ssl/t1_lib.c

   1 /* ssl/t1_lib.c */
   2 /* Copyright (C) 1995-1998 Eric Young (eay@cryptsoft.com)
   3  * All rights reserved.
   4  *
   5  * This package is an SSL implementation written
   6  * by Eric Young (eay@cryptsoft.com).
   7  * The implementation was written so as to conform with Netscapes SSL.
   8  *
   9  * This library is free for commercial and non-commercial use as long as
  10  * the following conditions are aheared to.  The following conditions
  11  * apply to all code found in this distribution, be it the RC4, RSA,
  12  * lhash, DES, etc., code; not just the SSL code.  The SSL documentation
  13  * included with this distribution is covered by the same copyright terms
  14  * except that the holder is Tim Hudson (tjh@cryptsoft.com).
  15  *
  16  * Copyright remains Eric Young's, and as such any Copyright notices in
  17  * the code are not to be removed.
  18  * If this package is used in a product, Eric Young should be given attribution
  19  * as the author of the parts of the library used.
  20  * This can be in the form of a textual message at program startup or
  21  * in documentation (online or textual) provided with the package.
  22  *
  23  * Redistribution and use in source and binary forms, with or without
  24  * modification, are permitted provided that the following conditions
  25  * are met:
  26  * 1. Redistributions of source code must retain the copyright
  27  *    notice, this list of conditions and the following disclaimer.
  28  * 2. Redistributions in binary form must reproduce the above copyright
  29  *    notice, this list of conditions and the following disclaimer in the
  30  *    documentation and/or other materials provided with the distribution.
  31  * 3. All advertising materials mentioning features or use of this software
  32  *    must display the following acknowledgement:
  33  *    "This product includes cryptographic software written by
  34  *     Eric Young (eay@cryptsoft.com)"
  35  *    The word 'cryptographic' can be left out if the rouines from the library
  36  *    being used are not cryptographic related :-).
  37  * 4. If you include any Windows specific code (or a derivative thereof) from
  38  *    the apps directory (application code) you must include an acknowledgement:
  39  *    "This product includes software written by Tim Hudson (tjh@cryptsoft.com)"
  40  *
  41  * THIS SOFTWARE IS PROVIDED BY ERIC YOUNG ``AS IS'' AND
  42  * ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
  43  * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE
  44  * ARE DISCLAIMED.  IN NO EVENT SHALL THE AUTHOR OR CONTRIBUTORS BE LIABLE
  45  * FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL
  46  * DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS
  47  * OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION)
  48  * HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT
  49  * LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY
  50  * OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF
  51  * SUCH DAMAGE.
  52  *
  53  * The licence and distribution terms for any publically available version or
  54  * derivative of this code cannot be changed.  i.e. this code cannot simply be
  55  * copied and put under another distribution licence
  56  * [including the GNU Public Licence.]
  57  */
  58 /* ====================================================================
  59  * Copyright (c) 1998-2007 The OpenSSL Project.  All rights reserved.
  60  *
  61  * Redistribution and use in source and binary forms, with or without
  62  * modification, are permitted provided that the following conditions
  63  * are met:
  64  *
  65  * 1. Redistributions of source code must retain the above copyright
  66  *    notice, this list of conditions and the following disclaimer.
  67  *
  68  * 2. Redistributions in binary form must reproduce the above copyright
  69  *    notice, this list of conditions and the following disclaimer in
  70  *    the documentation and/or other materials provided with the
  71  *    distribution.
  72  *
  73  * 3. All advertising materials mentioning features or use of this
  74  *    software must display the following acknowledgment:
  75  *    "This product includes software developed by the OpenSSL Project
  76  *    for use in the OpenSSL Toolkit. (http://www.openssl.org/)"
  77  *
  78  * 4. The names "OpenSSL Toolkit" and "OpenSSL Project" must not be used to
  79  *    endorse or promote products derived from this software without
  80  *    prior written permission. For written permission, please contact
  81  *    openssl-core@openssl.org.
  82  *
  83  * 5. Products derived from this software may not be called "OpenSSL"
  84  *    nor may "OpenSSL" appear in their names without prior written
  85  *    permission of the OpenSSL Project.
  86  *
  87  * 6. Redistributions of any form whatsoever must retain the following
  88  *    acknowledgment:
  89  *    "This product includes software developed by the OpenSSL Project
  90  *    for use in the OpenSSL Toolkit (http://www.openssl.org/)"
  91  *
  92  * THIS SOFTWARE IS PROVIDED BY THE OpenSSL PROJECT ``AS IS'' AND ANY
  93  * EXPRESSED OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
  94  * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
  95  * PURPOSE ARE DISCLAIMED.  IN NO EVENT SHALL THE OpenSSL PROJECT OR
  96  * ITS CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL,
  97  * SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT
  98  * NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES;
  99  * LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION)
 100  * HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT,
 101  * STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE)
 102  * ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED
 103  * OF THE POSSIBILITY OF SUCH DAMAGE.
 104  * ====================================================================
 105  *
 106  * This product includes cryptographic software written by Eric Young
 107  * (eay@cryptsoft.com).  This product includes software written by Tim
 108  * Hudson (tjh@cryptsoft.com).
 109  *
 110  */
 111
 112 #include <stdio.h>
 113 #include <openssl/objects.h>
 114 #include <openssl/evp.h>
 115 #include <openssl/hmac.h>
 116 #include <openssl/ocsp.h>
 117 #include "ssl_locl.h"
 118
 119 const char tls1_version_str[]="TLSv1" OPENSSL_VERSION_PTEXT;
 120
 121 #ifndef OPENSSL_NO_TLSEXT
 122 static int tls_decrypt_ticket(SSL *s, const unsigned char *tick, int ticklen,
 123                                 const unsigned char *sess_id, int sesslen,
 124                                 SSL_SESSION **psess);
 125 #endif
 126
 127 SSL3_ENC_METHOD TLSv1_enc_data={
 128         tls1_enc,
 129         tls1_mac,
 130         tls1_setup_key_block,
 131         tls1_generate_master_secret,
 132         tls1_change_cipher_state,
 133         tls1_final_finish_mac,
 134         TLS1_FINISH_MAC_LENGTH,
 135         tls1_cert_verify_mac,
 136         TLS_MD_CLIENT_FINISH_CONST,TLS_MD_CLIENT_FINISH_CONST_SIZE,
 137         TLS_MD_SERVER_FINISH_CONST,TLS_MD_SERVER_FINISH_CONST_SIZE,
 138         tls1_alert_code,
 139         };
 140
 141 long tls1_default_timeout(void)
 142         {
 143         /* 2 hours, the 24 hours mentioned in the TLSv1 spec
 144          * is way too long for http, the cache would over fill */
 145         return(60*60*2);
 146         }
 147
 148 int tls1_new(SSL *s)
 149         {
 150         if (!ssl3_new(s)) return(0);
 151         s->method->ssl_clear(s);
 152         return(1);
 153         }
 154
 155 void tls1_free(SSL *s)
 156         {
 157 #ifndef OPENSSL_NO_TLSEXT
 158         if (s->tlsext_session_ticket)
 159                 {
 160                 OPENSSL_free(s->tlsext_session_ticket);
 161                 }
 162 #endif /* OPENSSL_NO_TLSEXT */
 163         ssl3_free(s);
 164         }
 165
 166 void tls1_clear(SSL *s)
 167         {
 168         ssl3_clear(s);
 169         s->version = s->method->version;
 170         }
 171
 172 #ifndef OPENSSL_NO_EC
 173 static int nid_list[] =
 174         {
 175                 NID_sect163k1, /* sect163k1 (1) */
 176                 NID_sect163r1, /* sect163r1 (2) */
 177                 NID_sect163r2, /* sect163r2 (3) */
 178                 NID_sect193r1, /* sect193r1 (4) */
 179                 NID_sect193r2, /* sect193r2 (5) */
 180                 NID_sect233k1, /* sect233k1 (6) */
 181                 NID_sect233r1, /* sect233r1 (7) */
 182                 NID_sect239k1, /* sect239k1 (8) */
 183                 NID_sect283k1, /* sect283k1 (9) */
 184                 NID_sect283r1, /* sect283r1 (10) */
 185                 NID_sect409k1, /* sect409k1 (11) */
 186                 NID_sect409r1, /* sect409r1 (12) */
 187                 NID_sect571k1, /* sect571k1 (13) */
 188                 NID_sect571r1, /* sect571r1 (14) */
 189                 NID_secp160k1, /* secp160k1 (15) */
 190                 NID_secp160r1, /* secp160r1 (16) */
 191                 NID_secp160r2, /* secp160r2 (17) */
 192                 NID_secp192k1, /* secp192k1 (18) */
 193                 NID_X9_62_prime192v1, /* secp192r1 (19) */
 194                 NID_secp224k1, /* secp224k1 (20) */
 195                 NID_secp224r1, /* secp224r1 (21) */
 196                 NID_secp256k1, /* secp256k1 (22) */
 197                 NID_X9_62_prime256v1, /* secp256r1 (23) */
 198                 NID_secp384r1, /* secp384r1 (24) */
 199                 NID_secp521r1  /* secp521r1 (25) */
 200         };
 201
 202 int tls1_ec_curve_id2nid(int curve_id)
 203         {
 204         /* ECC curves from draft-ietf-tls-ecc-12.txt (Oct. 17, 2005) */
 205         if ((curve_id < 1) || ((unsigned int)curve_id >
 206                                 sizeof(nid_list)/sizeof(nid_list[0])))
 207                 return 0;
 208         return nid_list[curve_id-1];
 209         }
 210
 211 int tls1_ec_nid2curve_id(int nid)
 212         {
 213         /* ECC curves from draft-ietf-tls-ecc-12.txt (Oct. 17, 2005) */
 214         switch (nid)
 215                 {
 216         case NID_sect163k1: /* sect163k1 (1) */
 217                 return 1;
 218         case NID_sect163r1: /* sect163r1 (2) */
 219                 return 2;
 220         case NID_sect163r2: /* sect163r2 (3) */
 221                 return 3;
 222         case NID_sect193r1: /* sect193r1 (4) */
 223                 return 4;
 224         case NID_sect193r2: /* sect193r2 (5) */
 225                 return 5;
 226         case NID_sect233k1: /* sect233k1 (6) */
 227                 return 6;
 228         case NID_sect233r1: /* sect233r1 (7) */
 229                 return 7;
 230         case NID_sect239k1: /* sect239k1 (8) */
 231                 return 8;
 232         case NID_sect283k1: /* sect283k1 (9) */
 233                 return 9;
 234         case NID_sect283r1: /* sect283r1 (10) */
 235                 return 10;
 236         case NID_sect409k1: /* sect409k1 (11) */
 237                 return 11;
 238         case NID_sect409r1: /* sect409r1 (12) */
 239                 return 12;
 240         case NID_sect571k1: /* sect571k1 (13) */
 241                 return 13;
 242         case NID_sect571r1: /* sect571r1 (14) */
 243                 return 14;
 244         case NID_secp160k1: /* secp160k1 (15) */
 245                 return 15;
 246         case NID_secp160r1: /* secp160r1 (16) */
 247                 return 16;
 248         case NID_secp160r2: /* secp160r2 (17) */
 249                 return 17;
 250         case NID_secp192k1: /* secp192k1 (18) */
 251                 return 18;
 252         case NID_X9_62_prime192v1: /* secp192r1 (19) */
 253                 return 19;
 254         case NID_secp224k1: /* secp224k1 (20) */
 255                 return 20;
 256         case NID_secp224r1: /* secp224r1 (21) */
 257                 return 21;
 258         case NID_secp256k1: /* secp256k1 (22) */
 259                 return 22;
 260         case NID_X9_62_prime256v1: /* secp256r1 (23) */
 261                 return 23;
 262         case NID_secp384r1: /* secp384r1 (24) */
 263                 return 24;
 264         case NID_secp521r1:  /* secp521r1 (25) */
 265                 return 25;
 266         default:
 267                 return 0;
 268                 }
 269         }
 270 #endif /* OPENSSL_NO_EC */
 271
 272 #ifndef OPENSSL_NO_TLSEXT
 273
 274 /* List of supported signature algorithms and hashes. Should make this
 275  * customisable at some point, for now include everything we support.
