147                                         return 0;
2148                                         }
2149                                 s->session->tlsext_ecpointformatlist_length = ecpointformatlist_length;
2150                                 memcpy(s->session->tlsext_ecpointformatlist, sdata, ecpointformatlist_length);
2151                                 }
2152 #if 0
2153                         fprintf(stderr,"ssl_parse_clienthello_tlsext s->session->tlsext_ecpointformatlist (length=%i) ", s->session->tlsext_ecpointformatlist_length);
2154                         sdata = s->session->tlsext_ecpointformatlist;
2155                         for (i = 0; i < s->session->tlsext_ecpointformatlist_length; i++)
2156                                 fprintf(stderr,"%i ",*(sdata++));
2157                         fprintf(stderr,"\n");
2158 #endif
2159                         }
2160                 else if (type == TLSEXT_TYPE_elliptic_curves)
2161                         {
2162                         unsigned char *sdata = data;
2163                         int ellipticcurvelist_length = (*(sdata++) << 8);
2164                         ellipticcurvelist_length += (*(sdata++));
2165
2166                         if (ellipticcurvelist_length != size - 2 ||
2167                                 ellipticcurvelist_length < 1)
2168                                 {
2169                                 *al = TLS1_AD_DECODE_ERROR;
2170                                 return 0;
2171                                 }
2172                         if (!s->hit)
2173                                 {
2174                                 if(s->session->tlsext_ellipticcurvelist)
2175                                         {
2176                                         *al = TLS1_AD_DECODE_ERROR;
2177                                         return 0;
2178                                         }
2179                                 s->session->tlsext_ellipticcurvelist_length = 0;
2180                                 if ((s->session->tlsext_ellipticcurvelist = OPENSSL_malloc(ellipticcurvelist_length)) == NULL)
2181                                         {
2182                                         *al = TLS1_AD_INTERNAL_ERROR;
2183                                         return 0;
2184                                         }
2185                                 s->session->tlsext_ellipticcurvelist_length = ellipticcurvelist_length;
2186                                 memcpy(s->session->tlsext_ellipticcurvelist, sdata, ellipticcurvelist_length);
2187                                 }
2188 #if 0
2189                         fprintf(stderr,"ssl_parse_clienthello_tlsext s->session->tlsext_ellipticcurvelist (length=%i) ", s->session->tlsext_ellipticcurvelist_length);
2190                         sdata = s->session->tlsext_ellipticcurvelist;
2191                         for (i = 0; i < s->session->tlsext_ellipticcurvelist_length; i++)
2192                                 fprintf(stderr,"%i ",*(sdata++));
2193                         fprintf(stderr,"\n");
2194 #endif
2195                         }
2196 #endif /* OPENSSL_NO_EC */
2197 #ifdef TLSEXT_TYPE_opaque_prf_input
2198                 else if (type == TLSEXT_TYPE_opaque_prf_input)
2199                         {
2200                         unsigned char *sdata = data;
2201
2202                         if (size < 2)
2203                                 {
2204                                 *al = SSL_AD_DECODE_ERROR;
2205                                 return 0;
2206                                 }
2207                         n2s(sdata, s->s3->client_opaque_prf_input_len);
2208                         if (s->s3->client_opaque_prf_input_len != size - 2)
2209                                 {
2210                                 *al = SSL_AD_DECODE_ERROR;
2211                                 return 0;
2212                                 }
2213
2214                         if (s->s3->client_opaque_prf_input != NULL) /* shouldn't really happen */
2215                                 OPENSSL_free(s->s3->client_opaque_prf_input);
2216                         if (s->s3->client_opaque_prf_input_len == 0)
2217                                 s->s3->client_opaque_prf_input = OPENSSL_malloc(1); /* dummy byte just to get non-NULL */
2218                         else
2219                                 s->s3->client_opaque_prf_input = BUF_memdup(sdata, s->s3->client_opaque_prf_input_len);
2220                         if (s->s3->client_opaque_prf_input == NULL)
2221                                 {
2222                                 *al = TLS1_AD_INTERNAL_ERROR;
2223                                 return 0;
2224                                 }
2225                         }
2226 #endif
2227                 else if (type == TLSEXT_TYPE_session_ticket)
2228                         {
2229                         if (s->tls_session_ticket_ext_cb &&
2230                             !s->tls_session_ticket_ext_cb(s, data, size, s->tls_session_ticket_ext_cb_arg))
2231                                 {
2232                                 *al = TLS1_AD_INTERNAL_ERROR;
2233                                 return 0;
2234                                 }
2235                         }
2236                 else if (type == TLSEXT_TYPE_renegotiate)
2237                         {
2238                         if(!ssl_parse_clienthello_renegotiate_ext(s, data, size, al))
2239                                 return 0;
2240                         renegotiate_seen = 1;
2241                         }
2242                 else if (type == TLSEXT_TYPE_signature_algorithms)
2243                         {
2244                         int dsize;
2245                         if (s->cert->peer_sigalgs || size < 2)
2246                                 {
2247                                 *al = SSL_AD_DECODE_ERROR;
2248                                 return 0;
2249                                 }
2250                         n2s(data,dsize);
2251                         size -= 2;
2252                         if (dsize != size || dsize & 1 || !dsize)
2253                                 {
2254                                 *al = SSL_AD_DECODE_ERROR;
2255                                 return 0;
2256                                 }
2257                         if (!tls1_process_sigalgs(s, data, dsize))
2258                                 {
2259                                 *al = SSL_AD_DECODE_ERROR;
2260                                 return 0;
2261                                 }
2262                         /* If sigalgs received and no shared algorithms fatal
2263                          * error.
2264                          */
2265                         if (s->cert->peer_sigalgs && !s->cert->shared_sigalgs)
2266                                 {
2267                                 SSLerr(SSL_F_SSL_SCAN_CLIENTHELLO_TLSEXT,
2268                                         SSL_R_NO_SHARED_SIGATURE_ALGORITHMS);
2269                                 *al = SSL_AD_ILLEGAL_PARAMETER;
2270                                 return 0;
2271                                 }
2272                         }
2273                 else if (type == TLSEXT_TYPE_status_request
2274                          && s->ctx->tlsext_status_cb)
2275                         {
2276
2277                         if (size < 5)
2278                                 {
2279                                 *al = SSL_AD_DECODE_ERROR;
2280                                 return 0;
2281                                 }
2282
2283                         s->tlsext_status_type = *data++;
2284                         size--;
2285                         if (s->tlsext_status_type == TLSEXT_STATUSTYPE_ocsp)
2286                                 {
2287                                 const unsigned char *sdata;
2288                                 int dsize;
2289                                 /* Read in responder_id_list */
2290                                 n2s(data,dsize);
2291                                 size -= 2;
2292                                 if (dsize > size  )
2293                                         {
2294                                         *al = SSL_AD_DECODE_ERROR;
2295                                         return 0;
2296                                         }
2297                                 while (dsize > 0)
2298                                         {
2299                                         OCSP_RESPID *id;
2300                                         int idsize;
2301                                         if (dsize < 4)
2302                                                 {
2303                                                 *al = SSL_AD_DECODE_ERROR;
2304                                                 return 0;
2305                                                 }
2306                                         n2s(data, idsize);
2307                                         dsize -= 2 + idsize;
2308                                         size -= 2 + idsize;
2309                                         if (dsize < 0)
2310                                                 {
2311                                                 *al = SSL_AD_DECODE_ERROR;
2312                                                 return 0;
2313                                                 }
2314                                         sdata = data;
2315                                         data += idsize;
2316                                         id = d2i_OCSP_RESPID(NULL,
2317                                                                 &sdata, idsize);
2318                                         if (!id)
2319                                                 {
2320                                                 *al = SSL_AD_DECODE_ERROR;
2321                                                 return 0;
2322                                                 }
2323                                         if (data != sdata)
2324                                                 {
2325                                                 OCSP_RESPID_free(id);
2326                                                 *al = SSL_AD_DECODE_ERROR;
2327                                                 return 0;
2328                                                 }
2329                                         if (!s->tlsext_ocsp_ids
2330                                                 && !(s->tlsext_ocsp_ids =
2331                                                 sk_OCSP_RESPID_new_null()))
2332                                                 {
2333                                                 OCSP_RESPID_free(id);
2334                                                 *al = SSL_AD_INTERNAL_ERROR;
2335                                                 return 0;
2336                                                 }
2337                                         if (!sk_OCSP_RESPID_push(
2338                                                         s->tlsext_ocsp_ids, id))
2339                                                 {
2340                                                 OCSP_RESPID_free(id);
2341                                                 *al = SSL_AD_INTERNAL_ERROR;
2342                                                 return 0;
2343                                                 }
2344                                         }
2345
2346                                 /* Read in request_extensions */
2347                                 if (size < 2)
2348                                         {
2349                                         *al = SSL_AD_DECODE_ERROR;
2350                                         return 0;
2351                                         }
2352                                 n2s(data,dsize);
2353                                 size -= 2;
2354                                 if (dsize != size)
2355                                         {
2356                                         *al = SSL_AD_DECODE_ERROR;
2357                                         return 0;
2358                                         }
2359                                 sdata = data;
2360                                 if (dsize > 0)
2361                                         {
2362                                         if (s->tlsext_ocsp_exts)
2363                                                 {
2364                                                 sk_X509_EXTENSION_pop_free(s->tlsext_ocsp_exts,
2365                                                                            X509_EXTENSION_free);
2366                                                 }
2367
2368                                         s->tlsext_ocsp_exts =
2369                                                 d2i_X509_EXTENSIONS(NULL,
2370                                                         &sdata, dsize);
2371                                         if (!s->tlsext_ocsp_exts
2372                                                 || (data + dsize != sdata))
2373                                                 {
2374                                                 *al = SSL_AD_DECODE_ERROR;
2375                                                 return 0;
2376                                                 }
2377                                         }
2378                                 }
2379                                 /* We don't know what to do with any other type
2380                                 * so ignore it.
2381                                 */
2382                                 else
2383                                         s->tlsext_status_type = -1;
2384                         }
2385 #ifndef OPENSSL_NO_HEARTBEATS
2386                 else if (type == TLSEXT_TYPE_heartbeat)
2387                         {
2388                         switch(data[0])
2389                                 {
2390                                 case 0x01:      /* Client allows us to send HB requests */
2391                                                         s->tlsext_heartbeat |= SSL_TLSEXT_HB_ENABLED;
2392                                                         break;
2393                                 case 0x02:      /* Client doesn't accept HB requests */
2394                                                         s->tlsext_heartbeat |= SSL_TLSEXT_HB_ENABLED;
2395                                                         s->tlsext_heartbeat |= SSL_TLSEXT_HB_DONT_SEND_REQUESTS;
2396                                                         break;
2397                                 default:        *al = SSL_AD_ILLEGAL_PARAMETER;
2398                                                         return 0;
2399                                 }
2400                         }
2401 #endif
2402 #ifndef OPENSSL_NO_NEXTPROTONEG
2403                 else if (type == TLSEXT_TYPE_next_proto_neg &&
2404                          s->s3->tmp.finish_md_len == 0 &&
2405                          s->s3->alpn_selected == NULL)
2406                         {
2407                         /* We shouldn't accept this extension on a
2408                          * renegotiation.
2409                          *
2410                          * s->new_session will be set on renegotiation, but we
2411                          * probably shouldn't rely that it couldn't be set on
2412                          * the initial renegotation too in certain cases (when
2413                          * there's some other reason to disallow resuming an
2414                          * earlier session -- the current code won't be doing
2415                          * anything like that, but this might change).
