ssl/t1_lib.c

   1 /* ssl/t1_lib.c */
   2 /* Copyright (C) 1995-1998 Eric Young (eay@cryptsoft.com)
   3  * All rights reserved.
   4  *
   5  * This package is an SSL implementation written
   6  * by Eric Young (eay@cryptsoft.com).
   7  * The implementation was written so as to conform with Netscapes SSL.
   8  *
   9  * This library is free for commercial and non-commercial use as long as
  10  * the following conditions are aheared to.  The following conditions
  11  * apply to all code found in this distribution, be it the RC4, RSA,
  12  * lhash, DES, etc., code; not just the SSL code.  The SSL documentation
  13  * included with this distribution is covered by the same copyright terms
  14  * except that the holder is Tim Hudson (tjh@cryptsoft.com).
  15  *
  16  * Copyright remains Eric Young's, and as such any Copyright notices in
  17  * the code are not to be removed.
  18  * If this package is used in a product, Eric Young should be given attribution
  19  * as the author of the parts of the library used.
  20  * This can be in the form of a textual message at program startup or
  21  * in documentation (online or textual) provided with the package.
  22  *
  23  * Redistribution and use in source and binary forms, with or without
  24  * modification, are permitted provided that the following conditions
  25  * are met:
  26  * 1. Redistributions of source code must retain the copyright
  27  *    notice, this list of conditions and the following disclaimer.
  28  * 2. Redistributions in binary form must reproduce the above copyright
  29  *    notice, this list of conditions and the following disclaimer in the
  30  *    documentation and/or other materials provided with the distribution.
  31  * 3. All advertising materials mentioning features or use of this software
  32  *    must display the following acknowledgement:
  33  *    "This product includes cryptographic software written by
  34  *     Eric Young (eay@cryptsoft.com)"
  35  *    The word 'cryptographic' can be left out if the rouines from the library
  36  *    being used are not cryptographic related :-).
  37  * 4. If you include any Windows specific code (or a derivative thereof) from
  38  *    the apps directory (application code) you must include an acknowledgement:
  39  *    "This product includes software written by Tim Hudson (tjh@cryptsoft.com)"
  40  *
  41  * THIS SOFTWARE IS PROVIDED BY ERIC YOUNG ``AS IS'' AND
  42  * ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
  43  * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE
  44  * ARE DISCLAIMED.  IN NO EVENT SHALL THE AUTHOR OR CONTRIBUTORS BE LIABLE
  45  * FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL
  46  * DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS
  47  * OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION)
  48  * HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT
  49  * LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY
  50  * OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF
  51  * SUCH DAMAGE.
  52  *
  53  * The licence and distribution terms for any publically available version or
  54  * derivative of this code cannot be changed.  i.e. this code cannot simply be
  55  * copied and put under another distribution licence
  56  * [including the GNU Public Licence.]
  57  */
  58 /* ====================================================================
  59  * Copyright (c) 1998-2007 The OpenSSL Project.  All rights reserved.
  60  *
  61  * Redistribution and use in source and binary forms, with or without
  62  * modification, are permitted provided that the following conditions
  63  * are met:
  64  *
  65  * 1. Redistributions of source code must retain the above copyright
  66  *    notice, this list of conditions and the following disclaimer.
  67  *
  68  * 2. Redistributions in binary form must reproduce the above copyright
  69  *    notice, this list of conditions and the following disclaimer in
  70  *    the documentation and/or other materials provided with the
  71  *    distribution.
  72  *
  73  * 3. All advertising materials mentioning features or use of this
  74  *    software must display the following acknowledgment:
  75  *    "This product includes software developed by the OpenSSL Project
  76  *    for use in the OpenSSL Toolkit. (http://www.openssl.org/)"
  77  *
  78  * 4. The names "OpenSSL Toolkit" and "OpenSSL Project" must not be used to
  79  *    endorse or promote products derived from this software without
  80  *    prior written permission. For written permission, please contact
  81  *    openssl-core@openssl.org.
  82  *
  83  * 5. Products derived from this software may not be called "OpenSSL"
  84  *    nor may "OpenSSL" appear in their names without prior written
  85  *    permission of the OpenSSL Project.
  86  *
  87  * 6. Redistributions of any form whatsoever must retain the following
  88  *    acknowledgment:
  89  *    "This product includes software developed by the OpenSSL Project
  90  *    for use in the OpenSSL Toolkit (http://www.openssl.org/)"
  91  *
  92  * THIS SOFTWARE IS PROVIDED BY THE OpenSSL PROJECT ``AS IS'' AND ANY
  93  * EXPRESSED OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
  94  * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
  95  * PURPOSE ARE DISCLAIMED.  IN NO EVENT SHALL THE OpenSSL PROJECT OR
  96  * ITS CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL,
  97  * SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT
  98  * NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES;
  99  * LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION)
 100  * HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT,
 101  * STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE)
 102  * ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED
 103  * OF THE POSSIBILITY OF SUCH DAMAGE.
 104  * ====================================================================
 105  *
 106  * This product includes cryptographic software written by Eric Young
 107  * (eay@cryptsoft.com).  This product includes software written by Tim
 108  * Hudson (tjh@cryptsoft.com).
