ssl/t1_lib.c

   1 /* ssl/t1_lib.c */
   2 /* Copyright (C) 1995-1998 Eric Young (eay@cryptsoft.com)
   3  * All rights reserved.
   4  *
   5  * This package is an SSL implementation written
   6  * by Eric Young (eay@cryptsoft.com).
   7  * The implementation was written so as to conform with Netscapes SSL.
   8  *
   9  * This library is free for commercial and non-commercial use as long as
  10  * the following conditions are aheared to.  The following conditions
  11  * apply to all code found in this distribution, be it the RC4, RSA,
  12  * lhash, DES, etc., code; not just the SSL code.  The SSL documentation
  13  * included with this distribution is covered by the same copyright terms
  14  * except that the holder is Tim Hudson (tjh@cryptsoft.com).
  15  *
  16  * Copyright remains Eric Young's, and as such any Copyright notices in
  17  * the code are not to be removed.
  18  * If this package is used in a product, Eric Young should be given attribution
  19  * as the author of the parts of the library used.
  20  * This can be in the form of a textual message at program startup or
  21  * in documentation (online or textual) provided with the package.
  22  *
  23  * Redistribution and use in source and binary forms, with or without
  24  * modification, are permitted provided that the following conditions
  25  * are met:
  26  * 1. Redistributions of source code must retain the copyright
  27  *    notice, this list of conditions and the following disclaimer.
  28  * 2. Redistributions in binary form must reproduce the above copyright
  29  *    notice, this list of conditions and the following disclaimer in the
  30  *    documentation and/or other materials provided with the distribution.
  31  * 3. All advertising materials mentioning features or use of this software
  32  *    must display the following acknowledgement:
  33  *    "This product includes cryptographic software written by
  34  *     Eric Young (eay@cryptsoft.com)"
  35  *    The word 'cryptographic' can be left out if the rouines from the library
  36  *    being used are not cryptographic related :-).
  37  * 4. If you include any Windows specific code (or a derivative thereof) from
  38  *    the apps directory (application code) you must include an acknowledgement:
  39  *    "This product includes software written by Tim Hudson (tjh@cryptsoft.com)"
  40  *
  41  * THIS SOFTWARE IS PROVIDED BY ERIC YOUNG ``AS IS'' AND
  42  * ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
  43  * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE
  44  * ARE DISCLAIMED.  IN NO EVENT SHALL THE AUTHOR OR CONTRIBUTORS BE LIABLE
  45  * FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL
  46  * DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS
  47  * OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION)
  48  * HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT
  49  * LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY
  50  * OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF
  51  * SUCH DAMAGE.
  52  *
  53  * The licence and distribution terms for any publically available version or
  54  * derivative of this code cannot be changed.  i.e. this code cannot simply be
  55  * copied and put under another distribution licence
  56  * [including the GNU Public Licence.]
  57  */
  58 /* ====================================================================
  59  * Copyright (c) 1998-2007 The OpenSSL Project.  All rights reserved.
  60  *
  61  * Redistribution and use in source and binary forms, with or without
  62  * modification, are permitted provided that the following conditions
  63  * are met:
  64  *
  65  * 1. Redistributions of source code must retain the above copyright
  66  *    notice, this list of conditions and the following disclaimer.
  67  *
  68  * 2. Redistributions in binary form must reproduce the above copyright
  69  *    notice, this list of conditions and the following disclaimer in
  70  *    the documentation and/or other materials provided with the
  71  *    distribution.
  72  *
  73  * 3. All advertising materials mentioning features or use of this
  74  *    software must display the following acknowledgment:
  75  *    "This product includes software developed by the OpenSSL Project
  76  *    for use in the OpenSSL Toolkit. (http://www.openssl.org/)"
  77  *
  78  * 4. The names "OpenSSL Toolkit" and "OpenSSL Project" must not be used to
  79  *    endorse or promote products derived from this software without
  80  *    prior written permission. For written permission, please contact
  81  *    openssl-core@openssl.org.
  82  *
  83  * 5. Products derived from this software may not be called "OpenSSL"
  84  *    nor may "OpenSSL" appear in their names without prior written
  85  *    permission of the OpenSSL Project.
  86  *
  87  * 6. Redistributions of any form whatsoever must retain the following
  88  *    acknowledgment:
  89  *    "This product includes software developed by the OpenSSL Project
  90  *    for use in the OpenSSL Toolkit (http://www.openssl.org/)"
  91  *
  92  * THIS SOFTWARE IS PROVIDED BY THE OpenSSL PROJECT ``AS IS'' AND ANY
  93  * EXPRESSED OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
  94  * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
  95  * PURPOSE ARE DISCLAIMED.  IN NO EVENT SHALL THE OpenSSL PROJECT OR
  96  * ITS CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL,
  97  * SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT
  98  * NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES;
  99  * LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION)
 100  * HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT,
 101  * STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE)
 102  * ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED
 103  * OF THE POSSIBILITY OF SUCH DAMAGE.
 104  * ====================================================================
 105  *
 106  * This product includes cryptographic software written by Eric Young
 107  * (eay@cryptsoft.com).  This product includes software written by Tim
 108  * Hudson (tjh@cryptsoft.com).
 109  *
 110  */
 111
 112 #include <stdio.h>
 113 #include <openssl/objects.h>
 114 #include <openssl/evp.h>
 115 #include <openssl/hmac.h>
 116 #include <openssl/ocsp.h>
 117 #include "ssl_locl.h"
 118
 119 const char tls1_version_str[]="TLSv1" OPENSSL_VERSION_PTEXT;
 120
 121 #ifndef OPENSSL_NO_TLSEXT
 122 static int tls_decrypt_ticket(SSL *s, const unsigned char *tick, int ticklen,
 123                                 const unsigned char *sess_id, int sesslen,
 124                                 SSL_SESSION **psess);
 125 static int tls1_process_sigalgs(SSL *s, const unsigned char *data, int dsize);
 126 #endif
 127
 128 SSL3_ENC_METHOD TLSv1_enc_data={
 129         tls1_enc,
 130         tls1_mac,
 131         tls1_setup_key_block,
 132         tls1_generate_master_secret,
 133         tls1_change_cipher_state,
 134         tls1_final_finish_mac,
 135         TLS1_FINISH_MAC_LENGTH,
 136         tls1_cert_verify_mac,
 137         TLS_MD_CLIENT_FINISH_CONST,TLS_MD_CLIENT_FINISH_CONST_SIZE,
 138         TLS_MD_SERVER_FINISH_CONST,TLS_MD_SERVER_FINISH_CONST_SIZE,
 139         tls1_alert_code,
 140         };
 141
 142 long tls1_default_timeout(void)
 143         {
 144         /* 2 hours, the 24 hours mentioned in the TLSv1 spec
 145          * is way too long for http, the cache would over fill */
 146         return(60*60*2);
 147         }
 148
 149 int tls1_new(SSL *s)
 150         {
 151         if (!ssl3_new(s)) return(0);
 152         s->method->ssl_clear(s);
 153         return(1);
 154         }
 155
 156 void tls1_free(SSL *s)
 157         {
 158 #ifndef OPENSSL_NO_TLSEXT
 159         if (s->tlsext_session_ticket)
 160                 {
 161                 OPENSSL_free(s->tlsext_session_ticket);
 162                 }
 163 #endif /* OPENSSL_NO_TLSEXT */
 164         ssl3_free(s);
 165         }
 166
 167 void tls1_clear(SSL *s)
 168         {
 169         ssl3_clear(s);
 170         s->version = s->method->version;
 171         }
 172
 173 #ifndef OPENSSL_NO_EC
 174 static int nid_list[] =
 175         {
 176                 NID_sect163k1, /* sect163k1 (1) */
 177                 NID_sect163r1, /* sect163r1 (2) */
 178                 NID_sect163r2, /* sect163r2 (3) */
 179                 NID_sect193r1, /* sect193r1 (4) */
 180                 NID_sect193r2, /* sect193r2 (5) */
 181                 NID_sect233k1, /* sect233k1 (6) */
 182                 NID_sect233r1, /* sect233r1 (7) */
 183                 NID_sect239k1, /* sect239k1 (8) */
 184                 NID_sect283k1, /* sect283k1 (9) */
 185                 NID_sect283r1, /* sect283r1 (10) */
 186                 NID_sect409k1, /* sect409k1 (11) */
 187                 NID_sect409r1, /* sect409r1 (12) */
 188                 NID_sect571k1, /* sect571k1 (13) */
 189                 NID_sect571r1, /* sect571r1 (14) */
 190                 NID_secp160k1, /* secp160k1 (15) */
 191                 NID_secp160r1, /* secp160r1 (16) */
 192                 NID_secp160r2, /* secp160r2 (17) */
 193                 NID_secp192k1, /* secp192k1 (18) */
 194                 NID_X9_62_prime192v1, /* secp192r1 (19) */
 195                 NID_secp224k1, /* secp224k1 (20) */
 196                 NID_secp224r1, /* secp224r1 (21) */
 197                 NID_secp256k1, /* secp256k1 (22) */
 198                 NID_X9_62_prime256v1, /* secp256r1 (23) */
 199                 NID_secp384r1, /* secp384r1 (24) */
 200                 NID_secp521r1  /* secp521r1 (25) */
 201         };
 202
 203 int tls1_ec_curve_id2nid(int curve_id)
 204         {
 205         /* ECC curves from draft-ietf-tls-ecc-12.txt (Oct. 17, 2005) */
 206         if ((curve_id < 1) || ((unsigned int)curve_id >
 207                                 sizeof(nid_list)/sizeof(nid_list[0])))
 208                 return 0;
 209         return nid_list[curve_id-1];
 210         }
 211
 212 int tls1_ec_nid2curve_id(int nid)
 213         {
 214         /* ECC curves from draft-ietf-tls-ecc-12.txt (Oct. 17, 2005) */
 215         switch (nid)
 216                 {
 217         case NID_sect163k1: /* sect163k1 (1) */
 218                 return 1;
 219         case NID_sect163r1: /* sect163r1 (2) */
 220                 return 2;
 221         case NID_sect163r2: /* sect163r2 (3) */
 222                 return 3;
 223         case NID_sect193r1: /* sect193r1 (4) */
 224                 return 4;
 225         case NID_sect193r2: /* sect193r2 (5) */
 226                 return 5;
 227         case NID_sect233k1: /* sect233k1 (6) */
 228                 return 6;
 229         case NID_sect233r1: /* sect233r1 (7) */
 230                 return 7;
 231         case NID_sect239k1: /* sect239k1 (8) */
 232                 return 8;
 233         case NID_sect283k1: /* sect283k1 (9) */
 234                 return 9;
 235         case NID_sect283r1: /* sect283r1 (10) */
 236                 return 10;
 237         case NID_sect409k1: /* sect409k1 (11) */
 238                 return 11;
 239         case NID_sect409r1: /* sect409r1 (12) */
 240                 return 12;
 241         case NID_sect571k1: /* sect571k1 (13) */
 242                 return 13;
 243         case NID_sect571r1: /* sect571r1 (14) */
 244                 return 14;
 245         case NID_secp160k1: /* secp160k1 (15) */
 246                 return 15;
 247         case NID_secp160r1: /* secp160r1 (16) */
 248                 return 16;
 249         case NID_secp160r2: /* secp160r2 (17) */
 250                 return 17;
 251         case NID_secp192k1: /* secp192k1 (18) */
 252                 return 18;
 253         case NID_X9_62_prime192v1: /* secp192r1 (19) */
 254                 return 19;
 255         case NID_secp224k1: /* secp224k1 (20) */
 256                 return 20;
 257         case NID_secp224r1: /* secp224r1 (21) */
 258                 return 21;
 259         case NID_secp256k1: /* secp256k1 (22) */
 260                 return 22;
 261         case NID_X9_62_prime256v1: /* secp256r1 (23) */
 262                 return 23;
 263         case NID_secp384r1: /* secp384r1 (24) */
 264                 return 24;
 265         case NID_secp521r1:  /* secp521r1 (25) */
 266                 return 25;
 267         default:
 268                 return 0;
 269                 }
 270         }
 271 #endif /* OPENSSL_NO_EC */
 272
 273 #ifndef OPENSSL_NO_TLSEXT
 274
 275 /* List of supported signature algorithms and hashes. Should make this
 276  * customisable at some point, for now include everything we support.