2416
2417                          * A valid sign that there's been a previous handshake
2418                          * in this connection is if s->s3->tmp.finish_md_len >
2419                          * 0.  (We are talking about a check that will happen
2420                          * in the Hello protocol round, well before a new
2421                          * Finished message could have been computed.) */
2422                         s->s3->next_proto_neg_seen = 1;
2423                         }
2424 #endif
2425
2426                 else if (type == TLSEXT_TYPE_application_layer_protocol_negotiation &&
2427                          s->ctx->alpn_select_cb &&
2428                          s->s3->tmp.finish_md_len == 0)
2429                         {
2430                         if (tls1_alpn_handle_client_hello(s, data, size, al) != 0)
2431                                 return 0;
2432                         /* ALPN takes precedence over NPN. */
2433                         s->s3->next_proto_neg_seen = 0;
2434                         }
2435
2436                 /* session ticket processed earlier */
2437                 else if (type == TLSEXT_TYPE_use_srtp)
2438                         {
2439                         if(ssl_parse_clienthello_use_srtp_ext(s, data, size,
2440                                                               al))
2441                                 return 0;
2442                         }
2443                 /* If this ClientHello extension was unhandled and this is
2444                  * a nonresumed connection, check whether the extension is a
2445                  * custom TLS Extension (has a custom_srv_ext_record), and if
2446                  * so call the callback and record the extension number so that
2447                  * an appropriate ServerHello may be later returned.
2448                  */
2449                 else if (!s->hit && s->ctx->custom_srv_ext_records_count)
2450                         {
2451                         custom_srv_ext_record *record;
2452
2453                         for (i=0; i < s->ctx->custom_srv_ext_records_count; i++)
2454                                 {
2455                                 record = &s->ctx->custom_srv_ext_records[i];
2456                                 if (type == record->ext_type)
2457                                         {
2458                                         size_t j;
2459
2460                                         /* Error on duplicate TLS Extensions */
2461                                         for (j = 0; j < s->s3->tlsext_custom_types_count; j++)
2462                                                 {
2463                                                 if (type == s->s3->tlsext_custom_types[j])
2464                                                         {
2465                                                         *al = TLS1_AD_DECODE_ERROR;
2466                                                         return 0;
2467                                                         }
2468                                                 }
2469
2470                                         /* NULL callback still notes the extension */
2471                                         if (record->fn1 && !record->fn1(s, type, data, size, al, record->arg))
2472                                                 return 0;
2473
2474                                         /* Add the (non-duplicated) entry */
2475                                         s->s3->tlsext_custom_types_count++;
2476                                         s->s3->tlsext_custom_types = OPENSSL_realloc(
2477                                                         s->s3->tlsext_custom_types,
2478                                                         s->s3->tlsext_custom_types_count * 2);
2479                                         if (s->s3->tlsext_custom_types == NULL)
2480                                                 {
2481                                                 s->s3->tlsext_custom_types = 0;
2482                                                 *al = TLS1_AD_INTERNAL_ERROR;
2483                                                 return 0;
2484                                                 }
2485                                         s->s3->tlsext_custom_types[
2486                                                         s->s3->tlsext_custom_types_count - 1] = type;
2487                                         }
2488                                 }
2489                         }
2490 #ifdef TLSEXT_TYPE_encrypt_then_mac
2491                 else if (type == TLSEXT_TYPE_encrypt_then_mac)
2492                         s->s3->flags |= TLS1_FLAGS_ENCRYPT_THEN_MAC;
2493 #endif
2494
2495                 data+=size;
2496                 }
2497
2498         *p = data;
2499
2500         ri_check:
2501
2502         /* Need RI if renegotiating */
2503
2504         if (!renegotiate_seen && s->renegotiate &&
2505                 !(s->options & SSL_OP_ALLOW_UNSAFE_LEGACY_RENEGOTIATION))
2506                 {
2507                 *al = SSL_AD_HANDSHAKE_FAILURE;
2508                 SSLerr(SSL_F_SSL_SCAN_CLIENTHELLO_TLSEXT,
2509                                 SSL_R_UNSAFE_LEGACY_RENEGOTIATION_DISABLED);
2510                 return 0;
2511                 }
2512         /* If no signature algorithms extension set default values */
2513         if (!s->cert->peer_sigalgs)
2514                 ssl_cert_set_default_md(s->cert);
2515
2516         return 1;
2517         }
2518
2519 int ssl_parse_clienthello_tlsext(SSL *s, unsigned char **p, unsigned char *d, int n)
2520         {
2521         int al = -1;
2522         if (ssl_scan_clienthello_tlsext(s, p, d, n, &al) <= 0)
2523                 {
2524                 ssl3_send_alert(s,SSL3_AL_FATAL,al);
2525                 return 0;
2526                 }
2527
2528         if (ssl_check_clienthello_tlsext_early(s) <= 0)
2529                 {
2530                 SSLerr(SSL_F_SSL_PARSE_CLIENTHELLO_TLSEXT,SSL_R_CLIENTHELLO_TLSEXT);
2531                 return 0;
2532                 }
2533         return 1;
2534 }
2535
2536 #ifndef OPENSSL_NO_NEXTPROTONEG
2537 /* ssl_next_proto_validate validates a Next Protocol Negotiation block. No
2538  * elements of zero length are allowed and the set of elements must exactly fill
2539  * the length of the block. */
2540 static char ssl_next_proto_validate(unsigned char *d, unsigned len)
2541         {
2542         unsigned int off = 0;
2543
2544         while (off < len)
2545                 {
2546                 if (d[off] == 0)
2547                         return 0;
2548                 off += d[off];
2549                 off++;
2550                 }
2551
2552         return off == len;
2553         }
2554 #endif
2555
2556 static int ssl_scan_serverhello_tlsext(SSL *s, unsigned char **p, unsigned char *d, int n, int *al)
2557         {
2558         unsigned short length;
2559         unsigned short type;
2560         unsigned short size;
2561         unsigned char *data = *p;
2562         int tlsext_servername = 0;
2563         int renegotiate_seen = 0;
2564
2565 #ifndef OPENSSL_NO_NEXTPROTONEG
2566         s->s3->next_proto_neg_seen = 0;
2567 #endif
2568
2569         if (s->s3->alpn_selected)
2570                 {
2571                 OPENSSL_free(s->s3->alpn_selected);
2572                 s->s3->alpn_selected = NULL;
2573                 }
2574
2575 #ifndef OPENSSL_NO_HEARTBEATS
2576         s->tlsext_heartbeat &= ~(SSL_TLSEXT_HB_ENABLED |
2577                                SSL_TLSEXT_HB_DONT_SEND_REQUESTS);
2578 #endif
2579
2580 #ifdef TLSEXT_TYPE_encrypt_then_mac
2581         s->s3->flags &= ~TLS1_FLAGS_ENCRYPT_THEN_MAC;
2582 #endif
2583
2584         if (data >= (d+n-2))
2585                 goto ri_check;
2586
2587         n2s(data,length);
2588         if (data+length != d+n)
2589                 {
2590                 *al = SSL_AD_DECODE_ERROR;
2591                 return 0;
2592                 }
2593
2594         while(data <= (d+n-4))
2595                 {
2596                 n2s(data,type);
2597                 n2s(data,size);
2598
2599                 if (data+size > (d+n))
2600                         goto ri_check;
2601
2602                 if (s->tlsext_debug_cb)
2603                         s->tlsext_debug_cb(s, 1, type, data, size,
2604                                                 s->tlsext_debug_arg);
2605
2606                 if (type == TLSEXT_TYPE_server_name)
2607                         {
2608                         if (s->tlsext_hostname == NULL || size > 0)
2609                                 {
2610                                 *al = TLS1_AD_UNRECOGNIZED_NAME;
2611                                 return 0;
2612                                 }
2613                         tlsext_servername = 1;
2614                         }
2615
2616 #ifndef OPENSSL_NO_EC
2617                 else if (type == TLSEXT_TYPE_ec_point_formats)
2618                         {
2619                         unsigned char *sdata = data;
2620                         int ecpointformatlist_length = *(sdata++);
2621
2622                         if (ecpointformatlist_length != size - 1)
2623                                 {
2624                                 *al = TLS1_AD_DECODE_ERROR;
2625                                 return 0;
2626                                 }
2627                         s->session->tlsext_ecpointformatlist_length = 0;
2628                         if (s->session->tlsext_ecpointformatlist != NULL) OPENSSL_free(s->session->tlsext_ecpointformatlist);
2629                         if ((s->session->tlsext_ecpointformatlist = OPENSSL_malloc(ecpointformatlist_length)) == NULL)
2630                                 {
2631                                 *al = TLS1_AD_INTERNAL_ERROR;
2632                                 return 0;
2633                                 }
2634                         s->session->tlsext_ecpointformatlist_length = ecpointformatlist_length;
2635                         memcpy(s->session->tlsext_ecpointformatlist, sdata, ecpointformatlist_length);
2636 #if 0
2637                         fprintf(stderr,"ssl_parse_serverhello_tlsext s->session->tlsext_ecpointformatlist ");
2638                         sdata = s->session->tlsext_ecpointformatlist;
2639                         for (i = 0; i < s->session->tlsext_ecpointformatlist_length; i++)
2640                                 fprintf(stderr,"%i ",*(sdata++));
2641                         fprintf(stderr,"\n");
2642 #endif
2643                         }
2644 #endif /* OPENSSL_NO_EC */
2645
2646                 else if (type == TLSEXT_TYPE_session_ticket)
2647                         {
2648                         if (s->tls_session_ticket_ext_cb &&
2649                             !s->tls_session_ticket_ext_cb(s, data, size, s->tls_session_ticket_ext_cb_arg))
2650                                 {
2651                                 *al = TLS1_AD_INTERNAL_ERROR;
2652                                 return 0;
2653                                 }
2654                         if ((SSL_get_options(s) & SSL_OP_NO_TICKET)
2655                                 || (size > 0))
2656                                 {
2657                                 *al = TLS1_AD_UNSUPPORTED_EXTENSION;
2658                                 return 0;
2659                                 }
2660                         s->tlsext_ticket_expected = 1;
2661                         }
2662 #ifdef TLSEXT_TYPE_opaque_prf_input
2663                 else if (type == TLSEXT_TYPE_opaque_prf_input)
2664                         {
2665                         unsigned char *sdata = data;
2666
2667                         if (size < 2)
2668                                 {
2669                                 *al = SSL_AD_DECODE_ERROR;
2670                                 return 0;
2671                                 }
2672                         n2s(sdata, s->s3->server_opaque_prf_input_len);
2673                         if (s->s3->server_opaque_prf_input_len != size - 2)
2674                                 {
2675                                 *al = SSL_AD_DECODE_ERROR;
2676                                 return 0;
2677                                 }
2678
2679                         if (s->s3->server_opaque_prf_input != NULL) /* shouldn't really happen */
2680                                 OPENSSL_free(s->s3->server_opaque_prf_input);
2681                         if (s->s3->server_opaque_prf_input_len == 0)
2682                                 s->s3->server_opaque_prf_input = OPENSSL_malloc(1); /* dummy byte just to get non-NULL */
2683                         else
2684                                 s->s3->server_opaque_prf_input = BUF_memdup(sdata, s->s3->server_opaque_prf_input_len);
2685
2686                         if (s->s3->server_opaque_prf_input == NULL)
2687                                 {
2688                                 *al = TLS1_AD_INTERNAL_ERROR;
2689                                 return 0;
2690                                 }
2691                         }
2692 #endif
2693                 else if (type == TLSEXT_TYPE_status_request)
2694                         {
2695                         /* MUST be empty and only sent if we've requested
2696                          * a status request message.
