ssl/t1_lib.c

   1 /* ssl/t1_lib.c */
   2 /* Copyright (C) 1995-1998 Eric Young (eay@cryptsoft.com)
   3  * All rights reserved.
   4  *
   5  * This package is an SSL implementation written
   6  * by Eric Young (eay@cryptsoft.com).
   7  * The implementation was written so as to conform with Netscapes SSL.
   8  *
   9  * This library is free for commercial and non-commercial use as long as
  10  * the following conditions are aheared to.  The following conditions
  11  * apply to all code found in this distribution, be it the RC4, RSA,
  12  * lhash, DES, etc., code; not just the SSL code.  The SSL documentation
  13  * included with this distribution is covered by the same copyright terms
  14  * except that the holder is Tim Hudson (tjh@cryptsoft.com).
  15  *
  16  * Copyright remains Eric Young's, and as such any Copyright notices in
  17  * the code are not to be removed.
  18  * If this package is used in a product, Eric Young should be given attribution
  19  * as the author of the parts of the library used.
  20  * This can be in the form of a textual message at program startup or
  21  * in documentation (online or textual) provided with the package.
  22  *
  23  * Redistribution and use in source and binary forms, with or without
  24  * modification, are permitted provided that the following conditions
  25  * are met:
  26  * 1. Redistributions of source code must retain the copyright
  27  *    notice, this list of conditions and the following disclaimer.
  28  * 2. Redistributions in binary form must reproduce the above copyright
  29  *    notice, this list of conditions and the following disclaimer in the
  30  *    documentation and/or other materials provided with the distribution.
  31  * 3. All advertising materials mentioning features or use of this software
  32  *    must display the following acknowledgement:
  33  *    "This product includes cryptographic software written by
  34  *     Eric Young (eay@cryptsoft.com)"
  35  *    The word 'cryptographic' can be left out if the rouines from the library
  36  *    being used are not cryptographic related :-).
  37  * 4. If you include any Windows specific code (or a derivative thereof) from
  38  *    the apps directory (application code) you must include an acknowledgement:
  39  *    "This product includes software written by Tim Hudson (tjh@cryptsoft.com)"
  40  *
  41  * THIS SOFTWARE IS PROVIDED BY ERIC YOUNG ``AS IS'' AND
  42  * ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
  43  * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE
  44  * ARE DISCLAIMED.  IN NO EVENT SHALL THE AUTHOR OR CONTRIBUTORS BE LIABLE
  45  * FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL
  46  * DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS
  47  * OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION)
  48  * HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT
  49  * LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY
  50  * OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF
  51  * SUCH DAMAGE.
  52  *
  53  * The licence and distribution terms for any publically available version or
  54  * derivative of this code cannot be changed.  i.e. this code cannot simply be
  55  * copied and put under another distribution licence
  56  * [including the GNU Public Licence.]
  57  */
  58 /* ====================================================================
  59  * Copyright (c) 1998-2007 The OpenSSL Project.  All rights reserved.
  60  *
  61  * Redistribution and use in source and binary forms, with or without
  62  * modification, are permitted provided that the following conditions
  63  * are met:
  64  *
  65  * 1. Redistributions of source code must retain the above copyright
  66  *    notice, this list of conditions and the following disclaimer.
  67  *
  68  * 2. Redistributions in binary form must reproduce the above copyright
  69  *    notice, this list of conditions and the following disclaimer in
  70  *    the documentation and/or other materials provided with the
  71  *    distribution.
  72  *
  73  * 3. All advertising materials mentioning features or use of this
  74  *    software must display the following acknowledgment:
  75  *    "This product includes software developed by the OpenSSL Project
  76  *    for use in the OpenSSL Toolkit. (http://www.openssl.org/)"
  77  *
  78  * 4. The names "OpenSSL Toolkit" and "OpenSSL Project" must not be used to
  79  *    endorse or promote products derived from this software without
  80  *    prior written permission. For written permission, please contact
  81  *    openssl-core@openssl.org.
  82  *
  83  * 5. Products derived from this software may not be called "OpenSSL"
  84  *    nor may "OpenSSL" appear in their names without prior written
  85  *    permission of the OpenSSL Project.
  86  *
  87  * 6. Redistributions of any form whatsoever must retain the following
  88  *    acknowledgment:
  89  *    "This product includes software developed by the OpenSSL Project
  90  *    for use in the OpenSSL Toolkit (http://www.openssl.org/)"
  91  *
  92  * THIS SOFTWARE IS PROVIDED BY THE OpenSSL PROJECT ``AS IS'' AND ANY
  93  * EXPRESSED OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
  94  * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
  95  * PURPOSE ARE DISCLAIMED.  IN NO EVENT SHALL THE OpenSSL PROJECT OR
  96  * ITS CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL,
  97  * SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT
  98  * NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES;
  99  * LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION)
 100  * HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT,
 101  * STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE)
 102  * ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED
 103  * OF THE POSSIBILITY OF SUCH DAMAGE.
 104  * ====================================================================
 105  *
 106  * This product includes cryptographic software written by Eric Young
 107  * (eay@cryptsoft.com).  This product includes software written by Tim
 108  * Hudson (tjh@cryptsoft.com).
 109  *
 110  */
 111
 112 #include <stdio.h>
 113 #include <openssl/objects.h>
 114 #include <openssl/evp.h>
 115 #include <openssl/hmac.h>
 116 #include <openssl/ocsp.h>
 117 #include "ssl_locl.h"
 118
 119 const char tls1_version_str[]="TLSv1" OPENSSL_VERSION_PTEXT;
 120
 121 #ifndef OPENSSL_NO_TLSEXT
 122 static int tls_decrypt_ticket(SSL *s, const unsigned char *tick, int ticklen,
 123                                 const unsigned char *sess_id, int sesslen,
 124                                 SSL_SESSION **psess);
 125 #endif
 126
 127 SSL3_ENC_METHOD TLSv1_enc_data={
 128         tls1_enc,
 129         tls1_mac,
 130         tls1_setup_key_block,
 131         tls1_generate_master_secret,
 132         tls1_change_cipher_state,
 133         tls1_final_finish_mac,
 134         TLS1_FINISH_MAC_LENGTH,
 135         tls1_cert_verify_mac,
 136         TLS_MD_CLIENT_FINISH_CONST,TLS_MD_CLIENT_FINISH_CONST_SIZE,
 137         TLS_MD_SERVER_FINISH_CONST,TLS_MD_SERVER_FINISH_CONST_SIZE,
 138         tls1_alert_code,
 139         };
 140
 141 long tls1_default_timeout(void)
 142         {
 143         /* 2 hours, the 24 hours mentioned in the TLSv1 spec
 144          * is way too long for http, the cache would over fill */
 145         return(60*60*2);
 146         }
 147
 148 int tls1_new(SSL *s)
 149         {
 150         if (!ssl3_new(s)) return(0);
 151         s->method->ssl_clear(s);
 152         return(1);
 153         }
 154
 155 void tls1_free(SSL *s)
 156         {
 157 #ifndef OPENSSL_NO_TLSEXT
 158         if (s->tlsext_session_ticket)
 159                 {
 160                 OPENSSL_free(s->tlsext_session_ticket);
 161                 }
 162 #endif /* OPENSSL_NO_TLSEXT */
 163         ssl3_free(s);
 164         }
 165
 166 void tls1_clear(SSL *s)
 167         {
 168         ssl3_clear(s);
 169         s->version = s->method->version;
 170         }
 171
 172 #ifndef OPENSSL_NO_EC
 173 static int nid_list[] =
 174         {
 175                 NID_sect163k1, /* sect163k1 (1) */
 176                 NID_sect163r1, /* sect163r1 (2) */
 177                 NID_sect163r2, /* sect163r2 (3) */
 178                 NID_sect193r1, /* sect193r1 (4) */
 179                 NID_sect193r2, /* sect193r2 (5) */
 180                 NID_sect233k1, /* sect233k1 (6) */
 181                 NID_sect233r1, /* sect233r1 (7) */
 182                 NID_sect239k1, /* sect239k1 (8) */
 183                 NID_sect283k1, /* sect283k1 (9) */
 184                 NID_sect283r1, /* sect283r1 (10) */
 185                 NID_sect409k1, /* sect409k1 (11) */
 186                 NID_sect409r1, /* sect409r1 (12) */
 187                 NID_sect571k1, /* sect571k1 (13) */
 188                 NID_sect571r1, /* sect571r1 (14) */
 189                 NID_secp160k1, /* secp160k1 (15) */
 190                 NID_secp160r1, /* secp160r1 (16) */
 191                 NID_secp160r2, /* secp160r2 (17) */
 192                 NID_secp192k1, /* secp192k1 (18) */
 193                 NID_X9_62_prime192v1, /* secp192r1 (19) */
 194                 NID_secp224k1, /* secp224k1 (20) */
 195                 NID_secp224r1, /* secp224r1 (21) */
 196                 NID_secp256k1, /* secp256k1 (22) */
 197                 NID_X9_62_prime256v1, /* secp256r1 (23) */
 198                 NID_secp384r1, /* secp384r1 (24) */
 199                 NID_secp521r1  /* secp521r1 (25) */
 200         };
 201
 202 int tls1_ec_curve_id2nid(int curve_id)
 203         {
 204         /* ECC curves from draft-ietf-tls-ecc-12.txt (Oct. 17, 2005) */
 205         if ((curve_id < 1) || ((unsigned int)curve_id >
 206                                 sizeof(nid_list)/sizeof(nid_list[0])))
 207                 return 0;
 208         return nid_list[curve_id-1];
 209         }
 210
 211 int tls1_ec_nid2curve_id(int nid)
 212         {
 213         /* ECC curves from draft-ietf-tls-ecc-12.txt (Oct. 17, 2005) */
 214         switch (nid)
 215                 {
 216         case NID_sect163k1: /* sect163k1 (1) */
 217                 return 1;
 218         case NID_sect163r1: /* sect163r1 (2) */
 219                 return 2;
 220         case NID_sect163r2: /* sect163r2 (3) */
 221                 return 3;
 222         case NID_sect193r1: /* sect193r1 (4) */
 223                 return 4;
 224         case NID_sect193r2: /* sect193r2 (5) */
 225                 return 5;
 226         case NID_sect233k1: /* sect233k1 (6) */
 227                 return 6;
 228         case NID_sect233r1: /* sect233r1 (7) */
 229                 return 7;
 230         case NID_sect239k1: /* sect239k1 (8) */
 231                 return 8;
 232         case NID_sect283k1: /* sect283k1 (9) */
 233                 return 9;
 234         case NID_sect283r1: /* sect283r1 (10) */
 235                 return 10;
 236         case NID_sect409k1: /* sect409k1 (11) */
 237                 return 11;
 238         case NID_sect409r1: /* sect409r1 (12) */
 239                 return 12;
 240         case NID_sect571k1: /* sect571k1 (13) */
 241                 return 13;
 242         case NID_sect571r1: /* sect571r1 (14) */
 243                 return 14;
 244         case NID_secp160k1: /* secp160k1 (15) */
 245                 return 15;
 246         case NID_secp160r1: /* secp160r1 (16) */
 247                 return 16;
 248         case NID_secp160r2: /* secp160r2 (17) */
 249                 return 17;
 250         case NID_secp192k1: /* secp192k1 (18) */
 251                 return 18;
 252         case NID_X9_62_prime192v1: /* secp192r1 (19) */
 253                 return 19;
 254         case NID_secp224k1: /* secp224k1 (20) */
 255                 return 20;
 256         case NID_secp224r1: /* secp224r1 (21) */
 257                 return 21;
 258         case NID_secp256k1: /* secp256k1 (22) */
 259                 return 22;
 260         case NID_X9_62_prime256v1: /* secp256r1 (23) */
 261                 return 23;
 262         case NID_secp384r1: /* secp384r1 (24) */
 263                 return 24;
 264         case NID_secp521r1:  /* secp521r1 (25) */
 265                 return 25;
 266         default:
 267                 return 0;
 268                 }
 269         }
 270 #endif /* OPENSSL_NO_EC */
 271
 272 #ifndef OPENSSL_NO_TLSEXT
 273
 274 /* List of supported signature algorithms and hashes. Should make this
 275  * customisable at some point, for now include everything we support.