 109  *
 110  */
 111
 112 #include <stdio.h>
 113 #include <openssl/objects.h>
 114 #include <openssl/evp.h>
 115 #include <openssl/hmac.h>
 116 #include <openssl/ocsp.h>
 117 #include "ssl_locl.h"
 118
 119 const char tls1_version_str[]="TLSv1" OPENSSL_VERSION_PTEXT;
 120
 121 #ifndef OPENSSL_NO_TLSEXT
 122 static int tls_decrypt_ticket(SSL *s, const unsigned char *tick, int ticklen,
 123                                 const unsigned char *sess_id, int sesslen,
 124                                 SSL_SESSION **psess);
 125 #endif
 126
 127 SSL3_ENC_METHOD TLSv1_enc_data={
 128         tls1_enc,
 129         tls1_mac,
 130         tls1_setup_key_block,
 131         tls1_generate_master_secret,
 132         tls1_change_cipher_state,
 133         tls1_final_finish_mac,
 134         TLS1_FINISH_MAC_LENGTH,
 135         tls1_cert_verify_mac,
 136         TLS_MD_CLIENT_FINISH_CONST,TLS_MD_CLIENT_FINISH_CONST_SIZE,
 137         TLS_MD_SERVER_FINISH_CONST,TLS_MD_SERVER_FINISH_CONST_SIZE,
 138         tls1_alert_code,
 139         };
 140
 141 long tls1_default_timeout(void)
 142         {
 143         /* 2 hours, the 24 hours mentioned in the TLSv1 spec
 144          * is way too long for http, the cache would over fill */
 145         return(60*60*2);
 146         }
 147
 148 int tls1_new(SSL *s)
 149         {
 150         if (!ssl3_new(s)) return(0);
 151         s->method->ssl_clear(s);
 152         return(1);
 153         }
 154
 155 void tls1_free(SSL *s)
 156         {
 157 #ifndef OPENSSL_NO_TLSEXT
 158         if (s->tlsext_session_ticket)
 159                 {
 160                 OPENSSL_free(s->tlsext_session_ticket);
 161                 }
 162 #endif /* OPENSSL_NO_TLSEXT */
 163         ssl3_free(s);
 164         }
 165
 166 void tls1_clear(SSL *s)
 167         {
 168         ssl3_clear(s);
 169         s->version = s->method->version;
 170         }
 171
 172 #ifndef OPENSSL_NO_EC
 173 static int nid_list[] =
 174         {
 175                 NID_sect163k1, /* sect163k1 (1) */
 176                 NID_sect163r1, /* sect163r1 (2) */
 177                 NID_sect163r2, /* sect163r2 (3) */
 178                 NID_sect193r1, /* sect193r1 (4) */
 179                 NID_sect193r2, /* sect193r2 (5) */
 180                 NID_sect233k1, /* sect233k1 (6) */
 181                 NID_sect233r1, /* sect233r1 (7) */
 182                 NID_sect239k1, /* sect239k1 (8) */
 183                 NID_sect283k1, /* sect283k1 (9) */
 184                 NID_sect283r1, /* sect283r1 (10) */
 185                 NID_sect409k1, /* sect409k1 (11) */
 186                 NID_sect409r1, /* sect409r1 (12) */
 187                 NID_sect571k1, /* sect571k1 (13) */
 188                 NID_sect571r1, /* sect571r1 (14) */
 189                 NID_secp160k1, /* secp160k1 (15) */
 190                 NID_secp160r1, /* secp160r1 (16) */
 191                 NID_secp160r2, /* secp160r2 (17) */
 192                 NID_secp192k1, /* secp192k1 (18) */
 193                 NID_X9_62_prime192v1, /* secp192r1 (19) */
 194                 NID_secp224k1, /* secp224k1 (20) */
 195                 NID_secp224r1, /* secp224r1 (21) */
 196                 NID_secp256k1, /* secp256k1 (22) */
 197                 NID_X9_62_prime256v1, /* secp256r1 (23) */
 198                 NID_secp384r1, /* secp384r1 (24) */
 199                 NID_secp521r1  /* secp521r1 (25) */
 200         };
 201
 202 int tls1_ec_curve_id2nid(int curve_id)
 203         {
 204         /* ECC curves from draft-ietf-tls-ecc-12.txt (Oct. 17, 2005) */
 205         if ((curve_id < 1) || ((unsigned int)curve_id >
 206                                 sizeof(nid_list)/sizeof(nid_list[0])))
 207                 return 0;
 208         return nid_list[curve_id-1];
 209         }
 210
 211 int tls1_ec_nid2curve_id(int nid)
 212         {
 213         /* ECC curves from draft-ietf-tls-ecc-12.txt (Oct. 17, 2005) */
 214         switch (nid)
 215                 {
 216         case NID_sect163k1: /* sect163k1 (1) */
 217                 return 1;
 218         case NID_sect163r1: /* sect163r1 (2) */
 219                 return 2;
 220         case NID_sect163r2: /* sect163r2 (3) */
 221                 return 3;
 222         case NID_sect193r1: /* sect193r1 (4) */
 223                 return 4;
 224         case NID_sect193r2: /* sect193r2 (5) */
 225                 return 5;
 226         case NID_sect233k1: /* sect233k1 (6) */
 227                 return 6;
 228         case NID_sect233r1: /* sect233r1 (7) */
 229                 return 7;
 230         case NID_sect239k1: /* sect239k1 (8) */
 231                 return 8;
 232         case NID_sect283k1: /* sect283k1 (9) */
 233                 return 9;
 234         case NID_sect283r1: /* sect283r1 (10) */
 235                 return 10;
 236         case NID_sect409k1: /* sect409k1 (11) */
 237                 return 11;
 238         case NID_sect409r1: /* sect409r1 (12) */
 239                 return 12;
 240         case NID_sect571k1: /* sect571k1 (13) */
 241                 return 13;
 242         case NID_sect571r1: /* sect571r1 (14) */
 243                 return 14;
 244         case NID_secp160k1: /* secp160k1 (15) */
 245                 return 15;
 246         case NID_secp160r1: /* secp160r1 (16) */
 247                 return 16;
 248         case NID_secp160r2: /* secp160r2 (17) */
 249                 return 17;
 250         case NID_secp192k1: /* secp192k1 (18) */
 251                 return 18;
 252         case NID_X9_62_prime192v1: /* secp192r1 (19) */
 253                 return 19;
 254         case NID_secp224k1: /* secp224k1 (20) */
 255                 return 20;
 256         case NID_secp224r1: /* secp224r1 (21) */
 257                 return 21;
 258         case NID_secp256k1: /* secp256k1 (22) */
 259                 return 22;
 260         case NID_X9_62_prime256v1: /* secp256r1 (23) */
 261                 return 23;
 262         case NID_secp384r1: /* secp384r1 (24) */
 263                 return 24;
 264         case NID_secp521r1:  /* secp521r1 (25) */
 265                 return 25;
 266         default:
 267                 return 0;
 268                 }
 269         }
 270 #endif /* OPENSSL_NO_EC */
 271
 272 #ifndef OPENSSL_NO_TLSEXT
 273
 274 /* List of supported signature algorithms and hashes. Should make this
 275  * customisable at some point, for now include everything we support.