 277  */
 278
 279 #ifdef OPENSSL_NO_RSA
 280 #define tlsext_sigalg_rsa(md) /* */
 281 #else
 282 #define tlsext_sigalg_rsa(md) md, TLSEXT_signature_rsa,
 283 #endif
 284
 285 #ifdef OPENSSL_NO_DSA
 286 #define tlsext_sigalg_dsa(md) /* */
 287 #else
 288 #define tlsext_sigalg_dsa(md) md, TLSEXT_signature_dsa,
 289 #endif
 290
 291 #ifdef OPENSSL_NO_ECDSA
 292 #define tlsext_sigalg_ecdsa(md) /* */
 293 #else
 294 #define tlsext_sigalg_ecdsa(md) md, TLSEXT_signature_dsa,
 295 #endif
 296
 297 #define tlsext_sigalg(md) \
 298                 tlsext_sigalg_rsa(md) \
 299                 tlsext_sigalg_dsa(md) \
 300                 tlsext_sigalg_ecdsa(md)
 301
 302 static unsigned char tls12_sigalgs[] = {
 303 #ifndef OPENSSL_NO_SHA512
 304         tlsext_sigalg(TLSEXT_hash_sha512)
 305         tlsext_sigalg(TLSEXT_hash_sha384)
 306 #endif
 307 #ifndef OPENSSL_NO_SHA256
 308         tlsext_sigalg(TLSEXT_hash_sha256)
 309         tlsext_sigalg(TLSEXT_hash_sha224)
 310 #endif
 311 #ifndef OPENSSL_NO_SHA
 312         tlsext_sigalg(TLSEXT_hash_sha1)
 313 #endif
 314 #ifndef OPENSSL_NO_MD5
 315         tlsext_sigalg_rsa(TLSEXT_hash_md5)
 316 #endif
 317 };
 318
 319
 320
 321 unsigned char *ssl_add_clienthello_tlsext(SSL *s, unsigned char *p, unsigned char *limit)
 322         {
 323         int extdatalen=0;
 324         unsigned char *ret = p;
 325
 326         /* don't add extensions for SSLv3 unless doing secure renegotiation */
 327         if (s->client_version == SSL3_VERSION
 328                                         && !s->s3->send_connection_binding)
 329                 return p;
 330
 331         ret+=2;
 332
 333         if (ret>=limit) return NULL; /* this really never occurs, but ... */
 334
 335         if (s->tlsext_hostname != NULL)
 336                 {
 337                 /* Add TLS extension servername to the Client Hello message */
 338                 unsigned long size_str;
 339                 long lenmax;
 340
 341                 /* check for enough space.
 342                    4 for the servername type and entension length
 343                    2 for servernamelist length
 344                    1 for the hostname type
 345                    2 for hostname length
 346                    + hostname length
 347                 */
 348
 349                 if ((lenmax = limit - ret - 9) < 0
 350                     || (size_str = strlen(s->tlsext_hostname)) > (unsigned long)lenmax)
 351                         return NULL;
 352
 353                 /* extension type and length */
 354                 s2n(TLSEXT_TYPE_server_name,ret);
 355                 s2n(size_str+5,ret);
 356
 357                 /* length of servername list */
 358                 s2n(size_str+3,ret);
 359
 360                 /* hostname type, length and hostname */
 361                 *(ret++) = (unsigned char) TLSEXT_NAMETYPE_host_name;
 362                 s2n(size_str,ret);
 363                 memcpy(ret, s->tlsext_hostname, size_str);
 364                 ret+=size_str;
 365                 }
 366
 367         /* Add RI if renegotiating */
 368         if (s->renegotiate)
 369           {
 370           int el;
 371
 372           if(!ssl_add_clienthello_renegotiate_ext(s, 0, &el, 0))
 373               {
 374               SSLerr(SSL_F_SSL_ADD_CLIENTHELLO_TLSEXT, ERR_R_INTERNAL_ERROR);
 375               return NULL;
 376               }
 377
 378           if((limit - p - 4 - el) < 0) return NULL;
 379
 380           s2n(TLSEXT_TYPE_renegotiate,ret);
 381           s2n(el,ret);
 382
 383           if(!ssl_add_clienthello_renegotiate_ext(s, ret, &el, el))
 384               {
 385               SSLerr(SSL_F_SSL_ADD_CLIENTHELLO_TLSEXT, ERR_R_INTERNAL_ERROR);
 386               return NULL;
 387               }
 388
 389           ret += el;
 390         }
 391
 392 #ifndef OPENSSL_NO_SRP
 393 #define MIN(x,y) (((x)<(y))?(x):(y))
 394         /* we add SRP username the first time only if we have one! */
 395         if (s->srp_ctx.login != NULL)
 396                 {/* Add TLS extension SRP username to the Client Hello message */
 397                 int login_len = MIN(strlen(s->srp_ctx.login) + 1, 255);
 398                 long lenmax;
 399
 400                 if ((lenmax = limit - ret - 5) < 0) return NULL;
 401                 if (login_len > lenmax) return NULL;
 402                 if (login_len > 255)
 403                         {
 404                         SSLerr(SSL_F_SSL_ADD_CLIENTHELLO_TLSEXT, ERR_R_INTERNAL_ERROR);
 405                         return NULL;
 406                         }
 407                 s2n(TLSEXT_TYPE_srp,ret);
 408                 s2n(login_len+1,ret);
 409
 410                 (*ret++) = (unsigned char) MIN(strlen(s->srp_ctx.login), 254);
 411                 memcpy(ret, s->srp_ctx.login, MIN(strlen(s->srp_ctx.login), 254));
 412                 ret+=login_len;
 413                 }
 414 #endif
 415
 416 #ifndef OPENSSL_NO_EC
 417         if (s->tlsext_ecpointformatlist != NULL &&
 418             s->version != DTLS1_VERSION)
 419                 {
 420                 /* Add TLS extension ECPointFormats to the ClientHello message */
 421                 long lenmax;
 422
 423                 if ((lenmax = limit - ret - 5) < 0) return NULL;
 424                 if (s->tlsext_ecpointformatlist_length > (unsigned long)lenmax) return NULL;
 425                 if (s->tlsext_ecpointformatlist_length > 255)
 426                         {
 427                         SSLerr(SSL_F_SSL_ADD_CLIENTHELLO_TLSEXT, ERR_R_INTERNAL_ERROR);
 428                         return NULL;
 429                         }
 430
 431                 s2n(TLSEXT_TYPE_ec_point_formats,ret);
 432                 s2n(s->tlsext_ecpointformatlist_length + 1,ret);
 433                 *(ret++) = (unsigned char) s->tlsext_ecpointformatlist_length;
 434                 memcpy(ret, s->tlsext_ecpointformatlist, s->tlsext_ecpointformatlist_length);
 435                 ret+=s->tlsext_ecpointformatlist_length;
 436                 }
 437         if (s->tlsext_ellipticcurvelist != NULL &&
 438             s->version != DTLS1_VERSION)
 439                 {
 440                 /* Add TLS extension EllipticCurves to the ClientHello message */
 441                 long lenmax;
 442
 443                 if ((lenmax = limit - ret - 6) < 0) return NULL;
 444                 if (s->tlsext_ellipticcurvelist_length > (unsigned long)lenmax) return NULL;
 445                 if (s->tlsext_ellipticcurvelist_length > 65532)
 446                         {
 447                         SSLerr(SSL_F_SSL_ADD_CLIENTHELLO_TLSEXT, ERR_R_INTERNAL_ERROR);
 448                         return NULL;
 449                         }
 450
 451                 s2n(TLSEXT_TYPE_elliptic_curves,ret);
 452                 s2n(s->tlsext_ellipticcurvelist_length + 2, ret);
 453
 454                 /* NB: draft-ietf-tls-ecc-12.txt uses a one-byte prefix for
 455                  * elliptic_curve_list, but the examples use two bytes.
 456                  * http://www1.ietf.org/mail-archive/web/tls/current/msg00538.html
 457                  * resolves this to two bytes.