 276  */
 277
 278 #ifdef OPENSSL_NO_RSA
 279 #define tlsext_sigalg_rsa(md) /* */
 280 #else
 281 #define tlsext_sigalg_rsa(md) md, TLSEXT_signature_rsa,
 282 #endif
 283
 284 #ifdef OPENSSL_NO_DSA
 285 #define tlsext_sigalg_dsa(md) /* */
 286 #else
 287 #define tlsext_sigalg_dsa(md) md, TLSEXT_signature_dsa,
 288 #endif
 289
 290 #ifdef OPENSSL_NO_ECDSA
 291 #define tlsext_sigalg_ecdsa(md) /* */
 292 #else
 293 #define tlsext_sigalg_ecdsa(md) md, TLSEXT_signature_dsa,
 294 #endif
 295
 296 #define tlsext_sigalg(md) \
 297                 tlsext_sigalg_rsa(md) \
 298                 tlsext_sigalg_dsa(md) \
 299                 tlsext_sigalg_ecdsa(md)
 300
 301 static unsigned char tls12_sigalgs[] = {
 302 #ifndef OPENSSL_NO_SHA512
 303         tlsext_sigalg(TLSEXT_hash_sha512)
 304         tlsext_sigalg(TLSEXT_hash_sha384)
 305 #endif
 306 #ifndef OPENSSL_NO_SHA256
 307         tlsext_sigalg(TLSEXT_hash_sha256)
 308         tlsext_sigalg(TLSEXT_hash_sha224)
 309 #endif
 310 #ifndef OPENSSL_NO_SHA
 311         tlsext_sigalg(TLSEXT_hash_sha1)
 312 #endif
 313 #ifndef OPENSSL_NO_MD5
 314         tlsext_sigalg_rsa(TLSEXT_hash_md5)
 315 #endif
 316 };
 317
 318 int tls12_get_req_sig_algs(SSL *s, unsigned char *p)
 319         {
 320         size_t slen = sizeof(tls12_sigalgs);
 321 #ifdef OPENSSL_FIPS
 322         /* If FIPS mode don't include MD5 which is last */
 323         if (FIPS_mode())
 324                 slen -= 2;
 325 #endif
 326         if (p)
 327                 memcpy(p, tls12_sigalgs, slen);
 328         return (int)slen;
 329         }
 330
 331 unsigned char *ssl_add_clienthello_tlsext(SSL *s, unsigned char *p, unsigned char *limit)
 332         {
 333         int extdatalen=0;
 334         unsigned char *ret = p;
 335
 336         /* don't add extensions for SSLv3 unless doing secure renegotiation */
 337         if (s->client_version == SSL3_VERSION
 338                                         && !s->s3->send_connection_binding)
 339                 return p;
 340
 341         ret+=2;
 342
 343         if (ret>=limit) return NULL; /* this really never occurs, but ... */
 344
 345         if (s->tlsext_hostname != NULL)
 346                 {
 347                 /* Add TLS extension servername to the Client Hello message */
 348                 unsigned long size_str;
 349                 long lenmax;
 350
 351                 /* check for enough space.
 352                    4 for the servername type and entension length
 353                    2 for servernamelist length
 354                    1 for the hostname type
 355                    2 for hostname length
 356                    + hostname length
 357                 */
 358
 359                 if ((lenmax = limit - ret - 9) < 0
 360                     || (size_str = strlen(s->tlsext_hostname)) > (unsigned long)lenmax)
 361                         return NULL;
 362
 363                 /* extension type and length */
 364                 s2n(TLSEXT_TYPE_server_name,ret);
 365                 s2n(size_str+5,ret);
 366
 367                 /* length of servername list */
 368                 s2n(size_str+3,ret);
 369
 370                 /* hostname type, length and hostname */
 371                 *(ret++) = (unsigned char) TLSEXT_NAMETYPE_host_name;
 372                 s2n(size_str,ret);
 373                 memcpy(ret, s->tlsext_hostname, size_str);
 374                 ret+=size_str;
 375                 }
 376
 377         /* Add RI if renegotiating */
 378         if (s->renegotiate)
 379           {
 380           int el;
 381
 382           if(!ssl_add_clienthello_renegotiate_ext(s, 0, &el, 0))
 383               {
 384               SSLerr(SSL_F_SSL_ADD_CLIENTHELLO_TLSEXT, ERR_R_INTERNAL_ERROR);
 385               return NULL;
 386               }
 387
 388           if((limit - p - 4 - el) < 0) return NULL;
 389
 390           s2n(TLSEXT_TYPE_renegotiate,ret);
 391           s2n(el,ret);
 392
 393           if(!ssl_add_clienthello_renegotiate_ext(s, ret, &el, el))
 394               {
 395               SSLerr(SSL_F_SSL_ADD_CLIENTHELLO_TLSEXT, ERR_R_INTERNAL_ERROR);
 396               return NULL;
 397               }
 398
 399           ret += el;
 400         }
 401
 402 #ifndef OPENSSL_NO_SRP
 403 #define MIN(x,y) (((x)<(y))?(x):(y))
 404         /* we add SRP username the first time only if we have one! */
 405         if (s->srp_ctx.login != NULL)
 406                 {/* Add TLS extension SRP username to the Client Hello message */
 407                 int login_len = MIN(strlen(s->srp_ctx.login) + 1, 255);
 408                 long lenmax;
 409
 410                 if ((lenmax = limit - ret - 5) < 0) return NULL;
 411                 if (login_len > lenmax) return NULL;
 412                 if (login_len > 255)
 413                         {
 414                         SSLerr(SSL_F_SSL_ADD_CLIENTHELLO_TLSEXT, ERR_R_INTERNAL_ERROR);
 415                         return NULL;
 416                         }
 417                 s2n(TLSEXT_TYPE_srp,ret);
 418                 s2n(login_len+1,ret);
 419
 420                 (*ret++) = (unsigned char) MIN(strlen(s->srp_ctx.login), 254);
 421                 memcpy(ret, s->srp_ctx.login, MIN(strlen(s->srp_ctx.login), 254));
 422                 ret+=login_len;
 423                 }
 424 #endif
 425
 426 #ifndef OPENSSL_NO_EC
 427         if (s->tlsext_ecpointformatlist != NULL &&
 428             s->version != DTLS1_VERSION)
 429                 {
 430                 /* Add TLS extension ECPointFormats to the ClientHello message */
 431                 long lenmax;
 432
 433                 if ((lenmax = limit - ret - 5) < 0) return NULL;
 434                 if (s->tlsext_ecpointformatlist_length > (unsigned long)lenmax) return NULL;
 435                 if (s->tlsext_ecpointformatlist_length > 255)
 436                         {
 437                         SSLerr(SSL_F_SSL_ADD_CLIENTHELLO_TLSEXT, ERR_R_INTERNAL_ERROR);
 438                         return NULL;
 439                         }
 440
 441                 s2n(TLSEXT_TYPE_ec_point_formats,ret);
 442                 s2n(s->tlsext_ecpointformatlist_length + 1,ret);
 443                 *(ret++) = (unsigned char) s->tlsext_ecpointformatlist_length;
 444                 memcpy(ret, s->tlsext_ecpointformatlist, s->tlsext_ecpointformatlist_length);
 445                 ret+=s->tlsext_ecpointformatlist_length;
 446                 }
 447         if (s->tlsext_ellipticcurvelist != NULL &&
 448             s->version != DTLS1_VERSION)
 449                 {
 450                 /* Add TLS extension EllipticCurves to the ClientHello message */
 451                 long lenmax;
 452
 453                 if ((lenmax = limit - ret - 6) < 0) return NULL;
 454                 if (s->tlsext_ellipticcurvelist_length > (unsigned long)lenmax) return NULL;
 455                 if (s->tlsext_ellipticcurvelist_length > 65532)
 456                         {
 457                         SSLerr(SSL_F_SSL_ADD_CLIENTHELLO_TLSEXT, ERR_R_INTERNAL_ERROR);
 458                         return NULL;
 459                         }
 460
 461                 s2n(TLSEXT_TYPE_elliptic_curves,ret);
 462                 s2n(s->tlsext_ellipticcurvelist_length + 2, ret);
 463
 464                 /* NB: draft-ietf-tls-ecc-12.txt uses a one-byte prefix for
 465                  * elliptic_curve_list, but the examples use two bytes.
 466                  * http://www1.ietf.org/mail-archive/web/tls/current/msg00538.html
 467                  * resolves this to two bytes.