 276  */
 277
 278 #ifdef OPENSSL_NO_RSA
 279 #define tlsext_sigalg_rsa(md) /* */
 280 #else
 281 #define tlsext_sigalg_rsa(md) md, TLSEXT_signature_rsa,
 282 #endif
 283
 284 #ifdef OPENSSL_NO_DSA
 285 #define tlsext_sigalg_dsa(md) /* */
 286 #else
 287 #define tlsext_sigalg_dsa(md) md, TLSEXT_signature_dsa,
 288 #endif
 289
 290 #ifdef OPENSSL_NO_ECDSA
 291 #define tlsext_sigalg_ecdsa(md) /* */
 292 #else
 293 #define tlsext_sigalg_ecdsa(md) md, TLSEXT_signature_dsa,
 294 #endif
 295
 296 #define tlsext_sigalg(md) \
 297                 tlsext_sigalg_rsa(md) \
 298                 tlsext_sigalg_dsa(md) \
 299                 tlsext_sigalg_ecdsa(md)
 300
 301 static unsigned char tls12_sigalgs[] = {
 302 #ifndef OPENSSL_NO_SHA512
 303         tlsext_sigalg(TLSEXT_hash_sha512)
 304         tlsext_sigalg(TLSEXT_hash_sha384)
 305 #endif
 306 #ifndef OPENSSL_NO_SHA256
 307         tlsext_sigalg(TLSEXT_hash_sha256)
 308         tlsext_sigalg(TLSEXT_hash_sha224)
 309 #endif
 310 #ifndef OPENSSL_NO_SHA
 311         tlsext_sigalg(TLSEXT_hash_sha1)
 312 #endif
 313 #ifndef OPENSSL_NO_MD5
 314         tlsext_sigalg_rsa(TLSEXT_hash_md5)
 315 #endif
 316 };
 317
 318 int tls12_get_req_sig_algs(SSL *s, unsigned char *p)
 319         {
 320         size_t slen = sizeof(tls12_sigalgs);
 321 #ifdef OPENSSL_FIPS
 322         /* If FIPS mode don't include MD5 which is last */
 323         if (FIPS_mode())
 324                 slen -= 2;
 325 #endif
 326         if (p)
 327                 memcpy(p, tls12_sigalgs, slen);
 328         return (int)slen;
 329         }
 330
 331 unsigned char *ssl_add_clienthello_tlsext(SSL *s, unsigned char *p, unsigned char *limit)
 332         {
 333         int extdatalen=0;
 334         unsigned char *ret = p;
 335
 336         /* don't add extensions for SSLv3 unless doing secure renegotiation */
 337         if (s->client_version == SSL3_VERSION
 338                                         && !s->s3->send_connection_binding)
 339                 return p;
 340
 341         ret+=2;
 342
 343         if (ret>=limit) return NULL; /* this really never occurs, but ... */
 344
 345         if (s->tlsext_hostname != NULL)
 346                 {
 347                 /* Add TLS extension servername to the Client Hello message */
 348                 unsigned long size_str;
 349                 long lenmax;
 350
 351                 /* check for enough space.
 352                    4 for the servername type and entension length
 353                    2 for servernamelist length
 354                    1 for the hostname type
 355                    2 for hostname length
 356                    + hostname length
 357                 */
 358
 359                 if ((lenmax = limit - ret - 9) < 0
 360                     || (size_str = strlen(s->tlsext_hostname)) > (unsigned long)lenmax)
 361                         return NULL;
 362
 363                 /* extension type and length */
 364                 s2n(TLSEXT_TYPE_server_name,ret);
 365                 s2n(size_str+5,ret);
 366
 367                 /* length of servername list */
 368                 s2n(size_str+3,ret);
 369
 370                 /* hostname type, length and hostname */
 371                 *(ret++) = (unsigned char) TLSEXT_NAMETYPE_host_name;
 372                 s2n(size_str,ret);
 373                 memcpy(ret, s->tlsext_hostname, size_str);
 374                 ret+=size_str;
 375                 }
 376
 377         /* Add RI if renegotiating */
 378         if (s->renegotiate)
 379           {
 380           int el;
 381
 382           if(!ssl_add_clienthello_renegotiate_ext(s, 0, &el, 0))
 383               {
 384               SSLerr(SSL_F_SSL_ADD_CLIENTHELLO_TLSEXT, ERR_R_INTERNAL_ERROR);
 385               return NULL;
 386               }
 387
 388           if((limit - p - 4 - el) < 0) return NULL;
 389
 390           s2n(TLSEXT_TYPE_renegotiate,ret);
 391           s2n(el,ret);
 392
 393           if(!ssl_add_clienthello_renegotiate_ext(s, ret, &el, el))
 394               {
 395               SSLerr(SSL_F_SSL_ADD_CLIENTHELLO_TLSEXT, ERR_R_INTERNAL_ERROR);
 396               return NULL;
 397               }
 398
 399           ret += el;
 400         }
 401
 402 #ifndef OPENSSL_NO_SRP
 403 #define MIN(x,y) (((x)<(y))?(x):(y))
 404         /* we add SRP username the first time only if we have one! */
 405         if (s->srp_ctx.login != NULL)
 406                 {/* Add TLS extension SRP username to the Client Hello message */
 407                 int login_len = MIN(strlen(s->srp_ctx.login) + 1, 255);
 408                 long lenmax;
 409
 410                 if ((lenmax = limit - ret - 5) < 0) return NULL;
 411                 if (login_len > lenmax) return NULL;
 412                 if (login_len > 255)
 413                         {
 414                         SSLerr(SSL_F_SSL_ADD_CLIENTHELLO_TLSEXT, ERR_R_INTERNAL_ERROR);
 415                         return NULL;
 416                         }
 417                 s2n(TLSEXT_TYPE_srp,ret);
 418                 s2n(login_len+1,ret);
 419
 420                 (*ret++) = (unsigned char) MIN(strlen(s->srp_ctx.login), 254);
 421                 memcpy(ret, s->srp_ctx.login, MIN(strlen(s->srp_ctx.login), 254));
 422                 ret+=login_len;
 423                 }
 424 #endif
 425
 426 #ifndef OPENSSL_NO_EC
 427         if (s->tlsext_ecpointformatlist != NULL &&
 428             s->version != DTLS1_VERSION)
 429                 {
 430                 /* Add TLS extension ECPointFormats to the ClientHello message */
 431                 long lenmax;
 432
 433                 if ((lenmax = limit - ret - 5) < 0) return NULL;
 434                 if (s->tlsext_ecpointformatlist_length > (unsigned long)lenmax) return NULL;
 435                 if (s->tlsext_ecpointformatlist_length > 255)
 436                         {
 437                         SSLerr(SSL_F_SSL_ADD_CLIENTHELLO_TLSEXT, ERR_R_INTERNAL_ERROR);
 438                         return NULL;
 439                         }
 440
 441                 s2n(TLSEXT_TYPE_ec_point_formats,ret);
 442                 s2n(s->tlsext_ecpointformatlist_length + 1,ret);
 443                 *(ret++) = (unsigned char) s->tlsext_ecpointformatlist_length;
 444                 memcpy(ret, s->tlsext_ecpointformatlist, s->tlsext_ecpointformatlist_length);
 445                 ret+=s->tlsext_ecpointformatlist_length;
 446                 }
 447         if (s->tlsext_ellipticcurvelist != NULL &&
 448             s->version != DTLS1_VERSION)
 449                 {
 450                 /* Add TLS extension EllipticCurves to the ClientHello message */
 451                 long lenmax;
 452
 453                 if ((lenmax = limit - ret - 6) < 0) return NULL;
 454                 if (s->tlsext_ellipticcurvelist_length > (unsigned long)lenmax) return NULL;
 455                 if (s->tlsext_ellipticcurvelist_length > 65532)
 456                         {
 457                         SSLerr(SSL_F_SSL_ADD_CLIENTHELLO_TLSEXT, ERR_R_INTERNAL_ERROR);
 458                         return NULL;
 459                         }
 460
 461                 s2n(TLSEXT_TYPE_elliptic_curves,ret);
 462                 s2n(s->tlsext_ellipticcurvelist_length + 2, ret);
 463
 464                 /* NB: draft-ietf-tls-ecc-12.txt uses a one-byte prefix for
 465                  * elliptic_curve_list, but the examples use two bytes.
 466                  * http://www1.ietf.org/mail-archive/web/tls/current/msg00538.html
 467                  * resolves this to two bytes.