 458                  */
 459                 s2n(s->tlsext_ellipticcurvelist_length, ret);
 460                 memcpy(ret, s->tlsext_ellipticcurvelist, s->tlsext_ellipticcurvelist_length);
 461                 ret+=s->tlsext_ellipticcurvelist_length;
 462                 }
 463 #endif /* OPENSSL_NO_EC */
 464
 465         if (!(SSL_get_options(s) & SSL_OP_NO_TICKET))
 466                 {
 467                 int ticklen;
 468                 if (!s->new_session && s->session && s->session->tlsext_tick)
 469                         ticklen = s->session->tlsext_ticklen;
 470                 else if (s->session && s->tlsext_session_ticket &&
 471                          s->tlsext_session_ticket->data)
 472                         {
 473                         ticklen = s->tlsext_session_ticket->length;
 474                         s->session->tlsext_tick = OPENSSL_malloc(ticklen);
 475                         if (!s->session->tlsext_tick)
 476                                 return NULL;
 477                         memcpy(s->session->tlsext_tick,
 478                                s->tlsext_session_ticket->data,
 479                                ticklen);
 480                         s->session->tlsext_ticklen = ticklen;
 481                         }
 482                 else
 483                         ticklen = 0;
 484                 if (ticklen == 0 && s->tlsext_session_ticket &&
 485                     s->tlsext_session_ticket->data == NULL)
 486                         goto skip_ext;
 487                 /* Check for enough room 2 for extension type, 2 for len
 488                  * rest for ticket
 489                  */
 490                 if ((long)(limit - ret - 4 - ticklen) < 0) return NULL;
 491                 s2n(TLSEXT_TYPE_session_ticket,ret);
 492                 s2n(ticklen,ret);
 493                 if (ticklen)
 494                         {
 495                         memcpy(ret, s->session->tlsext_tick, ticklen);
 496                         ret += ticklen;
 497                         }
 498                 }
 499                 skip_ext:
 500
 501         if (s->version >= TLS1_2_VERSION)
 502                 {
 503                 if ((size_t)(limit - ret) < sizeof(tls12_sigalgs) + 6)
 504                         return NULL;
 505                 s2n(TLSEXT_TYPE_signature_algorithms,ret);
 506                 s2n(sizeof(tls12_sigalgs) + 2, ret);
 507                 s2n(sizeof(tls12_sigalgs), ret);
 508                 memcpy(ret, tls12_sigalgs, sizeof(tls12_sigalgs));
 509                 ret += sizeof(tls12_sigalgs);
 510                 }
 511
 512 #ifdef TLSEXT_TYPE_opaque_prf_input
 513         if (s->s3->client_opaque_prf_input != NULL &&
 514             s->version != DTLS1_VERSION)
 515                 {
 516                 size_t col = s->s3->client_opaque_prf_input_len;
 517
 518                 if ((long)(limit - ret - 6 - col < 0))
 519                         return NULL;
 520                 if (col > 0xFFFD) /* can't happen */
 521                         return NULL;
 522
 523                 s2n(TLSEXT_TYPE_opaque_prf_input, ret);
 524                 s2n(col + 2, ret);
 525                 s2n(col, ret);
 526                 memcpy(ret, s->s3->client_opaque_prf_input, col);
 527                 ret += col;
 528                 }
 529 #endif
 530
 531         if (s->tlsext_status_type == TLSEXT_STATUSTYPE_ocsp &&
 532             s->version != DTLS1_VERSION)
 533                 {
 534                 int i;
 535                 long extlen, idlen, itmp;
 536                 OCSP_RESPID *id;
 537
 538                 idlen = 0;
 539                 for (i = 0; i < sk_OCSP_RESPID_num(s->tlsext_ocsp_ids); i++)
 540                         {
 541                         id = sk_OCSP_RESPID_value(s->tlsext_ocsp_ids, i);
 542                         itmp = i2d_OCSP_RESPID(id, NULL);
 543                         if (itmp <= 0)
 544                                 return NULL;
 545                         idlen += itmp + 2;
 546                         }
 547
 548                 if (s->tlsext_ocsp_exts)
 549                         {
 550                         extlen = i2d_X509_EXTENSIONS(s->tlsext_ocsp_exts, NULL);
 551                         if (extlen < 0)
 552                                 return NULL;
 553                         }
 554                 else
 555                         extlen = 0;
 556
 557                 if ((long)(limit - ret - 7 - extlen - idlen) < 0) return NULL;
 558                 s2n(TLSEXT_TYPE_status_request, ret);
 559                 if (extlen + idlen > 0xFFF0)
 560                         return NULL;
 561                 s2n(extlen + idlen + 5, ret);
 562                 *(ret++) = TLSEXT_STATUSTYPE_ocsp;
 563                 s2n(idlen, ret);
 564                 for (i = 0; i < sk_OCSP_RESPID_num(s->tlsext_ocsp_ids); i++)
 565                         {
 566                         /* save position of id len */
 567                         unsigned char *q = ret;
 568                         id = sk_OCSP_RESPID_value(s->tlsext_ocsp_ids, i);
 569                         /* skip over id len */
 570                         ret += 2;
 571                         itmp = i2d_OCSP_RESPID(id, &ret);
 572                         /* write id len */
 573                         s2n(itmp, q);
 574                         }
 575                 s2n(extlen, ret);
 576                 if (extlen > 0)
 577                         i2d_X509_EXTENSIONS(s->tlsext_ocsp_exts, &ret);
 578                 }
 579
 580 #ifndef OPENSSL_NO_NEXTPROTONEG
 581         if (s->ctx->next_proto_select_cb && !s->s3->tmp.finish_md_len)
 582                 {
 583                 /* The client advertises an emtpy extension to indicate its
 584                  * support for Next Protocol Negotiation */
 585                 if (limit - ret - 4 < 0)
 586                         return NULL;
 587                 s2n(TLSEXT_TYPE_next_proto_neg,ret);
 588                 s2n(0,ret);
 589                 }
 590 #endif
 591
 592         if ((extdatalen = ret-p-2)== 0)
 593                 return p;
 594
 595         s2n(extdatalen,p);
 596         return ret;
 597         }
 598
 599 unsigned char *ssl_add_serverhello_tlsext(SSL *s, unsigned char *p, unsigned char *limit)
 600         {
 601         int extdatalen=0;
 602         unsigned char *ret = p;
 603 #ifndef OPENSSL_NO_NEXTPROTONEG
 604         int next_proto_neg_seen;
 605 #endif
 606
 607         /* don't add extensions for SSLv3, unless doing secure renegotiation */
 608         if (s->version == SSL3_VERSION && !s->s3->send_connection_binding)
 609                 return p;
 610
 611         ret+=2;
 612         if (ret>=limit) return NULL; /* this really never occurs, but ... */
 613
 614         if (!s->hit && s->servername_done == 1 && s->session->tlsext_hostname != NULL)
 615                 {
 616                 if ((long)(limit - ret - 4) < 0) return NULL;
 617
 618                 s2n(TLSEXT_TYPE_server_name,ret);
 619                 s2n(0,ret);
 620                 }
 621
 622         if(s->s3->send_connection_binding)
 623         {
 624           int el;
 625
 626           if(!ssl_add_serverhello_renegotiate_ext(s, 0, &el, 0))
 627               {
 628               SSLerr(SSL_F_SSL_ADD_SERVERHELLO_TLSEXT, ERR_R_INTERNAL_ERROR);
 629               return NULL;
 630               }
 631
 632           if((limit - p - 4 - el) < 0) return NULL;
 633
 634           s2n(TLSEXT_TYPE_renegotiate,ret);
 635           s2n(el,ret);
 636
 637           if(!ssl_add_serverhello_renegotiate_ext(s, ret, &el, el))
 638               {
 639               SSLerr(SSL_F_SSL_ADD_SERVERHELLO_TLSEXT, ERR_R_INTERNAL_ERROR);
 640               return NULL;
 641               }
 642
 643           ret += el;
 644         }
 645
 646 #ifndef OPENSSL_NO_EC
 647         if (s->tlsext_ecpointformatlist != NULL &&
 648             s->version != DTLS1_VERSION)
 649                 {
 650                 /* Add TLS extension ECPointFormats to the ServerHello message */
 651                 long lenmax;
 652
 653                 if ((lenmax = limit - ret - 5) < 0) return NULL;
 654                 if (s->tlsext_ecpointformatlist_length > (unsigned long)lenmax) return NULL;
 655                 if (s->tlsext_ecpointformatlist_length > 255)
 656                         {
 657                         SSLerr(SSL_F_SSL_ADD_SERVERHELLO_TLSEXT, ERR_R_INTERNAL_ERROR);
 658                         return NULL;
 659                         }
 660
 661                 s2n(TLSEXT_TYPE_ec_point_formats,ret);
 662                 s2n(s->tlsext_ecpointformatlist_length + 1,ret);
 663                 *(ret++) = (unsigned char) s->tlsext_ecpointformatlist_length;
 664                 memcpy(ret, s->tlsext_ecpointformatlist, s->tlsext_ecpointformatlist_length);
 665                 ret+=s->tlsext_ecpointformatlist_length;
 666
 667                 }
 668         /* Currently the server should not respond with a SupportedCurves extension */
 669 #endif /* OPENSSL_NO_EC */
 670
 671         if (s->tlsext_ticket_expected
 672                 && !(SSL_get_options(s) & SSL_OP_NO_TICKET))
 673                 {
 674                 if ((long)(limit - ret - 4) < 0) return NULL;
 675                 s2n(TLSEXT_TYPE_session_ticket,ret);
 676                 s2n(0,ret);
 677                 }
 678
 679         if (s->tlsext_status_expected)
 680                 {
 681                 if ((long)(limit - ret - 4) < 0) return NULL;
 682                 s2n(TLSEXT_TYPE_status_request,ret);
 683                 s2n(0,ret);
 684                 }
 685
 686 #ifdef TLSEXT_TYPE_opaque_prf_input
 687         if (s->s3->server_opaque_prf_input != NULL &&
 688             s->version != DTLS1_VERSION)
 689                 {
 690                 size_t sol = s->s3->server_opaque_prf_input_len;
 691
 692                 if ((long)(limit - ret - 6 - sol) < 0)
 693                         return NULL;
 694                 if (sol > 0xFFFD) /* can't happen */
 695                         return NULL;
 696
 697                 s2n(TLSEXT_TYPE_opaque_prf_input, ret);
 698                 s2n(sol + 2, ret);
 699                 s2n(sol, ret);
 700                 memcpy(ret, s->s3->server_opaque_prf_input, sol);
 701                 ret += sol;
 702                 }
 703 #endif
 704         if (((s->s3->tmp.new_cipher->id & 0xFFFF)==0x80 || (s->s3->tmp.new_cipher->id & 0xFFFF)==0x81)
 705                 && (SSL_get_options(s) & SSL_OP_CRYPTOPRO_TLSEXT_BUG))
 706                 { const unsigned char cryptopro_ext[36] = {
 707                         0xfd, 0xe8, /*65000*/
 708                         0x00, 0x20, /*32 bytes length*/
 709                         0x30, 0x1e, 0x30, 0x08, 0x06, 0x06, 0x2a, 0x85,
 710                         0x03,   0x02, 0x02, 0x09, 0x30, 0x08, 0x06, 0x06,
 711                         0x2a, 0x85, 0x03, 0x02, 0x02, 0x16, 0x30, 0x08,
 712                         0x06, 0x06, 0x2a, 0x85, 0x03, 0x02, 0x02, 0x17};
 713                         if (limit-ret<36) return NULL;
 714                         memcpy(ret,cryptopro_ext,36);
 715                         ret+=36;
 716
 717                 }
 718
 719 #ifndef OPENSSL_NO_NEXTPROTONEG
 720         next_proto_neg_seen = s->s3->next_proto_neg_seen;
 721         s->s3->next_proto_neg_seen = 0;
 722         if (next_proto_neg_seen && s->ctx->next_protos_advertised_cb)
 723                 {
 724                 const unsigned char *npa;
 725                 unsigned int npalen;
 726                 int r;
 727
 728                 r = s->ctx->next_protos_advertised_cb(s, &npa, &npalen, s->ctx->next_protos_advertised_cb_arg);
 729                 if (r == SSL_TLSEXT_ERR_OK)
 730                         {
 731                         if ((long)(limit - ret - 4 - npalen) < 0) return NULL;
 732                         s2n(TLSEXT_TYPE_next_proto_neg,ret);
 733                         s2n(npalen,ret);
 734                         memcpy(ret, npa, npalen);
 735                         ret += npalen;
 736                         s->s3->next_proto_neg_seen = 1;
 737                         }
 738                 }
 739 #endif
 740
 741         if ((extdatalen = ret-p-2)== 0)
 742                 return p;
 743
 744         s2n(extdatalen,p);
 745         return ret;
 746         }
 747
 748 int ssl_parse_clienthello_tlsext(SSL *s, unsigned char **p, unsigned char *d, int n, int *al)
 749         {
 750         unsigned short type;
 751         unsigned short size;
 752         unsigned short len;
 753         unsigned char *data = *p;
 754         int renegotiate_seen = 0;
 755         int sigalg_seen = 0;
 756
 757         s->servername_done = 0;
 758         s->tlsext_status_type = -1;
 759
 760         if (data >= (d+n-2))
 761                 goto ri_check;
 762         n2s(data,len);
 763
 764         if (data > (d+n-len))
 765                 goto ri_check;
 766
 767         while (data <= (d+n-4))
 768                 {
 769                 n2s(data,type);
 770                 n2s(data,size);
 771
 772                 if (data+size > (d+n))
 773                         goto ri_check;
 774 #if 0
 775                 fprintf(stderr,"Received extension type %d size %d\n",type,size);
 776 #endif
 777                 if (s->tlsext_debug_cb)
 778                         s->tlsext_debug_cb(s, 0, type, data, size,
 779                                                 s->tlsext_debug_arg);
 780 /* The servername extension is treated as follows:
 781
 782    - Only the hostname type is supported with a maximum length of 255.
 783    - The servername is rejected if too long or if it contains zeros,
 784      in which case an fatal alert is generated.
 785    - The servername field is maintained together with the session cache.
 786    - When a session is resumed, the servername call back invoked in order
 787      to allow the application to position itself to the right context.
 788    - The servername is acknowledged if it is new for a session or when
 789      it is identical to a previously used for the same session.