 468                  */
 469                 s2n(s->tlsext_ellipticcurvelist_length, ret);
 470                 memcpy(ret, s->tlsext_ellipticcurvelist, s->tlsext_ellipticcurvelist_length);
 471                 ret+=s->tlsext_ellipticcurvelist_length;
 472                 }
 473 #endif /* OPENSSL_NO_EC */
 474
 475         if (!(SSL_get_options(s) & SSL_OP_NO_TICKET))
 476                 {
 477                 int ticklen;
 478                 if (!s->new_session && s->session && s->session->tlsext_tick)
 479                         ticklen = s->session->tlsext_ticklen;
 480                 else if (s->session && s->tlsext_session_ticket &&
 481                          s->tlsext_session_ticket->data)
 482                         {
 483                         ticklen = s->tlsext_session_ticket->length;
 484                         s->session->tlsext_tick = OPENSSL_malloc(ticklen);
 485                         if (!s->session->tlsext_tick)
 486                                 return NULL;
 487                         memcpy(s->session->tlsext_tick,
 488                                s->tlsext_session_ticket->data,
 489                                ticklen);
 490                         s->session->tlsext_ticklen = ticklen;
 491                         }
 492                 else
 493                         ticklen = 0;
 494                 if (ticklen == 0 && s->tlsext_session_ticket &&
 495                     s->tlsext_session_ticket->data == NULL)
 496                         goto skip_ext;
 497                 /* Check for enough room 2 for extension type, 2 for len
 498                  * rest for ticket
 499                  */
 500                 if ((long)(limit - ret - 4 - ticklen) < 0) return NULL;
 501                 s2n(TLSEXT_TYPE_session_ticket,ret);
 502                 s2n(ticklen,ret);
 503                 if (ticklen)
 504                         {
 505                         memcpy(ret, s->session->tlsext_tick, ticklen);
 506                         ret += ticklen;
 507                         }
 508                 }
 509                 skip_ext:
 510
 511         if (TLS1_get_version(s) >= TLS1_2_VERSION)
 512                 {
 513                 if ((size_t)(limit - ret) < sizeof(tls12_sigalgs) + 6)
 514                         return NULL;
 515                 s2n(TLSEXT_TYPE_signature_algorithms,ret);
 516                 s2n(sizeof(tls12_sigalgs) + 2, ret);
 517                 s2n(sizeof(tls12_sigalgs), ret);
 518                 memcpy(ret, tls12_sigalgs, sizeof(tls12_sigalgs));
 519                 ret += sizeof(tls12_sigalgs);
 520                 }
 521
 522 #ifdef TLSEXT_TYPE_opaque_prf_input
 523         if (s->s3->client_opaque_prf_input != NULL &&
 524             s->version != DTLS1_VERSION)
 525                 {
 526                 size_t col = s->s3->client_opaque_prf_input_len;
 527
 528                 if ((long)(limit - ret - 6 - col < 0))
 529                         return NULL;
 530                 if (col > 0xFFFD) /* can't happen */
 531                         return NULL;
 532
 533                 s2n(TLSEXT_TYPE_opaque_prf_input, ret);
 534                 s2n(col + 2, ret);
 535                 s2n(col, ret);
 536                 memcpy(ret, s->s3->client_opaque_prf_input, col);
 537                 ret += col;
 538                 }
 539 #endif
 540
 541         if (s->tlsext_status_type == TLSEXT_STATUSTYPE_ocsp &&
 542             s->version != DTLS1_VERSION)
 543                 {
 544                 int i;
 545                 long extlen, idlen, itmp;
 546                 OCSP_RESPID *id;
 547
 548                 idlen = 0;
 549                 for (i = 0; i < sk_OCSP_RESPID_num(s->tlsext_ocsp_ids); i++)
 550                         {
 551                         id = sk_OCSP_RESPID_value(s->tlsext_ocsp_ids, i);
 552                         itmp = i2d_OCSP_RESPID(id, NULL);
 553                         if (itmp <= 0)
 554                                 return NULL;
 555                         idlen += itmp + 2;
 556                         }
 557
 558                 if (s->tlsext_ocsp_exts)
 559                         {
 560                         extlen = i2d_X509_EXTENSIONS(s->tlsext_ocsp_exts, NULL);
 561                         if (extlen < 0)
 562                                 return NULL;
 563                         }
 564                 else
 565                         extlen = 0;
 566
 567                 if ((long)(limit - ret - 7 - extlen - idlen) < 0) return NULL;
 568                 s2n(TLSEXT_TYPE_status_request, ret);
 569                 if (extlen + idlen > 0xFFF0)
 570                         return NULL;
 571                 s2n(extlen + idlen + 5, ret);
 572                 *(ret++) = TLSEXT_STATUSTYPE_ocsp;
 573                 s2n(idlen, ret);
 574                 for (i = 0; i < sk_OCSP_RESPID_num(s->tlsext_ocsp_ids); i++)
 575                         {
 576                         /* save position of id len */
 577                         unsigned char *q = ret;
 578                         id = sk_OCSP_RESPID_value(s->tlsext_ocsp_ids, i);
 579                         /* skip over id len */
 580                         ret += 2;
 581                         itmp = i2d_OCSP_RESPID(id, &ret);
 582                         /* write id len */
 583                         s2n(itmp, q);
 584                         }
 585                 s2n(extlen, ret);
 586                 if (extlen > 0)
 587                         i2d_X509_EXTENSIONS(s->tlsext_ocsp_exts, &ret);
 588                 }
 589
 590         if ((extdatalen = ret-p-2)== 0)
 591                 return p;
 592
 593         s2n(extdatalen,p);
 594         return ret;
 595         }
 596
 597 unsigned char *ssl_add_serverhello_tlsext(SSL *s, unsigned char *p, unsigned char *limit)
 598         {
 599         int extdatalen=0;
 600         unsigned char *ret = p;
 601
 602         /* don't add extensions for SSLv3, unless doing secure renegotiation */
 603         if (s->version == SSL3_VERSION && !s->s3->send_connection_binding)
 604                 return p;
 605
 606         ret+=2;
 607         if (ret>=limit) return NULL; /* this really never occurs, but ... */
 608
 609         if (!s->hit && s->servername_done == 1 && s->session->tlsext_hostname != NULL)
 610                 {
 611                 if ((long)(limit - ret - 4) < 0) return NULL;
 612
 613                 s2n(TLSEXT_TYPE_server_name,ret);
 614                 s2n(0,ret);
 615                 }
 616
 617         if(s->s3->send_connection_binding)
 618         {
 619           int el;
 620
 621           if(!ssl_add_serverhello_renegotiate_ext(s, 0, &el, 0))
 622               {
 623               SSLerr(SSL_F_SSL_ADD_SERVERHELLO_TLSEXT, ERR_R_INTERNAL_ERROR);
 624               return NULL;
 625               }
 626
 627           if((limit - p - 4 - el) < 0) return NULL;
 628
 629           s2n(TLSEXT_TYPE_renegotiate,ret);
 630           s2n(el,ret);
 631
 632           if(!ssl_add_serverhello_renegotiate_ext(s, ret, &el, el))
 633               {
 634               SSLerr(SSL_F_SSL_ADD_SERVERHELLO_TLSEXT, ERR_R_INTERNAL_ERROR);
 635               return NULL;
 636               }
 637
 638           ret += el;
 639         }
 640
 641 #ifndef OPENSSL_NO_EC
 642         if (s->tlsext_ecpointformatlist != NULL &&
 643             s->version != DTLS1_VERSION)
 644                 {
 645                 /* Add TLS extension ECPointFormats to the ServerHello message */
 646                 long lenmax;
 647
 648                 if ((lenmax = limit - ret - 5) < 0) return NULL;
 649                 if (s->tlsext_ecpointformatlist_length > (unsigned long)lenmax) return NULL;
 650                 if (s->tlsext_ecpointformatlist_length > 255)
 651                         {
 652                         SSLerr(SSL_F_SSL_ADD_SERVERHELLO_TLSEXT, ERR_R_INTERNAL_ERROR);
 653                         return NULL;
 654                         }
 655
 656                 s2n(TLSEXT_TYPE_ec_point_formats,ret);
 657                 s2n(s->tlsext_ecpointformatlist_length + 1,ret);
 658                 *(ret++) = (unsigned char) s->tlsext_ecpointformatlist_length;
 659                 memcpy(ret, s->tlsext_ecpointformatlist, s->tlsext_ecpointformatlist_length);
 660                 ret+=s->tlsext_ecpointformatlist_length;
 661
 662                 }
 663         /* Currently the server should not respond with a SupportedCurves extension */
 664 #endif /* OPENSSL_NO_EC */
 665
 666         if (s->tlsext_ticket_expected
 667                 && !(SSL_get_options(s) & SSL_OP_NO_TICKET))
 668                 {
 669                 if ((long)(limit - ret - 4) < 0) return NULL;
 670                 s2n(TLSEXT_TYPE_session_ticket,ret);
 671                 s2n(0,ret);
 672                 }
 673
 674         if (s->tlsext_status_expected)
 675                 {
 676                 if ((long)(limit - ret - 4) < 0) return NULL;
 677                 s2n(TLSEXT_TYPE_status_request,ret);
 678                 s2n(0,ret);
 679                 }
 680
 681 #ifdef TLSEXT_TYPE_opaque_prf_input
 682         if (s->s3->server_opaque_prf_input != NULL &&
 683             s->version != DTLS1_VERSION)
 684                 {
 685                 size_t sol = s->s3->server_opaque_prf_input_len;
 686
 687                 if ((long)(limit - ret - 6 - sol) < 0)
 688                         return NULL;
 689                 if (sol > 0xFFFD) /* can't happen */
 690                         return NULL;
 691
 692                 s2n(TLSEXT_TYPE_opaque_prf_input, ret);
 693                 s2n(sol + 2, ret);
 694                 s2n(sol, ret);
 695                 memcpy(ret, s->s3->server_opaque_prf_input, sol);
 696                 ret += sol;
 697                 }
 698 #endif
 699         if (((s->s3->tmp.new_cipher->id & 0xFFFF)==0x80 || (s->s3->tmp.new_cipher->id & 0xFFFF)==0x81)
 700                 && (SSL_get_options(s) & SSL_OP_CRYPTOPRO_TLSEXT_BUG))
 701                 { const unsigned char cryptopro_ext[36] = {
 702                         0xfd, 0xe8, /*65000*/
 703                         0x00, 0x20, /*32 bytes length*/
 704                         0x30, 0x1e, 0x30, 0x08, 0x06, 0x06, 0x2a, 0x85,
 705                         0x03,   0x02, 0x02, 0x09, 0x30, 0x08, 0x06, 0x06,
 706                         0x2a, 0x85, 0x03, 0x02, 0x02, 0x16, 0x30, 0x08,
 707                         0x06, 0x06, 0x2a, 0x85, 0x03, 0x02, 0x02, 0x17};
 708                         if (limit-ret<36) return NULL;
 709                         memcpy(ret,cryptopro_ext,36);
 710                         ret+=36;
 711
 712                 }
 713
 714         if ((extdatalen = ret-p-2)== 0)
 715                 return p;
 716
 717         s2n(extdatalen,p);
 718         return ret;
 719         }
 720
 721 int ssl_parse_clienthello_tlsext(SSL *s, unsigned char **p, unsigned char *d, int n, int *al)
 722         {
 723         unsigned short type;
 724         unsigned short size;
 725         unsigned short len;
 726         unsigned char *data = *p;
 727         int renegotiate_seen = 0;
 728         int sigalg_seen = 0;
 729
 730         s->servername_done = 0;
 731         s->tlsext_status_type = -1;
 732
 733         if (data >= (d+n-2))
 734                 goto ri_check;
 735         n2s(data,len);
 736
 737         if (data > (d+n-len))
 738                 goto ri_check;
 739
 740         while (data <= (d+n-4))
 741                 {
 742                 n2s(data,type);
 743                 n2s(data,size);
 744
 745                 if (data+size > (d+n))
 746                         goto ri_check;
 747 #if 0
 748                 fprintf(stderr,"Received extension type %d size %d\n",type,size);
 749 #endif
 750                 if (s->tlsext_debug_cb)
 751                         s->tlsext_debug_cb(s, 0, type, data, size,
 752                                                 s->tlsext_debug_arg);
 753 /* The servername extension is treated as follows:
 754
 755    - Only the hostname type is supported with a maximum length of 255.
 756    - The servername is rejected if too long or if it contains zeros,
 757      in which case an fatal alert is generated.
 758    - The servername field is maintained together with the session cache.
 759    - When a session is resumed, the servername call back invoked in order
 760      to allow the application to position itself to the right context.