 468                  */
 469                 s2n(s->tlsext_ellipticcurvelist_length, ret);
 470                 memcpy(ret, s->tlsext_ellipticcurvelist, s->tlsext_ellipticcurvelist_length);
 471                 ret+=s->tlsext_ellipticcurvelist_length;
 472                 }
 473 #endif /* OPENSSL_NO_EC */
 474
 475         if (!(SSL_get_options(s) & SSL_OP_NO_TICKET))
 476                 {
 477                 int ticklen;
 478                 if (!s->new_session && s->session && s->session->tlsext_tick)
 479                         ticklen = s->session->tlsext_ticklen;
 480                 else if (s->session && s->tlsext_session_ticket &&
 481                          s->tlsext_session_ticket->data)
 482                         {
 483                         ticklen = s->tlsext_session_ticket->length;
 484                         s->session->tlsext_tick = OPENSSL_malloc(ticklen);
 485                         if (!s->session->tlsext_tick)
 486                                 return NULL;
 487                         memcpy(s->session->tlsext_tick,
 488                                s->tlsext_session_ticket->data,
 489                                ticklen);
 490                         s->session->tlsext_ticklen = ticklen;
 491                         }
 492                 else
 493                         ticklen = 0;
 494                 if (ticklen == 0 && s->tlsext_session_ticket &&
 495                     s->tlsext_session_ticket->data == NULL)
 496                         goto skip_ext;
 497                 /* Check for enough room 2 for extension type, 2 for len
 498                  * rest for ticket
 499                  */
 500                 if ((long)(limit - ret - 4 - ticklen) < 0) return NULL;
 501                 s2n(TLSEXT_TYPE_session_ticket,ret);
 502                 s2n(ticklen,ret);
 503                 if (ticklen)
 504                         {
 505                         memcpy(ret, s->session->tlsext_tick, ticklen);
 506                         ret += ticklen;
 507                         }
 508                 }
 509                 skip_ext:
 510
 511         if (TLS1_get_version(s) >= TLS1_2_VERSION)
 512                 {
 513                 if ((size_t)(limit - ret) < sizeof(tls12_sigalgs) + 6)
 514                         return NULL;
 515                 s2n(TLSEXT_TYPE_signature_algorithms,ret);
 516                 s2n(sizeof(tls12_sigalgs) + 2, ret);
 517                 s2n(sizeof(tls12_sigalgs), ret);
 518                 memcpy(ret, tls12_sigalgs, sizeof(tls12_sigalgs));
 519                 ret += sizeof(tls12_sigalgs);
 520                 }
 521
 522 #ifdef TLSEXT_TYPE_opaque_prf_input
 523         if (s->s3->client_opaque_prf_input != NULL &&
 524             s->version != DTLS1_VERSION)
 525                 {
 526                 size_t col = s->s3->client_opaque_prf_input_len;
 527
 528                 if ((long)(limit - ret - 6 - col < 0))
 529                         return NULL;
 530                 if (col > 0xFFFD) /* can't happen */
 531                         return NULL;
 532
 533                 s2n(TLSEXT_TYPE_opaque_prf_input, ret);
 534                 s2n(col + 2, ret);
 535                 s2n(col, ret);
 536                 memcpy(ret, s->s3->client_opaque_prf_input, col);
 537                 ret += col;
 538                 }
 539 #endif
 540
 541         if (s->tlsext_status_type == TLSEXT_STATUSTYPE_ocsp &&
 542             s->version != DTLS1_VERSION)
 543                 {
 544                 int i;
 545                 long extlen, idlen, itmp;
 546                 OCSP_RESPID *id;
 547
 548                 idlen = 0;
 549                 for (i = 0; i < sk_OCSP_RESPID_num(s->tlsext_ocsp_ids); i++)
 550                         {
 551                         id = sk_OCSP_RESPID_value(s->tlsext_ocsp_ids, i);
 552                         itmp = i2d_OCSP_RESPID(id, NULL);
 553                         if (itmp <= 0)
 554                                 return NULL;
 555                         idlen += itmp + 2;
 556                         }
 557
 558                 if (s->tlsext_ocsp_exts)
 559                         {
 560                         extlen = i2d_X509_EXTENSIONS(s->tlsext_ocsp_exts, NULL);
 561                         if (extlen < 0)
 562                                 return NULL;
 563                         }
 564                 else
 565                         extlen = 0;
 566
 567                 if ((long)(limit - ret - 7 - extlen - idlen) < 0) return NULL;
 568                 s2n(TLSEXT_TYPE_status_request, ret);
 569                 if (extlen + idlen > 0xFFF0)
 570                         return NULL;
 571                 s2n(extlen + idlen + 5, ret);
 572                 *(ret++) = TLSEXT_STATUSTYPE_ocsp;
 573                 s2n(idlen, ret);
 574                 for (i = 0; i < sk_OCSP_RESPID_num(s->tlsext_ocsp_ids); i++)
 575                         {
 576                         /* save position of id len */
 577                         unsigned char *q = ret;
 578                         id = sk_OCSP_RESPID_value(s->tlsext_ocsp_ids, i);
 579                         /* skip over id len */
 580                         ret += 2;
 581                         itmp = i2d_OCSP_RESPID(id, &ret);
 582                         /* write id len */
 583                         s2n(itmp, q);
 584                         }
 585                 s2n(extlen, ret);
 586                 if (extlen > 0)
 587                         i2d_X509_EXTENSIONS(s->tlsext_ocsp_exts, &ret);
 588                 }
 589
 590 #ifndef OPENSSL_NO_NEXTPROTONEG
 591         if (s->ctx->next_proto_select_cb && !s->s3->tmp.finish_md_len)
 592                 {
 593                 /* The client advertises an emtpy extension to indicate its
 594                  * support for Next Protocol Negotiation */
 595                 if (limit - ret - 4 < 0)
 596                         return NULL;
 597                 s2n(TLSEXT_TYPE_next_proto_neg,ret);
 598                 s2n(0,ret);
 599                 }
 600 #endif
 601
 602         if ((extdatalen = ret-p-2)== 0)
 603                 return p;
 604
 605         s2n(extdatalen,p);
 606         return ret;
 607         }
 608
 609 unsigned char *ssl_add_serverhello_tlsext(SSL *s, unsigned char *p, unsigned char *limit)
 610         {
 611         int extdatalen=0;
 612         unsigned char *ret = p;
 613 #ifndef OPENSSL_NO_NEXTPROTONEG
 614         int next_proto_neg_seen;
 615 #endif
 616
 617         /* don't add extensions for SSLv3, unless doing secure renegotiation */
 618         if (s->version == SSL3_VERSION && !s->s3->send_connection_binding)
 619                 return p;
 620
 621         ret+=2;
 622         if (ret>=limit) return NULL; /* this really never occurs, but ... */
 623
 624         if (!s->hit && s->servername_done == 1 && s->session->tlsext_hostname != NULL)
 625                 {
 626                 if ((long)(limit - ret - 4) < 0) return NULL;
 627
 628                 s2n(TLSEXT_TYPE_server_name,ret);
 629                 s2n(0,ret);
 630                 }
 631
 632         if(s->s3->send_connection_binding)
 633         {
 634           int el;
 635
 636           if(!ssl_add_serverhello_renegotiate_ext(s, 0, &el, 0))
 637               {
 638               SSLerr(SSL_F_SSL_ADD_SERVERHELLO_TLSEXT, ERR_R_INTERNAL_ERROR);
 639               return NULL;
 640               }
 641
 642           if((limit - p - 4 - el) < 0) return NULL;
 643
 644           s2n(TLSEXT_TYPE_renegotiate,ret);
 645           s2n(el,ret);
 646
 647           if(!ssl_add_serverhello_renegotiate_ext(s, ret, &el, el))
 648               {
 649               SSLerr(SSL_F_SSL_ADD_SERVERHELLO_TLSEXT, ERR_R_INTERNAL_ERROR);
 650               return NULL;
 651               }
 652
 653           ret += el;
 654         }
 655
 656 #ifndef OPENSSL_NO_EC
 657         if (s->tlsext_ecpointformatlist != NULL &&
 658             s->version != DTLS1_VERSION)
 659                 {
 660                 /* Add TLS extension ECPointFormats to the ServerHello message */
 661                 long lenmax;
 662
 663                 if ((lenmax = limit - ret - 5) < 0) return NULL;
 664                 if (s->tlsext_ecpointformatlist_length > (unsigned long)lenmax) return NULL;
 665                 if (s->tlsext_ecpointformatlist_length > 255)
 666                         {
 667                         SSLerr(SSL_F_SSL_ADD_SERVERHELLO_TLSEXT, ERR_R_INTERNAL_ERROR);
 668                         return NULL;
 669                         }
 670
 671                 s2n(TLSEXT_TYPE_ec_point_formats,ret);
 672                 s2n(s->tlsext_ecpointformatlist_length + 1,ret);
 673                 *(ret++) = (unsigned char) s->tlsext_ecpointformatlist_length;
 674                 memcpy(ret, s->tlsext_ecpointformatlist, s->tlsext_ecpointformatlist_length);
 675                 ret+=s->tlsext_ecpointformatlist_length;
 676
 677                 }
 678         /* Currently the server should not respond with a SupportedCurves extension */
 679 #endif /* OPENSSL_NO_EC */
 680
 681         if (s->tlsext_ticket_expected
 682                 && !(SSL_get_options(s) & SSL_OP_NO_TICKET))
 683                 {
 684                 if ((long)(limit - ret - 4) < 0) return NULL;
 685                 s2n(TLSEXT_TYPE_session_ticket,ret);
 686                 s2n(0,ret);
 687                 }
 688
 689         if (s->tlsext_status_expected)
 690                 {
 691                 if ((long)(limit - ret - 4) < 0) return NULL;
 692                 s2n(TLSEXT_TYPE_status_request,ret);
 693                 s2n(0,ret);
 694                 }
 695
 696 #ifdef TLSEXT_TYPE_opaque_prf_input
 697         if (s->s3->server_opaque_prf_input != NULL &&
 698             s->version != DTLS1_VERSION)
 699                 {
 700                 size_t sol = s->s3->server_opaque_prf_input_len;
 701
 702                 if ((long)(limit - ret - 6 - sol) < 0)
 703                         return NULL;
 704                 if (sol > 0xFFFD) /* can't happen */
 705                         return NULL;
 706
 707                 s2n(TLSEXT_TYPE_opaque_prf_input, ret);
 708                 s2n(sol + 2, ret);
 709                 s2n(sol, ret);
 710                 memcpy(ret, s->s3->server_opaque_prf_input, sol);
 711                 ret += sol;
 712                 }
 713 #endif
 714         if (((s->s3->tmp.new_cipher->id & 0xFFFF)==0x80 || (s->s3->tmp.new_cipher->id & 0xFFFF)==0x81)
 715                 && (SSL_get_options(s) & SSL_OP_CRYPTOPRO_TLSEXT_BUG))
 716                 { const unsigned char cryptopro_ext[36] = {
 717                         0xfd, 0xe8, /*65000*/
 718                         0x00, 0x20, /*32 bytes length*/
 719                         0x30, 0x1e, 0x30, 0x08, 0x06, 0x06, 0x2a, 0x85,
 720                         0x03,   0x02, 0x02, 0x09, 0x30, 0x08, 0x06, 0x06,
 721                         0x2a, 0x85, 0x03, 0x02, 0x02, 0x16, 0x30, 0x08,
 722                         0x06, 0x06, 0x2a, 0x85, 0x03, 0x02, 0x02, 0x17};
 723                         if (limit-ret<36) return NULL;
 724                         memcpy(ret,cryptopro_ext,36);
 725                         ret+=36;
 726
 727                 }
 728
 729 #ifndef OPENSSL_NO_NEXTPROTONEG
 730         next_proto_neg_seen = s->s3->next_proto_neg_seen;
 731         s->s3->next_proto_neg_seen = 0;
 732         if (next_proto_neg_seen && s->ctx->next_protos_advertised_cb)
 733                 {
 734                 const unsigned char *npa;
 735                 unsigned int npalen;
 736                 int r;
 737
 738                 r = s->ctx->next_protos_advertised_cb(s, &npa, &npalen, s->ctx->next_protos_advertised_cb_arg);
 739                 if (r == SSL_TLSEXT_ERR_OK)
 740                         {
 741                         if ((long)(limit - ret - 4 - npalen) < 0) return NULL;
 742                         s2n(TLSEXT_TYPE_next_proto_neg,ret);
 743                         s2n(npalen,ret);
 744                         memcpy(ret, npa, npalen);
 745                         ret += npalen;
 746                         s->s3->next_proto_neg_seen = 1;
 747                         }
 748                 }
 749 #endif
 750
 751         if ((extdatalen = ret-p-2)== 0)
 752                 return p;
 753
 754         s2n(extdatalen,p);
 755         return ret;
 756         }
 757
 758 int ssl_parse_clienthello_tlsext(SSL *s, unsigned char **p, unsigned char *d, int n, int *al)
 759         {
 760         unsigned short type;
 761         unsigned short size;
 762         unsigned short len;
 763         unsigned char *data = *p;
 764         int renegotiate_seen = 0;
 765         int sigalg_seen = 0;
 766
 767         s->servername_done = 0;
 768         s->tlsext_status_type = -1;
 769
 770         if (data >= (d+n-2))
 771                 goto ri_check;
 772         n2s(data,len);
 773
 774         if (data > (d+n-len))
 775                 goto ri_check;
 776
 777         while (data <= (d+n-4))
 778                 {
 779                 n2s(data,type);
 780                 n2s(data,size);
 781
 782                 if (data+size > (d+n))
 783                         goto ri_check;
 784 #if 0
 785                 fprintf(stderr,"Received extension type %d size %d\n",type,size);
 786 #endif
 787                 if (s->tlsext_debug_cb)
 788                         s->tlsext_debug_cb(s, 0, type, data, size,
 789                                                 s->tlsext_debug_arg);
 790 /* The servername extension is treated as follows:
 791
 792    - Only the hostname type is supported with a maximum length of 255.
 793    - The servername is rejected if too long or if it contains zeros,
 794      in which case an fatal alert is generated.
 795    - The servername field is maintained together with the session cache.
 796    - When a session is resumed, the servername call back invoked in order
 797      to allow the application to position itself to the right context.
 798    - The servername is acknowledged if it is new for a session or when
 799      it is identical to a previously used for the same session.