2697                          */
2698                         if ((s->tlsext_status_type == -1) || (size > 0))
2699                                 {
2700                                 *al = TLS1_AD_UNSUPPORTED_EXTENSION;
2701                                 return 0;
2702                                 }
2703                         /* Set flag to expect CertificateStatus message */
2704                         s->tlsext_status_expected = 1;
2705                         }
2706 #ifndef OPENSSL_NO_NEXTPROTONEG
2707                 else if (type == TLSEXT_TYPE_next_proto_neg &&
2708                          s->s3->tmp.finish_md_len == 0)
2709                         {
2710                         unsigned char *selected;
2711                         unsigned char selected_len;
2712
2713                         /* We must have requested it. */
2714                         if (s->ctx->next_proto_select_cb == NULL)
2715                                 {
2716                                 *al = TLS1_AD_UNSUPPORTED_EXTENSION;
2717                                 return 0;
2718                                 }
2719                         /* The data must be valid */
2720                         if (!ssl_next_proto_validate(data, size))
2721                                 {
2722                                 *al = TLS1_AD_DECODE_ERROR;
2723                                 return 0;
2724                                 }
2725                         if (s->ctx->next_proto_select_cb(s, &selected, &selected_len, data, size, s->ctx->next_proto_select_cb_arg) != SSL_TLSEXT_ERR_OK)
2726                                 {
2727                                 *al = TLS1_AD_INTERNAL_ERROR;
2728                                 return 0;
2729                                 }
2730                         s->next_proto_negotiated = OPENSSL_malloc(selected_len);
2731                         if (!s->next_proto_negotiated)
2732                                 {
2733                                 *al = TLS1_AD_INTERNAL_ERROR;
2734                                 return 0;
2735                                 }
2736                         memcpy(s->next_proto_negotiated, selected, selected_len);
2737                         s->next_proto_negotiated_len = selected_len;
2738                         s->s3->next_proto_neg_seen = 1;
2739                         }
2740 #endif
2741
2742                 else if (type == TLSEXT_TYPE_application_layer_protocol_negotiation)
2743                         {
2744                         unsigned len;
2745
2746                         /* We must have requested it. */
2747                         if (s->alpn_client_proto_list == NULL)
2748                                 {
2749                                 *al = TLS1_AD_UNSUPPORTED_EXTENSION;
2750                                 return 0;
2751                                 }
2752                         if (size < 4)
2753                                 {
2754                                 *al = TLS1_AD_DECODE_ERROR;
2755                                 return 0;
2756                                 }
2757                         /* The extension data consists of:
2758                          *   uint16 list_length
2759                          *   uint8 proto_length;
2760                          *   uint8 proto[proto_length]; */
2761                         len = data[0];
2762                         len <<= 8;
2763                         len |= data[1];
2764                         if (len != (unsigned) size - 2)
2765                                 {
2766                                 *al = TLS1_AD_DECODE_ERROR;
2767                                 return 0;
2768                                 }
2769                         len = data[2];
2770                         if (len != (unsigned) size - 3)
2771                                 {
2772                                 *al = TLS1_AD_DECODE_ERROR;
2773                                 return 0;
2774                                 }
2775                         if (s->s3->alpn_selected)
2776                                 OPENSSL_free(s->s3->alpn_selected);
2777                         s->s3->alpn_selected = OPENSSL_malloc(len);
2778                         if (!s->s3->alpn_selected)
2779                                 {
2780                                 *al = TLS1_AD_INTERNAL_ERROR;
2781                                 return 0;
2782                                 }
2783                         memcpy(s->s3->alpn_selected, data + 3, len);
2784                         s->s3->alpn_selected_len = len;
2785                         }
2786
2787                 else if (type == TLSEXT_TYPE_renegotiate)
2788                         {
2789                         if(!ssl_parse_serverhello_renegotiate_ext(s, data, size, al))
2790                                 return 0;
2791                         renegotiate_seen = 1;
2792                         }
2793 #ifndef OPENSSL_NO_HEARTBEATS
2794                 else if (type == TLSEXT_TYPE_heartbeat)
2795                         {
2796                         switch(data[0])
2797                                 {
2798                                 case 0x01:      /* Server allows us to send HB requests */
2799                                                         s->tlsext_heartbeat |= SSL_TLSEXT_HB_ENABLED;
2800                                                         break;
2801                                 case 0x02:      /* Server doesn't accept HB requests */
2802                                                         s->tlsext_heartbeat |= SSL_TLSEXT_HB_ENABLED;
2803                                                         s->tlsext_heartbeat |= SSL_TLSEXT_HB_DONT_SEND_REQUESTS;
2804                                                         break;
2805                                 default:        *al = SSL_AD_ILLEGAL_PARAMETER;
2806                                                         return 0;
2807                                 }
2808                         }
2809 #endif
2810                 else if (type == TLSEXT_TYPE_use_srtp)
2811                         {
2812                         if(ssl_parse_serverhello_use_srtp_ext(s, data, size,
2813                                                               al))
2814                                 return 0;
2815                         }
2816                 /* If this extension type was not otherwise handled, but
2817                  * matches a custom_cli_ext_record, then send it to the c
2818                  * callback */
2819                 else if (s->ctx->custom_cli_ext_records_count)
2820                         {
2821                         size_t i;
2822                         custom_cli_ext_record* record;
2823
2824                         for (i = 0; i < s->ctx->custom_cli_ext_records_count; i++)
2825                                 {
2826                                 record = &s->ctx->custom_cli_ext_records[i];
2827                                 if (record->ext_type == type)
2828                                         {
2829                                         if (record->fn2 && !record->fn2(s, type, data, size, al, record->arg))
2830                                                 return 0;
2831                                         break;
2832                                         }
2833                                 }
2834                         }
2835 #ifdef TLSEXT_TYPE_encrypt_then_mac
2836                 else if (type == TLSEXT_TYPE_encrypt_then_mac)
2837                         {
2838                         /* Ignore if inappropriate ciphersuite */
2839                         if (s->s3->tmp.new_cipher->algorithm_mac != SSL_AEAD)
2840                                 s->s3->flags |= TLS1_FLAGS_ENCRYPT_THEN_MAC;
2841                         }
2842 #endif
2843
2844                 data += size;
2845                 }
2846
2847         if (data != d+n)
2848                 {
2849                 *al = SSL_AD_DECODE_ERROR;
2850                 return 0;
2851                 }
2852
2853         if (!s->hit && tlsext_servername == 1)
2854                 {
2855                 if (s->tlsext_hostname)
2856                         {
2857                         if (s->session->tlsext_hostname == NULL)
2858                                 {
2859                                 s->session->tlsext_hostname = BUF_strdup(s->tlsext_hostname);
2860                                 if (!s->session->tlsext_hostname)
2861                                         {
2862                                         *al = SSL_AD_UNRECOGNIZED_NAME;
2863                                         return 0;
2864                                         }
2865                                 }
2866                         else
2867                                 {
2868                                 *al = SSL_AD_DECODE_ERROR;
2869                                 return 0;
2870                                 }
2871                         }
2872                 }
2873
2874         *p = data;
2875
2876         ri_check:
2877
2878         /* Determine if we need to see RI. Strictly speaking if we want to
2879          * avoid an attack we should *always* see RI even on initial server
2880          * hello because the client doesn't see any renegotiation during an
2881          * attack. However this would mean we could not connect to any server
2882          * which doesn't support RI so for the immediate future tolerate RI
2883          * absence on initial connect only.
2884          */
2885         if (!renegotiate_seen
2886                 && !(s->options & SSL_OP_LEGACY_SERVER_CONNECT)
2887                 && !(s->options & SSL_OP_ALLOW_UNSAFE_LEGACY_RENEGOTIATION))
2888                 {
2889                 *al = SSL_AD_HANDSHAKE_FAILURE;
2890                 SSLerr(SSL_F_SSL_SCAN_SERVERHELLO_TLSEXT,
2891                                 SSL_R_UNSAFE_LEGACY_RENEGOTIATION_DISABLED);
2892                 return 0;
2893                 }
2894
2895         return 1;
2896         }
2897
2898
2899 int ssl_prepare_clienthello_tlsext(SSL *s)
2900         {
2901
2902 #ifdef TLSEXT_TYPE_opaque_prf_input
2903         {
2904                 int r = 1;
2905
2906                 if (s->ctx->tlsext_opaque_prf_input_callback != 0)
2907                         {
2908                         r = s->ctx->tlsext_opaque_prf_input_callback(s, NULL, 0, s->ctx->tlsext_opaque_prf_input_callback_arg);
2909                         if (!r)
2910                                 return -1;
2911                         }
2912
2913                 if (s->tlsext_opaque_prf_input != NULL)
2914                         {
2915                         if (s->s3->client_opaque_prf_input != NULL) /* shouldn't really happen */
2916                                 OPENSSL_free(s->s3->client_opaque_prf_input);
2917
2918                         if (s->tlsext_opaque_prf_input_len == 0)
2919                                 s->s3->client_opaque_prf_input = OPENSSL_malloc(1); /* dummy byte just to get non-NULL */
2920                         else
2921                                 s->s3->client_opaque_prf_input = BUF_memdup(s->tlsext_opaque_prf_input, s->tlsext_opaque_prf_input_len);
2922                         if (s->s3->client_opaque_prf_input == NULL)
2923                                 {
2924                                 SSLerr(SSL_F_SSL_PREPARE_CLIENTHELLO_TLSEXT,ERR_R_MALLOC_FAILURE);
2925                                 return -1;
2926                                 }
2927                         s->s3->client_opaque_prf_input_len = s->tlsext_opaque_prf_input_len;
2928                         }
2929
2930                 if (r == 2)
2931                         /* at callback's request, insist on receiving an appropriate server opaque PRF input */
2932                         s->s3->server_opaque_prf_input_len = s->tlsext_opaque_prf_input_len;
2933         }
2934 #endif
2935
2936         return 1;
2937         }
2938
2939 int ssl_prepare_serverhello_tlsext(SSL *s)
2940         {
2941         return 1;
2942         }
2943
2944 static int ssl_check_clienthello_tlsext_early(SSL *s)
2945         {
2946         int ret=SSL_TLSEXT_ERR_NOACK;
2947         int al = SSL_AD_UNRECOGNIZED_NAME;
2948
2949 #ifndef OPENSSL_NO_EC
2950         /* The handling of the ECPointFormats extension is done elsewhere, namely in
2951          * ssl3_choose_cipher in s3_lib.c.
2952          */
2953         /* The handling of the EllipticCurves extension is done elsewhere, namely in
2954          * ssl3_choose_cipher in s3_lib.c.
2955          */
2956 #endif
2957
2958         if (s->ctx != NULL && s->ctx->tlsext_servername_callback != 0)
2959                 ret = s->ctx->tlsext_servername_callback(s, &al, s->ctx->tlsext_servername_arg);
2960         else if (s->initial_ctx != NULL && s->initial_ctx->tlsext_servername_callback != 0)
2961                 ret = s->initial_ctx->tlsext_servername_callback(s, &al, s->initial_ctx->tlsext_servername_arg);
2962
2963 #ifdef TLSEXT_TYPE_opaque_prf_input
2964         {
2965                 /* This sort of belongs into ssl_prepare_serverhello_tlsext(),
2966                  * but we might be sending an alert in response to the client hello,
2967                  * so this has to happen here in
2968                  * ssl_check_clienthello_tlsext_early(). */
2969
2970                 int r = 1;
2971
2972                 if (s->ctx->tlsext_opaque_prf_input_callback != 0)
2973                         {
2974                         r = s->ctx->tlsext_opaque_prf_input_callback(s, NULL, 0, s->ctx->tlsext_opaque_prf_input_callback_arg);
2975                         if (!r)
2976                                 {
2977                                 ret = SSL_TLSEXT_ERR_ALERT_FATAL;
2978                                 al = SSL_AD_INTERNAL_ERROR;
2979                                 goto err;
2980                                 }
2981                         }
2982
2983                 if (s->s3->server_opaque_prf_input != NULL) /* shouldn't really happen */
2984                         OPENSSL_free(s->s3->server_opaque_prf_input);
2985                 s->s3->server_opaque_prf_input = NULL;
2986
2987                 if (s->tlsext_opaque_prf_input != NULL)
2988                         {
2989                         if (s->s3->client_opaque_prf_input != NULL &&
2990                                 s->s3->client_opaque_prf_input_len == s->tlsext_opaque_prf_input_len)
2991                                 {
2992                                 /* can only use this extension if we have a server opaque PRF input
2993                                  * of the same length as the client opaque PRF input! */
2994
2995                                 if (s->tlsext_opaque_prf_input_len == 0)
2996                                         s->s3->server_opaque_prf_input = OPENSSL_malloc(1); /* dummy byte just to get non-NULL */
2997                                 else
2998                                         s->s3->server_opaque_prf_input = BUF_memdup(s->tlsext_opaque_prf_input, s->tlsext_opaque_prf_input_len);
2999                                 if (s->s3->server_opaque_prf_input == NULL)
3000                                         {
3001                                         ret = SSL_TLSEXT_ERR_ALERT_FATAL;
3002                                         al = SSL_AD_INTERNAL_ERROR;
3003                                         goto err;
3004                                         }
3005                                 s->s3->server_opaque_prf_input_len = s->tlsext_opaque_prf_input_len;
3006                                 }
3007                         }
3008
3009                 if (r == 2 && s->s3->server_opaque_prf_input == NULL)
3010                         {
3011                         /* The callback wants to enforce use of the extension,
3012                          * but we can't do that with the client opaque PRF input;
3013                          * abort the handshake.