 761    - The servername is acknowledged if it is new for a session or when
 762      it is identical to a previously used for the same session.
 763      Applications can control the behaviour.  They can at any time
 764      set a 'desirable' servername for a new SSL object. This can be the
 765      case for example with HTTPS when a Host: header field is received and
 766      a renegotiation is requested. In this case, a possible servername
 767      presented in the new client hello is only acknowledged if it matches
 768      the value of the Host: field.
 769    - Applications must  use SSL_OP_NO_SESSION_RESUMPTION_ON_RENEGOTIATION
 770      if they provide for changing an explicit servername context for the session,
 771      i.e. when the session has been established with a servername extension.
 772    - On session reconnect, the servername extension may be absent.
 773
 774 */
 775
 776                 if (type == TLSEXT_TYPE_server_name)
 777                         {
 778                         unsigned char *sdata;
 779                         int servname_type;
 780                         int dsize;
 781
 782                         if (size < 2)
 783                                 {
 784                                 *al = SSL_AD_DECODE_ERROR;
 785                                 return 0;
 786                                 }
 787                         n2s(data,dsize);
 788                         size -= 2;
 789                         if (dsize > size  )
 790                                 {
 791                                 *al = SSL_AD_DECODE_ERROR;
 792                                 return 0;
 793                                 }
 794
 795                         sdata = data;
 796                         while (dsize > 3)
 797                                 {
 798                                 servname_type = *(sdata++);
 799                                 n2s(sdata,len);
 800                                 dsize -= 3;
 801
 802                                 if (len > dsize)
 803                                         {
 804                                         *al = SSL_AD_DECODE_ERROR;
 805                                         return 0;
 806                                         }
 807                                 if (s->servername_done == 0)
 808                                 switch (servname_type)
 809                                         {
 810                                 case TLSEXT_NAMETYPE_host_name:
 811                                         if (!s->hit)
 812                                                 {
 813                                                 if(s->session->tlsext_hostname)
 814                                                         {
 815                                                         *al = SSL_AD_DECODE_ERROR;
 816                                                         return 0;
 817                                                         }
 818                                                 if (len > TLSEXT_MAXLEN_host_name)
 819                                                         {
 820                                                         *al = TLS1_AD_UNRECOGNIZED_NAME;
 821                                                         return 0;
 822                                                         }
 823                                                 if ((s->session->tlsext_hostname = OPENSSL_malloc(len+1)) == NULL)
 824                                                         {
 825                                                         *al = TLS1_AD_INTERNAL_ERROR;
 826                                                         return 0;
 827                                                         }
 828                                                 memcpy(s->session->tlsext_hostname, sdata, len);
 829                                                 s->session->tlsext_hostname[len]='\0';
 830                                                 if (strlen(s->session->tlsext_hostname) != len) {
 831                                                         OPENSSL_free(s->session->tlsext_hostname);
 832                                                         s->session->tlsext_hostname = NULL;
 833                                                         *al = TLS1_AD_UNRECOGNIZED_NAME;
 834                                                         return 0;
 835                                                 }
 836                                                 s->servername_done = 1;
 837
 838                                                 }
 839                                         else
 840                                                 s->servername_done = s->session->tlsext_hostname
 841                                                         && strlen(s->session->tlsext_hostname) == len
 842                                                         && strncmp(s->session->tlsext_hostname, (char *)sdata, len) == 0;
 843
 844                                         break;
 845
 846                                 default:
 847                                         break;
 848                                         }
 849
 850                                 dsize -= len;
 851                                 }
 852                         if (dsize != 0)
 853                                 {
 854                                 *al = SSL_AD_DECODE_ERROR;
 855                                 return 0;
 856                                 }
 857
 858                         }
 859 #ifndef OPENSSL_NO_SRP
 860                 else if (type == TLSEXT_TYPE_srp)
 861                         {
 862                         if (size > 0)
 863                                 {
 864                                 len = data[0];
 865                                 if ((s->srp_ctx.login = OPENSSL_malloc(len+1)) == NULL)
 866                                         return -1;
 867                                 memcpy(s->srp_ctx.login, &data[1], len);
 868                                 s->srp_ctx.login[len]='\0';
 869                                 }
 870                         }
 871 #endif
 872
 873 #ifndef OPENSSL_NO_EC
 874                 else if (type == TLSEXT_TYPE_ec_point_formats &&
 875                      s->version != DTLS1_VERSION)
 876                         {
 877                         unsigned char *sdata = data;
 878                         int ecpointformatlist_length = *(sdata++);
 879
 880                         if (ecpointformatlist_length != size - 1)
 881                                 {
 882                                 *al = TLS1_AD_DECODE_ERROR;
 883                                 return 0;
 884                                 }
 885                         if (!s->hit)
 886                                 {
 887                                 if(s->session->tlsext_ecpointformatlist)
 888                                         {
 889                                         OPENSSL_free(s->session->tlsext_ecpointformatlist);
 890                                         s->session->tlsext_ecpointformatlist = NULL;
 891                                         }
 892                                 s->session->tlsext_ecpointformatlist_length = 0;
 893                                 if ((s->session->tlsext_ecpointformatlist = OPENSSL_malloc(ecpointformatlist_length)) == NULL)
 894                                         {
 895                                         *al = TLS1_AD_INTERNAL_ERROR;
 896                                         return 0;
 897                                         }
 898                                 s->session->tlsext_ecpointformatlist_length = ecpointformatlist_length;
 899                                 memcpy(s->session->tlsext_ecpointformatlist, sdata, ecpointformatlist_length);
 900                                 }
 901 #if 0
 902                         fprintf(stderr,"ssl_parse_clienthello_tlsext s->session->tlsext_ecpointformatlist (length=%i) ", s->session->tlsext_ecpointformatlist_length);
 903                         sdata = s->session->tlsext_ecpointformatlist;
 904                         for (i = 0; i < s->session->tlsext_ecpointformatlist_length; i++)
 905                                 fprintf(stderr,"%i ",*(sdata++));
 906                         fprintf(stderr,"\n");
 907 #endif
 908                         }
 909                 else if (type == TLSEXT_TYPE_elliptic_curves &&
 910                      s->version != DTLS1_VERSION)
 911                         {
 912                         unsigned char *sdata = data;
 913                         int ellipticcurvelist_length = (*(sdata++) << 8);
 914                         ellipticcurvelist_length += (*(sdata++));
 915
 916                         if (ellipticcurvelist_length != size - 2)
 917                                 {
 918                                 *al = TLS1_AD_DECODE_ERROR;
 919                                 return 0;
 920                                 }
 921                         if (!s->hit)
 922                                 {
 923                                 if(s->session->tlsext_ellipticcurvelist)
 924                                         {
 925                                         *al = TLS1_AD_DECODE_ERROR;
 926                                         return 0;
 927                                         }
 928                                 s->session->tlsext_ellipticcurvelist_length = 0;
 929                                 if ((s->session->tlsext_ellipticcurvelist = OPENSSL_malloc(ellipticcurvelist_length)) == NULL)
 930                                         {
 931                                         *al = TLS1_AD_INTERNAL_ERROR;
 932                                         return 0;
 933                                         }
 934                                 s->session->tlsext_ellipticcurvelist_length = ellipticcurvelist_length;
 935                                 memcpy(s->session->tlsext_ellipticcurvelist, sdata, ellipticcurvelist_length);
 936                                 }
 937 #if 0
 938                         fprintf(stderr,"ssl_parse_clienthello_tlsext s->session->tlsext_ellipticcurvelist (length=%i) ", s->session->tlsext_ellipticcurvelist_length);
 939                         sdata = s->session->tlsext_ellipticcurvelist;
 940                         for (i = 0; i < s->session->tlsext_ellipticcurvelist_length; i++)
 941                                 fprintf(stderr,"%i ",*(sdata++));
 942                         fprintf(stderr,"\n");
 943 #endif
 944                         }
 945 #endif /* OPENSSL_NO_EC */
 946 #ifdef TLSEXT_TYPE_opaque_prf_input
 947                 else if (type == TLSEXT_TYPE_opaque_prf_input &&
 948                      s->version != DTLS1_VERSION)
 949                         {
 950                         unsigned char *sdata = data;
 951
 952                         if (size < 2)
 953                                 {
 954                                 *al = SSL_AD_DECODE_ERROR;
 955                                 return 0;
 956                                 }
 957                         n2s(sdata, s->s3->client_opaque_prf_input_len);
 958                         if (s->s3->client_opaque_prf_input_len != size - 2)
 959                                 {
 960                                 *al = SSL_AD_DECODE_ERROR;
 961                                 return 0;
 962                                 }
 963
 964                         if (s->s3->client_opaque_prf_input != NULL) /* shouldn't really happen */
 965                                 OPENSSL_free(s->s3->client_opaque_prf_input);
 966                         if (s->s3->client_opaque_prf_input_len == 0)
 967                                 s->s3->client_opaque_prf_input = OPENSSL_malloc(1); /* dummy byte just to get non-NULL */
 968                         else
 969                                 s->s3->client_opaque_prf_input = BUF_memdup(sdata, s->s3->client_opaque_prf_input_len);
 970                         if (s->s3->client_opaque_prf_input == NULL)
 971                                 {
 972                                 *al = TLS1_AD_INTERNAL_ERROR;
 973                                 return 0;
 974                                 }
 975                         }
 976 #endif
 977                 else if (type == TLSEXT_TYPE_session_ticket)
 978                         {
 979                         if (s->tls_session_ticket_ext_cb &&
 980                             !s->tls_session_ticket_ext_cb(s, data, size, s->tls_session_ticket_ext_cb_arg))
 981                                 {
 982                                 *al = TLS1_AD_INTERNAL_ERROR;
 983                                 return 0;
 984                                 }
 985                         }
 986                 else if (type == TLSEXT_TYPE_renegotiate)
 987                         {
 988                         if(!ssl_parse_clienthello_renegotiate_ext(s, data, size, al))
 989                                 return 0;
 990                         renegotiate_seen = 1;
 991                         }
 992                 else if (type == TLSEXT_TYPE_signature_algorithms)
 993                         {
 994                         int dsize;
 995                         if (sigalg_seen || size < 2)
 996                                 {
 997                                 *al = SSL_AD_DECODE_ERROR;
 998                                 return 0;
 999                                 }
1000                         sigalg_seen = 1;
1001                         n2s(data,dsize);
1002                         size -= 2;
1003                         if (dsize != size || dsize & 1)
1004                                 {
1005                                 *al = SSL_AD_DECODE_ERROR;
1006                                 return 0;
1007                                 }
1008                         if (!tls1_process_sigalgs(s, data, dsize))
1009                                 {
1010                                 *al = SSL_AD_DECODE_ERROR;
1011                                 return 0;
1012                                 }
1013                         }
1014                 else if (type == TLSEXT_TYPE_status_request &&
1015                          s->version != DTLS1_VERSION && s->ctx->tlsext_status_cb)
1016                         {
1017
1018                         if (size < 5)
1019                                 {
1020                                 *al = SSL_AD_DECODE_ERROR;
1021                                 return 0;
1022                                 }
1023
1024                         s->tlsext_status_type = *data++;
1025                         size--;
1026                         if (s->tlsext_status_type == TLSEXT_STATUSTYPE_ocsp)
1027                                 {