 800      Applications can control the behaviour.  They can at any time
 801      set a 'desirable' servername for a new SSL object. This can be the
 802      case for example with HTTPS when a Host: header field is received and
 803      a renegotiation is requested. In this case, a possible servername
 804      presented in the new client hello is only acknowledged if it matches
 805      the value of the Host: field.
 806    - Applications must  use SSL_OP_NO_SESSION_RESUMPTION_ON_RENEGOTIATION
 807      if they provide for changing an explicit servername context for the session,
 808      i.e. when the session has been established with a servername extension.
 809    - On session reconnect, the servername extension may be absent.
 810
 811 */
 812
 813                 if (type == TLSEXT_TYPE_server_name)
 814                         {
 815                         unsigned char *sdata;
 816                         int servname_type;
 817                         int dsize;
 818
 819                         if (size < 2)
 820                                 {
 821                                 *al = SSL_AD_DECODE_ERROR;
 822                                 return 0;
 823                                 }
 824                         n2s(data,dsize);
 825                         size -= 2;
 826                         if (dsize > size  )
 827                                 {
 828                                 *al = SSL_AD_DECODE_ERROR;
 829                                 return 0;
 830                                 }
 831
 832                         sdata = data;
 833                         while (dsize > 3)
 834                                 {
 835                                 servname_type = *(sdata++);
 836                                 n2s(sdata,len);
 837                                 dsize -= 3;
 838
 839                                 if (len > dsize)
 840                                         {
 841                                         *al = SSL_AD_DECODE_ERROR;
 842                                         return 0;
 843                                         }
 844                                 if (s->servername_done == 0)
 845                                 switch (servname_type)
 846                                         {
 847                                 case TLSEXT_NAMETYPE_host_name:
 848                                         if (!s->hit)
 849                                                 {
 850                                                 if(s->session->tlsext_hostname)
 851                                                         {
 852                                                         *al = SSL_AD_DECODE_ERROR;
 853                                                         return 0;
 854                                                         }
 855                                                 if (len > TLSEXT_MAXLEN_host_name)
 856                                                         {
 857                                                         *al = TLS1_AD_UNRECOGNIZED_NAME;
 858                                                         return 0;
 859                                                         }
 860                                                 if ((s->session->tlsext_hostname = OPENSSL_malloc(len+1)) == NULL)
 861                                                         {
 862                                                         *al = TLS1_AD_INTERNAL_ERROR;
 863                                                         return 0;
 864                                                         }
 865                                                 memcpy(s->session->tlsext_hostname, sdata, len);
 866                                                 s->session->tlsext_hostname[len]='\0';
 867                                                 if (strlen(s->session->tlsext_hostname) != len) {
 868                                                         OPENSSL_free(s->session->tlsext_hostname);
 869                                                         s->session->tlsext_hostname = NULL;
 870                                                         *al = TLS1_AD_UNRECOGNIZED_NAME;
 871                                                         return 0;
 872                                                 }
 873                                                 s->servername_done = 1;
 874
 875                                                 }
 876                                         else
 877                                                 s->servername_done = s->session->tlsext_hostname
 878                                                         && strlen(s->session->tlsext_hostname) == len
 879                                                         && strncmp(s->session->tlsext_hostname, (char *)sdata, len) == 0;
 880
 881                                         break;
 882
 883                                 default:
 884                                         break;
 885                                         }
 886
 887                                 dsize -= len;
 888                                 }
 889                         if (dsize != 0)
 890                                 {
 891                                 *al = SSL_AD_DECODE_ERROR;
 892                                 return 0;
 893                                 }
 894
 895                         }
 896 #ifndef OPENSSL_NO_SRP
 897                 else if (type == TLSEXT_TYPE_srp)
 898                         {
 899                         if (size > 0)
 900                                 {
 901                                 len = data[0];
 902                                 if ((s->srp_ctx.login = OPENSSL_malloc(len+1)) == NULL)
 903                                         return -1;
 904                                 memcpy(s->srp_ctx.login, &data[1], len);
 905                                 s->srp_ctx.login[len]='\0';
 906                                 }
 907                         }
 908 #endif
 909
 910 #ifndef OPENSSL_NO_EC
 911                 else if (type == TLSEXT_TYPE_ec_point_formats &&
 912                      s->version != DTLS1_VERSION)
 913                         {
 914                         unsigned char *sdata = data;
 915                         int ecpointformatlist_length = *(sdata++);
 916
 917                         if (ecpointformatlist_length != size - 1)
 918                                 {
 919                                 *al = TLS1_AD_DECODE_ERROR;
 920                                 return 0;
 921                                 }
 922                         if (!s->hit)
 923                                 {
 924                                 if(s->session->tlsext_ecpointformatlist)
 925                                         {
 926                                         OPENSSL_free(s->session->tlsext_ecpointformatlist);
 927                                         s->session->tlsext_ecpointformatlist = NULL;
 928                                         }
 929                                 s->session->tlsext_ecpointformatlist_length = 0;
 930                                 if ((s->session->tlsext_ecpointformatlist = OPENSSL_malloc(ecpointformatlist_length)) == NULL)
 931                                         {
 932                                         *al = TLS1_AD_INTERNAL_ERROR;
 933                                         return 0;
 934                                         }
 935                                 s->session->tlsext_ecpointformatlist_length = ecpointformatlist_length;
 936                                 memcpy(s->session->tlsext_ecpointformatlist, sdata, ecpointformatlist_length);
 937                                 }
 938 #if 0
 939                         fprintf(stderr,"ssl_parse_clienthello_tlsext s->session->tlsext_ecpointformatlist (length=%i) ", s->session->tlsext_ecpointformatlist_length);
 940                         sdata = s->session->tlsext_ecpointformatlist;
 941                         for (i = 0; i < s->session->tlsext_ecpointformatlist_length; i++)
 942                                 fprintf(stderr,"%i ",*(sdata++));
 943                         fprintf(stderr,"\n");
 944 #endif
 945                         }
 946                 else if (type == TLSEXT_TYPE_elliptic_curves &&
 947                      s->version != DTLS1_VERSION)
 948                         {
 949                         unsigned char *sdata = data;
 950                         int ellipticcurvelist_length = (*(sdata++) << 8);
 951                         ellipticcurvelist_length += (*(sdata++));
 952
 953                         if (ellipticcurvelist_length != size - 2)
 954                                 {
 955                                 *al = TLS1_AD_DECODE_ERROR;
 956                                 return 0;
 957                                 }
 958                         if (!s->hit)
 959                                 {
 960                                 if(s->session->tlsext_ellipticcurvelist)
 961                                         {
 962                                         *al = TLS1_AD_DECODE_ERROR;
 963                                         return 0;
 964                                         }
 965                                 s->session->tlsext_ellipticcurvelist_length = 0;
 966                                 if ((s->session->tlsext_ellipticcurvelist = OPENSSL_malloc(ellipticcurvelist_length)) == NULL)
 967                                         {
 968                                         *al = TLS1_AD_INTERNAL_ERROR;
 969                                         return 0;
 970                                         }
 971                                 s->session->tlsext_ellipticcurvelist_length = ellipticcurvelist_length;
 972                                 memcpy(s->session->tlsext_ellipticcurvelist, sdata, ellipticcurvelist_length);
 973                                 }
 974 #if 0
 975                         fprintf(stderr,"ssl_parse_clienthello_tlsext s->session->tlsext_ellipticcurvelist (length=%i) ", s->session->tlsext_ellipticcurvelist_length);
 976                         sdata = s->session->tlsext_ellipticcurvelist;
 977                         for (i = 0; i < s->session->tlsext_ellipticcurvelist_length; i++)
 978                                 fprintf(stderr,"%i ",*(sdata++));
 979                         fprintf(stderr,"\n");
 980 #endif
 981                         }
 982 #endif /* OPENSSL_NO_EC */
 983 #ifdef TLSEXT_TYPE_opaque_prf_input
 984                 else if (type == TLSEXT_TYPE_opaque_prf_input &&
 985                      s->version != DTLS1_VERSION)
 986                         {
 987                         unsigned char *sdata = data;
 988
 989                         if (size < 2)
 990                                 {
 991                                 *al = SSL_AD_DECODE_ERROR;
 992                                 return 0;
 993                                 }
 994                         n2s(sdata, s->s3->client_opaque_prf_input_len);
 995                         if (s->s3->client_opaque_prf_input_len != size - 2)
 996                                 {
 997                                 *al = SSL_AD_DECODE_ERROR;
 998                                 return 0;
 999                                 }
1000
1001                         if (s->s3->client_opaque_prf_input != NULL) /* shouldn't really happen */
1002                                 OPENSSL_free(s->s3->client_opaque_prf_input);
1003                         if (s->s3->client_opaque_prf_input_len == 0)
1004                                 s->s3->client_opaque_prf_input = OPENSSL_malloc(1); /* dummy byte just to get non-NULL */
1005                         else
1006                                 s->s3->client_opaque_prf_input = BUF_memdup(sdata, s->s3->client_opaque_prf_input_len);
1007                         if (s->s3->client_opaque_prf_input == NULL)
1008                                 {
1009                                 *al = TLS1_AD_INTERNAL_ERROR;
1010                                 return 0;
1011                                 }
1012                         }
1013 #endif
1014                 else if (type == TLSEXT_TYPE_session_ticket)
1015                         {
1016                         if (s->tls_session_ticket_ext_cb &&
1017                             !s->tls_session_ticket_ext_cb(s, data, size, s->tls_session_ticket_ext_cb_arg))
1018                                 {
1019                                 *al = TLS1_AD_INTERNAL_ERROR;
1020                                 return 0;
1021                                 }
1022                         }
1023                 else if (type == TLSEXT_TYPE_renegotiate)
1024                         {
1025                         if(!ssl_parse_clienthello_renegotiate_ext(s, data, size, al))
1026                                 return 0;
1027                         renegotiate_seen = 1;
1028                         }
1029                 else if (type == TLSEXT_TYPE_signature_algorithms)
1030                         {
1031                         int dsize;
1032                         if (sigalg_seen || size < 2)
1033                                 {
1034                                 *al = SSL_AD_DECODE_ERROR;
1035                                 return 0;
1036                                 }
1037                         sigalg_seen = 1;
1038                         n2s(data,dsize);
1039                         size -= 2;
1040                         if (dsize != size || dsize & 1)
1041                                 {
1042                                 *al = SSL_AD_DECODE_ERROR;
1043                                 return 0;
1044                                 }
1045                         if (!tls1_process_sigalgs(s, data, dsize))
1046                                 {
1047                                 *al = SSL_AD_DECODE_ERROR;
1048                                 return 0;
1049                                 }
1050                         }
1051                 else if (type == TLSEXT_TYPE_status_request &&
1052                          s->version != DTLS1_VERSION && s->ctx->tlsext_status_cb)
1053                         {
1054
1055                         if (size < 5)
1056                                 {
1057                                 *al = SSL_AD_DECODE_ERROR;
1058                                 return 0;
1059                                 }
1060
1061                         s->tlsext_status_type = *data++;
1062                         size--;
1063                         if (s->tlsext_status_type == TLSEXT_STATUSTYPE_ocsp)
1064                                 {
1065                                 const unsigned char *sdata;
1066                                 int dsize;
1067                                 /* Read in responder_id_list */
1068                                 n2s(data,dsize);
1069                                 size -= 2;
1070                                 if (dsize > size  )
1071                                         {
1072                                         *al = SSL_AD_DECODE_ERROR;
1073                                         return 0;
1074                                         }
1075                                 while (dsize > 0)
1076                                         {
1077                                         OCSP_RESPID *id;
1078                                         int idsize;
1079                                         if (dsize < 4)
1080                                                 {
1081                                                 *al = SSL_AD_DECODE_ERROR;
1082                                                 return 0;
1083                                                 }
1084                                         n2s(data, idsize);
1085                                         dsize -= 2 + idsize;
1086                                         size -= 2 + idsize;
1087                                         if (dsize < 0)
1088                                                 {
1089                                                 *al = SSL_AD_DECODE_ERROR;
1090                                                 return 0;
1091                                                 }
1092                                         sdata = data;
1093                                         data += idsize;
1094                                         id = d2i_OCSP_RESPID(NULL,
1095                                                                 &sdata, idsize);
1096                                         if (!id)
1097                                                 {
1098                                                 *al = SSL_AD_DECODE_ERROR;
1099                                                 return 0;
1100                                                 }
1101                                         if (data != sdata)
1102                                                 {
1103                                                 OCSP_RESPID_free(id);
1104                                                 *al = SSL_AD_DECODE_ERROR;
1105                                                 return 0;
1106                                                 }
1107                                         if (!s->tlsext_ocsp_ids
1108                                                 && !(s->tlsext_ocsp_ids =
1109                                                 sk_OCSP_RESPID_new_null()))
1110                                                 {
1111                                                 OCSP_RESPID_free(id);
1112                                                 *al = SSL_AD_INTERNAL_ERROR;
1113                                                 return 0;
1114                                                 }
1115                                         if (!sk_OCSP_RESPID_push(
1116                                                         s->tlsext_ocsp_ids, id))
1117                                                 {
1118                                                 OCSP_RESPID_free(id);
1119                                                 *al = SSL_AD_INTERNAL_ERROR;
1120                                                 return 0;
1121                                                 }
1122                                         }
1123
1124                                 /* Read in request_extensions */
1125                                 if (size < 2)
1126                                         {
1127                                         *al = SSL_AD_DECODE_ERROR;
1128                                         return 0;
1129                                         }
1130                                 n2s(data,dsize);
1131                                 size -= 2;
1132                                 if (dsize != size)
1133                                         {
1134                                         *al = SSL_AD_DECODE_ERROR;
1135                                         return 0;
1136                                         }
1137                                 sdata = data;
1138                                 if (dsize > 0)
1139                                         {
1140                                         s->tlsext_ocsp_exts =
1141                                                 d2i_X509_EXTENSIONS(NULL,
1142                                                         &sdata, dsize);
1143                                         if (!s->tlsext_ocsp_exts
1144                                                 || (data + dsize != sdata))
1145                                                 {
1146                                                 *al = SSL_AD_DECODE_ERROR;
1147                                                 return 0;
1148                                                 }
1149                                         }
1150                                 }
1151                                 /* We don't know what to do with any other type
1152                                 * so ignore it.