3014                          */
3015                         ret = SSL_TLSEXT_ERR_ALERT_FATAL;
3016                         al = SSL_AD_HANDSHAKE_FAILURE;
3017                         }
3018         }
3019
3020  err:
3021 #endif
3022         switch (ret)
3023                 {
3024                 case SSL_TLSEXT_ERR_ALERT_FATAL:
3025                         ssl3_send_alert(s,SSL3_AL_FATAL,al);
3026                         return -1;
3027
3028                 case SSL_TLSEXT_ERR_ALERT_WARNING:
3029                         ssl3_send_alert(s,SSL3_AL_WARNING,al);
3030                         return 1;
3031
3032                 case SSL_TLSEXT_ERR_NOACK:
3033                         s->servername_done=0;
3034                         default:
3035                 return 1;
3036                 }
3037         }
3038
3039 int ssl_check_clienthello_tlsext_late(SSL *s)
3040         {
3041         int ret = SSL_TLSEXT_ERR_OK;
3042         int al;
3043
3044         /* If status request then ask callback what to do.
3045          * Note: this must be called after servername callbacks in case
3046          * the certificate has changed, and must be called after the cipher
3047          * has been chosen because this may influence which certificate is sent
3048          */
3049         if ((s->tlsext_status_type != -1) && s->ctx && s->ctx->tlsext_status_cb)
3050                 {
3051                 int r;
3052                 CERT_PKEY *certpkey;
3053                 certpkey = ssl_get_server_send_pkey(s);
3054                 /* If no certificate can't return certificate status */
3055                 if (certpkey == NULL)
3056                         {
3057                         s->tlsext_status_expected = 0;
3058                         return 1;
3059                         }
3060                 /* Set current certificate to one we will use so
3061                  * SSL_get_certificate et al can pick it up.
3062                  */
3063                 s->cert->key = certpkey;
3064                 r = s->ctx->tlsext_status_cb(s, s->ctx->tlsext_status_arg);
3065                 switch (r)
3066                         {
3067                         /* We don't want to send a status request response */
3068                         case SSL_TLSEXT_ERR_NOACK:
3069                                 s->tlsext_status_expected = 0;
3070                                 break;
3071                         /* status request response should be sent */
3072                         case SSL_TLSEXT_ERR_OK:
3073                                 if (s->tlsext_ocsp_resp)
3074                                         s->tlsext_status_expected = 1;
3075                                 else
3076                                         s->tlsext_status_expected = 0;
3077                                 break;
3078                         /* something bad happened */
3079                         case SSL_TLSEXT_ERR_ALERT_FATAL:
3080                                 ret = SSL_TLSEXT_ERR_ALERT_FATAL;
3081                                 al = SSL_AD_INTERNAL_ERROR;
3082                                 goto err;
3083                         }
3084                 }
3085         else
3086                 s->tlsext_status_expected = 0;
3087
3088  err:
3089         switch (ret)
3090                 {
3091                 case SSL_TLSEXT_ERR_ALERT_FATAL:
3092                         ssl3_send_alert(s, SSL3_AL_FATAL, al);
3093                         return -1;
3094
3095                 case SSL_TLSEXT_ERR_ALERT_WARNING:
3096                         ssl3_send_alert(s, SSL3_AL_WARNING, al);
3097                         return 1;
3098
3099                 default:
3100                         return 1;
3101                 }
3102         }
3103
3104 int ssl_check_serverhello_tlsext(SSL *s)
3105         {
3106         int ret=SSL_TLSEXT_ERR_NOACK;
3107         int al = SSL_AD_UNRECOGNIZED_NAME;
3108
3109 #ifndef OPENSSL_NO_EC
3110         /* If we are client and using an elliptic curve cryptography cipher
3111          * suite, then if server returns an EC point formats lists extension
3112          * it must contain uncompressed.
3113          */
3114         unsigned long alg_k = s->s3->tmp.new_cipher->algorithm_mkey;
3115         unsigned long alg_a = s->s3->tmp.new_cipher->algorithm_auth;
3116         if ((s->tlsext_ecpointformatlist != NULL) && (s->tlsext_ecpointformatlist_length > 0) &&
3117             (s->session->tlsext_ecpointformatlist != NULL) && (s->session->tlsext_ecpointformatlist_length > 0) &&
3118             ((alg_k & (SSL_kEECDH|SSL_kECDHr|SSL_kECDHe)) || (alg_a & SSL_aECDSA)))
3119                 {
3120                 /* we are using an ECC cipher */
3121                 size_t i;
3122                 unsigned char *list;
3123                 int found_uncompressed = 0;
3124                 list = s->session->tlsext_ecpointformatlist;
3125                 for (i = 0; i < s->session->tlsext_ecpointformatlist_length; i++)
3126                         {
3127                         if (*(list++) == TLSEXT_ECPOINTFORMAT_uncompressed)
3128                                 {
3129                                 found_uncompressed = 1;
3130                                 break;
3131                                 }
3132                         }
3133                 if (!found_uncompressed)
3134                         {
3135                         SSLerr(SSL_F_SSL_CHECK_SERVERHELLO_TLSEXT,SSL_R_TLS_INVALID_ECPOINTFORMAT_LIST);
3136                         return -1;
3137                         }
3138                 }
3139         ret = SSL_TLSEXT_ERR_OK;
3140 #endif /* OPENSSL_NO_EC */
3141
3142         if (s->ctx != NULL && s->ctx->tlsext_servername_callback != 0)
3143                 ret = s->ctx->tlsext_servername_callback(s, &al, s->ctx->tlsext_servername_arg);
3144         else if (s->initial_ctx != NULL && s->initial_ctx->tlsext_servername_callback != 0)
3145                 ret = s->initial_ctx->tlsext_servername_callback(s, &al, s->initial_ctx->tlsext_servername_arg);
3146
3147 #ifdef TLSEXT_TYPE_opaque_prf_input
3148         if (s->s3->server_opaque_prf_input_len > 0)
3149                 {
3150                 /* This case may indicate that we, as a client, want to insist on using opaque PRF inputs.
3151                  * So first verify that we really have a value from the server too. */
3152
3153                 if (s->s3->server_opaque_prf_input == NULL)
3154                         {
3155                         ret = SSL_TLSEXT_ERR_ALERT_FATAL;
3156                         al = SSL_AD_HANDSHAKE_FAILURE;
3157                         }
3158
3159                 /* Anytime the server *has* sent an opaque PRF input, we need to check
3160                  * that we have a client opaque PRF input of the same size. */
3161                 if (s->s3->client_opaque_prf_input == NULL ||
3162                     s->s3->client_opaque_prf_input_len != s->s3->server_opaque_prf_input_len)
3163                         {
3164                         ret = SSL_TLSEXT_ERR_ALERT_FATAL;
3165                         al = SSL_AD_ILLEGAL_PARAMETER;
3166                         }
3167                 }
3168 #endif
3169
3170         /* If we've requested certificate status and we wont get one
3171          * tell the callback
3172          */
3173         if ((s->tlsext_status_type != -1) && !(s->tlsext_status_expected)
3174                         && s->ctx && s->ctx->tlsext_status_cb)
3175                 {
3176                 int r;
3177                 /* Set resp to NULL, resplen to -1 so callback knows
3178                  * there is no response.
3179                  */
3180                 if (s->tlsext_ocsp_resp)
3181                         {
3182                         OPENSSL_free(s->tlsext_ocsp_resp);
3183                         s->tlsext_ocsp_resp = NULL;
3184                         }
3185                 s->tlsext_ocsp_resplen = -1;
3186                 r = s->ctx->tlsext_status_cb(s, s->ctx->tlsext_status_arg);
3187                 if (r == 0)
3188                         {
3189                         al = SSL_AD_BAD_CERTIFICATE_STATUS_RESPONSE;
3190                         ret = SSL_TLSEXT_ERR_ALERT_FATAL;
3191                         }
3192                 if (r < 0)
3193                         {
3194                         al = SSL_AD_INTERNAL_ERROR;
3195                         ret = SSL_TLSEXT_ERR_ALERT_FATAL;
3196                         }
3197                 }
3198
3199         switch (ret)
3200                 {
3201                 case SSL_TLSEXT_ERR_ALERT_FATAL:
3202                         ssl3_send_alert(s,SSL3_AL_FATAL,al);
3203                         return -1;
3204
3205                 case SSL_TLSEXT_ERR_ALERT_WARNING:
3206                         ssl3_send_alert(s,SSL3_AL_WARNING,al);
3207                         return 1;
3208
3209                 case SSL_TLSEXT_ERR_NOACK:
3210                         s->servername_done=0;
3211                         default:
3212                 return 1;
3213                 }
3214         }
3215
3216 int ssl_parse_serverhello_tlsext(SSL *s, unsigned char **p, unsigned char *d, int n)
3217         {
3218         int al = -1;
3219         if (s->version < SSL3_VERSION)
3220                 return 1;
3221         if (ssl_scan_serverhello_tlsext(s, p, d, n, &al) <= 0)
3222                 {
3223                 ssl3_send_alert(s,SSL3_AL_FATAL,al);
3224                 return 0;
3225                 }
3226
3227         if (ssl_check_serverhello_tlsext(s) <= 0)
3228                 {
3229                 SSLerr(SSL_F_SSL_PARSE_SERVERHELLO_TLSEXT,SSL_R_SERVERHELLO_TLSEXT);
3230                 return 0;
3231                 }
3232         return 1;
3233 }
3234
3235 /* Since the server cache lookup is done early on in the processing of the
3236  * ClientHello, and other operations depend on the result, we need to handle
3237  * any TLS session ticket extension at the same time.
3238  *
3239  *   session_id: points at the session ID in the ClientHello. This code will
3240  *       read past the end of this in order to parse out the session ticket
3241  *       extension, if any.
3242  *   len: the length of the session ID.
3243  *   limit: a pointer to the first byte after the ClientHello.
3244  *   ret: (output) on return, if a ticket was decrypted, then this is set to
3245  *       point to the resulting session.
3246  *
3247  * If s->tls_session_secret_cb is set then we are expecting a pre-shared key
3248  * ciphersuite, in which case we have no use for session tickets and one will
3249  * never be decrypted, nor will s->tlsext_ticket_expected be set to 1.
3250  *
3251  * Returns:
3252  *   -1: fatal error, either from parsing or decrypting the ticket.
3253  *    0: no ticket was found (or was ignored, based on settings).
3254  *    1: a zero length extension was found, indicating that the client supports
3255  *       session tickets but doesn't currently have one to offer.
3256  *    2: either s->tls_session_secret_cb was set, or a ticket was offered but
3257  *       couldn't be decrypted because of a non-fatal error.
3258  *    3: a ticket was successfully decrypted and *ret was set.