1028                                 const unsigned char *sdata;
1029                                 int dsize;
1030                                 /* Read in responder_id_list */
1031                                 n2s(data,dsize);
1032                                 size -= 2;
1033                                 if (dsize > size  )
1034                                         {
1035                                         *al = SSL_AD_DECODE_ERROR;
1036                                         return 0;
1037                                         }
1038                                 while (dsize > 0)
1039                                         {
1040                                         OCSP_RESPID *id;
1041                                         int idsize;
1042                                         if (dsize < 4)
1043                                                 {
1044                                                 *al = SSL_AD_DECODE_ERROR;
1045                                                 return 0;
1046                                                 }
1047                                         n2s(data, idsize);
1048                                         dsize -= 2 + idsize;
1049                                         size -= 2 + idsize;
1050                                         if (dsize < 0)
1051                                                 {
1052                                                 *al = SSL_AD_DECODE_ERROR;
1053                                                 return 0;
1054                                                 }
1055                                         sdata = data;
1056                                         data += idsize;
1057                                         id = d2i_OCSP_RESPID(NULL,
1058                                                                 &sdata, idsize);
1059                                         if (!id)
1060                                                 {
1061                                                 *al = SSL_AD_DECODE_ERROR;
1062                                                 return 0;
1063                                                 }
1064                                         if (data != sdata)
1065                                                 {
1066                                                 OCSP_RESPID_free(id);
1067                                                 *al = SSL_AD_DECODE_ERROR;
1068                                                 return 0;
1069                                                 }
1070                                         if (!s->tlsext_ocsp_ids
1071                                                 && !(s->tlsext_ocsp_ids =
1072                                                 sk_OCSP_RESPID_new_null()))
1073                                                 {
1074                                                 OCSP_RESPID_free(id);
1075                                                 *al = SSL_AD_INTERNAL_ERROR;
1076                                                 return 0;
1077                                                 }
1078                                         if (!sk_OCSP_RESPID_push(
1079                                                         s->tlsext_ocsp_ids, id))
1080                                                 {
1081                                                 OCSP_RESPID_free(id);
1082                                                 *al = SSL_AD_INTERNAL_ERROR;
1083                                                 return 0;
1084                                                 }
1085                                         }
1086
1087                                 /* Read in request_extensions */
1088                                 if (size < 2)
1089                                         {
1090                                         *al = SSL_AD_DECODE_ERROR;
1091                                         return 0;
1092                                         }
1093                                 n2s(data,dsize);
1094                                 size -= 2;
1095                                 if (dsize != size)
1096                                         {
1097                                         *al = SSL_AD_DECODE_ERROR;
1098                                         return 0;
1099                                         }
1100                                 sdata = data;
1101                                 if (dsize > 0)
1102                                         {
1103                                         s->tlsext_ocsp_exts =
1104                                                 d2i_X509_EXTENSIONS(NULL,
1105                                                         &sdata, dsize);
1106                                         if (!s->tlsext_ocsp_exts
1107                                                 || (data + dsize != sdata))
1108                                                 {
1109                                                 *al = SSL_AD_DECODE_ERROR;
1110                                                 return 0;
1111                                                 }
1112                                         }
1113                                 }
1114                                 /* We don't know what to do with any other type
1115                                 * so ignore it.
1116                                 */
1117                                 else
1118                                         s->tlsext_status_type = -1;
1119                         }
1120
1121                 /* session ticket processed earlier */
1122                 data+=size;
1123                 }
1124
1125         *p = data;
1126
1127         ri_check:
1128
1129         /* Need RI if renegotiating */
1130
1131         if (!renegotiate_seen && s->renegotiate &&
1132                 !(s->options & SSL_OP_ALLOW_UNSAFE_LEGACY_RENEGOTIATION))
1133                 {
1134                 *al = SSL_AD_HANDSHAKE_FAILURE;
1135                 SSLerr(SSL_F_SSL_PARSE_CLIENTHELLO_TLSEXT,
1136                                 SSL_R_UNSAFE_LEGACY_RENEGOTIATION_DISABLED);
1137                 return 0;
1138                 }
1139
1140         return 1;
1141         }
1142
1143 int ssl_parse_serverhello_tlsext(SSL *s, unsigned char **p, unsigned char *d, int n, int *al)
1144         {
1145         unsigned short length;
1146         unsigned short type;
1147         unsigned short size;
1148         unsigned char *data = *p;
1149         int tlsext_servername = 0;
1150         int renegotiate_seen = 0;
1151
1152         if (data >= (d+n-2))
1153                 goto ri_check;
1154
1155         n2s(data,length);
1156         if (data+length != d+n)
1157                 {
1158                 *al = SSL_AD_DECODE_ERROR;
1159                 return 0;
1160                 }
1161
1162         while(data <= (d+n-4))
1163                 {
1164                 n2s(data,type);
1165                 n2s(data,size);
1166
1167                 if (data+size > (d+n))
1168                         goto ri_check;
1169
1170                 if (s->tlsext_debug_cb)
1171                         s->tlsext_debug_cb(s, 1, type, data, size,
1172                                                 s->tlsext_debug_arg);
1173
1174                 if (type == TLSEXT_TYPE_server_name)
1175                         {
1176                         if (s->tlsext_hostname == NULL || size > 0)
1177                                 {
1178                                 *al = TLS1_AD_UNRECOGNIZED_NAME;
1179                                 return 0;
1180                                 }
1181                         tlsext_servername = 1;
1182                         }
1183
1184 #ifndef OPENSSL_NO_EC
1185                 else if (type == TLSEXT_TYPE_ec_point_formats &&
1186                      s->version != DTLS1_VERSION)
1187                         {
1188                         unsigned char *sdata = data;
1189                         int ecpointformatlist_length = *(sdata++);
1190
1191                         if (ecpointformatlist_length != size - 1)
1192                                 {
1193                                 *al = TLS1_AD_DECODE_ERROR;
1194                                 return 0;
1195                                 }
1196                         s->session->tlsext_ecpointformatlist_length = 0;
1197                         if (s->session->tlsext_ecpointformatlist != NULL) OPENSSL_free(s->session->tlsext_ecpointformatlist);
1198                         if ((s->session->tlsext_ecpointformatlist = OPENSSL_malloc(ecpointformatlist_length)) == NULL)
1199                                 {
1200                                 *al = TLS1_AD_INTERNAL_ERROR;
1201                                 return 0;
1202                                 }
1203                         s->session->tlsext_ecpointformatlist_length = ecpointformatlist_length;
1204                         memcpy(s->session->tlsext_ecpointformatlist, sdata, ecpointformatlist_length);
1205 #if 0
1206                         fprintf(stderr,"ssl_parse_serverhello_tlsext s->session->tlsext_ecpointformatlist ");
1207                         sdata = s->session->tlsext_ecpointformatlist;
1208                         for (i = 0; i < s->session->tlsext_ecpointformatlist_length; i++)
1209                                 fprintf(stderr,"%i ",*(sdata++));
1210                         fprintf(stderr,"\n");
1211 #endif
1212                         }
1213 #endif /* OPENSSL_NO_EC */
1214
1215                 else if (type == TLSEXT_TYPE_session_ticket)
1216                         {
1217                         if (s->tls_session_ticket_ext_cb &&
1218                             !s->tls_session_ticket_ext_cb(s, data, size, s->tls_session_ticket_ext_cb_arg))
1219                                 {
1220                                 *al = TLS1_AD_INTERNAL_ERROR;
1221                                 return 0;
1222                                 }
1223                         if ((SSL_get_options(s) & SSL_OP_NO_TICKET)
1224                                 || (size > 0))
1225                                 {
1226                                 *al = TLS1_AD_UNSUPPORTED_EXTENSION;
1227                                 return 0;
1228                                 }
1229                         s->tlsext_ticket_expected = 1;
1230                         }
1231 #ifdef TLSEXT_TYPE_opaque_prf_input
1232                 else if (type == TLSEXT_TYPE_opaque_prf_input &&
1233                      s->version != DTLS1_VERSION)
1234                         {
1235                         unsigned char *sdata = data;
1236
1237                         if (size < 2)
1238                                 {
1239                                 *al = SSL_AD_DECODE_ERROR;
1240                                 return 0;
1241                                 }
1242                         n2s(sdata, s->s3->server_opaque_prf_input_len);
1243                         if (s->s3->server_opaque_prf_input_len != size - 2)
1244                                 {
1245                                 *al = SSL_AD_DECODE_ERROR;
1246                                 return 0;
1247                                 }
1248
1249                         if (s->s3->server_opaque_prf_input != NULL) /* shouldn't really happen */
1250                                 OPENSSL_free(s->s3->server_opaque_prf_input);
1251                         if (s->s3->server_opaque_prf_input_len == 0)
1252                                 s->s3->server_opaque_prf_input = OPENSSL_malloc(1); /* dummy byte just to get non-NULL */
1253                         else
1254                                 s->s3->server_opaque_prf_input = BUF_memdup(sdata, s->s3->server_opaque_prf_input_len);
1255
1256                         if (s->s3->server_opaque_prf_input == NULL)
1257                                 {
1258                                 *al = TLS1_AD_INTERNAL_ERROR;
1259                                 return 0;
1260                                 }
1261                         }
1262 #endif
1263                 else if (type == TLSEXT_TYPE_status_request &&
1264                          s->version != DTLS1_VERSION)
1265                         {
1266                         /* MUST be empty and only sent if we've requested
1267                          * a status request message.
1268                          */
1269                         if ((s->tlsext_status_type == -1) || (size > 0))
1270                                 {
1271                                 *al = TLS1_AD_UNSUPPORTED_EXTENSION;
1272                                 return 0;
1273                                 }
1274                         /* Set flag to expect CertificateStatus message */
1275                         s->tlsext_status_expected = 1;
1276                         }
1277                 else if (type == TLSEXT_TYPE_renegotiate)
1278                         {
1279                         if(!ssl_parse_serverhello_renegotiate_ext(s, data, size, al))
1280                                 return 0;
1281                         renegotiate_seen = 1;
1282                         }
1283                 data+=size;
1284                 }
1285
1286         if (data != d+n)
1287                 {
1288                 *al = SSL_AD_DECODE_ERROR;
1289                 return 0;
1290                 }
1291
1292         if (!s->hit && tlsext_servername == 1)
1293                 {
1294                 if (s->tlsext_hostname)
1295                         {
1296                         if (s->session->tlsext_hostname == NULL)
1297                                 {
1298                                 s->session->tlsext_hostname = BUF_strdup(s->tlsext_hostname);
1299                                 if (!s->session->tlsext_hostname)
1300                                         {
1301                                         *al = SSL_AD_UNRECOGNIZED_NAME;
1302                                         return 0;
1303                                         }
1304                                 }
1305                         else
1306                                 {
1307                                 *al = SSL_AD_DECODE_ERROR;
1308                                 return 0;
1309                                 }
1310                         }
1311                 }
1312
1313         *p = data;
1314
1315         ri_check:
1316
1317         /* Determine if we need to see RI. Strictly speaking if we want to
1318          * avoid an attack we should *always* see RI even on initial server
1319          * hello because the client doesn't see any renegotiation during an
1320          * attack. However this would mean we could not connect to any server
1321          * which doesn't support RI so for the immediate future tolerate RI
1322          * absence on initial connect only.