1153                                 */
1154                                 else
1155                                         s->tlsext_status_type = -1;
1156                         }
1157 #ifndef OPENSSL_NO_NEXTPROTONEG
1158                 else if (type == TLSEXT_TYPE_next_proto_neg &&
1159                          s->s3->tmp.finish_md_len == 0)
1160                         {
1161                         /* We shouldn't accept this extension on a
1162                          * renegotiation.
1163                          *
1164                          * s->new_session will be set on renegotiation, but we
1165                          * probably shouldn't rely that it couldn't be set on
1166                          * the initial renegotation too in certain cases (when
1167                          * there's some other reason to disallow resuming an
1168                          * earlier session -- the current code won't be doing
1169                          * anything like that, but this might change).
1170
1171                          * A valid sign that there's been a previous handshake
1172                          * in this connection is if s->s3->tmp.finish_md_len >
1173                          * 0.  (We are talking about a check that will happen
1174                          * in the Hello protocol round, well before a new
1175                          * Finished message could have been computed.) */
1176                         s->s3->next_proto_neg_seen = 1;
1177                         }
1178 #endif
1179
1180                 /* session ticket processed earlier */
1181                 data+=size;
1182                 }
1183
1184         *p = data;
1185
1186         ri_check:
1187
1188         /* Need RI if renegotiating */
1189
1190         if (!renegotiate_seen && s->renegotiate &&
1191                 !(s->options & SSL_OP_ALLOW_UNSAFE_LEGACY_RENEGOTIATION))
1192                 {
1193                 *al = SSL_AD_HANDSHAKE_FAILURE;
1194                 SSLerr(SSL_F_SSL_PARSE_CLIENTHELLO_TLSEXT,
1195                                 SSL_R_UNSAFE_LEGACY_RENEGOTIATION_DISABLED);
1196                 return 0;
1197                 }
1198
1199         return 1;
1200         }
1201
1202 #ifndef OPENSSL_NO_NEXTPROTONEG
1203 /* ssl_next_proto_validate validates a Next Protocol Negotiation block. No
1204  * elements of zero length are allowed and the set of elements must exactly fill
1205  * the length of the block. */
1206 static int ssl_next_proto_validate(unsigned char *d, unsigned len)
1207         {
1208         unsigned int off = 0;
1209
1210         while (off < len)
1211                 {
1212                 if (d[off] == 0)
1213                         return 0;
1214                 off += d[off];
1215                 off++;
1216                 }
1217
1218         return off == len;
1219         }
1220 #endif
1221
1222 int ssl_parse_serverhello_tlsext(SSL *s, unsigned char **p, unsigned char *d, int n, int *al)
1223         {
1224         unsigned short length;
1225         unsigned short type;
1226         unsigned short size;
1227         unsigned char *data = *p;
1228         int tlsext_servername = 0;
1229         int renegotiate_seen = 0;
1230
1231         if (data >= (d+n-2))
1232                 goto ri_check;
1233
1234         n2s(data,length);
1235         if (data+length != d+n)
1236                 {
1237                 *al = SSL_AD_DECODE_ERROR;
1238                 return 0;
1239                 }
1240
1241         while(data <= (d+n-4))
1242                 {
1243                 n2s(data,type);
1244                 n2s(data,size);
1245
1246                 if (data+size > (d+n))
1247                         goto ri_check;
1248
1249                 if (s->tlsext_debug_cb)
1250                         s->tlsext_debug_cb(s, 1, type, data, size,
1251                                                 s->tlsext_debug_arg);
1252
1253                 if (type == TLSEXT_TYPE_server_name)
1254                         {
1255                         if (s->tlsext_hostname == NULL || size > 0)
1256                                 {
1257                                 *al = TLS1_AD_UNRECOGNIZED_NAME;
1258                                 return 0;
1259                                 }
1260                         tlsext_servername = 1;
1261                         }
1262
1263 #ifndef OPENSSL_NO_EC
1264                 else if (type == TLSEXT_TYPE_ec_point_formats &&
1265                      s->version != DTLS1_VERSION)
1266                         {
1267                         unsigned char *sdata = data;
1268                         int ecpointformatlist_length = *(sdata++);
1269
1270                         if (ecpointformatlist_length != size - 1)
1271                                 {
1272                                 *al = TLS1_AD_DECODE_ERROR;
1273                                 return 0;
1274                                 }
1275                         s->session->tlsext_ecpointformatlist_length = 0;
1276                         if (s->session->tlsext_ecpointformatlist != NULL) OPENSSL_free(s->session->tlsext_ecpointformatlist);
1277                         if ((s->session->tlsext_ecpointformatlist = OPENSSL_malloc(ecpointformatlist_length)) == NULL)
1278                                 {
1279                                 *al = TLS1_AD_INTERNAL_ERROR;
1280                                 return 0;
1281                                 }
1282                         s->session->tlsext_ecpointformatlist_length = ecpointformatlist_length;
1283                         memcpy(s->session->tlsext_ecpointformatlist, sdata, ecpointformatlist_length);
1284 #if 0
1285                         fprintf(stderr,"ssl_parse_serverhello_tlsext s->session->tlsext_ecpointformatlist ");
1286                         sdata = s->session->tlsext_ecpointformatlist;
1287                         for (i = 0; i < s->session->tlsext_ecpointformatlist_length; i++)
1288                                 fprintf(stderr,"%i ",*(sdata++));
1289                         fprintf(stderr,"\n");
1290 #endif
1291                         }
1292 #endif /* OPENSSL_NO_EC */
1293
1294                 else if (type == TLSEXT_TYPE_session_ticket)
1295                         {
1296                         if (s->tls_session_ticket_ext_cb &&
1297                             !s->tls_session_ticket_ext_cb(s, data, size, s->tls_session_ticket_ext_cb_arg))
1298                                 {
1299                                 *al = TLS1_AD_INTERNAL_ERROR;
1300                                 return 0;
1301                                 }
1302                         if ((SSL_get_options(s) & SSL_OP_NO_TICKET)
1303                                 || (size > 0))
1304                                 {
1305                                 *al = TLS1_AD_UNSUPPORTED_EXTENSION;
1306                                 return 0;
1307                                 }
1308                         s->tlsext_ticket_expected = 1;
1309                         }
1310 #ifdef TLSEXT_TYPE_opaque_prf_input
1311                 else if (type == TLSEXT_TYPE_opaque_prf_input &&
1312                      s->version != DTLS1_VERSION)
1313                         {
1314                         unsigned char *sdata = data;
1315
1316                         if (size < 2)
1317                                 {
1318                                 *al = SSL_AD_DECODE_ERROR;
1319                                 return 0;
1320                                 }
1321                         n2s(sdata, s->s3->server_opaque_prf_input_len);
1322                         if (s->s3->server_opaque_prf_input_len != size - 2)
1323                                 {
1324                                 *al = SSL_AD_DECODE_ERROR;
1325                                 return 0;
1326                                 }
1327
1328                         if (s->s3->server_opaque_prf_input != NULL) /* shouldn't really happen */
1329                                 OPENSSL_free(s->s3->server_opaque_prf_input);
1330                         if (s->s3->server_opaque_prf_input_len == 0)
1331                                 s->s3->server_opaque_prf_input = OPENSSL_malloc(1); /* dummy byte just to get non-NULL */
1332                         else
1333                                 s->s3->server_opaque_prf_input = BUF_memdup(sdata, s->s3->server_opaque_prf_input_len);
1334
1335                         if (s->s3->server_opaque_prf_input == NULL)
1336                                 {
1337                                 *al = TLS1_AD_INTERNAL_ERROR;
1338                                 return 0;
1339                                 }
1340                         }
1341 #endif
1342                 else if (type == TLSEXT_TYPE_status_request &&
1343                          s->version != DTLS1_VERSION)
1344                         {
1345                         /* MUST be empty and only sent if we've requested
1346                          * a status request message.