 276  */
 277
 278 #ifdef OPENSSL_NO_RSA
 279 #define tlsext_sigalg_rsa(md) /* */
 280 #else
 281 #define tlsext_sigalg_rsa(md) md, TLSEXT_signature_rsa,
 282 #endif
 283
 284 #ifdef OPENSSL_NO_DSA
 285 #define tlsext_sigalg_dsa(md) /* */
 286 #else
 287 #define tlsext_sigalg_dsa(md) md, TLSEXT_signature_dsa,
 288 #endif
 289
 290 #ifdef OPENSSL_NO_ECDSA
 291 #define tlsext_sigalg_ecdsa(md) /* */
 292 #else
 293 #define tlsext_sigalg_ecdsa(md) md, TLSEXT_signature_dsa,
 294 #endif
 295
 296 #define tlsext_sigalg(md) \
 297                 tlsext_sigalg_rsa(md) \
 298                 tlsext_sigalg_dsa(md) \
 299                 tlsext_sigalg_ecdsa(md)
 300
 301 static unsigned char tls12_sigalgs[] = {
 302 #ifndef OPENSSL_NO_SHA512
 303         tlsext_sigalg(TLSEXT_hash_sha512)
 304         tlsext_sigalg(TLSEXT_hash_sha384)
 305 #endif
 306 #ifndef OPENSSL_NO_SHA256
 307         tlsext_sigalg(TLSEXT_hash_sha256)
 308         tlsext_sigalg(TLSEXT_hash_sha224)
 309 #endif
 310 #ifndef OPENSSL_NO_SHA
 311         tlsext_sigalg(TLSEXT_hash_sha1)
 312 #endif
 313 #ifndef OPENSSL_NO_MD5
 314         tlsext_sigalg_rsa(TLSEXT_hash_md5)
 315 #endif
 316 };
 317
 318 int tls12_get_req_sig_algs(SSL *s, unsigned char *p)
 319         {
 320         if (p)
 321                 memcpy(p, tls12_sigalgs, sizeof(tls12_sigalgs));
 322         return (int)sizeof(tls12_sigalgs);
 323         }
 324
 325 unsigned char *ssl_add_clienthello_tlsext(SSL *s, unsigned char *p, unsigned char *limit)
 326         {
 327         int extdatalen=0;
 328         unsigned char *ret = p;
 329
 330         /* don't add extensions for SSLv3 unless doing secure renegotiation */
 331         if (s->client_version == SSL3_VERSION
 332                                         && !s->s3->send_connection_binding)
 333                 return p;
 334
 335         ret+=2;
 336
 337         if (ret>=limit) return NULL; /* this really never occurs, but ... */
 338
 339         if (s->tlsext_hostname != NULL)
 340                 {
 341                 /* Add TLS extension servername to the Client Hello message */
 342                 unsigned long size_str;
 343                 long lenmax;
 344
 345                 /* check for enough space.