3259  *
3260  * Side effects:
3261  *   Sets s->tlsext_ticket_expected to 1 if the server will have to issue
3262  *   a new session ticket to the client because the client indicated support
3263  *   (and s->tls_session_secret_cb is NULL) but the client either doesn't have
3264  *   a session ticket or we couldn't use the one it gave us, or if
3265  *   s->ctx->tlsext_ticket_key_cb asked to renew the client's ticket.
3266  *   Otherwise, s->tlsext_ticket_expected is set to 0.
3267  */
3268 int tls1_process_ticket(SSL *s, unsigned char *session_id, int len,
3269                         const unsigned char *limit, SSL_SESSION **ret)
3270         {
3271         /* Point after session ID in client hello */
3272         const unsigned char *p = session_id + len;
3273         unsigned short i;
3274
3275         *ret = NULL;
3276         s->tlsext_ticket_expected = 0;
3277
3278         /* If tickets disabled behave as if no ticket present
3279          * to permit stateful resumption.
3280          */
3281         if (SSL_get_options(s) & SSL_OP_NO_TICKET)
3282                 return 0;
3283         if ((s->version <= SSL3_VERSION) || !limit)
3284                 return 0;
3285         if (p >= limit)
3286                 return -1;
3287         /* Skip past DTLS cookie */
3288         if (SSL_IS_DTLS(s))
3289                 {
3290                 i = *(p++);
3291                 p+= i;
3292                 if (p >= limit)
3293                         return -1;
3294                 }
3295         /* Skip past cipher list */
3296         n2s(p, i);
3297         p+= i;
3298         if (p >= limit)
3299                 return -1;
3300         /* Skip past compression algorithm list */
3301         i = *(p++);
3302         p += i;
3303         if (p > limit)
3304                 return -1;
3305         /* Now at start of extensions */
3306         if ((p + 2) >= limit)
3307                 return 0;
3308         n2s(p, i);
3309         while ((p + 4) <= limit)
3310                 {
3311                 unsigned short type, size;
3312                 n2s(p, type);
3313                 n2s(p, size);
3314                 if (p + size > limit)
3315                         return 0;
3316                 if (type == TLSEXT_TYPE_session_ticket)
3317                         {
3318                         int r;
3319                         if (size == 0)
3320                                 {
3321                                 /* The client will accept a ticket but doesn't
3322                                  * currently have one. */
3323                                 s->tlsext_ticket_expected = 1;
3324                                 return 1;
3325                                 }
3326                         if (s->tls_session_secret_cb)
3327                                 {
3328                                 /* Indicate that the ticket couldn't be
3329                                  * decrypted rather than generating the session
3330                                  * from ticket now, trigger abbreviated
3331                                  * handshake based on external mechanism to
3332                                  * calculate the master secret later. */
3333                                 return 2;
3334                                 }
3335                         r = tls_decrypt_ticket(s, p, size, session_id, len, ret);
3336                         switch (r)
3337                                 {
3338                                 case 2: /* ticket couldn't be decrypted */
3339                                         s->tlsext_ticket_expected = 1;
3340                                         return 2;
3341                                 case 3: /* ticket was decrypted */
3342                                         return r;
3343                                 case 4: /* ticket decrypted but need to renew */
3344                                         s->tlsext_ticket_expected = 1;
3345                                         return 3;
3346                                 default: /* fatal error */
3347                                         return -1;
3348                                 }
3349                         }
3350                 p += size;
3351                 }
3352         return 0;
3353         }
3354
3355 /* tls_decrypt_ticket attempts to decrypt a session ticket.
3356  *
3357  *   etick: points to the body of the session ticket extension.
3358  *   eticklen: the length of the session tickets extenion.
3359  *   sess_id: points at the session ID.
3360  *   sesslen: the length of the session ID.
3361  *   psess: (output) on return, if a ticket was decrypted, then this is set to
3362  *       point to the resulting session.
3363  *
3364  * Returns:
3365  *   -1: fatal error, either from parsing or decrypting the ticket.
3366  *    2: the ticket couldn't be decrypted.
3367  *    3: a ticket was successfully decrypted and *psess was set.
3368  *    4: same as 3, but the ticket needs to be renewed.
3369  */
3370 static int tls_decrypt_ticket(SSL *s, const unsigned char *etick, int eticklen,
3371                                 const unsigned char *sess_id, int sesslen,
3372                                 SSL_SESSION **psess)
3373         {
3374         SSL_SESSION *sess;
3375         unsigned char *sdec;
3376         const unsigned char *p;
3377         int slen, mlen, renew_ticket = 0;
3378         unsigned char tick_hmac[EVP_MAX_MD_SIZE];
3379         HMAC_CTX hctx;
3380         EVP_CIPHER_CTX ctx;
3381         SSL_CTX *tctx = s->initial_ctx;
3382         /* Need at least keyname + iv + some encrypted data */
3383         if (eticklen < 48)
3384                 return 2;
3385         /* Initialize session ticket encryption and HMAC contexts */
3386         HMAC_CTX_init(&hctx);
3387         EVP_CIPHER_CTX_init(&ctx);
3388         if (tctx->tlsext_ticket_key_cb)
3389                 {
3390                 unsigned char *nctick = (unsigned char *)etick;
3391                 int rv = tctx->tlsext_ticket_key_cb(s, nctick, nctick + 16,
3392                                                         &ctx, &hctx, 0);
3393                 if (rv < 0)
3394                         return -1;
3395                 if (rv == 0)
3396                         return 2;
3397                 if (rv == 2)
3398                         renew_ticket = 1;
3399                 }
3400         else
3401                 {
3402                 /* Check key name matches */
3403                 if (memcmp(etick, tctx->tlsext_tick_key_name, 16))
3404                         return 2;
3405                 HMAC_Init_ex(&hctx, tctx->tlsext_tick_hmac_key, 16,
3406                                         tlsext_tick_md(), NULL);
3407                 EVP_DecryptInit_ex(&ctx, EVP_aes_128_cbc(), NULL,
3408                                 tctx->tlsext_tick_aes_key, etick + 16);
3409                 }
3410         /* Attempt to process session ticket, first conduct sanity and
3411          * integrity checks on ticket.
3412          */
3413         mlen = HMAC_size(&hctx);
3414         if (mlen < 0)
3415                 {
3416                 EVP_CIPHER_CTX_cleanup(&ctx);
3417                 return -1;
3418                 }
3419         eticklen -= mlen;
3420         /* Check HMAC of encrypted ticket */
3421         HMAC_Update(&hctx, etick, eticklen);
3422         HMAC_Final(&hctx, tick_hmac, NULL);
3423         HMAC_CTX_cleanup(&hctx);
3424         if (CRYPTO_memcmp(tick_hmac, etick + eticklen, mlen))
3425                 return 2;
3426         /* Attempt to decrypt session data */
3427         /* Move p after IV to start of encrypted ticket, update length */
3428         p = etick + 16 + EVP_CIPHER_CTX_iv_length(&ctx);
3429         eticklen -= 16 + EVP_CIPHER_CTX_iv_length(&ctx);
3430         sdec = OPENSSL_malloc(eticklen);
3431         if (!sdec)
3432                 {
3433                 EVP_CIPHER_CTX_cleanup(&ctx);
3434                 return -1;
3435                 }
3436         EVP_DecryptUpdate(&ctx, sdec, &slen, p, eticklen);
3437         if (EVP_DecryptFinal(&ctx, sdec + slen, &mlen) <= 0)
3438                 return 2;
3439         slen += mlen;
3440         EVP_CIPHER_CTX_cleanup(&ctx);
3441         p = sdec;
3442
3443         sess = d2i_SSL_SESSION(NULL, &p, slen);
3444         OPENSSL_free(sdec);
3445         if (sess)
3446                 {
3447                 /* The session ID, if non-empty, is used by some clients to
3448                  * detect that the ticket has been accepted. So we copy it to
3449                  * the session structure. If it is empty set length to zero
3450                  * as required by standard.
3451                  */
3452                 if (sesslen)
3453                         memcpy(sess->session_id, sess_id, sesslen);
3454                 sess->session_id_length = sesslen;
3455                 *psess = sess;
3456                 if (renew_ticket)
3457                         return 4;
3458                 else
3459                         return 3;
3460                 }
3461         ERR_clear_error();
3462         /* For session parse failure, indicate that we need to send a new
3463          * ticket. */
3464         return 2;
3465         }
3466
3467 /* Tables to translate from NIDs to TLS v1.2 ids */
3468
3469 typedef struct
3470         {
3471         int nid;
3472         int id;
3473         } tls12_lookup;
3474
3475 static tls12_lookup tls12_md[] = {
3476         {NID_md5, TLSEXT_hash_md5},
3477         {NID_sha1, TLSEXT_hash_sha1},
3478         {NID_sha224, TLSEXT_hash_sha224},
3479         {NID_sha256, TLSEXT_hash_sha256},
3480         {NID_sha384, TLSEXT_hash_sha384},
3481         {NID_sha512, TLSEXT_hash_sha512}
3482 };
3483
3484 static tls12_lookup tls12_sig[] = {
3485         {EVP_PKEY_RSA, TLSEXT_signature_rsa},
3486         {EVP_PKEY_DSA, TLSEXT_signature_dsa},
3487         {EVP_PKEY_EC, TLSEXT_signature_ecdsa}
3488 };
3489
3490 static int tls12_find_id(int nid, tls12_lookup *table, size_t tlen)
3491         {
3492         size_t i;
3493         for (i = 0; i < tlen; i++)
3494                 {
3495                 if (table[i].nid == nid)
3496                         return table[i].id;
3497                 }
3498         return -1;
3499         }
3500
3501 static int tls12_find_nid(int id, tls12_lookup *table, size_t tlen)
3502         {
3503         size_t i;
3504         for (i = 0; i < tlen; i++)
3505                 {
3506                 if ((table[i].id) == id)
3507                         return table[i].nid;
3508                 }
3509         return NID_undef;
3510         }
3511
3512 int tls12_get_sigandhash(unsigned char *p, const EVP_PKEY *pk, const EVP_MD *md)
3513         {
3514         int sig_id, md_id;