1347                          */
1348                         if ((s->tlsext_status_type == -1) || (size > 0))
1349                                 {
1350                                 *al = TLS1_AD_UNSUPPORTED_EXTENSION;
1351                                 return 0;
1352                                 }
1353                         /* Set flag to expect CertificateStatus message */
1354                         s->tlsext_status_expected = 1;
1355                         }
1356 #ifndef OPENSSL_NO_NEXTPROTONEG
1357                 else if (type == TLSEXT_TYPE_next_proto_neg)
1358                         {
1359                         unsigned char *selected;
1360                         unsigned char selected_len;
1361
1362                         /* We must have requested it. */
1363                         if ((s->ctx->next_proto_select_cb == NULL))
1364                                 {
1365                                 *al = TLS1_AD_UNSUPPORTED_EXTENSION;
1366                                 return 0;
1367                                 }
1368                         /* The data must be valid */
1369                         if (!ssl_next_proto_validate(data, size))
1370                                 {
1371                                 *al = TLS1_AD_DECODE_ERROR;
1372                                 return 0;
1373                                 }
1374                         if (s->ctx->next_proto_select_cb(s, &selected, &selected_len, data, size, s->ctx->next_proto_select_cb_arg) != SSL_TLSEXT_ERR_OK)
1375                                 {
1376                                 *al = TLS1_AD_INTERNAL_ERROR;
1377                                 return 0;
1378                                 }
1379                         s->next_proto_negotiated = OPENSSL_malloc(selected_len);
1380                         if (!s->next_proto_negotiated)
1381                                 {
1382                                 *al = TLS1_AD_INTERNAL_ERROR;
1383                                 return 0;
1384                                 }
1385                         memcpy(s->next_proto_negotiated, selected, selected_len);
1386                         s->next_proto_negotiated_len = selected_len;
1387                         }
1388 #endif
1389                 else if (type == TLSEXT_TYPE_renegotiate)
1390                         {
1391                         if(!ssl_parse_serverhello_renegotiate_ext(s, data, size, al))
1392                                 return 0;
1393                         renegotiate_seen = 1;
1394                         }
1395                 data+=size;
1396                 }
1397
1398         if (data != d+n)
1399                 {
1400                 *al = SSL_AD_DECODE_ERROR;
1401                 return 0;
1402                 }
1403
1404         if (!s->hit && tlsext_servername == 1)
1405                 {
1406                 if (s->tlsext_hostname)
1407                         {
1408                         if (s->session->tlsext_hostname == NULL)
1409                                 {
1410                                 s->session->tlsext_hostname = BUF_strdup(s->tlsext_hostname);
1411                                 if (!s->session->tlsext_hostname)
1412                                         {
1413                                         *al = SSL_AD_UNRECOGNIZED_NAME;
1414                                         return 0;
1415                                         }
1416                                 }
1417                         else
1418                                 {
1419                                 *al = SSL_AD_DECODE_ERROR;
1420                                 return 0;
1421                                 }
1422                         }
1423                 }
1424
1425         *p = data;
1426
1427         ri_check:
1428
1429         /* Determine if we need to see RI. Strictly speaking if we want to
1430          * avoid an attack we should *always* see RI even on initial server
1431          * hello because the client doesn't see any renegotiation during an
1432          * attack. However this would mean we could not connect to any server
1433          * which doesn't support RI so for the immediate future tolerate RI
1434          * absence on initial connect only.
1435          */
1436         if (!renegotiate_seen
1437                 && !(s->options & SSL_OP_LEGACY_SERVER_CONNECT)
1438                 && !(s->options & SSL_OP_ALLOW_UNSAFE_LEGACY_RENEGOTIATION))
1439                 {
1440                 *al = SSL_AD_HANDSHAKE_FAILURE;
1441                 SSLerr(SSL_F_SSL_PARSE_SERVERHELLO_TLSEXT,
1442                                 SSL_R_UNSAFE_LEGACY_RENEGOTIATION_DISABLED);
1443                 return 0;
1444                 }
1445
1446         return 1;
1447         }
1448
1449
1450 int ssl_prepare_clienthello_tlsext(SSL *s)
1451         {
1452 #ifndef OPENSSL_NO_EC
1453         /* If we are client and using an elliptic curve cryptography cipher suite, send the point formats
1454          * and elliptic curves we support.
1455          */
1456         int using_ecc = 0;
1457         int i;
1458         unsigned char *j;
1459         unsigned long alg_k, alg_a;
1460         STACK_OF(SSL_CIPHER) *cipher_stack = SSL_get_ciphers(s);
1461
1462         for (i = 0; i < sk_SSL_CIPHER_num(cipher_stack); i++)
1463                 {
1464                 SSL_CIPHER *c = sk_SSL_CIPHER_value(cipher_stack, i);
1465
1466                 alg_k = c->algorithm_mkey;
1467                 alg_a = c->algorithm_auth;
1468                 if ((alg_k & (SSL_kEECDH|SSL_kECDHr|SSL_kECDHe) || (alg_a & SSL_aECDSA)))
1469                         {
1470                         using_ecc = 1;
1471                         break;
1472                         }
1473                 }
1474         using_ecc = using_ecc && (s->version >= TLS1_VERSION);
1475         if (using_ecc)
1476                 {
1477                 if (s->tlsext_ecpointformatlist != NULL) OPENSSL_free(s->tlsext_ecpointformatlist);
1478                 if ((s->tlsext_ecpointformatlist = OPENSSL_malloc(3)) == NULL)
1479                         {
1480                         SSLerr(SSL_F_SSL_PREPARE_CLIENTHELLO_TLSEXT,ERR_R_MALLOC_FAILURE);
1481                         return -1;
1482                         }
1483                 s->tlsext_ecpointformatlist_length = 3;
1484                 s->tlsext_ecpointformatlist[0] = TLSEXT_ECPOINTFORMAT_uncompressed;
1485                 s->tlsext_ecpointformatlist[1] = TLSEXT_ECPOINTFORMAT_ansiX962_compressed_prime;
1486                 s->tlsext_ecpointformatlist[2] = TLSEXT_ECPOINTFORMAT_ansiX962_compressed_char2;
1487
1488                 /* we support all named elliptic curves in draft-ietf-tls-ecc-12 */
1489                 if (s->tlsext_ellipticcurvelist != NULL) OPENSSL_free(s->tlsext_ellipticcurvelist);
1490                 s->tlsext_ellipticcurvelist_length = sizeof(nid_list)/sizeof(nid_list[0]) * 2;
1491                 if ((s->tlsext_ellipticcurvelist = OPENSSL_malloc(s->tlsext_ellipticcurvelist_length)) == NULL)
1492                         {
1493                         s->tlsext_ellipticcurvelist_length = 0;
1494                         SSLerr(SSL_F_SSL_PREPARE_CLIENTHELLO_TLSEXT,ERR_R_MALLOC_FAILURE);
1495                         return -1;
1496                         }
1497                 for (i = 1, j = s->tlsext_ellipticcurvelist; (unsigned int)i <=
1498                                 sizeof(nid_list)/sizeof(nid_list[0]); i++)
1499                         s2n(i,j);
1500                 }
1501 #endif /* OPENSSL_NO_EC */
1502
1503 #ifdef TLSEXT_TYPE_opaque_prf_input
1504         {
1505                 int r = 1;
1506
1507                 if (s->ctx->tlsext_opaque_prf_input_callback != 0)
1508                         {
1509                         r = s->ctx->tlsext_opaque_prf_input_callback(s, NULL, 0, s->ctx->tlsext_opaque_prf_input_callback_arg);
1510                         if (!r)
1511                                 return -1;
1512                         }
1513
1514                 if (s->tlsext_opaque_prf_input != NULL)
1515                         {
1516                         if (s->s3->client_opaque_prf_input != NULL) /* shouldn't really happen */
1517                                 OPENSSL_free(s->s3->client_opaque_prf_input);
1518
1519                         if (s->tlsext_opaque_prf_input_len == 0)
1520                                 s->s3->client_opaque_prf_input = OPENSSL_malloc(1); /* dummy byte just to get non-NULL */
1521                         else
1522                                 s->s3->client_opaque_prf_input = BUF_memdup(s->tlsext_opaque_prf_input, s->tlsext_opaque_prf_input_len);
1523                         if (s->s3->client_opaque_prf_input == NULL)
1524                                 {
1525                                 SSLerr(SSL_F_SSL_PREPARE_CLIENTHELLO_TLSEXT,ERR_R_MALLOC_FAILURE);
1526                                 return -1;
1527                                 }
1528                         s->s3->client_opaque_prf_input_len = s->tlsext_opaque_prf_input_len;
1529                         }
1530
1531                 if (r == 2)
1532                         /* at callback's request, insist on receiving an appropriate server opaque PRF input */
1533                         s->s3->server_opaque_prf_input_len = s->tlsext_opaque_prf_input_len;
1534         }
1535 #endif
1536
1537         return 1;
1538         }
1539
1540 int ssl_prepare_serverhello_tlsext(SSL *s)
1541         {
1542 #ifndef OPENSSL_NO_EC
1543         /* If we are server and using an ECC cipher suite, send the point formats we support
1544          * if the client sent us an ECPointsFormat extension.  Note that the server is not
1545          * supposed to send an EllipticCurves extension.
1546          */
1547
1548         unsigned long alg_k = s->s3->tmp.new_cipher->algorithm_mkey;
1549         unsigned long alg_a = s->s3->tmp.new_cipher->algorithm_auth;
1550         int using_ecc = (alg_k & (SSL_kEECDH|SSL_kECDHr|SSL_kECDHe)) || (alg_a & SSL_aECDSA);
1551         using_ecc = using_ecc && (s->session->tlsext_ecpointformatlist != NULL);
1552
1553         if (using_ecc)
1554                 {
1555                 if (s->tlsext_ecpointformatlist != NULL) OPENSSL_free(s->tlsext_ecpointformatlist);
1556                 if ((s->tlsext_ecpointformatlist = OPENSSL_malloc(3)) == NULL)
1557                         {
1558                         SSLerr(SSL_F_SSL_PREPARE_SERVERHELLO_TLSEXT,ERR_R_MALLOC_FAILURE);
1559                         return -1;
1560                         }
1561                 s->tlsext_ecpointformatlist_length = 3;
1562                 s->tlsext_ecpointformatlist[0] = TLSEXT_ECPOINTFORMAT_uncompressed;
1563                 s->tlsext_ecpointformatlist[1] = TLSEXT_ECPOINTFORMAT_ansiX962_compressed_prime;
1564                 s->tlsext_ecpointformatlist[2] = TLSEXT_ECPOINTFORMAT_ansiX962_compressed_char2;
1565                 }
1566 #endif /* OPENSSL_NO_EC */
1567
1568         return 1;
1569         }
1570
1571 int ssl_check_clienthello_tlsext(SSL *s)
1572         {
1573         int ret=SSL_TLSEXT_ERR_NOACK;
1574         int al = SSL_AD_UNRECOGNIZED_NAME;
1575
1576 #ifndef OPENSSL_NO_EC
1577         /* The handling of the ECPointFormats extension is done elsewhere, namely in
1578          * ssl3_choose_cipher in s3_lib.c.
1579          */
1580         /* The handling of the EllipticCurves extension is done elsewhere, namely in
1581          * ssl3_choose_cipher in s3_lib.c.
1582          */
1583 #endif
1584
1585         if (s->ctx != NULL && s->ctx->tlsext_servername_callback != 0)
1586                 ret = s->ctx->tlsext_servername_callback(s, &al, s->ctx->tlsext_servername_arg);
1587         else if (s->initial_ctx != NULL && s->initial_ctx->tlsext_servername_callback != 0)
1588                 ret = s->initial_ctx->tlsext_servername_callback(s, &al, s->initial_ctx->tlsext_servername_arg);
1589
1590         /* If status request then ask callback what to do.
1591          * Note: this must be called after servername callbacks in case
1592          * the certificate has changed.