 346                    4 for the servername type and entension length
 347                    2 for servernamelist length
 348                    1 for the hostname type
 349                    2 for hostname length
 350                    + hostname length
 351                 */
 352
 353                 if ((lenmax = limit - ret - 9) < 0
 354                     || (size_str = strlen(s->tlsext_hostname)) > (unsigned long)lenmax)
 355                         return NULL;
 356
 357                 /* extension type and length */
 358                 s2n(TLSEXT_TYPE_server_name,ret);
 359                 s2n(size_str+5,ret);
 360
 361                 /* length of servername list */
 362                 s2n(size_str+3,ret);
 363
 364                 /* hostname type, length and hostname */
 365                 *(ret++) = (unsigned char) TLSEXT_NAMETYPE_host_name;
 366                 s2n(size_str,ret);
 367                 memcpy(ret, s->tlsext_hostname, size_str);
 368                 ret+=size_str;
 369                 }
 370
 371         /* Add RI if renegotiating */
 372         if (s->renegotiate)
 373           {
 374           int el;
 375
 376           if(!ssl_add_clienthello_renegotiate_ext(s, 0, &el, 0))
 377               {
 378               SSLerr(SSL_F_SSL_ADD_CLIENTHELLO_TLSEXT, ERR_R_INTERNAL_ERROR);
 379               return NULL;
 380               }
 381
 382           if((limit - p - 4 - el) < 0) return NULL;
 383
 384           s2n(TLSEXT_TYPE_renegotiate,ret);
 385           s2n(el,ret);
 386
 387           if(!ssl_add_clienthello_renegotiate_ext(s, ret, &el, el))
 388               {
 389               SSLerr(SSL_F_SSL_ADD_CLIENTHELLO_TLSEXT, ERR_R_INTERNAL_ERROR);
 390               return NULL;
 391               }
 392
 393           ret += el;
 394         }
 395
 396 #ifndef OPENSSL_NO_SRP
 397 #define MIN(x,y) (((x)<(y))?(x):(y))
 398         /* we add SRP username the first time only if we have one! */
 399         if (s->srp_ctx.login != NULL)
 400                 {/* Add TLS extension SRP username to the Client Hello message */
 401                 int login_len = MIN(strlen(s->srp_ctx.login) + 1, 255);
 402                 long lenmax;
 403
 404                 if ((lenmax = limit - ret - 5) < 0) return NULL;
 405                 if (login_len > lenmax) return NULL;
 406                 if (login_len > 255)
 407                         {
 408                         SSLerr(SSL_F_SSL_ADD_CLIENTHELLO_TLSEXT, ERR_R_INTERNAL_ERROR);
 409                         return NULL;
 410                         }
 411                 s2n(TLSEXT_TYPE_srp,ret);
 412                 s2n(login_len+1,ret);
 413
 414                 (*ret++) = (unsigned char) MIN(strlen(s->srp_ctx.login), 254);
 415                 memcpy(ret, s->srp_ctx.login, MIN(strlen(s->srp_ctx.login), 254));
 416                 ret+=login_len;
 417                 }
 418 #endif
 419
 420 #ifndef OPENSSL_NO_EC
 421         if (s->tlsext_ecpointformatlist != NULL &&
 422             s->version != DTLS1_VERSION)
 423                 {
 424                 /* Add TLS extension ECPointFormats to the ClientHello message */
 425                 long lenmax;
 426
 427                 if ((lenmax = limit - ret - 5) < 0) return NULL;
 428                 if (s->tlsext_ecpointformatlist_length > (unsigned long)lenmax) return NULL;
 429                 if (s->tlsext_ecpointformatlist_length > 255)
 430                         {
 431                         SSLerr(SSL_F_SSL_ADD_CLIENTHELLO_TLSEXT, ERR_R_INTERNAL_ERROR);
 432                         return NULL;
 433                         }
 434
 435                 s2n(TLSEXT_TYPE_ec_point_formats,ret);
 436                 s2n(s->tlsext_ecpointformatlist_length + 1,ret);
 437                 *(ret++) = (unsigned char) s->tlsext_ecpointformatlist_length;
 438                 memcpy(ret, s->tlsext_ecpointformatlist, s->tlsext_ecpointformatlist_length);
 439                 ret+=s->tlsext_ecpointformatlist_length;
 440                 }
 441         if (s->tlsext_ellipticcurvelist != NULL &&
 442             s->version != DTLS1_VERSION)
 443                 {
 444                 /* Add TLS extension EllipticCurves to the ClientHello message */
 445                 long lenmax;
 446
 447                 if ((lenmax = limit - ret - 6) < 0) return NULL;
 448                 if (s->tlsext_ellipticcurvelist_length > (unsigned long)lenmax) return NULL;
 449                 if (s->tlsext_ellipticcurvelist_length > 65532)
 450                         {
 451                         SSLerr(SSL_F_SSL_ADD_CLIENTHELLO_TLSEXT, ERR_R_INTERNAL_ERROR);
 452                         return NULL;
 453                         }
 454
 455                 s2n(TLSEXT_TYPE_elliptic_curves,ret);
 456                 s2n(s->tlsext_ellipticcurvelist_length + 2, ret);
 457
 458                 /* NB: draft-ietf-tls-ecc-12.txt uses a one-byte prefix for
 459                  * elliptic_curve_list, but the examples use two bytes.
 460                  * http://www1.ietf.org/mail-archive/web/tls/current/msg00538.html
 461                  * resolves this to two bytes.