 790      Applications can control the behaviour.  They can at any time
 791      set a 'desirable' servername for a new SSL object. This can be the
 792      case for example with HTTPS when a Host: header field is received and
 793      a renegotiation is requested. In this case, a possible servername
 794      presented in the new client hello is only acknowledged if it matches
 795      the value of the Host: field.
 796    - Applications must  use SSL_OP_NO_SESSION_RESUMPTION_ON_RENEGOTIATION
 797      if they provide for changing an explicit servername context for the session,
 798      i.e. when the session has been established with a servername extension.
 799    - On session reconnect, the servername extension may be absent.
 800
 801 */
 802
 803                 if (type == TLSEXT_TYPE_server_name)
 804                         {
 805                         unsigned char *sdata;
 806                         int servname_type;
 807                         int dsize;
 808
 809                         if (size < 2)
 810                                 {
 811                                 *al = SSL_AD_DECODE_ERROR;
 812                                 return 0;
 813                                 }
 814                         n2s(data,dsize);
 815                         size -= 2;
 816                         if (dsize > size  )
 817                                 {
 818                                 *al = SSL_AD_DECODE_ERROR;
 819                                 return 0;
 820                                 }
 821
 822                         sdata = data;
 823                         while (dsize > 3)
 824                                 {
 825                                 servname_type = *(sdata++);
 826                                 n2s(sdata,len);
 827                                 dsize -= 3;
 828
 829                                 if (len > dsize)
 830                                         {
 831                                         *al = SSL_AD_DECODE_ERROR;
 832                                         return 0;
 833                                         }
 834                                 if (s->servername_done == 0)
 835                                 switch (servname_type)
 836                                         {
 837                                 case TLSEXT_NAMETYPE_host_name:
 838                                         if (!s->hit)
 839                                                 {
 840                                                 if(s->session->tlsext_hostname)
 841                                                         {
 842                                                         *al = SSL_AD_DECODE_ERROR;
 843                                                         return 0;
 844                                                         }
 845                                                 if (len > TLSEXT_MAXLEN_host_name)
 846                                                         {
 847                                                         *al = TLS1_AD_UNRECOGNIZED_NAME;
 848                                                         return 0;
 849                                                         }
 850                                                 if ((s->session->tlsext_hostname = OPENSSL_malloc(len+1)) == NULL)
 851                                                         {
 852                                                         *al = TLS1_AD_INTERNAL_ERROR;
 853                                                         return 0;
 854                                                         }
 855                                                 memcpy(s->session->tlsext_hostname, sdata, len);
 856                                                 s->session->tlsext_hostname[len]='\0';
 857                                                 if (strlen(s->session->tlsext_hostname) != len) {
 858                                                         OPENSSL_free(s->session->tlsext_hostname);
 859                                                         s->session->tlsext_hostname = NULL;
 860                                                         *al = TLS1_AD_UNRECOGNIZED_NAME;
 861                                                         return 0;
 862                                                 }
 863                                                 s->servername_done = 1;
 864
 865                                                 }
 866                                         else
 867                                                 s->servername_done = s->session->tlsext_hostname
 868                                                         && strlen(s->session->tlsext_hostname) == len
 869                                                         && strncmp(s->session->tlsext_hostname, (char *)sdata, len) == 0;
 870
 871                                         break;
 872
 873                                 default:
 874                                         break;
 875                                         }
 876
 877                                 dsize -= len;
 878                                 }
 879                         if (dsize != 0)
 880                                 {
 881                                 *al = SSL_AD_DECODE_ERROR;
 882                                 return 0;
 883                                 }
 884
 885                         }
 886 #ifndef OPENSSL_NO_SRP
 887                 else if (type == TLSEXT_TYPE_srp)
 888                         {
 889                         if (size > 0)
 890                                 {
 891                                 len = data[0];
 892                                 if ((s->srp_ctx.login = OPENSSL_malloc(len+1)) == NULL)
 893                                         return -1;
 894                                 memcpy(s->srp_ctx.login, &data[1], len);
 895                                 s->srp_ctx.login[len]='\0';
 896                                 }
 897                         }
 898 #endif
 899
 900 #ifndef OPENSSL_NO_EC
 901                 else if (type == TLSEXT_TYPE_ec_point_formats &&
 902                      s->version != DTLS1_VERSION)
 903                         {
 904                         unsigned char *sdata = data;
 905                         int ecpointformatlist_length = *(sdata++);
 906
 907                         if (ecpointformatlist_length != size - 1)
 908                                 {
 909                                 *al = TLS1_AD_DECODE_ERROR;
 910                                 return 0;
 911                                 }
 912                         if (!s->hit)
 913                                 {
 914                                 if(s->session->tlsext_ecpointformatlist)
 915                                         {
 916                                         OPENSSL_free(s->session->tlsext_ecpointformatlist);
 917                                         s->session->tlsext_ecpointformatlist = NULL;
 918                                         }
 919                                 s->session->tlsext_ecpointformatlist_length = 0;
 920                                 if ((s->session->tlsext_ecpointformatlist = OPENSSL_malloc(ecpointformatlist_length)) == NULL)
 921                                         {
 922                                         *al = TLS1_AD_INTERNAL_ERROR;
 923                                         return 0;
 924                                         }
 925                                 s->session->tlsext_ecpointformatlist_length = ecpointformatlist_length;
 926                                 memcpy(s->session->tlsext_ecpointformatlist, sdata, ecpointformatlist_length);
 927                                 }
 928 #if 0
 929                         fprintf(stderr,"ssl_parse_clienthello_tlsext s->session->tlsext_ecpointformatlist (length=%i) ", s->session->tlsext_ecpointformatlist_length);
 930                         sdata = s->session->tlsext_ecpointformatlist;
 931                         for (i = 0; i < s->session->tlsext_ecpointformatlist_length; i++)
 932                                 fprintf(stderr,"%i ",*(sdata++));
 933                         fprintf(stderr,"\n");
 934 #endif
 935                         }
 936                 else if (type == TLSEXT_TYPE_elliptic_curves &&
 937                      s->version != DTLS1_VERSION)
 938                         {
 939                         unsigned char *sdata = data;
 940                         int ellipticcurvelist_length = (*(sdata++) << 8);
 941                         ellipticcurvelist_length += (*(sdata++));
 942
 943                         if (ellipticcurvelist_length != size - 2)
 944                                 {
 945                                 *al = TLS1_AD_DECODE_ERROR;
 946                                 return 0;
 947                                 }
 948                         if (!s->hit)
 949                                 {
 950                                 if(s->session->tlsext_ellipticcurvelist)
 951                                         {
 952                                         *al = TLS1_AD_DECODE_ERROR;
 953                                         return 0;
 954                                         }
 955                                 s->session->tlsext_ellipticcurvelist_length = 0;
 956                                 if ((s->session->tlsext_ellipticcurvelist = OPENSSL_malloc(ellipticcurvelist_length)) == NULL)
 957                                         {
 958                                         *al = TLS1_AD_INTERNAL_ERROR;
 959                                         return 0;
 960                                         }
 961                                 s->session->tlsext_ellipticcurvelist_length = ellipticcurvelist_length;
 962                                 memcpy(s->session->tlsext_ellipticcurvelist, sdata, ellipticcurvelist_length);
 963                                 }
 964 #if 0
 965                         fprintf(stderr,"ssl_parse_clienthello_tlsext s->session->tlsext_ellipticcurvelist (length=%i) ", s->session->tlsext_ellipticcurvelist_length);
 966                         sdata = s->session->tlsext_ellipticcurvelist;
 967                         for (i = 0; i < s->session->tlsext_ellipticcurvelist_length; i++)
 968                                 fprintf(stderr,"%i ",*(sdata++));
 969                         fprintf(stderr,"\n");
 970 #endif
 971                         }
 972 #endif /* OPENSSL_NO_EC */
 973 #ifdef TLSEXT_TYPE_opaque_prf_input
 974                 else if (type == TLSEXT_TYPE_opaque_prf_input &&
 975                      s->version != DTLS1_VERSION)
 976                         {
 977                         unsigned char *sdata = data;
 978
 979                         if (size < 2)
 980                                 {
 981                                 *al = SSL_AD_DECODE_ERROR;
 982                                 return 0;
 983                                 }
 984                         n2s(sdata, s->s3->client_opaque_prf_input_len);
 985                         if (s->s3->client_opaque_prf_input_len != size - 2)
 986                                 {
 987                                 *al = SSL_AD_DECODE_ERROR;
 988                                 return 0;
 989                                 }
 990
 991                         if (s->s3->client_opaque_prf_input != NULL) /* shouldn't really happen */
 992                                 OPENSSL_free(s->s3->client_opaque_prf_input);
 993                         if (s->s3->client_opaque_prf_input_len == 0)
 994                                 s->s3->client_opaque_prf_input = OPENSSL_malloc(1); /* dummy byte just to get non-NULL */
 995                         else
 996                                 s->s3->client_opaque_prf_input = BUF_memdup(sdata, s->s3->client_opaque_prf_input_len);
 997                         if (s->s3->client_opaque_prf_input == NULL)
 998                                 {
 999                                 *al = TLS1_AD_INTERNAL_ERROR;
1000                                 return 0;
1001                                 }
1002                         }
1003 #endif
1004                 else if (type == TLSEXT_TYPE_session_ticket)
1005                         {
1006                         if (s->tls_session_ticket_ext_cb &&
1007                             !s->tls_session_ticket_ext_cb(s, data, size, s->tls_session_ticket_ext_cb_arg))
1008                                 {
1009                                 *al = TLS1_AD_INTERNAL_ERROR;
1010                                 return 0;
1011                                 }
1012                         }
1013                 else if (type == TLSEXT_TYPE_renegotiate)
1014                         {
1015                         if(!ssl_parse_clienthello_renegotiate_ext(s, data, size, al))
1016                                 return 0;
1017                         renegotiate_seen = 1;
1018                         }
1019                 else if (type == TLSEXT_TYPE_signature_algorithms)
1020                         {
1021                         int dsize;
1022                         if (sigalg_seen || size < 2)
1023                                 {
1024                                 *al = SSL_AD_DECODE_ERROR;
1025                                 return 0;
1026                                 }
1027                         sigalg_seen = 1;
1028                         n2s(data,dsize);
1029                         size -= 2;
1030                         if (dsize != size || dsize & 1)
1031                                 {
1032                                 *al = SSL_AD_DECODE_ERROR;
1033                                 return 0;
1034                                 }
1035                         if (!tls1_process_sigalgs(s, data, dsize))
1036                                 {
1037                                 *al = SSL_AD_DECODE_ERROR;
1038                                 return 0;
1039                                 }
1040                         }
1041                 else if (type == TLSEXT_TYPE_status_request &&
1042                          s->version != DTLS1_VERSION && s->ctx->tlsext_status_cb)
1043                         {
1044
1045                         if (size < 5)
1046                                 {
1047                                 *al = SSL_AD_DECODE_ERROR;
1048                                 return 0;
1049                                 }
1050
1051                         s->tlsext_status_type = *data++;
1052                         size--;
1053                         if (s->tlsext_status_type == TLSEXT_STATUSTYPE_ocsp)
1054                                 {
1055                                 const unsigned char *sdata;
1056                                 int dsize;
1057                                 /* Read in responder_id_list */
1058                                 n2s(data,dsize);
1059                                 size -= 2;
1060                                 if (dsize > size  )
1061                                         {
1062                                         *al = SSL_AD_DECODE_ERROR;
1063                                         return 0;
1064                                         }
1065                                 while (dsize > 0)
1066                                         {
1067                                         OCSP_RESPID *id;
1068                                         int idsize;
1069                                         if (dsize < 4)
1070                                                 {
1071                                                 *al = SSL_AD_DECODE_ERROR;
1072                                                 return 0;
1073                                                 }
1074                                         n2s(data, idsize);
1075                                         dsize -= 2 + idsize;
1076                                         size -= 2 + idsize;
1077                                         if (dsize < 0)
1078                                                 {
1079                                                 *al = SSL_AD_DECODE_ERROR;
1080                                                 return 0;
1081                                                 }
1082                                         sdata = data;
1083                                         data += idsize;
1084                                         id = d2i_OCSP_RESPID(NULL,
1085                                                                 &sdata, idsize);
1086                                         if (!id)
1087                                                 {
1088                                                 *al = SSL_AD_DECODE_ERROR;
1089                                                 return 0;
1090                                                 }
1091                                         if (data != sdata)
1092                                                 {
1093                                                 OCSP_RESPID_free(id);
1094                                                 *al = SSL_AD_DECODE_ERROR;
1095                                                 return 0;
1096                                                 }
1097                                         if (!s->tlsext_ocsp_ids
1098                                                 && !(s->tlsext_ocsp_ids =
1099                                                 sk_OCSP_RESPID_new_null()))
1100                                                 {
1101                                                 OCSP_RESPID_free(id);
1102                                                 *al = SSL_AD_INTERNAL_ERROR;
1103                                                 return 0;
1104                                                 }
1105                                         if (!sk_OCSP_RESPID_push(
1106                                                         s->tlsext_ocsp_ids, id))
1107                                                 {
1108                                                 OCSP_RESPID_free(id);
1109                                                 *al = SSL_AD_INTERNAL_ERROR;
1110                                                 return 0;
1111                                                 }
1112                                         }
1113
1114                                 /* Read in request_extensions */
1115                                 if (size < 2)
1116                                         {
1117                                         *al = SSL_AD_DECODE_ERROR;
1118                                         return 0;
1119                                         }
1120                                 n2s(data,dsize);
1121                                 size -= 2;
1122                                 if (dsize != size)
1123                                         {
1124                                         *al = SSL_AD_DECODE_ERROR;
1125                                         return 0;
1126                                         }
1127                                 sdata = data;
1128                                 if (dsize > 0)
1129                                         {
1130                                         s->tlsext_ocsp_exts =
1131                                                 d2i_X509_EXTENSIONS(NULL,
1132                                                         &sdata, dsize);
1133                                         if (!s->tlsext_ocsp_exts
1134                                                 || (data + dsize != sdata))
1135                                                 {
1136                                                 *al = SSL_AD_DECODE_ERROR;
1137                                                 return 0;
1138                                                 }
1139                                         }
1140                                 }
1141                                 /* We don't know what to do with any other type
1142                                 * so ignore it.