1323          */
1324         if (!renegotiate_seen
1325                 && !(s->options & SSL_OP_LEGACY_SERVER_CONNECT)
1326                 && !(s->options & SSL_OP_ALLOW_UNSAFE_LEGACY_RENEGOTIATION))
1327                 {
1328                 *al = SSL_AD_HANDSHAKE_FAILURE;
1329                 SSLerr(SSL_F_SSL_PARSE_SERVERHELLO_TLSEXT,
1330                                 SSL_R_UNSAFE_LEGACY_RENEGOTIATION_DISABLED);
1331                 return 0;
1332                 }
1333
1334         return 1;
1335         }
1336
1337
1338 int ssl_prepare_clienthello_tlsext(SSL *s)
1339         {
1340 #ifndef OPENSSL_NO_EC
1341         /* If we are client and using an elliptic curve cryptography cipher suite, send the point formats
1342          * and elliptic curves we support.
1343          */
1344         int using_ecc = 0;
1345         int i;
1346         unsigned char *j;
1347         unsigned long alg_k, alg_a;
1348         STACK_OF(SSL_CIPHER) *cipher_stack = SSL_get_ciphers(s);
1349
1350         for (i = 0; i < sk_SSL_CIPHER_num(cipher_stack); i++)
1351                 {
1352                 SSL_CIPHER *c = sk_SSL_CIPHER_value(cipher_stack, i);
1353
1354                 alg_k = c->algorithm_mkey;
1355                 alg_a = c->algorithm_auth;
1356                 if ((alg_k & (SSL_kEECDH|SSL_kECDHr|SSL_kECDHe) || (alg_a & SSL_aECDSA)))
1357                         {
1358                         using_ecc = 1;
1359                         break;
1360                         }
1361                 }
1362         using_ecc = using_ecc && (s->version >= TLS1_VERSION);
1363         if (using_ecc)
1364                 {
1365                 if (s->tlsext_ecpointformatlist != NULL) OPENSSL_free(s->tlsext_ecpointformatlist);
1366                 if ((s->tlsext_ecpointformatlist = OPENSSL_malloc(3)) == NULL)
1367                         {
1368                         SSLerr(SSL_F_SSL_PREPARE_CLIENTHELLO_TLSEXT,ERR_R_MALLOC_FAILURE);
1369                         return -1;
1370                         }
1371                 s->tlsext_ecpointformatlist_length = 3;
1372                 s->tlsext_ecpointformatlist[0] = TLSEXT_ECPOINTFORMAT_uncompressed;
1373                 s->tlsext_ecpointformatlist[1] = TLSEXT_ECPOINTFORMAT_ansiX962_compressed_prime;
1374                 s->tlsext_ecpointformatlist[2] = TLSEXT_ECPOINTFORMAT_ansiX962_compressed_char2;
1375
1376                 /* we support all named elliptic curves in draft-ietf-tls-ecc-12 */
1377                 if (s->tlsext_ellipticcurvelist != NULL) OPENSSL_free(s->tlsext_ellipticcurvelist);
1378                 s->tlsext_ellipticcurvelist_length = sizeof(nid_list)/sizeof(nid_list[0]) * 2;
1379                 if ((s->tlsext_ellipticcurvelist = OPENSSL_malloc(s->tlsext_ellipticcurvelist_length)) == NULL)
1380                         {
1381                         s->tlsext_ellipticcurvelist_length = 0;
1382                         SSLerr(SSL_F_SSL_PREPARE_CLIENTHELLO_TLSEXT,ERR_R_MALLOC_FAILURE);
1383                         return -1;
1384                         }
1385                 for (i = 1, j = s->tlsext_ellipticcurvelist; (unsigned int)i <=
1386                                 sizeof(nid_list)/sizeof(nid_list[0]); i++)
1387                         s2n(i,j);
1388                 }
1389 #endif /* OPENSSL_NO_EC */
1390
1391 #ifdef TLSEXT_TYPE_opaque_prf_input
1392         {
1393                 int r = 1;
1394
1395                 if (s->ctx->tlsext_opaque_prf_input_callback != 0)
1396                         {
1397                         r = s->ctx->tlsext_opaque_prf_input_callback(s, NULL, 0, s->ctx->tlsext_opaque_prf_input_callback_arg);
1398                         if (!r)
1399                                 return -1;
1400                         }
1401
1402                 if (s->tlsext_opaque_prf_input != NULL)
1403                         {
1404                         if (s->s3->client_opaque_prf_input != NULL) /* shouldn't really happen */
1405                                 OPENSSL_free(s->s3->client_opaque_prf_input);
1406
1407                         if (s->tlsext_opaque_prf_input_len == 0)
1408                                 s->s3->client_opaque_prf_input = OPENSSL_malloc(1); /* dummy byte just to get non-NULL */
1409                         else
1410                                 s->s3->client_opaque_prf_input = BUF_memdup(s->tlsext_opaque_prf_input, s->tlsext_opaque_prf_input_len);
1411                         if (s->s3->client_opaque_prf_input == NULL)
1412                                 {
1413                                 SSLerr(SSL_F_SSL_PREPARE_CLIENTHELLO_TLSEXT,ERR_R_MALLOC_FAILURE);
1414                                 return -1;
1415                                 }
1416                         s->s3->client_opaque_prf_input_len = s->tlsext_opaque_prf_input_len;
1417                         }
1418
1419                 if (r == 2)
1420                         /* at callback's request, insist on receiving an appropriate server opaque PRF input */
1421                         s->s3->server_opaque_prf_input_len = s->tlsext_opaque_prf_input_len;
1422         }
1423 #endif
1424
1425         return 1;
1426         }
1427
1428 int ssl_prepare_serverhello_tlsext(SSL *s)
1429         {
1430 #ifndef OPENSSL_NO_EC
1431         /* If we are server and using an ECC cipher suite, send the point formats we support
1432          * if the client sent us an ECPointsFormat extension.  Note that the server is not
1433          * supposed to send an EllipticCurves extension.
1434          */
1435
1436         unsigned long alg_k = s->s3->tmp.new_cipher->algorithm_mkey;
1437         unsigned long alg_a = s->s3->tmp.new_cipher->algorithm_auth;
1438         int using_ecc = (alg_k & (SSL_kEECDH|SSL_kECDHr|SSL_kECDHe)) || (alg_a & SSL_aECDSA);
1439         using_ecc = using_ecc && (s->session->tlsext_ecpointformatlist != NULL);
1440
1441         if (using_ecc)
1442                 {
1443                 if (s->tlsext_ecpointformatlist != NULL) OPENSSL_free(s->tlsext_ecpointformatlist);
1444                 if ((s->tlsext_ecpointformatlist = OPENSSL_malloc(3)) == NULL)
1445                         {
1446                         SSLerr(SSL_F_SSL_PREPARE_SERVERHELLO_TLSEXT,ERR_R_MALLOC_FAILURE);
1447                         return -1;
1448                         }
1449                 s->tlsext_ecpointformatlist_length = 3;
1450                 s->tlsext_ecpointformatlist[0] = TLSEXT_ECPOINTFORMAT_uncompressed;
1451                 s->tlsext_ecpointformatlist[1] = TLSEXT_ECPOINTFORMAT_ansiX962_compressed_prime;
1452                 s->tlsext_ecpointformatlist[2] = TLSEXT_ECPOINTFORMAT_ansiX962_compressed_char2;
1453                 }
1454 #endif /* OPENSSL_NO_EC */
1455
1456         return 1;
1457         }
1458
1459 int ssl_check_clienthello_tlsext(SSL *s)
1460         {
1461         int ret=SSL_TLSEXT_ERR_NOACK;
1462         int al = SSL_AD_UNRECOGNIZED_NAME;
1463
1464 #ifndef OPENSSL_NO_EC
1465         /* The handling of the ECPointFormats extension is done elsewhere, namely in
1466          * ssl3_choose_cipher in s3_lib.c.
1467          */
1468         /* The handling of the EllipticCurves extension is done elsewhere, namely in
1469          * ssl3_choose_cipher in s3_lib.c.
1470          */
1471 #endif
1472
1473         if (s->ctx != NULL && s->ctx->tlsext_servername_callback != 0)
1474                 ret = s->ctx->tlsext_servername_callback(s, &al, s->ctx->tlsext_servername_arg);
1475         else if (s->initial_ctx != NULL && s->initial_ctx->tlsext_servername_callback != 0)
1476                 ret = s->initial_ctx->tlsext_servername_callback(s, &al, s->initial_ctx->tlsext_servername_arg);
1477
1478         /* If status request then ask callback what to do.
1479          * Note: this must be called after servername callbacks in case
1480          * the certificate has changed.
1481          */
1482         if ((s->tlsext_status_type != -1) && s->ctx && s->ctx->tlsext_status_cb)
1483                 {
1484                 int r;
1485                 r = s->ctx->tlsext_status_cb(s, s->ctx->tlsext_status_arg);
1486                 switch (r)
1487                         {
1488                         /* We don't want to send a status request response */
1489                         case SSL_TLSEXT_ERR_NOACK:
1490                                 s->tlsext_status_expected = 0;
1491                                 break;
1492                         /* status request response should be sent */
1493                         case SSL_TLSEXT_ERR_OK:
1494                                 if (s->tlsext_ocsp_resp)
1495                                         s->tlsext_status_expected = 1;
1496                                 else
1497                                         s->tlsext_status_expected = 0;
1498                                 break;
1499                         /* something bad happened */
1500                         case SSL_TLSEXT_ERR_ALERT_FATAL:
1501                                 ret = SSL_TLSEXT_ERR_ALERT_FATAL;
1502                                 al = SSL_AD_INTERNAL_ERROR;
1503                                 goto err;
1504                         }
1505                 }
1506         else
1507                 s->tlsext_status_expected = 0;
1508
1509 #ifdef TLSEXT_TYPE_opaque_prf_input
1510         {
1511                 /* This sort of belongs into ssl_prepare_serverhello_tlsext(),
1512                  * but we might be sending an alert in response to the client hello,
1513                  * so this has to happen here in ssl_check_clienthello_tlsext(). */
1514
1515                 int r = 1;
1516
1517                 if (s->ctx->tlsext_opaque_prf_input_callback != 0)
1518                         {
1519                         r = s->ctx->tlsext_opaque_prf_input_callback(s, NULL, 0, s->ctx->tlsext_opaque_prf_input_callback_arg);
1520                         if (!r)
1521                                 {
1522                                 ret = SSL_TLSEXT_ERR_ALERT_FATAL;
1523                                 al = SSL_AD_INTERNAL_ERROR;
1524                                 goto err;
1525                                 }
1526                         }
1527
1528                 if (s->s3->server_opaque_prf_input != NULL) /* shouldn't really happen */
1529                         OPENSSL_free(s->s3->server_opaque_prf_input);
1530                 s->s3->server_opaque_prf_input = NULL;
1531
1532                 if (s->tlsext_opaque_prf_input != NULL)
1533                         {
1534                         if (s->s3->client_opaque_prf_input != NULL &&
1535                                 s->s3->client_opaque_prf_input_len == s->tlsext_opaque_prf_input_len)
1536                                 {
1537                                 /* can only use this extension if we have a server opaque PRF input
1538                                  * of the same length as the client opaque PRF input! */
1539
1540                                 if (s->tlsext_opaque_prf_input_len == 0)
1541                                         s->s3->server_opaque_prf_input = OPENSSL_malloc(1); /* dummy byte just to get non-NULL */
1542                                 else
1543                                         s->s3->server_opaque_prf_input = BUF_memdup(s->tlsext_opaque_prf_input, s->tlsext_opaque_prf_input_len);
1544                                 if (s->s3->server_opaque_prf_input == NULL)
1545                                         {
1546                                         ret = SSL_TLSEXT_ERR_ALERT_FATAL;
1547                                         al = SSL_AD_INTERNAL_ERROR;
1548                                         goto err;
1549                                         }
1550                                 s->s3->server_opaque_prf_input_len = s->tlsext_opaque_prf_input_len;
1551                                 }
1552                         }
1553
1554                 if (r == 2 && s->s3->server_opaque_prf_input == NULL)
1555                         {
1556                         /* The callback wants to enforce use of the extension,
1557                          * but we can't do that with the client opaque PRF input;
1558                          * abort the handshake.