 462                  */
 463                 s2n(s->tlsext_ellipticcurvelist_length, ret);
 464                 memcpy(ret, s->tlsext_ellipticcurvelist, s->tlsext_ellipticcurvelist_length);
 465                 ret+=s->tlsext_ellipticcurvelist_length;
 466                 }
 467 #endif /* OPENSSL_NO_EC */
 468
 469         if (!(SSL_get_options(s) & SSL_OP_NO_TICKET))
 470                 {
 471                 int ticklen;
 472                 if (!s->new_session && s->session && s->session->tlsext_tick)
 473                         ticklen = s->session->tlsext_ticklen;
 474                 else if (s->session && s->tlsext_session_ticket &&
 475                          s->tlsext_session_ticket->data)
 476                         {
 477                         ticklen = s->tlsext_session_ticket->length;
 478                         s->session->tlsext_tick = OPENSSL_malloc(ticklen);
 479                         if (!s->session->tlsext_tick)
 480                                 return NULL;
 481                         memcpy(s->session->tlsext_tick,
 482                                s->tlsext_session_ticket->data,
 483                                ticklen);
 484                         s->session->tlsext_ticklen = ticklen;
 485                         }
 486                 else
 487                         ticklen = 0;
 488                 if (ticklen == 0 && s->tlsext_session_ticket &&
 489                     s->tlsext_session_ticket->data == NULL)
 490                         goto skip_ext;
 491                 /* Check for enough room 2 for extension type, 2 for len
 492                  * rest for ticket
 493                  */
 494                 if ((long)(limit - ret - 4 - ticklen) < 0) return NULL;
 495                 s2n(TLSEXT_TYPE_session_ticket,ret);
 496                 s2n(ticklen,ret);
 497                 if (ticklen)
 498                         {
 499                         memcpy(ret, s->session->tlsext_tick, ticklen);
 500                         ret += ticklen;
 501                         }
 502                 }
 503                 skip_ext:
 504
 505         if (s->version >= TLS1_2_VERSION)
 506                 {
 507                 if ((size_t)(limit - ret) < sizeof(tls12_sigalgs) + 6)
 508                         return NULL;
 509                 s2n(TLSEXT_TYPE_signature_algorithms,ret);
 510                 s2n(sizeof(tls12_sigalgs) + 2, ret);
 511                 s2n(sizeof(tls12_sigalgs), ret);
 512                 memcpy(ret, tls12_sigalgs, sizeof(tls12_sigalgs));
 513                 ret += sizeof(tls12_sigalgs);
 514                 }
 515
 516 #ifdef TLSEXT_TYPE_opaque_prf_input
 517         if (s->s3->client_opaque_prf_input != NULL &&
 518             s->version != DTLS1_VERSION)
 519                 {
 520                 size_t col = s->s3->client_opaque_prf_input_len;
 521
 522                 if ((long)(limit - ret - 6 - col < 0))
 523                         return NULL;
 524                 if (col > 0xFFFD) /* can't happen */
 525                         return NULL;
 526
 527                 s2n(TLSEXT_TYPE_opaque_prf_input, ret);
 528                 s2n(col + 2, ret);
 529                 s2n(col, ret);
 530                 memcpy(ret, s->s3->client_opaque_prf_input, col);
 531                 ret += col;
 532                 }
 533 #endif
 534
 535         if (s->tlsext_status_type == TLSEXT_STATUSTYPE_ocsp &&
 536             s->version != DTLS1_VERSION)
 537                 {
 538                 int i;
 539                 long extlen, idlen, itmp;
 540                 OCSP_RESPID *id;
 541
 542                 idlen = 0;
 543                 for (i = 0; i < sk_OCSP_RESPID_num(s->tlsext_ocsp_ids); i++)
 544                         {
 545                         id = sk_OCSP_RESPID_value(s->tlsext_ocsp_ids, i);
 546                         itmp = i2d_OCSP_RESPID(id, NULL);
 547                         if (itmp <= 0)
 548                                 return NULL;
 549                         idlen += itmp + 2;
 550                         }
 551
 552                 if (s->tlsext_ocsp_exts)
 553                         {
 554                         extlen = i2d_X509_EXTENSIONS(s->tlsext_ocsp_exts, NULL);
 555                         if (extlen < 0)
 556                                 return NULL;
 557                         }
 558                 else
 559                         extlen = 0;
 560
 561                 if ((long)(limit - ret - 7 - extlen - idlen) < 0) return NULL;
 562                 s2n(TLSEXT_TYPE_status_request, ret);
 563                 if (extlen + idlen > 0xFFF0)
 564                         return NULL;
 565                 s2n(extlen + idlen + 5, ret);
 566                 *(ret++) = TLSEXT_STATUSTYPE_ocsp;
 567                 s2n(idlen, ret);
 568                 for (i = 0; i < sk_OCSP_RESPID_num(s->tlsext_ocsp_ids); i++)
 569                         {
 570                         /* save position of id len */
 571                         unsigned char *q = ret;
 572                         id = sk_OCSP_RESPID_value(s->tlsext_ocsp_ids, i);
 573                         /* skip over id len */
 574                         ret += 2;
 575                         itmp = i2d_OCSP_RESPID(id, &ret);
 576                         /* write id len */
 577                         s2n(itmp, q);
 578                         }
 579                 s2n(extlen, ret);
 580                 if (extlen > 0)
 581                         i2d_X509_EXTENSIONS(s->tlsext_ocsp_exts, &ret);
 582                 }
 583
 584         if ((extdatalen = ret-p-2)== 0)
 585                 return p;
 586
 587         s2n(extdatalen,p);
 588         return ret;
 589         }
 590
 591 unsigned char *ssl_add_serverhello_tlsext(SSL *s, unsigned char *p, unsigned char *limit)
 592         {
 593         int extdatalen=0;
 594         unsigned char *ret = p;
 595
 596         /* don't add extensions for SSLv3, unless doing secure renegotiation */
 597         if (s->version == SSL3_VERSION && !s->s3->send_connection_binding)