1143                                 */
1144                                 else
1145                                         s->tlsext_status_type = -1;
1146                         }
1147 #ifndef OPENSSL_NO_NEXTPROTONEG
1148                 else if (type == TLSEXT_TYPE_next_proto_neg &&
1149                          s->s3->tmp.finish_md_len == 0)
1150                         {
1151                         /* We shouldn't accept this extension on a
1152                          * renegotiation.
1153                          *
1154                          * s->new_session will be set on renegotiation, but we
1155                          * probably shouldn't rely that it couldn't be set on
1156                          * the initial renegotation too in certain cases (when
1157                          * there's some other reason to disallow resuming an
1158                          * earlier session -- the current code won't be doing
1159                          * anything like that, but this might change).
1160
1161                          * A valid sign that there's been a previous handshake
1162                          * in this connection is if s->s3->tmp.finish_md_len >
1163                          * 0.  (We are talking about a check that will happen
1164                          * in the Hello protocol round, well before a new
1165                          * Finished message could have been computed.) */
1166                         s->s3->next_proto_neg_seen = 1;
1167                         }
1168 #endif
1169
1170                 /* session ticket processed earlier */
1171                 data+=size;
1172                 }
1173
1174         *p = data;
1175
1176         ri_check:
1177
1178         /* Need RI if renegotiating */
1179
1180         if (!renegotiate_seen && s->renegotiate &&
1181                 !(s->options & SSL_OP_ALLOW_UNSAFE_LEGACY_RENEGOTIATION))
1182                 {
1183                 *al = SSL_AD_HANDSHAKE_FAILURE;
1184                 SSLerr(SSL_F_SSL_PARSE_CLIENTHELLO_TLSEXT,
1185                                 SSL_R_UNSAFE_LEGACY_RENEGOTIATION_DISABLED);
1186                 return 0;
1187                 }
1188
1189         return 1;
1190         }
1191
1192 #ifndef OPENSSL_NO_NEXTPROTONEG
1193 /* ssl_next_proto_validate validates a Next Protocol Negotiation block. No
1194  * elements of zero length are allowed and the set of elements must exactly fill
1195  * the length of the block. */
1196 static int ssl_next_proto_validate(unsigned char *d, unsigned len)
1197         {
1198         unsigned int off = 0;
1199
1200         while (off < len)
1201                 {
1202                 if (d[off] == 0)
1203                         return 0;
1204                 off += d[off];
1205                 off++;
1206                 }
1207
1208         return off == len;
1209         }
1210 #endif
1211
1212 int ssl_parse_serverhello_tlsext(SSL *s, unsigned char **p, unsigned char *d, int n, int *al)
1213         {
1214         unsigned short length;
1215         unsigned short type;
1216         unsigned short size;
1217         unsigned char *data = *p;
1218         int tlsext_servername = 0;
1219         int renegotiate_seen = 0;
1220
1221         if (data >= (d+n-2))
1222                 goto ri_check;
1223
1224         n2s(data,length);
1225         if (data+length != d+n)
1226                 {
1227                 *al = SSL_AD_DECODE_ERROR;
1228                 return 0;
1229                 }
1230
1231         while(data <= (d+n-4))
1232                 {
1233                 n2s(data,type);
1234                 n2s(data,size);
1235
1236                 if (data+size > (d+n))
1237                         goto ri_check;
1238
1239                 if (s->tlsext_debug_cb)
1240                         s->tlsext_debug_cb(s, 1, type, data, size,
1241                                                 s->tlsext_debug_arg);
1242
1243                 if (type == TLSEXT_TYPE_server_name)
1244                         {
1245                         if (s->tlsext_hostname == NULL || size > 0)
1246                                 {
1247                                 *al = TLS1_AD_UNRECOGNIZED_NAME;
1248                                 return 0;
1249                                 }
1250                         tlsext_servername = 1;
1251                         }
1252
1253 #ifndef OPENSSL_NO_EC
1254                 else if (type == TLSEXT_TYPE_ec_point_formats &&
1255                      s->version != DTLS1_VERSION)
1256                         {
1257                         unsigned char *sdata = data;
1258                         int ecpointformatlist_length = *(sdata++);
1259
1260                         if (ecpointformatlist_length != size - 1)
1261                                 {
1262                                 *al = TLS1_AD_DECODE_ERROR;
1263                                 return 0;
1264                                 }
1265                         s->session->tlsext_ecpointformatlist_length = 0;
1266                         if (s->session->tlsext_ecpointformatlist != NULL) OPENSSL_free(s->session->tlsext_ecpointformatlist);
1267                         if ((s->session->tlsext_ecpointformatlist = OPENSSL_malloc(ecpointformatlist_length)) == NULL)
1268                                 {
1269                                 *al = TLS1_AD_INTERNAL_ERROR;
1270                                 return 0;
1271                                 }
1272                         s->session->tlsext_ecpointformatlist_length = ecpointformatlist_length;
1273                         memcpy(s->session->tlsext_ecpointformatlist, sdata, ecpointformatlist_length);
1274 #if 0
1275                         fprintf(stderr,"ssl_parse_serverhello_tlsext s->session->tlsext_ecpointformatlist ");
1276                         sdata = s->session->tlsext_ecpointformatlist;
1277                         for (i = 0; i < s->session->tlsext_ecpointformatlist_length; i++)
1278                                 fprintf(stderr,"%i ",*(sdata++));
1279                         fprintf(stderr,"\n");
1280 #endif
1281                         }
1282 #endif /* OPENSSL_NO_EC */
1283
1284                 else if (type == TLSEXT_TYPE_session_ticket)
1285                         {
1286                         if (s->tls_session_ticket_ext_cb &&
1287                             !s->tls_session_ticket_ext_cb(s, data, size, s->tls_session_ticket_ext_cb_arg))
1288                                 {
1289                                 *al = TLS1_AD_INTERNAL_ERROR;
1290                                 return 0;
1291                                 }
1292                         if ((SSL_get_options(s) & SSL_OP_NO_TICKET)
1293                                 || (size > 0))
1294                                 {
1295                                 *al = TLS1_AD_UNSUPPORTED_EXTENSION;
1296                                 return 0;
1297                                 }
1298                         s->tlsext_ticket_expected = 1;
1299                         }
1300 #ifdef TLSEXT_TYPE_opaque_prf_input
1301                 else if (type == TLSEXT_TYPE_opaque_prf_input &&
1302                      s->version != DTLS1_VERSION)
1303                         {
1304                         unsigned char *sdata = data;
1305
1306                         if (size < 2)
1307                                 {
1308                                 *al = SSL_AD_DECODE_ERROR;
1309                                 return 0;
1310                                 }
1311                         n2s(sdata, s->s3->server_opaque_prf_input_len);
1312                         if (s->s3->server_opaque_prf_input_len != size - 2)
1313                                 {
1314                                 *al = SSL_AD_DECODE_ERROR;
1315                                 return 0;
1316                                 }
1317
1318                         if (s->s3->server_opaque_prf_input != NULL) /* shouldn't really happen */
1319                                 OPENSSL_free(s->s3->server_opaque_prf_input);
1320                         if (s->s3->server_opaque_prf_input_len == 0)
1321                                 s->s3->server_opaque_prf_input = OPENSSL_malloc(1); /* dummy byte just to get non-NULL */
1322                         else
1323                                 s->s3->server_opaque_prf_input = BUF_memdup(sdata, s->s3->server_opaque_prf_input_len);
1324
1325                         if (s->s3->server_opaque_prf_input == NULL)
1326                                 {
1327                                 *al = TLS1_AD_INTERNAL_ERROR;
1328                                 return 0;
1329                                 }
1330                         }
1331 #endif
1332                 else if (type == TLSEXT_TYPE_status_request &&
1333                          s->version != DTLS1_VERSION)
1334                         {
1335                         /* MUST be empty and only sent if we've requested
1336                          * a status request message.