1559                          */
1560                         ret = SSL_TLSEXT_ERR_ALERT_FATAL;
1561                         al = SSL_AD_HANDSHAKE_FAILURE;
1562                         }
1563         }
1564
1565 #endif
1566  err:
1567         switch (ret)
1568                 {
1569                 case SSL_TLSEXT_ERR_ALERT_FATAL:
1570                         ssl3_send_alert(s,SSL3_AL_FATAL,al);
1571                         return -1;
1572
1573                 case SSL_TLSEXT_ERR_ALERT_WARNING:
1574                         ssl3_send_alert(s,SSL3_AL_WARNING,al);
1575                         return 1;
1576
1577                 case SSL_TLSEXT_ERR_NOACK:
1578                         s->servername_done=0;
1579                         default:
1580                 return 1;
1581                 }
1582         }
1583
1584 int ssl_check_serverhello_tlsext(SSL *s)
1585         {
1586         int ret=SSL_TLSEXT_ERR_NOACK;
1587         int al = SSL_AD_UNRECOGNIZED_NAME;
1588
1589 #ifndef OPENSSL_NO_EC
1590         /* If we are client and using an elliptic curve cryptography cipher
1591          * suite, then if server returns an EC point formats lists extension
1592          * it must contain uncompressed.
1593          */
1594         unsigned long alg_k = s->s3->tmp.new_cipher->algorithm_mkey;
1595         unsigned long alg_a = s->s3->tmp.new_cipher->algorithm_auth;
1596         if ((s->tlsext_ecpointformatlist != NULL) && (s->tlsext_ecpointformatlist_length > 0) &&
1597             (s->session->tlsext_ecpointformatlist != NULL) && (s->session->tlsext_ecpointformatlist_length > 0) &&
1598             ((alg_k & (SSL_kEECDH|SSL_kECDHr|SSL_kECDHe)) || (alg_a & SSL_aECDSA)))
1599                 {
1600                 /* we are using an ECC cipher */
1601                 size_t i;
1602                 unsigned char *list;
1603                 int found_uncompressed = 0;
1604                 list = s->session->tlsext_ecpointformatlist;
1605                 for (i = 0; i < s->session->tlsext_ecpointformatlist_length; i++)
1606                         {
1607                         if (*(list++) == TLSEXT_ECPOINTFORMAT_uncompressed)
1608                                 {
1609                                 found_uncompressed = 1;
1610                                 break;
1611                                 }
1612                         }
1613                 if (!found_uncompressed)
1614                         {
1615                         SSLerr(SSL_F_SSL_CHECK_SERVERHELLO_TLSEXT,SSL_R_TLS_INVALID_ECPOINTFORMAT_LIST);
1616                         return -1;
1617                         }
1618                 }
1619         ret = SSL_TLSEXT_ERR_OK;
1620 #endif /* OPENSSL_NO_EC */
1621
1622         if (s->ctx != NULL && s->ctx->tlsext_servername_callback != 0)
1623                 ret = s->ctx->tlsext_servername_callback(s, &al, s->ctx->tlsext_servername_arg);
1624         else if (s->initial_ctx != NULL && s->initial_ctx->tlsext_servername_callback != 0)
1625                 ret = s->initial_ctx->tlsext_servername_callback(s, &al, s->initial_ctx->tlsext_servername_arg);
1626
1627 #ifdef TLSEXT_TYPE_opaque_prf_input
1628         if (s->s3->server_opaque_prf_input_len > 0)
1629                 {
1630                 /* This case may indicate that we, as a client, want to insist on using opaque PRF inputs.
1631                  * So first verify that we really have a value from the server too. */
1632
1633                 if (s->s3->server_opaque_prf_input == NULL)
1634                         {
1635                         ret = SSL_TLSEXT_ERR_ALERT_FATAL;
1636                         al = SSL_AD_HANDSHAKE_FAILURE;
1637                         }
1638
1639                 /* Anytime the server *has* sent an opaque PRF input, we need to check
1640                  * that we have a client opaque PRF input of the same size. */
1641                 if (s->s3->client_opaque_prf_input == NULL ||
1642                     s->s3->client_opaque_prf_input_len != s->s3->server_opaque_prf_input_len)
1643                         {
1644                         ret = SSL_TLSEXT_ERR_ALERT_FATAL;
1645                         al = SSL_AD_ILLEGAL_PARAMETER;
1646                         }
1647                 }
1648 #endif
1649
1650         /* If we've requested certificate status and we wont get one
1651          * tell the callback
1652          */
1653         if ((s->tlsext_status_type != -1) && !(s->tlsext_status_expected)
1654                         && s->ctx && s->ctx->tlsext_status_cb)
1655                 {
1656                 int r;
1657                 /* Set resp to NULL, resplen to -1 so callback knows
1658                  * there is no response.
1659                  */
1660                 if (s->tlsext_ocsp_resp)
1661                         {
1662                         OPENSSL_free(s->tlsext_ocsp_resp);
1663                         s->tlsext_ocsp_resp = NULL;
1664                         }
1665                 s->tlsext_ocsp_resplen = -1;
1666                 r = s->ctx->tlsext_status_cb(s, s->ctx->tlsext_status_arg);
1667                 if (r == 0)
1668                         {
1669                         al = SSL_AD_BAD_CERTIFICATE_STATUS_RESPONSE;
1670                         ret = SSL_TLSEXT_ERR_ALERT_FATAL;
1671                         }
1672                 if (r < 0)
1673                         {
1674                         al = SSL_AD_INTERNAL_ERROR;
1675                         ret = SSL_TLSEXT_ERR_ALERT_FATAL;
1676                         }
1677                 }
1678
1679         switch (ret)
1680                 {
1681                 case SSL_TLSEXT_ERR_ALERT_FATAL:
1682                         ssl3_send_alert(s,SSL3_AL_FATAL,al);
1683                         return -1;
1684
1685                 case SSL_TLSEXT_ERR_ALERT_WARNING:
1686                         ssl3_send_alert(s,SSL3_AL_WARNING,al);
1687                         return 1;
1688
1689                 case SSL_TLSEXT_ERR_NOACK:
1690                         s->servername_done=0;
1691                         default:
1692                 return 1;
1693                 }
1694         }
1695
1696 /* Since the server cache lookup is done early on in the processing of client
1697  * hello and other operations depend on the result we need to handle any TLS
1698  * session ticket extension at the same time.
1699  */
1700
1701 int tls1_process_ticket(SSL *s, unsigned char *session_id, int len,
1702                                 const unsigned char *limit, SSL_SESSION **ret)
1703         {
1704         /* Point after session ID in client hello */
1705         const unsigned char *p = session_id + len;
1706         unsigned short i;
1707
1708         /* If tickets disabled behave as if no ticket present
1709          * to permit stateful resumption.
1710          */
1711         if (SSL_get_options(s) & SSL_OP_NO_TICKET)
1712                 return 1;
1713
1714         if ((s->version <= SSL3_VERSION) || !limit)
1715                 return 1;
1716         if (p >= limit)
1717                 return -1;
1718         /* Skip past DTLS cookie */
1719         if (s->version == DTLS1_VERSION || s->version == DTLS1_BAD_VER)
1720                 {
1721                 i = *(p++);
1722                 p+= i;
1723                 if (p >= limit)
1724                         return -1;
1725                 }
1726         /* Skip past cipher list */
1727         n2s(p, i);
1728         p+= i;
1729         if (p >= limit)
1730                 return -1;
1731         /* Skip past compression algorithm list */
1732         i = *(p++);
1733         p += i;
1734         if (p > limit)
1735                 return -1;
1736         /* Now at start of extensions */
1737         if ((p + 2) >= limit)
1738                 return 1;
1739         n2s(p, i);
1740         while ((p + 4) <= limit)
1741                 {
1742                 unsigned short type, size;
1743                 n2s(p, type);
1744                 n2s(p, size);
1745                 if (p + size > limit)
1746                         return 1;
1747                 if (type == TLSEXT_TYPE_session_ticket)
1748                         {
1749                         /* If tickets disabled indicate cache miss which will
1750                          * trigger a full handshake
1751                          */
1752                         if (SSL_get_options(s) & SSL_OP_NO_TICKET)
1753                                 return 1;
1754                         /* If zero length note client will accept a ticket
1755                          * and indicate cache miss to trigger full handshake
1756                          */
1757                         if (size == 0)
1758                                 {
1759                                 s->tlsext_ticket_expected = 1;
1760                                 return 0;       /* Cache miss */
1761                                 }
1762                         if (s->tls_session_secret_cb)
1763                                 {
1764                                 /* Indicate cache miss here and instead of
1765                                  * generating the session from ticket now,
1766                                  * trigger abbreviated handshake based on
1767                                  * external mechanism to calculate the master
1768                                  * secret later. */
1769                                 return 0;
1770                                 }
1771                         return tls_decrypt_ticket(s, p, size, session_id, len,
1772                                                                         ret);
1773                         }
1774                 p += size;
1775                 }
1776         return 1;
1777         }
1778
1779 static int tls_decrypt_ticket(SSL *s, const unsigned char *etick, int eticklen,
1780                                 const unsigned char *sess_id, int sesslen,
1781                                 SSL_SESSION **psess)
1782         {
1783         SSL_SESSION *sess;
1784         unsigned char *sdec;
1785         const unsigned char *p;
1786         int slen, mlen, renew_ticket = 0;
1787         unsigned char tick_hmac[EVP_MAX_MD_SIZE];
1788         HMAC_CTX hctx;
1789         EVP_CIPHER_CTX ctx;
1790         SSL_CTX *tctx = s->initial_ctx;
1791         /* Need at least keyname + iv + some encrypted data */
1792         if (eticklen < 48)
1793                 goto tickerr;
1794         /* Initialize session ticket encryption and HMAC contexts */
1795         HMAC_CTX_init(&hctx);
1796         EVP_CIPHER_CTX_init(&ctx);
1797         if (tctx->tlsext_ticket_key_cb)
1798                 {
1799                 unsigned char *nctick = (unsigned char *)etick;
1800                 int rv = tctx->tlsext_ticket_key_cb(s, nctick, nctick + 16,
1801                                                         &ctx, &hctx, 0);
1802                 if (rv < 0)
1803                         return -1;
1804                 if (rv == 0)
1805                         goto tickerr;
1806                 if (rv == 2)
1807                         renew_ticket = 1;
1808                 }
1809         else
1810                 {
1811                 /* Check key name matches */
1812                 if (memcmp(etick, tctx->tlsext_tick_key_name, 16))
1813                         goto tickerr;
1814                 HMAC_Init_ex(&hctx, tctx->tlsext_tick_hmac_key, 16,
1815                                         tlsext_tick_md(), NULL);
1816                 EVP_DecryptInit_ex(&ctx, EVP_aes_128_cbc(), NULL,
1817                                 tctx->tlsext_tick_aes_key, etick + 16);
1818                 }
1819         /* Attempt to process session ticket, first conduct sanity and
1820          * integrity checks on ticket.