 598                 return p;
 599
 600         ret+=2;
 601         if (ret>=limit) return NULL; /* this really never occurs, but ... */
 602
 603         if (!s->hit && s->servername_done == 1 && s->session->tlsext_hostname != NULL)
 604                 {
 605                 if ((long)(limit - ret - 4) < 0) return NULL;
 606
 607                 s2n(TLSEXT_TYPE_server_name,ret);
 608                 s2n(0,ret);
 609                 }
 610
 611         if(s->s3->send_connection_binding)
 612         {
 613           int el;
 614
 615           if(!ssl_add_serverhello_renegotiate_ext(s, 0, &el, 0))
 616               {
 617               SSLerr(SSL_F_SSL_ADD_SERVERHELLO_TLSEXT, ERR_R_INTERNAL_ERROR);
 618               return NULL;
 619               }
 620
 621           if((limit - p - 4 - el) < 0) return NULL;
 622
 623           s2n(TLSEXT_TYPE_renegotiate,ret);
 624           s2n(el,ret);
 625
 626           if(!ssl_add_serverhello_renegotiate_ext(s, ret, &el, el))
 627               {
 628               SSLerr(SSL_F_SSL_ADD_SERVERHELLO_TLSEXT, ERR_R_INTERNAL_ERROR);
 629               return NULL;
 630               }
 631
 632           ret += el;
 633         }
 634
 635 #ifndef OPENSSL_NO_EC
 636         if (s->tlsext_ecpointformatlist != NULL &&
 637             s->version != DTLS1_VERSION)
 638                 {
 639                 /* Add TLS extension ECPointFormats to the ServerHello message */
 640                 long lenmax;
 641
 642                 if ((lenmax = limit - ret - 5) < 0) return NULL;
 643                 if (s->tlsext_ecpointformatlist_length > (unsigned long)lenmax) return NULL;
 644                 if (s->tlsext_ecpointformatlist_length > 255)
 645                         {
 646                         SSLerr(SSL_F_SSL_ADD_SERVERHELLO_TLSEXT, ERR_R_INTERNAL_ERROR);
 647                         return NULL;
 648                         }
 649
 650                 s2n(TLSEXT_TYPE_ec_point_formats,ret);
 651                 s2n(s->tlsext_ecpointformatlist_length + 1,ret);
 652                 *(ret++) = (unsigned char) s->tlsext_ecpointformatlist_length;
 653                 memcpy(ret, s->tlsext_ecpointformatlist, s->tlsext_ecpointformatlist_length);
 654                 ret+=s->tlsext_ecpointformatlist_length;
 655
 656                 }
 657         /* Currently the server should not respond with a SupportedCurves extension */
 658 #endif /* OPENSSL_NO_EC */
 659
 660         if (s->tlsext_ticket_expected
 661                 && !(SSL_get_options(s) & SSL_OP_NO_TICKET))
 662                 {
 663                 if ((long)(limit - ret - 4) < 0) return NULL;
 664                 s2n(TLSEXT_TYPE_session_ticket,ret);
 665                 s2n(0,ret);
 666                 }
 667
 668         if (s->tlsext_status_expected)
 669                 {
 670                 if ((long)(limit - ret - 4) < 0) return NULL;
 671                 s2n(TLSEXT_TYPE_status_request,ret);
 672                 s2n(0,ret);
 673                 }
 674
 675 #ifdef TLSEXT_TYPE_opaque_prf_input
 676         if (s->s3->server_opaque_prf_input != NULL &&
 677             s->version != DTLS1_VERSION)
 678                 {
 679                 size_t sol = s->s3->server_opaque_prf_input_len;
 680
 681                 if ((long)(limit - ret - 6 - sol) < 0)
 682                         return NULL;
 683                 if (sol > 0xFFFD) /* can't happen */
 684                         return NULL;
 685
 686                 s2n(TLSEXT_TYPE_opaque_prf_input, ret);
 687                 s2n(sol + 2, ret);
 688                 s2n(sol, ret);
 689                 memcpy(ret, s->s3->server_opaque_prf_input, sol);
 690                 ret += sol;
 691                 }
 692 #endif
 693         if (((s->s3->tmp.new_cipher->id & 0xFFFF)==0x80 || (s->s3->tmp.new_cipher->id & 0xFFFF)==0x81)
 694                 && (SSL_get_options(s) & SSL_OP_CRYPTOPRO_TLSEXT_BUG))
 695                 { const unsigned char cryptopro_ext[36] = {
 696                         0xfd, 0xe8, /*65000*/
 697                         0x00, 0x20, /*32 bytes length*/
 698                         0x30, 0x1e, 0x30, 0x08, 0x06, 0x06, 0x2a, 0x85,
 699                         0x03,   0x02, 0x02, 0x09, 0x30, 0x08, 0x06, 0x06,
 700                         0x2a, 0x85, 0x03, 0x02, 0x02, 0x16, 0x30, 0x08,
 701                         0x06, 0x06, 0x2a, 0x85, 0x03, 0x02, 0x02, 0x17};
 702                         if (limit-ret<36) return NULL;
 703                         memcpy(ret,cryptopro_ext,36);
 704                         ret+=36;
 705
 706                 }
 707
 708         if ((extdatalen = ret-p-2)== 0)
 709                 return p;
 710
 711         s2n(extdatalen,p);
 712         return ret;
 713         }
 714
 715 int ssl_parse_clienthello_tlsext(SSL *s, unsigned char **p, unsigned char *d, int n, int *al)
 716         {
 717         unsigned short type;
 718         unsigned short size;
 719         unsigned short len;
 720         unsigned char *data = *p;
 721         int renegotiate_seen = 0;
 722         int sigalg_seen = 0;
 723
 724         s->servername_done = 0;
 725         s->tlsext_status_type = -1;
 726
 727         if (data >= (d+n-2))
 728                 goto ri_check;
 729         n2s(data,len);
 730
 731         if (data > (d+n-len))
 732                 goto ri_check;
 733
 734         while (data <= (d+n-4))
 735                 {
 736                 n2s(data,type);
 737                 n2s(data,size);
 738
 739                 if (data+size > (d+n))
 740                         goto ri_check;
 741 #if 0
 742                 fprintf(stderr,"Received extension type %d size %d\n",type,size);
 743 #endif
 744                 if (s->tlsext_debug_cb)
 745                         s->tlsext_debug_cb(s, 0, type, data, size,
 746                                                 s->tlsext_debug_arg);
 747 /* The servername extension is treated as follows:
 748
 749    - Only the hostname type is supported with a maximum length of 255.