1337                          */
1338                         if ((s->tlsext_status_type == -1) || (size > 0))
1339                                 {
1340                                 *al = TLS1_AD_UNSUPPORTED_EXTENSION;
1341                                 return 0;
1342                                 }
1343                         /* Set flag to expect CertificateStatus message */
1344                         s->tlsext_status_expected = 1;
1345                         }
1346 #ifndef OPENSSL_NO_NEXTPROTONEG
1347                 else if (type == TLSEXT_TYPE_next_proto_neg)
1348                         {
1349                         unsigned char *selected;
1350                         unsigned char selected_len;
1351
1352                         /* We must have requested it. */
1353                         if ((s->ctx->next_proto_select_cb == NULL))
1354                                 {
1355                                 *al = TLS1_AD_UNSUPPORTED_EXTENSION;
1356                                 return 0;
1357                                 }
1358                         /* The data must be valid */
1359                         if (!ssl_next_proto_validate(data, size))
1360                                 {
1361                                 *al = TLS1_AD_DECODE_ERROR;
1362                                 return 0;
1363                                 }
1364                         if (s->ctx->next_proto_select_cb(s, &selected, &selected_len, data, size, s->ctx->next_proto_select_cb_arg) != SSL_TLSEXT_ERR_OK)
1365                                 {
1366                                 *al = TLS1_AD_INTERNAL_ERROR;
1367                                 return 0;
1368                                 }
1369                         s->next_proto_negotiated = OPENSSL_malloc(selected_len);
1370                         if (!s->next_proto_negotiated)
1371                                 {
1372                                 *al = TLS1_AD_INTERNAL_ERROR;
1373                                 return 0;
1374                                 }
1375                         memcpy(s->next_proto_negotiated, selected, selected_len);
1376                         s->next_proto_negotiated_len = selected_len;
1377                         }
1378 #endif
1379                 else if (type == TLSEXT_TYPE_renegotiate)
1380                         {
1381                         if(!ssl_parse_serverhello_renegotiate_ext(s, data, size, al))
1382                                 return 0;
1383                         renegotiate_seen = 1;
1384                         }
1385                 data+=size;
1386                 }
1387
1388         if (data != d+n)
1389                 {
1390                 *al = SSL_AD_DECODE_ERROR;
1391                 return 0;
1392                 }
1393
1394         if (!s->hit && tlsext_servername == 1)
1395                 {
1396                 if (s->tlsext_hostname)
1397                         {
1398                         if (s->session->tlsext_hostname == NULL)
1399                                 {
1400                                 s->session->tlsext_hostname = BUF_strdup(s->tlsext_hostname);
1401                                 if (!s->session->tlsext_hostname)
1402                                         {
1403                                         *al = SSL_AD_UNRECOGNIZED_NAME;
1404                                         return 0;
1405                                         }
1406                                 }
1407                         else
1408                                 {
1409                                 *al = SSL_AD_DECODE_ERROR;
1410                                 return 0;
1411                                 }
1412                         }
1413                 }
1414
1415         *p = data;
1416
1417         ri_check:
1418
1419         /* Determine if we need to see RI. Strictly speaking if we want to
1420          * avoid an attack we should *always* see RI even on initial server
1421          * hello because the client doesn't see any renegotiation during an
1422          * attack. However this would mean we could not connect to any server
1423          * which doesn't support RI so for the immediate future tolerate RI
1424          * absence on initial connect only.
1425          */
1426         if (!renegotiate_seen
1427                 && !(s->options & SSL_OP_LEGACY_SERVER_CONNECT)
1428                 && !(s->options & SSL_OP_ALLOW_UNSAFE_LEGACY_RENEGOTIATION))
1429                 {
1430                 *al = SSL_AD_HANDSHAKE_FAILURE;
1431                 SSLerr(SSL_F_SSL_PARSE_SERVERHELLO_TLSEXT,
1432                                 SSL_R_UNSAFE_LEGACY_RENEGOTIATION_DISABLED);
1433                 return 0;
1434                 }
1435
1436         return 1;
1437         }
1438
1439
1440 int ssl_prepare_clienthello_tlsext(SSL *s)
1441         {
1442 #ifndef OPENSSL_NO_EC
1443         /* If we are client and using an elliptic curve cryptography cipher suite, send the point formats
1444          * and elliptic curves we support.
1445          */
1446         int using_ecc = 0;
1447         int i;
1448         unsigned char *j;
1449         unsigned long alg_k, alg_a;
1450         STACK_OF(SSL_CIPHER) *cipher_stack = SSL_get_ciphers(s);
1451
1452         for (i = 0; i < sk_SSL_CIPHER_num(cipher_stack); i++)
1453                 {
1454                 SSL_CIPHER *c = sk_SSL_CIPHER_value(cipher_stack, i);
1455
1456                 alg_k = c->algorithm_mkey;
1457                 alg_a = c->algorithm_auth;
1458                 if ((alg_k & (SSL_kEECDH|SSL_kECDHr|SSL_kECDHe) || (alg_a & SSL_aECDSA)))
1459                         {
1460                         using_ecc = 1;
1461                         break;
1462                         }
1463                 }
1464         using_ecc = using_ecc && (s->version >= TLS1_VERSION);
1465         if (using_ecc)
1466                 {
1467                 if (s->tlsext_ecpointformatlist != NULL) OPENSSL_free(s->tlsext_ecpointformatlist);
1468                 if ((s->tlsext_ecpointformatlist = OPENSSL_malloc(3)) == NULL)
1469                         {
1470                         SSLerr(SSL_F_SSL_PREPARE_CLIENTHELLO_TLSEXT,ERR_R_MALLOC_FAILURE);
1471                         return -1;
1472                         }
1473                 s->tlsext_ecpointformatlist_length = 3;
1474                 s->tlsext_ecpointformatlist[0] = TLSEXT_ECPOINTFORMAT_uncompressed;
1475                 s->tlsext_ecpointformatlist[1] = TLSEXT_ECPOINTFORMAT_ansiX962_compressed_prime;
1476                 s->tlsext_ecpointformatlist[2] = TLSEXT_ECPOINTFORMAT_ansiX962_compressed_char2;
1477
1478                 /* we support all named elliptic curves in draft-ietf-tls-ecc-12 */
1479                 if (s->tlsext_ellipticcurvelist != NULL) OPENSSL_free(s->tlsext_ellipticcurvelist);
1480                 s->tlsext_ellipticcurvelist_length = sizeof(nid_list)/sizeof(nid_list[0]) * 2;
1481                 if ((s->tlsext_ellipticcurvelist = OPENSSL_malloc(s->tlsext_ellipticcurvelist_length)) == NULL)
1482                         {
1483                         s->tlsext_ellipticcurvelist_length = 0;
1484                         SSLerr(SSL_F_SSL_PREPARE_CLIENTHELLO_TLSEXT,ERR_R_MALLOC_FAILURE);
1485                         return -1;
1486                         }
1487                 for (i = 1, j = s->tlsext_ellipticcurvelist; (unsigned int)i <=
1488                                 sizeof(nid_list)/sizeof(nid_list[0]); i++)
1489                         s2n(i,j);
1490                 }
1491 #endif /* OPENSSL_NO_EC */
1492
1493 #ifdef TLSEXT_TYPE_opaque_prf_input
1494         {
1495                 int r = 1;
1496
1497                 if (s->ctx->tlsext_opaque_prf_input_callback != 0)
1498                         {
1499                         r = s->ctx->tlsext_opaque_prf_input_callback(s, NULL, 0, s->ctx->tlsext_opaque_prf_input_callback_arg);
1500                         if (!r)
1501                                 return -1;
1502                         }
1503
1504                 if (s->tlsext_opaque_prf_input != NULL)
1505                         {
1506                         if (s->s3->client_opaque_prf_input != NULL) /* shouldn't really happen */
1507                                 OPENSSL_free(s->s3->client_opaque_prf_input);
1508
1509                         if (s->tlsext_opaque_prf_input_len == 0)
1510                                 s->s3->client_opaque_prf_input = OPENSSL_malloc(1); /* dummy byte just to get non-NULL */
1511                         else
1512                                 s->s3->client_opaque_prf_input = BUF_memdup(s->tlsext_opaque_prf_input, s->tlsext_opaque_prf_input_len);
1513                         if (s->s3->client_opaque_prf_input == NULL)
1514                                 {
1515                                 SSLerr(SSL_F_SSL_PREPARE_CLIENTHELLO_TLSEXT,ERR_R_MALLOC_FAILURE);
1516                                 return -1;
1517                                 }
1518                         s->s3->client_opaque_prf_input_len = s->tlsext_opaque_prf_input_len;
1519                         }
1520
1521                 if (r == 2)
1522                         /* at callback's request, insist on receiving an appropriate server opaque PRF input */
1523                         s->s3->server_opaque_prf_input_len = s->tlsext_opaque_prf_input_len;
1524         }
1525 #endif
1526
1527         return 1;
1528         }
1529
1530 int ssl_prepare_serverhello_tlsext(SSL *s)
1531         {
1532 #ifndef OPENSSL_NO_EC
1533         /* If we are server and using an ECC cipher suite, send the point formats we support
1534          * if the client sent us an ECPointsFormat extension.  Note that the server is not
1535          * supposed to send an EllipticCurves extension.
1536          */
1537
1538         unsigned long alg_k = s->s3->tmp.new_cipher->algorithm_mkey;
1539         unsigned long alg_a = s->s3->tmp.new_cipher->algorithm_auth;
1540         int using_ecc = (alg_k & (SSL_kEECDH|SSL_kECDHr|SSL_kECDHe)) || (alg_a & SSL_aECDSA);
1541         using_ecc = using_ecc && (s->session->tlsext_ecpointformatlist != NULL);
1542
1543         if (using_ecc)
1544                 {
1545                 if (s->tlsext_ecpointformatlist != NULL) OPENSSL_free(s->tlsext_ecpointformatlist);
1546                 if ((s->tlsext_ecpointformatlist = OPENSSL_malloc(3)) == NULL)
1547                         {
1548                         SSLerr(SSL_F_SSL_PREPARE_SERVERHELLO_TLSEXT,ERR_R_MALLOC_FAILURE);
1549                         return -1;
1550                         }
1551                 s->tlsext_ecpointformatlist_length = 3;
1552                 s->tlsext_ecpointformatlist[0] = TLSEXT_ECPOINTFORMAT_uncompressed;
1553                 s->tlsext_ecpointformatlist[1] = TLSEXT_ECPOINTFORMAT_ansiX962_compressed_prime;
1554                 s->tlsext_ecpointformatlist[2] = TLSEXT_ECPOINTFORMAT_ansiX962_compressed_char2;
1555                 }
1556 #endif /* OPENSSL_NO_EC */
1557
1558         return 1;
1559         }
1560
1561 int ssl_check_clienthello_tlsext(SSL *s)
1562         {
1563         int ret=SSL_TLSEXT_ERR_NOACK;
1564         int al = SSL_AD_UNRECOGNIZED_NAME;
1565
1566 #ifndef OPENSSL_NO_EC
1567         /* The handling of the ECPointFormats extension is done elsewhere, namely in
1568          * ssl3_choose_cipher in s3_lib.c.
1569          */
1570         /* The handling of the EllipticCurves extension is done elsewhere, namely in
1571          * ssl3_choose_cipher in s3_lib.c.
1572          */
1573 #endif
1574
1575         if (s->ctx != NULL && s->ctx->tlsext_servername_callback != 0)
1576                 ret = s->ctx->tlsext_servername_callback(s, &al, s->ctx->tlsext_servername_arg);
1577         else if (s->initial_ctx != NULL && s->initial_ctx->tlsext_servername_callback != 0)
1578                 ret = s->initial_ctx->tlsext_servername_callback(s, &al, s->initial_ctx->tlsext_servername_arg);
1579
1580         /* If status request then ask callback what to do.
1581          * Note: this must be called after servername callbacks in case
1582          * the certificate has changed.