3515         if (!md)
3516                 return 0;
3517         md_id = tls12_find_id(EVP_MD_type(md), tls12_md,
3518                                 sizeof(tls12_md)/sizeof(tls12_lookup));
3519         if (md_id == -1)
3520                 return 0;
3521         sig_id = tls12_get_sigid(pk);
3522         if (sig_id == -1)
3523                 return 0;
3524         p[0] = (unsigned char)md_id;
3525         p[1] = (unsigned char)sig_id;
3526         return 1;
3527         }
3528
3529 int tls12_get_sigid(const EVP_PKEY *pk)
3530         {
3531         return tls12_find_id(pk->type, tls12_sig,
3532                                 sizeof(tls12_sig)/sizeof(tls12_lookup));
3533         }
3534
3535 const EVP_MD *tls12_get_hash(unsigned char hash_alg)
3536         {
3537         switch(hash_alg)
3538                 {
3539 #ifndef OPENSSL_NO_MD5
3540                 case TLSEXT_hash_md5:
3541 #ifdef OPENSSL_FIPS
3542                 if (FIPS_mode())
3543                         return NULL;
3544 #endif
3545                 return EVP_md5();
3546 #endif
3547 #ifndef OPENSSL_NO_SHA
3548                 case TLSEXT_hash_sha1:
3549                 return EVP_sha1();
3550 #endif
3551 #ifndef OPENSSL_NO_SHA256
3552                 case TLSEXT_hash_sha224:
3553                 return EVP_sha224();
3554
3555                 case TLSEXT_hash_sha256:
3556                 return EVP_sha256();
3557 #endif
3558 #ifndef OPENSSL_NO_SHA512
3559                 case TLSEXT_hash_sha384:
3560                 return EVP_sha384();
3561
3562                 case TLSEXT_hash_sha512:
3563                 return EVP_sha512();
3564 #endif
3565                 default:
3566                 return NULL;
3567
3568                 }
3569         }
3570
3571 static int tls12_get_pkey_idx(unsigned char sig_alg)
3572         {
3573         switch(sig_alg)
3574                 {
3575 #ifndef OPENSSL_NO_RSA
3576         case TLSEXT_signature_rsa:
3577                 return SSL_PKEY_RSA_SIGN;
3578 #endif
3579 #ifndef OPENSSL_NO_DSA
3580         case TLSEXT_signature_dsa:
3581                 return SSL_PKEY_DSA_SIGN;
3582 #endif
3583 #ifndef OPENSSL_NO_ECDSA
3584         case TLSEXT_signature_ecdsa:
3585                 return SSL_PKEY_ECC;
3586 #endif
3587                 }
3588         return -1;
3589         }
3590
3591 /* Convert TLS 1.2 signature algorithm extension values into NIDs */
3592 static void tls1_lookup_sigalg(int *phash_nid, int *psign_nid,
3593                         int *psignhash_nid, const unsigned char *data)
3594         {
3595         int sign_nid = 0, hash_nid = 0;
3596         if (!phash_nid && !psign_nid && !psignhash_nid)
3597                 return;
3598         if (phash_nid || psignhash_nid)
3599                 {
3600                 hash_nid = tls12_find_nid(data[0], tls12_md,
3601                                         sizeof(tls12_md)/sizeof(tls12_lookup));
3602                 if (phash_nid)
3603                         *phash_nid = hash_nid;
3604                 }
3605         if (psign_nid || psignhash_nid)
3606                 {
3607                 sign_nid = tls12_find_nid(data[1], tls12_sig,
3608                                         sizeof(tls12_sig)/sizeof(tls12_lookup));
3609                 if (psign_nid)
3610                         *psign_nid = sign_nid;
3611                 }
3612         if (psignhash_nid)
3613                 {
3614                 if (sign_nid && hash_nid)
3615                         OBJ_find_sigid_by_algs(psignhash_nid,
3616                                                         hash_nid, sign_nid);
3617                 else
3618                         *psignhash_nid = NID_undef;
3619                 }
3620         }
3621 /* Given preference and allowed sigalgs set shared sigalgs */
3622 static int tls12_do_shared_sigalgs(TLS_SIGALGS *shsig,
3623                                 const unsigned char *pref, size_t preflen,
3624                                 const unsigned char *allow, size_t allowlen)
3625         {
3626         const unsigned char *ptmp, *atmp;
3627         size_t i, j, nmatch = 0;
3628         for (i = 0, ptmp = pref; i < preflen; i+=2, ptmp+=2)
3629                 {
3630                 /* Skip disabled hashes or signature algorithms */
3631                 if (tls12_get_hash(ptmp[0]) == NULL)
3632                         continue;
3633                 if (tls12_get_pkey_idx(ptmp[1]) == -1)
3634                         continue;
3635                 for (j = 0, atmp = allow; j < allowlen; j+=2, atmp+=2)
3636                         {
3637                         if (ptmp[0] == atmp[0] && ptmp[1] == atmp[1])
3638                                 {
3639                                 nmatch++;
3640                                 if (shsig)
3641                                         {
3642                                         shsig->rhash = ptmp[0];
3643                                         shsig->rsign = ptmp[1];
3644                                         tls1_lookup_sigalg(&shsig->hash_nid,
3645                                                 &shsig->sign_nid,
3646                                                 &shsig->signandhash_nid,
3647                                                 ptmp);
3648                                         shsig++;
3649                                         }
3650                                 break;
3651                                 }
3652                         }
3653                 }
3654         return nmatch;
3655         }
3656
3657 /* Set shared signature algorithms for SSL structures */
3658 static int tls1_set_shared_sigalgs(SSL *s)
3659         {
3660         const unsigned char *pref, *allow, *conf;
3661         size_t preflen, allowlen, conflen;
3662         size_t nmatch;
3663         TLS_SIGALGS *salgs = NULL;
3664         CERT *c = s->cert;
3665         unsigned int is_suiteb = tls1_suiteb(s);
3666         /* If client use client signature algorithms if not NULL */
3667         if (!s->server && c->client_sigalgs && !is_suiteb)
3668                 {
3669                 conf = c->client_sigalgs;
3670                 conflen = c->client_sigalgslen;
3671                 }
3672         else if (c->conf_sigalgs && !is_suiteb)
3673                 {
3674                 conf = c->conf_sigalgs;
3675                 conflen = c->conf_sigalgslen;
3676                 }
3677         else
3678                 conflen = tls12_get_psigalgs(s, &conf);
3679         if(s->options & SSL_OP_CIPHER_SERVER_PREFERENCE || is_suiteb)
3680                 {
3681                 pref = conf;
3682                 preflen = conflen;
3683                 allow = c->peer_sigalgs;
3684                 allowlen = c->peer_sigalgslen;
3685                 }
3686         else
3687                 {
3688                 allow = conf;
3689                 allowlen = conflen;
3690                 pref = c->peer_sigalgs;
3691                 preflen = c->peer_sigalgslen;
3692                 }
3693         nmatch = tls12_do_shared_sigalgs(NULL, pref, preflen, allow, allowlen);
3694         if (!nmatch)
3695                 return 1;
3696         salgs = OPENSSL_malloc(nmatch * sizeof(TLS_SIGALGS));
3697         if (!salgs)
3698                 return 0;
3699         nmatch = tls12_do_shared_sigalgs(salgs, pref, preflen, allow, allowlen);
3700         c->shared_sigalgs = salgs;
3701         c->shared_sigalgslen = nmatch;
3702         return 1;
3703         }
3704
3705
3706 /* Set preferred digest for each key type */
3707
3708 int tls1_process_sigalgs(SSL *s, const unsigned char *data, int dsize)
3709         {
3710         int idx;
3711         size_t i;
3712         const EVP_MD *md;
3713         CERT *c = s->cert;
3714         TLS_SIGALGS *sigptr;
3715         /* Extension ignored for inappropriate versions */
3716         if (!SSL_USE_SIGALGS(s))
3717                 return 1;
3718         /* Should never happen */
3719         if (!c)
3720                 return 0;
3721
3722         c->peer_sigalgs = OPENSSL_malloc(dsize);
3723         if (!c->peer_sigalgs)
3724                 return 0;
3725         c->peer_sigalgslen = dsize;
3726         memcpy(c->peer_sigalgs, data, dsize);
3727
3728         tls1_set_shared_sigalgs(s);
3729
3730 #ifdef OPENSSL_SSL_DEBUG_BROKEN_PROTOCOL
3731         if (s->cert->cert_flags & SSL_CERT_FLAG_BROKEN_PROTOCOL)
3732                 {
3733                 /* Use first set signature preference to force message
3734                  * digest, ignoring any peer preferences.
3735                  */
3736                 const unsigned char *sigs = NULL;
3737                 if (s->server)
3738                         sigs = c->conf_sigalgs;
3739                 else
3740                         sigs = c->client_sigalgs;
3741                 if (sigs)
3742                         {
3743                         idx = tls12_get_pkey_idx(sigs[1]);
3744                         md = tls12_get_hash(sigs[0]);
3745                         c->pkeys[idx].digest = md;
3746                         c->pkeys[idx].valid_flags = CERT_PKEY_EXPLICIT_SIGN;
3747                         if (idx == SSL_PKEY_RSA_SIGN)
3748                                 {
3749                                 c->pkeys[SSL_PKEY_RSA_ENC].valid_flags = CERT_PKEY_EXPLICIT_SIGN;
3750                                 c->pkeys[SSL_PKEY_RSA_ENC].digest = md;
3751                                 }
3752                         }
3753                 }
3754 #endif
3755
3756         for (i = 0, sigptr = c->shared_sigalgs;
3757                         i < c->shared_sigalgslen; i++, sigptr++)
3758                 {
3759                 idx = tls12_get_pkey_idx(sigptr->rsign);
3760                 if (idx > 0 && c->pkeys[idx].digest == NULL)
3761                         {
3762                         md = tls12_get_hash(sigptr->rhash);
3763                         c->pkeys[idx].digest = md;
3764                         c->pkeys[idx].valid_flags = CERT_PKEY_EXPLICIT_SIGN;
3765                         if (idx == SSL_PKEY_RSA_SIGN)
3766                                 {
3767                                 c->pkeys[SSL_PKEY_RSA_ENC].valid_flags = CERT_PKEY_EXPLICIT_SIGN;
3768                                 c->pkeys[SSL_PKEY_RSA_ENC].digest = md;
3769                                 }
3770                         }
3771
3772                 }
3773         /* In strict mode leave unset digests as NULL to indicate we can't
3774          * use the certificate for signing.
3775          */
3776         if (!(s->cert->cert_flags & SSL_CERT_FLAGS_CHECK_TLS_STRICT))
3777                 {
3778                 /* Set any remaining keys to default values. NOTE: if alg is
3779                  * not supported it stays as NULL.