1821          */
1822         mlen = HMAC_size(&hctx);
1823         if (mlen < 0)
1824                 {
1825                 EVP_CIPHER_CTX_cleanup(&ctx);
1826                 return -1;
1827                 }
1828         eticklen -= mlen;
1829         /* Check HMAC of encrypted ticket */
1830         HMAC_Update(&hctx, etick, eticklen);
1831         HMAC_Final(&hctx, tick_hmac, NULL);
1832         HMAC_CTX_cleanup(&hctx);
1833         if (memcmp(tick_hmac, etick + eticklen, mlen))
1834                 goto tickerr;
1835         /* Attempt to decrypt session data */
1836         /* Move p after IV to start of encrypted ticket, update length */
1837         p = etick + 16 + EVP_CIPHER_CTX_iv_length(&ctx);
1838         eticklen -= 16 + EVP_CIPHER_CTX_iv_length(&ctx);
1839         sdec = OPENSSL_malloc(eticklen);
1840         if (!sdec)
1841                 {
1842                 EVP_CIPHER_CTX_cleanup(&ctx);
1843                 return -1;
1844                 }
1845         EVP_DecryptUpdate(&ctx, sdec, &slen, p, eticklen);
1846         if (EVP_DecryptFinal(&ctx, sdec + slen, &mlen) <= 0)
1847                 goto tickerr;
1848         slen += mlen;
1849         EVP_CIPHER_CTX_cleanup(&ctx);
1850         p = sdec;
1851
1852         sess = d2i_SSL_SESSION(NULL, &p, slen);
1853         OPENSSL_free(sdec);
1854         if (sess)
1855                 {
1856                 /* The session ID if non-empty is used by some clients to
1857                  * detect that the ticket has been accepted. So we copy it to
1858                  * the session structure. If it is empty set length to zero
1859                  * as required by standard.
1860                  */
1861                 if (sesslen)
1862                         memcpy(sess->session_id, sess_id, sesslen);
1863                 sess->session_id_length = sesslen;
1864                 *psess = sess;
1865                 s->tlsext_ticket_expected = renew_ticket;
1866                 return 1;
1867                 }
1868         /* If session decrypt failure indicate a cache miss and set state to
1869          * send a new ticket
1870          */
1871         tickerr:
1872         s->tlsext_ticket_expected = 1;
1873         return 0;
1874         }
1875
1876 /* Tables to translate from NIDs to TLS v1.2 ids */
1877
1878 typedef struct
1879         {
1880         int nid;
1881         int id;
1882         } tls12_lookup;
1883
1884 static tls12_lookup tls12_md[] = {
1885 #ifndef OPENSSL_NO_MD5
1886         {NID_md5, TLSEXT_hash_md5},
1887 #endif
1888 #ifndef OPENSSL_NO_SHA
1889         {NID_sha1, TLSEXT_hash_sha1},
1890 #endif
1891 #ifndef OPENSSL_NO_SHA256
1892         {NID_sha224, TLSEXT_hash_sha224},
1893         {NID_sha256, TLSEXT_hash_sha256},
1894 #endif
1895 #ifndef OPENSSL_NO_SHA512
1896         {NID_sha384, TLSEXT_hash_sha384},
1897         {NID_sha512, TLSEXT_hash_sha512}
1898 #endif
1899 };
1900
1901 static tls12_lookup tls12_sig[] = {
1902 #ifndef OPENSSL_NO_RSA
1903         {EVP_PKEY_RSA, TLSEXT_signature_rsa},
1904 #endif
1905 #ifndef OPENSSL_NO_RSA
1906         {EVP_PKEY_DSA, TLSEXT_signature_dsa},
1907 #endif
1908 #ifndef OPENSSL_NO_ECDSA
1909         {EVP_PKEY_EC, TLSEXT_signature_ecdsa}
1910 #endif
1911 };
1912
1913 static int tls12_find_id(int nid, tls12_lookup *table, size_t tlen)
1914         {
1915         size_t i;
1916         for (i = 0; i < tlen; i++)
1917                 {
1918                 if (table[i].nid == nid)
1919                         return table[i].id;
1920                 }
1921         return -1;
1922         }
1923 #if 0
1924 static int tls12_find_nid(int id, tls12_lookup *table, size_t tlen)
1925         {
1926         size_t i;
1927         for (i = 0; i < tlen; i++)
1928                 {
1929                 if (table[i].id == id)
1930                         return table[i].nid;
1931                 }
1932         return -1;
1933         }
1934 #endif
1935
1936 int tls12_get_sigandhash(unsigned char *p, const EVP_PKEY *pk, const EVP_MD *md)
1937         {
1938         int sig_id, md_id;
1939         md_id = tls12_find_id(EVP_MD_type(md), tls12_md,
1940                                 sizeof(tls12_md)/sizeof(tls12_lookup));
1941         if (md_id == -1)
1942                 return 0;
1943         sig_id = tls12_get_sigid(pk);
1944         if (sig_id == -1)
1945                 return 0;
1946         p[0] = (unsigned char)md_id;
1947         p[1] = (unsigned char)sig_id;
1948         return 1;
1949         }
1950
1951 int tls12_get_sigid(const EVP_PKEY *pk)
1952         {
1953         return tls12_find_id(pk->type, tls12_sig,
1954                                 sizeof(tls12_sig)/sizeof(tls12_lookup));
1955         }
1956
1957 const EVP_MD *tls12_get_hash(unsigned char hash_alg)
1958         {
1959         switch(hash_alg)
1960                 {
1961 #ifndef OPENSSL_NO_MD5
1962                 case TLSEXT_hash_md5:
1963 #ifdef OPENSSL_FIPS
1964                 if (FIPS_mode())
1965                         return NULL;
1966 #endif
1967                 return EVP_md5();
1968 #endif
1969 #ifndef OPENSSL_NO_SHA
1970                 case TLSEXT_hash_sha1:
1971                 return EVP_sha1();
1972 #endif
1973 #ifndef OPENSSL_NO_SHA256
1974                 case TLSEXT_hash_sha224:
1975                 return EVP_sha224();
1976
1977                 case TLSEXT_hash_sha256:
1978                 return EVP_sha256();
1979 #endif
1980 #ifndef OPENSSL_NO_SHA512
1981                 case TLSEXT_hash_sha384:
1982                 return EVP_sha384();
1983
1984                 case TLSEXT_hash_sha512:
1985                 return EVP_sha512();
1986 #endif
1987                 default:
1988                 return NULL;
1989
1990                 }
1991         }
1992
1993 /* Set preferred digest for each key type */
1994
1995 int tls1_process_sigalgs(SSL *s, const unsigned char *data, int dsize)
1996         {
1997         int i, idx;
1998         const EVP_MD *md;
1999         CERT *c = s->cert;
2000         /* Extension ignored for TLS versions below 1.2 */
2001         if (TLS1_get_version(s) < TLS1_2_VERSION)
2002                 return 1;
2003         /* Should never happen */
2004         if (!c)
2005                 return 0;
2006
2007         c->pkeys[SSL_PKEY_DSA_SIGN].digest = NULL;
2008         c->pkeys[SSL_PKEY_RSA_SIGN].digest = NULL;
2009         c->pkeys[SSL_PKEY_RSA_ENC].digest = NULL;
2010         c->pkeys[SSL_PKEY_ECC].digest = NULL;
2011
2012         for (i = 0; i < dsize; i += 2)
2013                 {
2014                 unsigned char hash_alg = data[i], sig_alg = data[i+1];
2015
2016                 switch(sig_alg)
2017                         {
2018 #ifndef OPENSSL_NO_RSA
2019                         case TLSEXT_signature_rsa:
2020                         idx = SSL_PKEY_RSA_SIGN;
2021                         break;
2022 #endif
2023 #ifndef OPENSSL_NO_DSA
2024                         case TLSEXT_signature_dsa:
2025                         idx = SSL_PKEY_DSA_SIGN;
2026                         break;
2027 #endif
2028 #ifndef OPENSSL_NO_ECDSA
2029                         case TLSEXT_signature_ecdsa:
2030                         idx = SSL_PKEY_ECC;
2031                         break;
2032 #endif
2033                         default:
2034                         continue;
2035                         }
2036
2037                 if (c->pkeys[idx].digest == NULL)
2038                         {
2039                         md = tls12_get_hash(hash_alg);
2040                         if (md)
2041                                 {
2042                                 c->pkeys[idx].digest = md;
2043                                 if (idx == SSL_PKEY_RSA_SIGN)
2044                                         c->pkeys[SSL_PKEY_RSA_ENC].digest = md;
2045                                 }
2046                         }
2047
2048                 }
2049
2050
2051         /* Set any remaining keys to default values. NOTE: if alg is not
2052          * supported it stays as NULL.
2053          */
2054 #ifndef OPENSSL_NO_DSA
2055         if (!c->pkeys[SSL_PKEY_DSA_SIGN].digest)
2056                 c->pkeys[SSL_PKEY_DSA_SIGN].digest = EVP_dss1();
2057 #endif
2058 #ifndef OPENSSL_NO_RSA
2059         if (!c->pkeys[SSL_PKEY_RSA_SIGN].digest)
2060                 {
2061                 c->pkeys[SSL_PKEY_RSA_SIGN].digest = EVP_sha1();
2062                 c->pkeys[SSL_PKEY_RSA_ENC].digest = EVP_sha1();
2063                 }
2064 #endif
2065 #ifndef OPENSSL_NO_ECDSA
2066         if (!c->pkeys[SSL_PKEY_ECC].digest)
2067                 c->pkeys[SSL_PKEY_ECC].digest = EVP_ecdsa();
2068 #endif
2069         return 1;
2070         }
2071
2072 #endif