1583          */
1584         if ((s->tlsext_status_type != -1) && s->ctx && s->ctx->tlsext_status_cb)
1585                 {
1586                 int r;
1587                 r = s->ctx->tlsext_status_cb(s, s->ctx->tlsext_status_arg);
1588                 switch (r)
1589                         {
1590                         /* We don't want to send a status request response */
1591                         case SSL_TLSEXT_ERR_NOACK:
1592                                 s->tlsext_status_expected = 0;
1593                                 break;
1594                         /* status request response should be sent */
1595                         case SSL_TLSEXT_ERR_OK:
1596                                 if (s->tlsext_ocsp_resp)
1597                                         s->tlsext_status_expected = 1;
1598                                 else
1599                                         s->tlsext_status_expected = 0;
1600                                 break;
1601                         /* something bad happened */
1602                         case SSL_TLSEXT_ERR_ALERT_FATAL:
1603                                 ret = SSL_TLSEXT_ERR_ALERT_FATAL;
1604                                 al = SSL_AD_INTERNAL_ERROR;
1605                                 goto err;
1606                         }
1607                 }
1608         else
1609                 s->tlsext_status_expected = 0;
1610
1611 #ifdef TLSEXT_TYPE_opaque_prf_input
1612         {
1613                 /* This sort of belongs into ssl_prepare_serverhello_tlsext(),
1614                  * but we might be sending an alert in response to the client hello,
1615                  * so this has to happen here in ssl_check_clienthello_tlsext(). */
1616
1617                 int r = 1;
1618
1619                 if (s->ctx->tlsext_opaque_prf_input_callback != 0)
1620                         {
1621                         r = s->ctx->tlsext_opaque_prf_input_callback(s, NULL, 0, s->ctx->tlsext_opaque_prf_input_callback_arg);
1622                         if (!r)
1623                                 {
1624                                 ret = SSL_TLSEXT_ERR_ALERT_FATAL;
1625                                 al = SSL_AD_INTERNAL_ERROR;
1626                                 goto err;
1627                                 }
1628                         }
1629
1630                 if (s->s3->server_opaque_prf_input != NULL) /* shouldn't really happen */
1631                         OPENSSL_free(s->s3->server_opaque_prf_input);
1632                 s->s3->server_opaque_prf_input = NULL;
1633
1634                 if (s->tlsext_opaque_prf_input != NULL)
1635                         {
1636                         if (s->s3->client_opaque_prf_input != NULL &&
1637                                 s->s3->client_opaque_prf_input_len == s->tlsext_opaque_prf_input_len)
1638                                 {
1639                                 /* can only use this extension if we have a server opaque PRF input
1640                                  * of the same length as the client opaque PRF input! */
1641
1642                                 if (s->tlsext_opaque_prf_input_len == 0)
1643                                         s->s3->server_opaque_prf_input = OPENSSL_malloc(1); /* dummy byte just to get non-NULL */
1644                                 else
1645                                         s->s3->server_opaque_prf_input = BUF_memdup(s->tlsext_opaque_prf_input, s->tlsext_opaque_prf_input_len);
1646                                 if (s->s3->server_opaque_prf_input == NULL)
1647                                         {
1648                                         ret = SSL_TLSEXT_ERR_ALERT_FATAL;
1649                                         al = SSL_AD_INTERNAL_ERROR;
1650                                         goto err;
1651                                         }
1652                                 s->s3->server_opaque_prf_input_len = s->tlsext_opaque_prf_input_len;
1653                                 }
1654                         }
1655
1656                 if (r == 2 && s->s3->server_opaque_prf_input == NULL)
1657                         {
1658                         /* The callback wants to enforce use of the extension,
1659                          * but we can't do that with the client opaque PRF input;
1660                          * abort the handshake.
1661                          */
1662                         ret = SSL_TLSEXT_ERR_ALERT_FATAL;
1663                         al = SSL_AD_HANDSHAKE_FAILURE;
1664                         }
1665         }
1666
1667 #endif
1668  err:
1669         switch (ret)
1670                 {
1671                 case SSL_TLSEXT_ERR_ALERT_FATAL:
1672                         ssl3_send_alert(s,SSL3_AL_FATAL,al);
1673                         return -1;
1674
1675                 case SSL_TLSEXT_ERR_ALERT_WARNING:
1676                         ssl3_send_alert(s,SSL3_AL_WARNING,al);
1677                         return 1;
1678
1679                 case SSL_TLSEXT_ERR_NOACK:
1680                         s->servername_done=0;
1681                         default:
1682                 return 1;
1683                 }
1684         }
1685
1686 int ssl_check_serverhello_tlsext(SSL *s)
1687         {
1688         int ret=SSL_TLSEXT_ERR_NOACK;
1689         int al = SSL_AD_UNRECOGNIZED_NAME;
1690
1691 #ifndef OPENSSL_NO_EC
1692         /* If we are client and using an elliptic curve cryptography cipher
1693          * suite, then if server returns an EC point formats lists extension
1694          * it must contain uncompressed.
1695          */
1696         unsigned long alg_k = s->s3->tmp.new_cipher->algorithm_mkey;
1697         unsigned long alg_a = s->s3->tmp.new_cipher->algorithm_auth;
1698         if ((s->tlsext_ecpointformatlist != NULL) && (s->tlsext_ecpointformatlist_length > 0) &&
1699             (s->session->tlsext_ecpointformatlist != NULL) && (s->session->tlsext_ecpointformatlist_length > 0) &&
1700             ((alg_k & (SSL_kEECDH|SSL_kECDHr|SSL_kECDHe)) || (alg_a & SSL_aECDSA)))
1701                 {
1702                 /* we are using an ECC cipher */
1703                 size_t i;
1704                 unsigned char *list;
1705                 int found_uncompressed = 0;
1706                 list = s->session->tlsext_ecpointformatlist;
1707                 for (i = 0; i < s->session->tlsext_ecpointformatlist_length; i++)
1708                         {
1709                         if (*(list++) == TLSEXT_ECPOINTFORMAT_uncompressed)
1710                                 {
1711                                 found_uncompressed = 1;
1712                                 break;
1713                                 }
1714                         }
1715                 if (!found_uncompressed)
1716                         {
1717                         SSLerr(SSL_F_SSL_CHECK_SERVERHELLO_TLSEXT,SSL_R_TLS_INVALID_ECPOINTFORMAT_LIST);
1718                         return -1;
1719                         }
1720                 }
1721         ret = SSL_TLSEXT_ERR_OK;
1722 #endif /* OPENSSL_NO_EC */
1723
1724         if (s->ctx != NULL && s->ctx->tlsext_servername_callback != 0)
1725                 ret = s->ctx->tlsext_servername_callback(s, &al, s->ctx->tlsext_servername_arg);
1726         else if (s->initial_ctx != NULL && s->initial_ctx->tlsext_servername_callback != 0)
1727                 ret = s->initial_ctx->tlsext_servername_callback(s, &al, s->initial_ctx->tlsext_servername_arg);
1728
1729 #ifdef TLSEXT_TYPE_opaque_prf_input
1730         if (s->s3->server_opaque_prf_input_len > 0)
1731                 {
1732                 /* This case may indicate that we, as a client, want to insist on using opaque PRF inputs.
1733                  * So first verify that we really have a value from the server too. */
1734
1735                 if (s->s3->server_opaque_prf_input == NULL)
1736                         {
1737                         ret = SSL_TLSEXT_ERR_ALERT_FATAL;
1738                         al = SSL_AD_HANDSHAKE_FAILURE;
1739                         }
1740
1741                 /* Anytime the server *has* sent an opaque PRF input, we need to check
1742                  * that we have a client opaque PRF input of the same size. */
1743                 if (s->s3->client_opaque_prf_input == NULL ||
1744                     s->s3->client_opaque_prf_input_len != s->s3->server_opaque_prf_input_len)
1745                         {
1746                         ret = SSL_TLSEXT_ERR_ALERT_FATAL;
1747                         al = SSL_AD_ILLEGAL_PARAMETER;
1748                         }
1749                 }
1750 #endif
1751
1752         /* If we've requested certificate status and we wont get one
1753          * tell the callback
1754          */
1755         if ((s->tlsext_status_type != -1) && !(s->tlsext_status_expected)
1756                         && s->ctx && s->ctx->tlsext_status_cb)
1757                 {
1758                 int r;
1759                 /* Set resp to NULL, resplen to -1 so callback knows
1760                  * there is no response.
1761                  */
1762                 if (s->tlsext_ocsp_resp)
1763                         {
1764                         OPENSSL_free(s->tlsext_ocsp_resp);
1765                         s->tlsext_ocsp_resp = NULL;
1766                         }
1767                 s->tlsext_ocsp_resplen = -1;
1768                 r = s->ctx->tlsext_status_cb(s, s->ctx->tlsext_status_arg);
1769                 if (r == 0)
1770                         {
1771                         al = SSL_AD_BAD_CERTIFICATE_STATUS_RESPONSE;
1772                         ret = SSL_TLSEXT_ERR_ALERT_FATAL;
1773                         }
1774                 if (r < 0)
1775                         {
1776                         al = SSL_AD_INTERNAL_ERROR;
1777                         ret = SSL_TLSEXT_ERR_ALERT_FATAL;
1778                         }
1779                 }
1780
1781         switch (ret)
1782                 {
1783                 case SSL_TLSEXT_ERR_ALERT_FATAL:
1784                         ssl3_send_alert(s,SSL3_AL_FATAL,al);
1785                         return -1;
1786
1787                 case SSL_TLSEXT_ERR_ALERT_WARNING:
1788                         ssl3_send_alert(s,SSL3_AL_WARNING,al);
1789                         return 1;
1790
1791                 case SSL_TLSEXT_ERR_NOACK:
1792                         s->servername_done=0;
1793                         default:
1794                 return 1;
1795                 }
1796         }
1797
1798 /* Since the server cache lookup is done early on in the processing of client
1799  * hello and other operations depend on the result we need to handle any TLS
1800  * session ticket extension at the same time.
1801  */
1802
1803 int tls1_process_ticket(SSL *s, unsigned char *session_id, int len,
1804                                 const unsigned char *limit, SSL_SESSION **ret)
1805         {
1806         /* Point after session ID in client hello */
1807         const unsigned char *p = session_id + len;
1808         unsigned short i;
1809
1810         /* If tickets disabled behave as if no ticket present
1811          * to permit stateful resumption.