3780                  */
3781 #ifndef OPENSSL_NO_DSA
3782                 if (!c->pkeys[SSL_PKEY_DSA_SIGN].digest)
3783                         c->pkeys[SSL_PKEY_DSA_SIGN].digest = EVP_sha1();
3784 #endif
3785 #ifndef OPENSSL_NO_RSA
3786                 if (!c->pkeys[SSL_PKEY_RSA_SIGN].digest)
3787                         {
3788                         c->pkeys[SSL_PKEY_RSA_SIGN].digest = EVP_sha1();
3789                         c->pkeys[SSL_PKEY_RSA_ENC].digest = EVP_sha1();
3790                         }
3791 #endif
3792 #ifndef OPENSSL_NO_ECDSA
3793                 if (!c->pkeys[SSL_PKEY_ECC].digest)
3794                         c->pkeys[SSL_PKEY_ECC].digest = EVP_sha1();
3795 #endif
3796                 }
3797         return 1;
3798         }
3799
3800
3801 int SSL_get_sigalgs(SSL *s, int idx,
3802                         int *psign, int *phash, int *psignhash,
3803                         unsigned char *rsig, unsigned char *rhash)
3804         {
3805         const unsigned char *psig = s->cert->peer_sigalgs;
3806         if (psig == NULL)
3807                 return 0;
3808         if (idx >= 0)
3809                 {
3810                 idx <<= 1;
3811                 if (idx >= (int)s->cert->peer_sigalgslen)
3812                         return 0;
3813                 psig += idx;
3814                 if (rhash)
3815                         *rhash = psig[0];
3816                 if (rsig)
3817                         *rsig = psig[1];
3818                 tls1_lookup_sigalg(phash, psign, psignhash, psig);
3819                 }
3820         return s->cert->peer_sigalgslen / 2;
3821         }
3822
3823 int SSL_get_shared_sigalgs(SSL *s, int idx,
3824                         int *psign, int *phash, int *psignhash,
3825                         unsigned char *rsig, unsigned char *rhash)
3826         {
3827         TLS_SIGALGS *shsigalgs = s->cert->shared_sigalgs;
3828         if (!shsigalgs || idx >= (int)s->cert->shared_sigalgslen)
3829                 return 0;
3830         shsigalgs += idx;
3831         if (phash)
3832                 *phash = shsigalgs->hash_nid;
3833         if (psign)
3834                 *psign = shsigalgs->sign_nid;
3835         if (psignhash)
3836                 *psignhash = shsigalgs->signandhash_nid;
3837         if (rsig)
3838                 *rsig = shsigalgs->rsign;
3839         if (rhash)
3840                 *rhash = shsigalgs->rhash;
3841         return s->cert->shared_sigalgslen;
3842         }
3843
3844
3845 #ifndef OPENSSL_NO_HEARTBEATS
3846 int
3847 tls1_process_heartbeat(SSL *s)
3848         {
3849         unsigned char *p = &s->s3->rrec.data[0], *pl;
3850         unsigned short hbtype;
3851         unsigned int payload;
3852         unsigned int padding = 16; /* Use minimum padding */
3853
3854         /* Read type and payload length first */
3855         hbtype = *p++;
3856         n2s(p, payload);
3857         pl = p;
3858
3859         if (s->msg_callback)
3860                 s->msg_callback(0, s->version, TLS1_RT_HEARTBEAT,
3861                         &s->s3->rrec.data[0], s->s3->rrec.length,
3862                         s, s->msg_callback_arg);
3863
3864         if (hbtype == TLS1_HB_REQUEST)
3865                 {
3866                 unsigned char *buffer, *bp;
3867                 int r;
3868
3869                 /* Allocate memory for the response, size is 1 bytes
3870                  * message type, plus 2 bytes payload length, plus
3871                  * payload, plus padding
3872                  */
3873                 buffer = OPENSSL_malloc(1 + 2 + payload + padding);
3874                 bp = buffer;
3875
3876                 /* Enter response type, length and copy payload */
3877                 *bp++ = TLS1_HB_RESPONSE;
3878                 s2n(payload, bp);
3879                 memcpy(bp, pl, payload);
3880                 bp += payload;
3881                 /* Random padding */
3882                 RAND_pseudo_bytes(bp, padding);
3883
3884                 r = ssl3_write_bytes(s, TLS1_RT_HEARTBEAT, buffer, 3 + payload + padding);
3885
3886                 if (r >= 0 && s->msg_callback)
3887                         s->msg_callback(1, s->version, TLS1_RT_HEARTBEAT,
3888                                 buffer, 3 + payload + padding,
3889                                 s, s->msg_callback_arg);
3890
3891                 OPENSSL_free(buffer);
3892
3893                 if (r < 0)
3894                         return r;
3895                 }
3896         else if (hbtype == TLS1_HB_RESPONSE)
3897                 {
3898                 unsigned int seq;
3899
3900                 /* We only send sequence numbers (2 bytes unsigned int),
3901                  * and 16 random bytes, so we just try to read the
3902                  * sequence number */
3903                 n2s(pl, seq);
3904
3905                 if (payload == 18 && seq == s->tlsext_hb_seq)
3906                         {
3907                         s->tlsext_hb_seq++;
3908                         s->tlsext_hb_pending = 0;
3909                         }
3910                 }
3911
3912         return 0;
3913         }
3914
3915 int
3916 tls1_heartbeat(SSL *s)
3917         {
3918         unsigned char *buf, *p;
3919         int ret;
3920         unsigned int payload = 18; /* Sequence number + random bytes */
3921         unsigned int padding = 16; /* Use minimum padding */
3922
3923         /* Only send if peer supports and accepts HB requests... */
3924         if (!(s->tlsext_heartbeat & SSL_TLSEXT_HB_ENABLED) ||
3925             s->tlsext_heartbeat & SSL_TLSEXT_HB_DONT_SEND_REQUESTS)
3926                 {
3927                 SSLerr(SSL_F_TLS1_HEARTBEAT,SSL_R_TLS_HEARTBEAT_PEER_DOESNT_ACCEPT);
3928                 return -1;
3929                 }
3930
3931         /* ...and there is none in flight yet... */
3932         if (s->tlsext_hb_pending)
3933                 {
3934                 SSLerr(SSL_F_TLS1_HEARTBEAT,SSL_R_TLS_HEARTBEAT_PENDING);
3935                 return -1;
3936                 }
3937
3938         /* ...and no handshake in progress. */
3939         if (SSL_in_init(s) || s->in_handshake)
3940                 {
3941                 SSLerr(SSL_F_TLS1_HEARTBEAT,SSL_R_UNEXPECTED_MESSAGE);
3942                 return -1;
3943                 }
3944
3945         /* Check if padding is too long, payload and padding
3946          * must not exceed 2^14 - 3 = 16381 bytes in total.
3947          */
3948         OPENSSL_assert(payload + padding <= 16381);
3949
3950         /* Create HeartBeat message, we just use a sequence number
3951          * as payload to distuingish different messages and add
3952          * some random stuff.
3953          *  - Message Type, 1 byte
3954          *  - Payload Length, 2 bytes (unsigned int)
3955          *  - Payload, the sequence number (2 bytes uint)
3956          *  - Payload, random bytes (16 bytes uint)
3957          *  - Padding
3958          */
3959         buf = OPENSSL_malloc(1 + 2 + payload + padding);
3960         p = buf;
3961         /* Message Type */
3962         *p++ = TLS1_HB_REQUEST;
3963         /* Payload length (18 bytes here) */
3964         s2n(payload, p);
3965         /* Sequence number */
3966         s2n(s->tlsext_hb_seq, p);
3967         /* 16 random bytes */
3968         RAND_pseudo_bytes(p, 16);
3969         p += 16;
3970         /* Random padding */
3971         RAND_pseudo_bytes(p, padding);
3972
3973         ret = ssl3_write_bytes(s, TLS1_RT_HEARTBEAT, buf, 3 + payload + padding);
3974         if (ret >= 0)
3975                 {
3976                 if (s->msg_callback)
3977                         s->msg_callback(1, s->version, TLS1_RT_HEARTBEAT,
3978                                 buf, 3 + payload + padding,
3979                                 s, s->msg_callback_arg);
3980
3981                 s->tlsext_hb_pending = 1;
3982                 }
3983
3984         OPENSSL_free(buf);
3985
3986         return ret;
3987         }
3988 #endif
3989
3990 #define MAX_SIGALGLEN   (TLSEXT_hash_num * TLSEXT_signature_num * 2)
3991
3992 typedef struct
3993         {
3994         size_t sigalgcnt;
3995         int sigalgs[MAX_SIGALGLEN];
3996         } sig_cb_st;
3997
3998 static int sig_cb(const char *elem, int len, void *arg)
3999         {
4000         sig_cb_st *sarg = arg;
4001         size_t i;
4002         char etmp[20], *p;
4003         int sig_alg, hash_alg;
4004         if (sarg->sigalgcnt == MAX_SIGALGLEN)
4005                 return 0;
4006         if (len > (int)(sizeof(etmp) - 1))
4007                 return 0;
4008         memcpy(etmp, elem, len);
4009         etmp[len] = 0;
4010         p = strchr(etmp, '+');
4011         if (!p)
4012                 return 0;
4013         *p = 0;
4014         p++;
4015         if (!*p)
4016                 return 0;
4017
4018         if (!strcmp(etmp, "RSA"))
4019                 sig_alg = EVP_PKEY_RSA;
4020         else if (!strcmp(etmp, "DSA"))
4021                 sig_alg = EVP_PKEY_DSA;
4022         else if (!strcmp(etmp, "ECDSA"))
4023                 sig_alg = EVP_PKEY_EC;
4024         else return 0;
4025
4026         hash_alg = OBJ_sn2nid(p);
4027         if (hash_alg == NID_undef)
4028                 hash_alg = OBJ_ln2nid(p);
4029         if (hash_alg == NID_undef)
4030                 return 0;
4031
4032         for (i = 0; i < sarg->sigalgcnt; i+=2)
4033                 {
4034                 if (sarg->sigalgs[i] == sig_alg
4035                         && sarg->sigalgs[i + 1] == hash_alg)
4036                         return 0;
4037                 }
4038         sarg->sigalgs[sarg->sigalgcnt++] = hash_alg;
4039         sarg->sigalgs[sarg->sigalgcnt++] = sig_alg;
4040         return 1;
4041         }
4042
4043 /* Set suppored signature algorithms based on a colon separated list
4044  * of the form sig+hash e.g. RSA+SHA512:DSA+SHA512 */
4045 int tls1_set_sigalgs_list(CERT *c, const char *str, int client)
4046         {
4047         sig_cb_st sig;
4048         sig.sigalgcnt = 0;
4049         if (!CONF_parse_list(str, ':', 1, sig_cb, &sig))
4050                 return 0;
4051         if (c == NULL)
4052                 return 1;
4053         return tls1_set_sigalgs(c, sig.sigalgs, sig.sigalgcnt, client);
4054         }
4055
4056 int tls1_set_sigalgs(CERT *c, const int *psig_nids, size_t salglen, int client)
4057         {
4058         unsigned char *sigalgs, *sptr;
4059         int rhash, rsign;
4060         size_t i;
4061         if (salglen & 1)
4062                 return 0;
4063         sigalgs = OPENSSL_malloc(salglen);
4064         if (sigalgs == NULL)
4065                 return 0;
4066         for (i = 0, sptr = sigalgs; i < salglen; i+=2)
4067                 {
4068                 rhash = tls12_find_id(*psig_nids++, tls12_md,
4069                                         sizeof(tls12_md)/sizeof(tls12_lookup));
4070                 rsign = tls12_find_id(*psig_nids++, tls12_sig,
4071                                 sizeof(tls12_sig)/sizeof(tls12_lookup));
4072
4073                 if (rhash == -1 || rsign == -1)
4074                         goto err;
4075                 *sptr++ = rhash;
4076                 *sptr++ = rsign;
4077                 }
4078
4079         if (client)
4080                 {
4081                 if (c->client_sigalgs)
4082                         OPENSSL_free(c->client_sigalgs);
4083                 c->client_sigalgs = sigalgs;
4084                 c->client_sigalgslen = salglen;
4085                 }
4086         else
4087                 {
4088                 if (c->conf_sigalgs)
4089                         OPENSSL_free(c->conf_sigalgs);
4090                 c->conf_sigalgs = sigalgs;
4091                 c->conf_sigalgslen = salglen;
4092                 }
4093
4094         return 1;
4095
4096         err:
4097         OPENSSL_free(sigalgs);
4098         return 0;
4099         }
4100
4101 static int tls1_check_sig_alg(CERT *c, X509 *x, int default_nid)
4102         {
4103         int sig_nid;
4104         size_t i;
4105         if (default_nid == -1)
4106                 return 1;
4107         sig_nid = X509_get_signature_nid(x);
4108         if (default_nid)
4109                 return sig_nid == default_nid ? 1 : 0;
4110         for (i = 0; i < c->shared_sigalgslen; i++)
4111                 if (sig_nid == c->shared_sigalgs[i].signandhash_nid)
4112                         return 1;
4113         return 0;
4114         }
4115 /* Check to see if a certificate issuer name matches list of CA names */
4116 static int ssl_check_ca_name(STACK_OF(X509_NAME) *names, X509 *x)
4117         {
4118         X509_NAME *nm;
4119         int i;
4120         nm = X509_get_issuer_name(x);
4121         for (i = 0; i < sk_X509_NAME_num(names); i++)
4122                 {
4123                 if(!X509_NAME_cmp(nm, sk_X509_NAME_value(names, i)))
4124                         return 1;
4125                 }
4126         return 0;
4127         }
4128
4129 /* Check certificate chain is consistent with TLS extensions and is
4130  * usable by server. This servers two purposes: it allows users to
4131  * check chains before passing them to the server and it allows the
4132  * server to check chains before attempting to use them.