 750    - The servername is rejected if too long or if it contains zeros,
 751      in which case an fatal alert is generated.
 752    - The servername field is maintained together with the session cache.
 753    - When a session is resumed, the servername call back invoked in order
 754      to allow the application to position itself to the right context.
 755    - The servername is acknowledged if it is new for a session or when
 756      it is identical to a previously used for the same session.
 757      Applications can control the behaviour.  They can at any time
 758      set a 'desirable' servername for a new SSL object. This can be the
 759      case for example with HTTPS when a Host: header field is received and
 760      a renegotiation is requested. In this case, a possible servername
 761      presented in the new client hello is only acknowledged if it matches
 762      the value of the Host: field.
 763    - Applications must  use SSL_OP_NO_SESSION_RESUMPTION_ON_RENEGOTIATION
 764      if they provide for changing an explicit servername context for the session,
 765      i.e. when the session has been established with a servername extension.
 766    - On session reconnect, the servername extension may be absent.
 767
 768 */
 769
 770                 if (type == TLSEXT_TYPE_server_name)
 771                         {
 772                         unsigned char *sdata;
 773                         int servname_type;
 774                         int dsize;
 775
 776                         if (size < 2)
 777                                 {
 778                                 *al = SSL_AD_DECODE_ERROR;
 779                                 return 0;
 780                                 }
 781                         n2s(data,dsize);
 782                         size -= 2;
 783                         if (dsize > size  )
 784                                 {
 785                                 *al = SSL_AD_DECODE_ERROR;
 786                                 return 0;
 787                                 }
 788
 789                         sdata = data;
 790                         while (dsize > 3)
 791                                 {
 792                                 servname_type = *(sdata++);
 793                                 n2s(sdata,len);
 794                                 dsize -= 3;
 795
 796                                 if (len > dsize)
 797                                         {
 798                                         *al = SSL_AD_DECODE_ERROR;
 799                                         return 0;
 800                                         }
 801                                 if (s->servername_done == 0)
 802                                 switch (servname_type)
 803                                         {
 804                                 case TLSEXT_NAMETYPE_host_name:
 805                                         if (!s->hit)
 806                                                 {
 807                                                 if(s->session->tlsext_hostname)
 808                                                         {
 809                                                         *al = SSL_AD_DECODE_ERROR;
 810                                                         return 0;
 811                                                         }
 812                                                 if (len > TLSEXT_MAXLEN_host_name)
 813                                                         {
 814                                                         *al = TLS1_AD_UNRECOGNIZED_NAME;
 815                                                         return 0;
 816                                                         }
 817                                                 if ((s->session->tlsext_hostname = OPENSSL_malloc(len+1)) == NULL)
 818                                                         {
 819                                                         *al = TLS1_AD_INTERNAL_ERROR;
 820                                                         return 0;
 821                                                         }
 822                                                 memcpy(s->session->tlsext_hostname, sdata, len);
 823                                                 s->session->tlsext_hostname[len]='\0';
 824                                                 if (strlen(s->session->tlsext_hostname) != len) {
 825                                                         OPENSSL_free(s->session->tlsext_hostname);
 826                                                         s->session->tlsext_hostname = NULL;
 827                                                         *al = TLS1_AD_UNRECOGNIZED_NAME;
 828                                                         return 0;
 829                                                 }
 830                                                 s->servername_done = 1;
 831
 832                                                 }
 833                                         else
 834                                                 s->servername_done = s->session->tlsext_hostname
 835                                                         && strlen(s->session->tlsext_hostname) == len
 836                                                         && strncmp(s->session->tlsext_hostname, (char *)sdata, len) == 0;
 837
 838                                         break;
 839
 840                                 default:
 841                                         break;
 842                                         }
 843
 844                                 dsize -= len;
 845                                 }
 846                         if (dsize != 0)
 847                                 {
 848                                 *al = SSL_AD_DECODE_ERROR;
 849                                 return 0;
 850                                 }
 851
 852                         }
 853 #ifndef OPENSSL_NO_SRP
 854                 else if (type == TLSEXT_TYPE_srp)
 855                         {
 856                         if (size > 0)
 857                                 {
 858                                 len = data[0];
 859                                 if ((s->srp_ctx.login = OPENSSL_malloc(len+1)) == NULL)
 860                                         return -1;
 861                                 memcpy(s->srp_ctx.login, &data[1], len);
 862                                 s->srp_ctx.login[len]='\0';
 863                                 }
 864                         }
 865 #endif
 866
 867 #ifndef OPENSSL_NO_EC
 868                 else if (type == TLSEXT_TYPE_ec_point_formats &&
 869                      s->version != DTLS1_VERSION)
 870                         {
 871                         unsigned char *sdata = data;
 872                         int ecpointformatlist_length = *(sdata++);
 873
 874                         if (ecpointformatlist_length != size - 1)
 875                                 {
 876                                 *al = TLS1_AD_DECODE_ERROR;
 877                                 return 0;
 878                                 }
 879                         if (!s->hit)