1593          */
1594         if ((s->tlsext_status_type != -1) && s->ctx && s->ctx->tlsext_status_cb)
1595                 {
1596                 int r;
1597                 r = s->ctx->tlsext_status_cb(s, s->ctx->tlsext_status_arg);
1598                 switch (r)
1599                         {
1600                         /* We don't want to send a status request response */
1601                         case SSL_TLSEXT_ERR_NOACK:
1602                                 s->tlsext_status_expected = 0;
1603                                 break;
1604                         /* status request response should be sent */
1605                         case SSL_TLSEXT_ERR_OK:
1606                                 if (s->tlsext_ocsp_resp)
1607                                         s->tlsext_status_expected = 1;
1608                                 else
1609                                         s->tlsext_status_expected = 0;
1610                                 break;
1611                         /* something bad happened */
1612                         case SSL_TLSEXT_ERR_ALERT_FATAL:
1613                                 ret = SSL_TLSEXT_ERR_ALERT_FATAL;
1614                                 al = SSL_AD_INTERNAL_ERROR;
1615                                 goto err;
1616                         }
1617                 }
1618         else
1619                 s->tlsext_status_expected = 0;
1620
1621 #ifdef TLSEXT_TYPE_opaque_prf_input
1622         {
1623                 /* This sort of belongs into ssl_prepare_serverhello_tlsext(),
1624                  * but we might be sending an alert in response to the client hello,
1625                  * so this has to happen here in ssl_check_clienthello_tlsext(). */
1626
1627                 int r = 1;
1628
1629                 if (s->ctx->tlsext_opaque_prf_input_callback != 0)
1630                         {
1631                         r = s->ctx->tlsext_opaque_prf_input_callback(s, NULL, 0, s->ctx->tlsext_opaque_prf_input_callback_arg);
1632                         if (!r)
1633                                 {
1634                                 ret = SSL_TLSEXT_ERR_ALERT_FATAL;
1635                                 al = SSL_AD_INTERNAL_ERROR;
1636                                 goto err;
1637                                 }
1638                         }
1639
1640                 if (s->s3->server_opaque_prf_input != NULL) /* shouldn't really happen */
1641                         OPENSSL_free(s->s3->server_opaque_prf_input);
1642                 s->s3->server_opaque_prf_input = NULL;
1643
1644                 if (s->tlsext_opaque_prf_input != NULL)
1645                         {
1646                         if (s->s3->client_opaque_prf_input != NULL &&
1647                                 s->s3->client_opaque_prf_input_len == s->tlsext_opaque_prf_input_len)
1648                                 {
1649                                 /* can only use this extension if we have a server opaque PRF input
1650                                  * of the same length as the client opaque PRF input! */
1651
1652                                 if (s->tlsext_opaque_prf_input_len == 0)
1653                                         s->s3->server_opaque_prf_input = OPENSSL_malloc(1); /* dummy byte just to get non-NULL */
1654                                 else
1655                                         s->s3->server_opaque_prf_input = BUF_memdup(s->tlsext_opaque_prf_input, s->tlsext_opaque_prf_input_len);
1656                                 if (s->s3->server_opaque_prf_input == NULL)
1657                                         {
1658                                         ret = SSL_TLSEXT_ERR_ALERT_FATAL;
1659                                         al = SSL_AD_INTERNAL_ERROR;
1660                                         goto err;
1661                                         }
1662                                 s->s3->server_opaque_prf_input_len = s->tlsext_opaque_prf_input_len;
1663                                 }
1664                         }
1665
1666                 if (r == 2 && s->s3->server_opaque_prf_input == NULL)
1667                         {
1668                         /* The callback wants to enforce use of the extension,
1669                          * but we can't do that with the client opaque PRF input;
1670                          * abort the handshake.
1671                          */
1672                         ret = SSL_TLSEXT_ERR_ALERT_FATAL;
1673                         al = SSL_AD_HANDSHAKE_FAILURE;
1674                         }
1675         }
1676
1677 #endif
1678  err:
1679         switch (ret)
1680                 {
1681                 case SSL_TLSEXT_ERR_ALERT_FATAL:
1682                         ssl3_send_alert(s,SSL3_AL_FATAL,al);
1683                         return -1;
1684
1685                 case SSL_TLSEXT_ERR_ALERT_WARNING:
1686                         ssl3_send_alert(s,SSL3_AL_WARNING,al);
1687                         return 1;
1688
1689                 case SSL_TLSEXT_ERR_NOACK:
1690                         s->servername_done=0;
1691                         default:
1692                 return 1;
1693                 }
1694         }
1695
1696 int ssl_check_serverhello_tlsext(SSL *s)
1697         {
1698         int ret=SSL_TLSEXT_ERR_NOACK;
1699         int al = SSL_AD_UNRECOGNIZED_NAME;
1700
1701 #ifndef OPENSSL_NO_EC
1702         /* If we are client and using an elliptic curve cryptography cipher
1703          * suite, then if server returns an EC point formats lists extension
1704          * it must contain uncompressed.
1705          */
1706         unsigned long alg_k = s->s3->tmp.new_cipher->algorithm_mkey;
1707         unsigned long alg_a = s->s3->tmp.new_cipher->algorithm_auth;
1708         if ((s->tlsext_ecpointformatlist != NULL) && (s->tlsext_ecpointformatlist_length > 0) &&
1709             (s->session->tlsext_ecpointformatlist != NULL) && (s->session->tlsext_ecpointformatlist_length > 0) &&
1710             ((alg_k & (SSL_kEECDH|SSL_kECDHr|SSL_kECDHe)) || (alg_a & SSL_aECDSA)))
1711                 {
1712                 /* we are using an ECC cipher */
1713                 size_t i;
1714                 unsigned char *list;
1715                 int found_uncompressed = 0;
1716                 list = s->session->tlsext_ecpointformatlist;
1717                 for (i = 0; i < s->session->tlsext_ecpointformatlist_length; i++)
1718                         {
1719                         if (*(list++) == TLSEXT_ECPOINTFORMAT_uncompressed)
1720                                 {
1721                                 found_uncompressed = 1;
1722                                 break;
1723                                 }
1724                         }
1725                 if (!found_uncompressed)
1726                         {
1727                         SSLerr(SSL_F_SSL_CHECK_SERVERHELLO_TLSEXT,SSL_R_TLS_INVALID_ECPOINTFORMAT_LIST);
1728                         return -1;
1729                         }
1730                 }
1731         ret = SSL_TLSEXT_ERR_OK;
1732 #endif /* OPENSSL_NO_EC */
1733
1734         if (s->ctx != NULL && s->ctx->tlsext_servername_callback != 0)
1735                 ret = s->ctx->tlsext_servername_callback(s, &al, s->ctx->tlsext_servername_arg);
1736         else if (s->initial_ctx != NULL && s->initial_ctx->tlsext_servername_callback != 0)
1737                 ret = s->initial_ctx->tlsext_servername_callback(s, &al, s->initial_ctx->tlsext_servername_arg);
1738
1739 #ifdef TLSEXT_TYPE_opaque_prf_input
1740         if (s->s3->server_opaque_prf_input_len > 0)
1741                 {
1742                 /* This case may indicate that we, as a client, want to insist on using opaque PRF inputs.
1743                  * So first verify that we really have a value from the server too. */
1744
1745                 if (s->s3->server_opaque_prf_input == NULL)
1746                         {
1747                         ret = SSL_TLSEXT_ERR_ALERT_FATAL;
1748                         al = SSL_AD_HANDSHAKE_FAILURE;
1749                         }
1750
1751                 /* Anytime the server *has* sent an opaque PRF input, we need to check
1752                  * that we have a client opaque PRF input of the same size. */
1753                 if (s->s3->client_opaque_prf_input == NULL ||
1754                     s->s3->client_opaque_prf_input_len != s->s3->server_opaque_prf_input_len)
1755                         {
1756                         ret = SSL_TLSEXT_ERR_ALERT_FATAL;
1757                         al = SSL_AD_ILLEGAL_PARAMETER;
1758                         }
1759                 }
1760 #endif
1761
1762         /* If we've requested certificate status and we wont get one
1763          * tell the callback
1764          */
1765         if ((s->tlsext_status_type != -1) && !(s->tlsext_status_expected)
1766                         && s->ctx && s->ctx->tlsext_status_cb)
1767                 {
1768                 int r;
1769                 /* Set resp to NULL, resplen to -1 so callback knows
1770                  * there is no response.
1771                  */
1772                 if (s->tlsext_ocsp_resp)
1773                         {
1774                         OPENSSL_free(s->tlsext_ocsp_resp);
1775                         s->tlsext_ocsp_resp = NULL;
1776                         }
1777                 s->tlsext_ocsp_resplen = -1;
1778                 r = s->ctx->tlsext_status_cb(s, s->ctx->tlsext_status_arg);
1779                 if (r == 0)
1780                         {
1781                         al = SSL_AD_BAD_CERTIFICATE_STATUS_RESPONSE;
1782                         ret = SSL_TLSEXT_ERR_ALERT_FATAL;
1783                         }
1784                 if (r < 0)
1785                         {
1786                         al = SSL_AD_INTERNAL_ERROR;
1787                         ret = SSL_TLSEXT_ERR_ALERT_FATAL;
1788                         }
1789                 }
1790
1791         switch (ret)
1792                 {
1793                 case SSL_TLSEXT_ERR_ALERT_FATAL:
1794                         ssl3_send_alert(s,SSL3_AL_FATAL,al);
1795                         return -1;
1796
1797                 case SSL_TLSEXT_ERR_ALERT_WARNING:
1798                         ssl3_send_alert(s,SSL3_AL_WARNING,al);
1799                         return 1;
1800
1801                 case SSL_TLSEXT_ERR_NOACK:
1802                         s->servername_done=0;
1803                         default:
1804                 return 1;
1805                 }
1806         }
1807
1808 /* Since the server cache lookup is done early on in the processing of client
1809  * hello and other operations depend on the result we need to handle any TLS
1810  * session ticket extension at the same time.
1811  */
1812
1813 int tls1_process_ticket(SSL *s, unsigned char *session_id, int len,
1814                                 const unsigned char *limit, SSL_SESSION **ret)
1815         {
1816         /* Point after session ID in client hello */
1817         const unsigned char *p = session_id + len;
1818         unsigned short i;
1819
1820         /* If tickets disabled behave as if no ticket present
1821          * to permit stateful resumption.
1822          */
1823         if (SSL_get_options(s) & SSL_OP_NO_TICKET)
1824                 return 1;
1825
1826         if ((s->version <= SSL3_VERSION) || !limit)
1827                 return 1;
1828         if (p >= limit)
1829                 return -1;
1830         /* Skip past DTLS cookie */
1831         if (s->version == DTLS1_VERSION || s->version == DTLS1_BAD_VER)
1832                 {
1833                 i = *(p++);
1834                 p+= i;
1835                 if (p >= limit)
1836                         return -1;
1837                 }
1838         /* Skip past cipher list */
1839         n2s(p, i);
1840         p+= i;
1841         if (p >= limit)
1842                 return -1;
1843         /* Skip past compression algorithm list */
1844         i = *(p++);
1845         p += i;
1846         if (p > limit)
1847                 return -1;
1848         /* Now at start of extensions */
1849         if ((p + 2) >= limit)
1850                 return 1;
1851         n2s(p, i);
1852         while ((p + 4) <= limit)
1853                 {
1854                 unsigned short type, size;
1855                 n2s(p, type);
1856                 n2s(p, size);
1857                 if (p + size > limit)
1858                         return 1;
1859                 if (type == TLSEXT_TYPE_session_ticket)
1860                         {
1861                         /* If tickets disabled indicate cache miss which will
1862                          * trigger a full handshake
1863                          */
1864                         if (SSL_get_options(s) & SSL_OP_NO_TICKET)
1865                                 return 1;
1866                         /* If zero length note client will accept a ticket
1867                          * and indicate cache miss to trigger full handshake
1868                          */
1869                         if (size == 0)
1870                                 {
1871                                 s->tlsext_ticket_expected = 1;
1872                                 return 0;       /* Cache miss */
1873                                 }
1874                         if (s->tls_session_secret_cb)
1875                                 {
1876                                 /* Indicate cache miss here and instead of
1877                                  * generating the session from ticket now,
1878                                  * trigger abbreviated handshake based on
1879                                  * external mechanism to calculate the master
1880                                  * secret later. */
1881                                 return 0;
1882                                 }
1883                         return tls_decrypt_ticket(s, p, size, session_id, len,
1884                                                                         ret);
1885                         }
1886                 p += size;
1887                 }
1888         return 1;
1889         }
1890
1891 static int tls_decrypt_ticket(SSL *s, const unsigned char *etick, int eticklen,
1892                                 const unsigned char *sess_id, int sesslen,
1893                                 SSL_SESSION **psess)
1894         {
1895         SSL_SESSION *sess;
1896         unsigned char *sdec;
1897         const unsigned char *p;
1898         int slen, mlen, renew_ticket = 0;
1899         unsigned char tick_hmac[EVP_MAX_MD_SIZE];
1900         HMAC_CTX hctx;
1901         EVP_CIPHER_CTX ctx;
1902         SSL_CTX *tctx = s->initial_ctx;
1903         /* Need at least keyname + iv + some encrypted data */
1904         if (eticklen < 48)
1905                 goto tickerr;
1906         /* Initialize session ticket encryption and HMAC contexts */
1907         HMAC_CTX_init(&hctx);
1908         EVP_CIPHER_CTX_init(&ctx);
1909         if (tctx->tlsext_ticket_key_cb)
1910                 {
1911                 unsigned char *nctick = (unsigned char *)etick;
1912                 int rv = tctx->tlsext_ticket_key_cb(s, nctick, nctick + 16,
1913                                                         &ctx, &hctx, 0);
1914                 if (rv < 0)
1915                         return -1;
1916                 if (rv == 0)
1917                         goto tickerr;
1918                 if (rv == 2)
1919                         renew_ticket = 1;
1920                 }
1921         else
1922                 {
1923                 /* Check key name matches */
1924                 if (memcmp(etick, tctx->tlsext_tick_key_name, 16))
1925                         goto tickerr;
1926                 HMAC_Init_ex(&hctx, tctx->tlsext_tick_hmac_key, 16,
1927                                         tlsext_tick_md(), NULL);
1928                 EVP_DecryptInit_ex(&ctx, EVP_aes_128_cbc(), NULL,
1929                                 tctx->tlsext_tick_aes_key, etick + 16);
1930                 }
1931         /* Attempt to process session ticket, first conduct sanity and
1932          * integrity checks on ticket.