4133  */
4134
4135 /* Flags which need to be set for a certificate when stict mode not set */
4136
4137 #define CERT_PKEY_VALID_FLAGS \
4138         (CERT_PKEY_EE_SIGNATURE|CERT_PKEY_EE_PARAM)
4139 /* Strict mode flags */
4140 #define CERT_PKEY_STRICT_FLAGS \
4141          (CERT_PKEY_VALID_FLAGS|CERT_PKEY_CA_SIGNATURE|CERT_PKEY_CA_PARAM \
4142          | CERT_PKEY_ISSUER_NAME|CERT_PKEY_CERT_TYPE)
4143
4144 int tls1_check_chain(SSL *s, X509 *x, EVP_PKEY *pk, STACK_OF(X509) *chain,
4145                                                                         int idx)
4146         {
4147         int i;
4148         int rv = 0;
4149         int check_flags = 0, strict_mode;
4150         CERT_PKEY *cpk = NULL;
4151         CERT *c = s->cert;
4152         unsigned int suiteb_flags = tls1_suiteb(s);
4153         /* idx == -1 means checking server chains */
4154         if (idx != -1)
4155                 {
4156                 /* idx == -2 means checking client certificate chains */
4157                 if (idx == -2)
4158                         {
4159                         cpk = c->key;
4160                         idx = cpk - c->pkeys;
4161                         }
4162                 else
4163                         cpk = c->pkeys + idx;
4164                 x = cpk->x509;
4165                 pk = cpk->privatekey;
4166                 chain = cpk->chain;
4167                 strict_mode = c->cert_flags & SSL_CERT_FLAGS_CHECK_TLS_STRICT;
4168                 /* If no cert or key, forget it */
4169                 if (!x || !pk)
4170                         goto end;
4171 #ifdef OPENSSL_SSL_DEBUG_BROKEN_PROTOCOL
4172                 /* Allow any certificate to pass test */
4173                 if (s->cert->cert_flags & SSL_CERT_FLAG_BROKEN_PROTOCOL)
4174                         {
4175                         rv = CERT_PKEY_STRICT_FLAGS|CERT_PKEY_EXPLICIT_SIGN|CERT_PKEY_VALID|CERT_PKEY_SIGN;
4176                         cpk->valid_flags = rv;
4177                         return rv;
4178                         }
4179 #endif
4180                 }
4181         else
4182                 {
4183                 if (!x || !pk)
4184                         goto end;
4185                 idx = ssl_cert_type(x, pk);
4186                 if (idx == -1)
4187                         goto end;
4188                 cpk = c->pkeys + idx;
4189                 if (c->cert_flags & SSL_CERT_FLAGS_CHECK_TLS_STRICT)
4190                         check_flags = CERT_PKEY_STRICT_FLAGS;
4191                 else
4192                         check_flags = CERT_PKEY_VALID_FLAGS;
4193                 strict_mode = 1;
4194                 }
4195
4196         if (suiteb_flags)
4197                 {
4198                 int ok;
4199                 if (check_flags)
4200                         check_flags |= CERT_PKEY_SUITEB;
4201                 ok = X509_chain_check_suiteb(NULL, x, chain, suiteb_flags);
4202                 if (ok != X509_V_OK)
4203                         {
4204                         if (check_flags)
4205                                 rv |= CERT_PKEY_SUITEB;
4206                         else
4207                                 goto end;
4208                         }
4209                 }
4210
4211         /* Check all signature algorithms are consistent with
4212          * signature algorithms extension if TLS 1.2 or later
4213          * and strict mode.
4214          */
4215         if (TLS1_get_version(s) >= TLS1_2_VERSION && strict_mode)
4216                 {
4217                 int default_nid;
4218                 unsigned char rsign = 0;
4219                 if (c->peer_sigalgs)
4220                         default_nid = 0;
4221                 /* If no sigalgs extension use defaults from RFC5246 */
4222                 else
4223                         {
4224                         switch(idx)
4225                                 {
4226                         case SSL_PKEY_RSA_ENC:
4227                         case SSL_PKEY_RSA_SIGN:
4228                         case SSL_PKEY_DH_RSA:
4229                                 rsign = TLSEXT_signature_rsa;
4230                                 default_nid = NID_sha1WithRSAEncryption;
4231                                 break;
4232
4233                         case SSL_PKEY_DSA_SIGN:
4234                         case SSL_PKEY_DH_DSA:
4235                                 rsign = TLSEXT_signature_dsa;
4236                                 default_nid = NID_dsaWithSHA1;
4237                                 break;
4238
4239                         case SSL_PKEY_ECC:
4240                                 rsign = TLSEXT_signature_ecdsa;
4241                                 default_nid = NID_ecdsa_with_SHA1;
4242                                 break;
4243
4244                         default:
4245                                 default_nid = -1;
4246                                 break;
4247                                 }
4248                         }
4249                 /* If peer sent no signature algorithms extension and we
4250                  * have set preferred signature algorithms check we support
4251                  * sha1.
4252                  */
4253                 if (default_nid > 0 && c->conf_sigalgs)
4254                         {
4255                         size_t j;
4256                         const unsigned char *p = c->conf_sigalgs;
4257                         for (j = 0; j < c->conf_sigalgslen; j += 2, p += 2)
4258                                 {
4259                                 if (p[0] == TLSEXT_hash_sha1 && p[1] == rsign)
4260                                         break;
4261                                 }
4262                         if (j == c->conf_sigalgslen)
4263                                 {
4264                                 if (check_flags)
4265                                         goto skip_sigs;
4266                                 else
4267                                         goto end;
4268                                 }
4269                         }
4270                 /* Check signature algorithm of each cert in chain */
4271                 if (!tls1_check_sig_alg(c, x, default_nid))
4272                         {
4273                         if (!check_flags) goto end;
4274                         }
4275                 else
4276                         rv |= CERT_PKEY_EE_SIGNATURE;
4277                 rv |= CERT_PKEY_CA_SIGNATURE;
4278                 for (i = 0; i < sk_X509_num(chain); i++)
4279                         {
4280                         if (!tls1_check_sig_alg(c, sk_X509_value(chain, i),
4281                                                         default_nid))
4282                                 {
4283                                 if (check_flags)
4284                                         {
4285                                         rv &= ~CERT_PKEY_CA_SIGNATURE;
4286                                         break;
4287                                         }
4288                                 else
4289                                         goto end;
4290                                 }
4291                         }
4292                 }
4293         /* Else not TLS 1.2, so mark EE and CA signing algorithms OK */
4294         else if(check_flags)
4295                 rv |= CERT_PKEY_EE_SIGNATURE|CERT_PKEY_CA_SIGNATURE;
4296         skip_sigs:
4297         /* Check cert parameters are consistent */
4298         if (tls1_check_cert_param(s, x, check_flags ? 1 : 2))
4299                 rv |= CERT_PKEY_EE_PARAM;
4300         else if (!check_flags)
4301                 goto end;
4302         if (!s->server)
4303                 rv |= CERT_PKEY_CA_PARAM;
4304         /* In strict mode check rest of chain too */
4305         else if (strict_mode)
4306                 {
4307                 rv |= CERT_PKEY_CA_PARAM;
4308                 for (i = 0; i < sk_X509_num(chain); i++)
4309                         {
4310                         X509 *ca = sk_X509_value(chain, i);
4311                         if (!tls1_check_cert_param(s, ca, 0))
4312                                 {
4313                                 if (check_flags)
4314                                         {
4315                                         rv &= ~CERT_PKEY_CA_PARAM;
4316                                         break;
4317                                         }
4318                                 else
4319                                         goto end;
4320                                 }
4321                         }
4322                 }
4323         if (!s->server && strict_mode)
4324                 {
4325                 STACK_OF(X509_NAME) *ca_dn;
4326                 int check_type = 0;
4327                 switch (pk->type)
4328                         {
4329                 case EVP_PKEY_RSA:
4330                         check_type = TLS_CT_RSA_SIGN;
4331                         break;
4332                 case EVP_PKEY_DSA:
4333                         check_type = TLS_CT_DSS_SIGN;
4334                         break;
4335                 case EVP_PKEY_EC:
4336                         check_type = TLS_CT_ECDSA_SIGN;
4337                         break;
4338                 case EVP_PKEY_DH:
4339                 case EVP_PKEY_DHX:
4340                                 {
4341                                 int cert_type = X509_certificate_type(x, pk);
4342                                 if (cert_type & EVP_PKS_RSA)
4343                                         check_type = TLS_CT_RSA_FIXED_DH;
4344                                 if (cert_type & EVP_PKS_DSA)
4345                                         check_type = TLS_CT_DSS_FIXED_DH;
4346                                 }
4347                         }
4348                 if (check_type)
4349                         {
4350                         const unsigned char *ctypes;
4351                         int ctypelen;
4352                         if (c->ctypes)
4353                                 {
4354                                 ctypes = c->ctypes;
4355                                 ctypelen = (int)c->ctype_num;
4356                                 }
4357                         else
4358                                 {
4359                                 ctypes = (unsigned char *)s->s3->tmp.ctype;
4360                                 ctypelen = s->s3->tmp.ctype_num;
4361                                 }
4362                         for (i = 0; i < ctypelen; i++)
4363                                 {
4364                                 if (ctypes[i] == check_type)
4365                                         {
4366                                         rv |= CERT_PKEY_CERT_TYPE;
4367                                         break;
4368                                         }
4369                                 }
4370                         if (!(rv & CERT_PKEY_CERT_TYPE) && !check_flags)
4371                                 goto end;
4372                         }
4373                 else
4374                         rv |= CERT_PKEY_CERT_TYPE;
4375
4376
4377                 ca_dn = s->s3->tmp.ca_names;
4378
4379                 if (!sk_X509_NAME_num(ca_dn))
4380                         rv |= CERT_PKEY_ISSUER_NAME;
4381
4382                 if (!(rv & CERT_PKEY_ISSUER_NAME))
4383                         {
4384                         if (ssl_check_ca_name(ca_dn, x))
4385                                 rv |= CERT_PKEY_ISSUER_NAME;
4386                         }
4387                 if (!(rv & CERT_PKEY_ISSUER_NAME))
4388                         {
4389                         for (i = 0; i < sk_X509_num(chain); i++)
4390                                 {
4391                                 X509 *xtmp = sk_X509_value(chain, i);
4392                                 if (ssl_check_ca_name(ca_dn, xtmp))
4393                                         {
4394                                         rv |= CERT_PKEY_ISSUER_NAME;
4395                                         break;
4396                                         }
4397                                 }
4398                         }
4399                 if (!check_flags && !(rv & CERT_PKEY_ISSUER_NAME))
4400                         goto end;
4401                 }
4402         else
4403                 rv |= CERT_PKEY_ISSUER_NAME|CERT_PKEY_CERT_TYPE;
4404
4405         if (!check_flags || (rv & check_flags) == check_flags)
4406                 rv |= CERT_PKEY_VALID;
4407
4408         end:
4409
4410         if (TLS1_get_version(s) >= TLS1_2_VERSION)
4411                 {
4412                 if (cpk->valid_flags & CERT_PKEY_EXPLICIT_SIGN)
4413                         rv |= CERT_PKEY_EXPLICIT_SIGN|CERT_PKEY_SIGN;
4414                 else if (cpk->digest)
4415                         rv |= CERT_PKEY_SIGN;
4416                 }
4417         else
4418                 rv |= CERT_PKEY_SIGN|CERT_PKEY_EXPLICIT_SIGN;
4419
4420         /* When checking a CERT_PKEY structure all flags are irrelevant
4421          * if the chain is invalid.
4422          */
4423         if (!check_flags)
4424                 {
4425                 if (rv & CERT_PKEY_VALID)
4426                         cpk->valid_flags = rv;
4427                 else
4428                         {
4429                         /* Preserve explicit sign flag, clear rest */
4430                         cpk->valid_flags &= CERT_PKEY_EXPLICIT_SIGN;
4431                         return 0;
4432                         }
4433                 }
4434         return rv;
4435         }
4436
4437 /* Set validity of certificates in an SSL structure */
4438 void tls1_set_cert_validity(SSL *s)
4439         {
4440         tls1_check_chain(s, NULL, NULL, NULL, SSL_PKEY_RSA_ENC);
4441         tls1_check_chain(s, NULL, NULL, NULL, SSL_PKEY_RSA_SIGN);
4442         tls1_check_chain(s, NULL, NULL, NULL, SSL_PKEY_DSA_SIGN);
4443         tls1_check_chain(s, NULL, NULL, NULL, SSL_PKEY_DH_RSA);
4444         tls1_check_chain(s, NULL, NULL, NULL, SSL_PKEY_DH_DSA);
4445         tls1_check_chain(s, NULL, NULL, NULL, SSL_PKEY_ECC);
4446         }
4447 /* User level utiity function to check a chain is suitable */
4448 int SSL_check_chain(SSL *s, X509 *x, EVP_PKEY *pk, STACK_OF(X509) *chain)
4449         {
4450         return tls1_check_chain(s, x, pk, chain, -1);
4451         }
4452
4453 #endif