1812          */
1813         if (SSL_get_options(s) & SSL_OP_NO_TICKET)
1814                 return 1;
1815
1816         if ((s->version <= SSL3_VERSION) || !limit)
1817                 return 1;
1818         if (p >= limit)
1819                 return -1;
1820         /* Skip past DTLS cookie */
1821         if (s->version == DTLS1_VERSION || s->version == DTLS1_BAD_VER)
1822                 {
1823                 i = *(p++);
1824                 p+= i;
1825                 if (p >= limit)
1826                         return -1;
1827                 }
1828         /* Skip past cipher list */
1829         n2s(p, i);
1830         p+= i;
1831         if (p >= limit)
1832                 return -1;
1833         /* Skip past compression algorithm list */
1834         i = *(p++);
1835         p += i;
1836         if (p > limit)
1837                 return -1;
1838         /* Now at start of extensions */
1839         if ((p + 2) >= limit)
1840                 return 1;
1841         n2s(p, i);
1842         while ((p + 4) <= limit)
1843                 {
1844                 unsigned short type, size;
1845                 n2s(p, type);
1846                 n2s(p, size);
1847                 if (p + size > limit)
1848                         return 1;
1849                 if (type == TLSEXT_TYPE_session_ticket)
1850                         {
1851                         /* If tickets disabled indicate cache miss which will
1852                          * trigger a full handshake
1853                          */
1854                         if (SSL_get_options(s) & SSL_OP_NO_TICKET)
1855                                 return 1;
1856                         /* If zero length note client will accept a ticket
1857                          * and indicate cache miss to trigger full handshake
1858                          */
1859                         if (size == 0)
1860                                 {
1861                                 s->tlsext_ticket_expected = 1;
1862                                 return 0;       /* Cache miss */
1863                                 }
1864                         if (s->tls_session_secret_cb)
1865                                 {
1866                                 /* Indicate cache miss here and instead of
1867                                  * generating the session from ticket now,
1868                                  * trigger abbreviated handshake based on
1869                                  * external mechanism to calculate the master
1870                                  * secret later. */
1871                                 return 0;
1872                                 }
1873                         return tls_decrypt_ticket(s, p, size, session_id, len,
1874                                                                         ret);
1875                         }
1876                 p += size;
1877                 }
1878         return 1;
1879         }
1880
1881 static int tls_decrypt_ticket(SSL *s, const unsigned char *etick, int eticklen,
1882                                 const unsigned char *sess_id, int sesslen,
1883                                 SSL_SESSION **psess)
1884         {
1885         SSL_SESSION *sess;
1886         unsigned char *sdec;
1887         const unsigned char *p;
1888         int slen, mlen, renew_ticket = 0;
1889         unsigned char tick_hmac[EVP_MAX_MD_SIZE];
1890         HMAC_CTX hctx;
1891         EVP_CIPHER_CTX ctx;
1892         SSL_CTX *tctx = s->initial_ctx;
1893         /* Need at least keyname + iv + some encrypted data */
1894         if (eticklen < 48)
1895                 goto tickerr;
1896         /* Initialize session ticket encryption and HMAC contexts */
1897         HMAC_CTX_init(&hctx);
1898         EVP_CIPHER_CTX_init(&ctx);
1899         if (tctx->tlsext_ticket_key_cb)
1900                 {
1901                 unsigned char *nctick = (unsigned char *)etick;
1902                 int rv = tctx->tlsext_ticket_key_cb(s, nctick, nctick + 16,
1903                                                         &ctx, &hctx, 0);
1904                 if (rv < 0)
1905                         return -1;
1906                 if (rv == 0)
1907                         goto tickerr;
1908                 if (rv == 2)
1909                         renew_ticket = 1;
1910                 }
1911         else
1912                 {
1913                 /* Check key name matches */
1914                 if (memcmp(etick, tctx->tlsext_tick_key_name, 16))
1915                         goto tickerr;
1916                 HMAC_Init_ex(&hctx, tctx->tlsext_tick_hmac_key, 16,
1917                                         tlsext_tick_md(), NULL);
1918                 EVP_DecryptInit_ex(&ctx, EVP_aes_128_cbc(), NULL,
1919                                 tctx->tlsext_tick_aes_key, etick + 16);
1920                 }
1921         /* Attempt to process session ticket, first conduct sanity and
1922          * integrity checks on ticket.
1923          */
1924         mlen = HMAC_size(&hctx);
1925         if (mlen < 0)
1926                 {
1927                 EVP_CIPHER_CTX_cleanup(&ctx);
1928                 return -1;
1929                 }
1930         eticklen -= mlen;
1931         /* Check HMAC of encrypted ticket */
1932         HMAC_Update(&hctx, etick, eticklen);
1933         HMAC_Final(&hctx, tick_hmac, NULL);
1934         HMAC_CTX_cleanup(&hctx);
1935         if (memcmp(tick_hmac, etick + eticklen, mlen))
1936                 goto tickerr;
1937         /* Attempt to decrypt session data */
1938         /* Move p after IV to start of encrypted ticket, update length */
1939         p = etick + 16 + EVP_CIPHER_CTX_iv_length(&ctx);
1940         eticklen -= 16 + EVP_CIPHER_CTX_iv_length(&ctx);
1941         sdec = OPENSSL_malloc(eticklen);
1942         if (!sdec)
1943                 {
1944                 EVP_CIPHER_CTX_cleanup(&ctx);
1945                 return -1;
1946                 }
1947         EVP_DecryptUpdate(&ctx, sdec, &slen, p, eticklen);
1948         if (EVP_DecryptFinal(&ctx, sdec + slen, &mlen) <= 0)
1949                 goto tickerr;
1950         slen += mlen;
1951         EVP_CIPHER_CTX_cleanup(&ctx);
1952         p = sdec;
1953
1954         sess = d2i_SSL_SESSION(NULL, &p, slen);
1955         OPENSSL_free(sdec);
1956         if (sess)
1957                 {
1958                 /* The session ID if non-empty is used by some clients to
1959                  * detect that the ticket has been accepted. So we copy it to
1960                  * the session structure. If it is empty set length to zero
1961                  * as required by standard.
1962                  */
1963                 if (sesslen)
1964                         memcpy(sess->session_id, sess_id, sesslen);
1965                 sess->session_id_length = sesslen;
1966                 *psess = sess;
1967                 s->tlsext_ticket_expected = renew_ticket;
1968                 return 1;
1969                 }
1970         /* If session decrypt failure indicate a cache miss and set state to
1971          * send a new ticket
1972          */
1973         tickerr:
1974         s->tlsext_ticket_expected = 1;
1975         return 0;
1976         }
1977
1978 /* Tables to translate from NIDs to TLS v1.2 ids */
1979
1980 typedef struct
1981         {
1982         int nid;
1983         int id;
1984         } tls12_lookup;
1985
1986 static tls12_lookup tls12_md[] = {
1987 #ifndef OPENSSL_NO_MD5
1988         {NID_md5, TLSEXT_hash_md5},
1989 #endif
1990 #ifndef OPENSSL_NO_SHA
1991         {NID_sha1, TLSEXT_hash_sha1},
1992 #endif
1993 #ifndef OPENSSL_NO_SHA256
1994         {NID_sha224, TLSEXT_hash_sha224},
1995         {NID_sha256, TLSEXT_hash_sha256},
1996 #endif
1997 #ifndef OPENSSL_NO_SHA512
1998         {NID_sha384, TLSEXT_hash_sha384},
1999         {NID_sha512, TLSEXT_hash_sha512}
2000 #endif
2001 };
2002
2003 static tls12_lookup tls12_sig[] = {
2004 #ifndef OPENSSL_NO_RSA
2005         {EVP_PKEY_RSA, TLSEXT_signature_rsa},
2006 #endif
2007 #ifndef OPENSSL_NO_RSA
2008         {EVP_PKEY_DSA, TLSEXT_signature_dsa},
2009 #endif
2010 #ifndef OPENSSL_NO_ECDSA
2011         {EVP_PKEY_EC, TLSEXT_signature_ecdsa}
2012 #endif
2013 };
2014
2015 static int tls12_find_id(int nid, tls12_lookup *table, size_t tlen)
2016         {
2017         size_t i;
2018         for (i = 0; i < tlen; i++)
2019                 {
2020                 if (table[i].nid == nid)
2021                         return table[i].id;
2022                 }
2023         return -1;
2024         }
2025 #if 0
2026 static int tls12_find_nid(int id, tls12_lookup *table, size_t tlen)
2027         {
2028         size_t i;
2029         for (i = 0; i < tlen; i++)
2030                 {
2031                 if (table[i].id == id)
2032                         return table[i].nid;
2033                 }
2034         return -1;
2035         }
2036 #endif
2037
2038 int tls12_get_sigandhash(unsigned char *p, const EVP_PKEY *pk, const EVP_MD *md)
2039         {
2040         int sig_id, md_id;
2041         md_id = tls12_find_id(EVP_MD_type(md), tls12_md,
2042                                 sizeof(tls12_md)/sizeof(tls12_lookup));
2043         if (md_id == -1)
2044                 return 0;
2045         sig_id = tls12_get_sigid(pk);
2046         if (sig_id == -1)
2047                 return 0;
2048         p[0] = (unsigned char)md_id;
2049         p[1] = (unsigned char)sig_id;
2050         return 1;
2051         }
2052
2053 int tls12_get_sigid(const EVP_PKEY *pk)
2054         {
2055         return tls12_find_id(pk->type, tls12_sig,
2056                                 sizeof(tls12_sig)/sizeof(tls12_lookup));
2057         }
2058
2059 const EVP_MD *tls12_get_hash(unsigned char hash_alg)
2060         {
2061         switch(hash_alg)
2062                 {
2063 #ifndef OPENSSL_NO_MD5
2064                 case TLSEXT_hash_md5:
2065                 return EVP_md5();
2066 #endif
2067 #ifndef OPENSSL_NO_SHA
2068                 case TLSEXT_hash_sha1:
2069                 return EVP_sha1();
2070 #endif
2071 #ifndef OPENSSL_NO_SHA256
2072                 case TLSEXT_hash_sha224:
2073                 return EVP_sha224();
2074
2075                 case TLSEXT_hash_sha256:
2076                 return EVP_sha256();
2077 #endif
2078 #ifndef OPENSSL_NO_SHA512
2079                 case TLSEXT_hash_sha384:
2080                 return EVP_sha384();
2081
2082                 case TLSEXT_hash_sha512:
2083                 return EVP_sha512();
2084 #endif
2085                 default:
2086                 return NULL;
2087
2088                 }
2089         }
2090
2091 /* Set preferred digest for each key type */
2092
2093 static int tls1_process_sigalgs(SSL *s, const unsigned char *data, int dsize)
2094         {
2095         int i, idx;
2096         const EVP_MD *md;
2097         CERT *c = s->cert;
2098         /* Extension ignored for TLS versions below 1.2 */
2099         if (s->version < TLS1_2_VERSION)
2100                 return 1;
2101
2102         c->pkeys[SSL_PKEY_DSA_SIGN].digest = NULL;
2103         c->pkeys[SSL_PKEY_RSA_SIGN].digest = NULL;
2104         c->pkeys[SSL_PKEY_RSA_ENC].digest = NULL;
2105         c->pkeys[SSL_PKEY_ECC].digest = NULL;
2106
2107         for (i = 0; i < dsize; i += 2)
2108                 {
2109                 unsigned char hash_alg = data[i], sig_alg = data[i+1];
2110
2111                 switch(sig_alg)
2112                         {
2113 #ifndef OPENSSL_NO_RSA
2114                         case TLSEXT_signature_rsa:
2115                         idx = SSL_PKEY_RSA_SIGN;
2116                         break;
2117 #endif
2118 #ifndef OPENSSL_NO_DSA
2119                         case TLSEXT_signature_dsa:
2120                         idx = SSL_PKEY_DSA_SIGN;
2121                         break;
2122 #endif
2123 #ifndef OPENSSL_NO_ECDSA
2124                         case TLSEXT_signature_ecdsa:
2125                         idx = SSL_PKEY_ECC;
2126                         break;
2127 #endif
2128                         default:
2129                         continue;
2130                         }
2131
2132                 if (c->pkeys[idx].digest == NULL)
2133                         {
2134                         md = tls12_get_hash(hash_alg);
2135                         if (md)
2136                                 {
2137                                 c->pkeys[idx].digest = md;
2138                                 if (idx == SSL_PKEY_RSA_SIGN)
2139                                         c->pkeys[SSL_PKEY_RSA_ENC].digest = md;
2140                                 }
2141                         }
2142
2143                 }
2144
2145         /* Set any remaining keys to default values. NOTE: if alg is not
2146          * supported it stays as NULL.
2147          */
2148 #ifndef OPENSSL_NO_DSA
2149         if (!c->pkeys[SSL_PKEY_DSA_SIGN].digest)
2150                 c->pkeys[SSL_PKEY_DSA_SIGN].digest = EVP_dss1();
2151 #endif
2152 #ifndef OPENSSL_NO_RSA
2153         if (!c->pkeys[SSL_PKEY_RSA_SIGN].digest)
2154                 {
2155                 c->pkeys[SSL_PKEY_RSA_SIGN].digest = EVP_sha1();
2156                 c->pkeys[SSL_PKEY_RSA_ENC].digest = EVP_sha1();
2157                 }
2158 #endif
2159 #ifndef OPENSSL_NO_ECDSA
2160         if (!c->pkeys[SSL_PKEY_ECC].digest)
2161                 c->pkeys[SSL_PKEY_ECC].digest = EVP_ecdsa();
2162 #endif
2163         return 1;
2164         }
2165
2166 #endif