1933          */
1934         mlen = HMAC_size(&hctx);
1935         if (mlen < 0)
1936                 {
1937                 EVP_CIPHER_CTX_cleanup(&ctx);
1938                 return -1;
1939                 }
1940         eticklen -= mlen;
1941         /* Check HMAC of encrypted ticket */
1942         HMAC_Update(&hctx, etick, eticklen);
1943         HMAC_Final(&hctx, tick_hmac, NULL);
1944         HMAC_CTX_cleanup(&hctx);
1945         if (memcmp(tick_hmac, etick + eticklen, mlen))
1946                 goto tickerr;
1947         /* Attempt to decrypt session data */
1948         /* Move p after IV to start of encrypted ticket, update length */
1949         p = etick + 16 + EVP_CIPHER_CTX_iv_length(&ctx);
1950         eticklen -= 16 + EVP_CIPHER_CTX_iv_length(&ctx);
1951         sdec = OPENSSL_malloc(eticklen);
1952         if (!sdec)
1953                 {
1954                 EVP_CIPHER_CTX_cleanup(&ctx);
1955                 return -1;
1956                 }
1957         EVP_DecryptUpdate(&ctx, sdec, &slen, p, eticklen);
1958         if (EVP_DecryptFinal(&ctx, sdec + slen, &mlen) <= 0)
1959                 goto tickerr;
1960         slen += mlen;
1961         EVP_CIPHER_CTX_cleanup(&ctx);
1962         p = sdec;
1963
1964         sess = d2i_SSL_SESSION(NULL, &p, slen);
1965         OPENSSL_free(sdec);
1966         if (sess)
1967                 {
1968                 /* The session ID if non-empty is used by some clients to
1969                  * detect that the ticket has been accepted. So we copy it to
1970                  * the session structure. If it is empty set length to zero
1971                  * as required by standard.
1972                  */
1973                 if (sesslen)
1974                         memcpy(sess->session_id, sess_id, sesslen);
1975                 sess->session_id_length = sesslen;
1976                 *psess = sess;
1977                 s->tlsext_ticket_expected = renew_ticket;
1978                 return 1;
1979                 }
1980         /* If session decrypt failure indicate a cache miss and set state to
1981          * send a new ticket
1982          */
1983         tickerr:
1984         s->tlsext_ticket_expected = 1;
1985         return 0;
1986         }
1987
1988 /* Tables to translate from NIDs to TLS v1.2 ids */
1989
1990 typedef struct
1991         {
1992         int nid;
1993         int id;
1994         } tls12_lookup;
1995
1996 static tls12_lookup tls12_md[] = {
1997 #ifndef OPENSSL_NO_MD5
1998         {NID_md5, TLSEXT_hash_md5},
1999 #endif
2000 #ifndef OPENSSL_NO_SHA
2001         {NID_sha1, TLSEXT_hash_sha1},
2002 #endif
2003 #ifndef OPENSSL_NO_SHA256
2004         {NID_sha224, TLSEXT_hash_sha224},
2005         {NID_sha256, TLSEXT_hash_sha256},
2006 #endif
2007 #ifndef OPENSSL_NO_SHA512
2008         {NID_sha384, TLSEXT_hash_sha384},
2009         {NID_sha512, TLSEXT_hash_sha512}
2010 #endif
2011 };
2012
2013 static tls12_lookup tls12_sig[] = {
2014 #ifndef OPENSSL_NO_RSA
2015         {EVP_PKEY_RSA, TLSEXT_signature_rsa},
2016 #endif
2017 #ifndef OPENSSL_NO_RSA
2018         {EVP_PKEY_DSA, TLSEXT_signature_dsa},
2019 #endif
2020 #ifndef OPENSSL_NO_ECDSA
2021         {EVP_PKEY_EC, TLSEXT_signature_ecdsa}
2022 #endif
2023 };
2024
2025 static int tls12_find_id(int nid, tls12_lookup *table, size_t tlen)
2026         {
2027         size_t i;
2028         for (i = 0; i < tlen; i++)
2029                 {
2030                 if (table[i].nid == nid)
2031                         return table[i].id;
2032                 }
2033         return -1;
2034         }
2035 #if 0
2036 static int tls12_find_nid(int id, tls12_lookup *table, size_t tlen)
2037         {
2038         size_t i;
2039         for (i = 0; i < tlen; i++)
2040                 {
2041                 if (table[i].id == id)
2042                         return table[i].nid;
2043                 }
2044         return -1;
2045         }
2046 #endif
2047
2048 int tls12_get_sigandhash(unsigned char *p, const EVP_PKEY *pk, const EVP_MD *md)
2049         {
2050         int sig_id, md_id;
2051         md_id = tls12_find_id(EVP_MD_type(md), tls12_md,
2052                                 sizeof(tls12_md)/sizeof(tls12_lookup));
2053         if (md_id == -1)
2054                 return 0;
2055         sig_id = tls12_get_sigid(pk);
2056         if (sig_id == -1)
2057                 return 0;
2058         p[0] = (unsigned char)md_id;
2059         p[1] = (unsigned char)sig_id;
2060         return 1;
2061         }
2062
2063 int tls12_get_sigid(const EVP_PKEY *pk)
2064         {
2065         return tls12_find_id(pk->type, tls12_sig,
2066                                 sizeof(tls12_sig)/sizeof(tls12_lookup));
2067         }
2068
2069 const EVP_MD *tls12_get_hash(unsigned char hash_alg)
2070         {
2071         switch(hash_alg)
2072                 {
2073 #ifndef OPENSSL_NO_MD5
2074                 case TLSEXT_hash_md5:
2075 #ifdef OPENSSL_FIPS
2076                 if (FIPS_mode())
2077                         return NULL;
2078 #endif
2079                 return EVP_md5();
2080 #endif
2081 #ifndef OPENSSL_NO_SHA
2082                 case TLSEXT_hash_sha1:
2083                 return EVP_sha1();
2084 #endif
2085 #ifndef OPENSSL_NO_SHA256
2086                 case TLSEXT_hash_sha224:
2087                 return EVP_sha224();
2088
2089                 case TLSEXT_hash_sha256:
2090                 return EVP_sha256();
2091 #endif
2092 #ifndef OPENSSL_NO_SHA512
2093                 case TLSEXT_hash_sha384:
2094                 return EVP_sha384();
2095
2096                 case TLSEXT_hash_sha512:
2097                 return EVP_sha512();
2098 #endif
2099                 default:
2100                 return NULL;
2101
2102                 }
2103         }
2104
2105 /* Set preferred digest for each key type */
2106
2107 int tls1_process_sigalgs(SSL *s, const unsigned char *data, int dsize)
2108         {
2109         int i, idx;
2110         const EVP_MD *md;
2111         CERT *c = s->cert;
2112         /* Extension ignored for TLS versions below 1.2 */
2113         if (TLS1_get_version(s) < TLS1_2_VERSION)
2114                 return 1;
2115         /* Should never happen */
2116         if (!c)
2117                 return 0;
2118
2119         c->pkeys[SSL_PKEY_DSA_SIGN].digest = NULL;
2120         c->pkeys[SSL_PKEY_RSA_SIGN].digest = NULL;
2121         c->pkeys[SSL_PKEY_RSA_ENC].digest = NULL;
2122         c->pkeys[SSL_PKEY_ECC].digest = NULL;
2123
2124         for (i = 0; i < dsize; i += 2)
2125                 {
2126                 unsigned char hash_alg = data[i], sig_alg = data[i+1];
2127
2128                 switch(sig_alg)
2129                         {
2130 #ifndef OPENSSL_NO_RSA
2131                         case TLSEXT_signature_rsa:
2132                         idx = SSL_PKEY_RSA_SIGN;
2133                         break;
2134 #endif
2135 #ifndef OPENSSL_NO_DSA
2136                         case TLSEXT_signature_dsa:
2137                         idx = SSL_PKEY_DSA_SIGN;
2138                         break;
2139 #endif
2140 #ifndef OPENSSL_NO_ECDSA
2141                         case TLSEXT_signature_ecdsa:
2142                         idx = SSL_PKEY_ECC;
2143                         break;
2144 #endif
2145                         default:
2146                         continue;
2147                         }
2148
2149                 if (c->pkeys[idx].digest == NULL)
2150                         {
2151                         md = tls12_get_hash(hash_alg);
2152                         if (md)
2153                                 {
2154                                 c->pkeys[idx].digest = md;
2155                                 if (idx == SSL_PKEY_RSA_SIGN)
2156                                         c->pkeys[SSL_PKEY_RSA_ENC].digest = md;
2157                                 }
2158                         }
2159
2160                 }
2161
2162
2163         /* Set any remaining keys to default values. NOTE: if alg is not
2164          * supported it stays as NULL.
2165          */
2166 #ifndef OPENSSL_NO_DSA
2167         if (!c->pkeys[SSL_PKEY_DSA_SIGN].digest)
2168                 c->pkeys[SSL_PKEY_DSA_SIGN].digest = EVP_dss1();
2169 #endif
2170 #ifndef OPENSSL_NO_RSA
2171         if (!c->pkeys[SSL_PKEY_RSA_SIGN].digest)
2172                 {
2173                 c->pkeys[SSL_PKEY_RSA_SIGN].digest = EVP_sha1();
2174                 c->pkeys[SSL_PKEY_RSA_ENC].digest = EVP_sha1();
2175                 }
2176 #endif
2177 #ifndef OPENSSL_NO_ECDSA
2178         if (!c->pkeys[SSL_PKEY_ECC].digest)
2179                 c->pkeys[SSL_PKEY_ECC].digest = EVP_ecdsa();
2180 #endif
2181         return 1;
2182         }
2183
2184 #endif