 880                                 {
 881                                 if(s->session->tlsext_ecpointformatlist)
 882                                         {
 883                                         OPENSSL_free(s->session->tlsext_ecpointformatlist);
 884                                         s->session->tlsext_ecpointformatlist = NULL;
 885                                         }
 886                                 s->session->tlsext_ecpointformatlist_length = 0;
 887                                 if ((s->session->tlsext_ecpointformatlist = OPENSSL_malloc(ecpointformatlist_length)) == NULL)
 888                                         {
 889                                         *al = TLS1_AD_INTERNAL_ERROR;
 890                                         return 0;
 891                                         }
 892                                 s->session->tlsext_ecpointformatlist_length = ecpointformatlist_length;
 893                                 memcpy(s->session->tlsext_ecpointformatlist, sdata, ecpointformatlist_length);
 894                                 }
 895 #if 0
 896                         fprintf(stderr,"ssl_parse_clienthello_tlsext s->session->tlsext_ecpointformatlist (length=%i) ", s->session->tlsext_ecpointformatlist_length);
 897                         sdata = s->session->tlsext_ecpointformatlist;
 898                         for (i = 0; i < s->session->tlsext_ecpointformatlist_length; i++)
 899                                 fprintf(stderr,"%i ",*(sdata++));
 900                         fprintf(stderr,"\n");
 901 #endif
 902                         }
 903                 else if (type == TLSEXT_TYPE_elliptic_curves &&
 904                      s->version != DTLS1_VERSION)
 905                         {
 906                         unsigned char *sdata = data;
 907                         int ellipticcurvelist_length = (*(sdata++) << 8);
 908                         ellipticcurvelist_length += (*(sdata++));
 909
 910                         if (ellipticcurvelist_length != size - 2)
 911                                 {
 912                                 *al = TLS1_AD_DECODE_ERROR;
 913                                 return 0;
 914                                 }
 915                         if (!s->hit)
 916                                 {
 917                                 if(s->session->tlsext_ellipticcurvelist)
 918                                         {
 919                                         *al = TLS1_AD_DECODE_ERROR;
 920                                         return 0;
 921                                         }
 922                                 s->session->tlsext_ellipticcurvelist_length = 0;
 923                                 if ((s->session->tlsext_ellipticcurvelist = OPENSSL_malloc(ellipticcurvelist_length)) == NULL)
 924                                         {
 925                                         *al = TLS1_AD_INTERNAL_ERROR;
 926                                         return 0;
 927                                         }
 928                                 s->session->tlsext_ellipticcurvelist_length = ellipticcurvelist_length;
 929                                 memcpy(s->session->tlsext_ellipticcurvelist, sdata, ellipticcurvelist_length);
 930                                 }
 931 #if 0
 932                         fprintf(stderr,"ssl_parse_clienthello_tlsext s->session->tlsext_ellipticcurvelist (length=%i) ", s->session->tlsext_ellipticcurvelist_length);
 933                         sdata = s->session->tlsext_ellipticcurvelist;
 934                         for (i = 0; i < s->session->tlsext_ellipticcurvelist_length; i++)
 935                                 fprintf(stderr,"%i ",*(sdata++));
 936                         fprintf(stderr,"\n");
 937 #endif
 938                         }
 939 #endif /* OPENSSL_NO_EC */
 940 #ifdef TLSEXT_TYPE_opaque_prf_input
 941                 else if (type == TLSEXT_TYPE_opaque_prf_input &&
 942                      s->version != DTLS1_VERSION)
 943                         {
 944                         unsigned char *sdata = data;
 945
 946                         if (size < 2)
 947                                 {
 948                                 *al = SSL_AD_DECODE_ERROR;
 949                                 return 0;
 950                                 }
 951                         n2s(sdata, s->s3->client_opaque_prf_input_len);
 952                         if (s->s3->client_opaque_prf_input_len != size - 2)
 953                                 {
 954                                 *al = SSL_AD_DECODE_ERROR;
 955                                 return 0;
 956                                 }
 957
 958                         if (s->s3->client_opaque_prf_input != NULL) /* shouldn't really happen */
 959                                 OPENSSL_free(s->s3->client_opaque_prf_input);
 960                         if (s->s3->client_opaque_prf_input_len == 0)
 961                                 s->s3->client_opaque_prf_input = OPENSSL_malloc(1); /* dummy byte just to get non-NULL */
 962                         else
 963                                 s->s3->client_opaque_prf_input = BUF_memdup(sdata, s->s3->client_opaque_prf_input_len);
 964                         if (s->s3->client_opaque_prf_input == NULL)
 965                                 {
 966                                 *al = TLS1_AD_INTERNAL_ERROR;
 967                                 return 0;
 968                                 }
 969                         }
 970 #endif
 971                 else if (type == TLSEXT_TYPE_session_ticket)
 972                         {
 973                         if (s->tls_session_ticket_ext_cb &&
 974                             !s->tls_session_ticket_ext_cb(s, data, size, s->tls_session_ticket_ext_cb_arg))
 975                                 {
 976                                 *al = TLS1_AD_INTERNAL_ERROR;
 977                                 return 0;
 978                                 }
 979                         }
 980                 else if (type == TLSEXT_TYPE_renegotiate)
 981                         {
 982                         if(!ssl_parse_clienthello_renegotiate_ext(s, data, size, al))
 983                                 return 0;
 984                         renegotiate_seen = 1;
 985                         }
 986                 else if (type == TLSEXT_TYPE_signature_algorithms)
 987                         {
 988                         int dsize;
 989                         if (sigalg_seen || size < 2)
 990                                 {
 991                                 *al = SSL_AD_DECODE_ERROR;
 992                                 return 0;
 993                                 }
 994                         sigalg_seen = 1;
 995                         n2s(data,dsize);
 996                         size -= 2;
 997                         if (dsize != size || dsize & 1)
 998                                 {
 999                                 *al = SSL_AD_DECODE_ERROR;
1000                                 return 0;
1001                                 }
1002                         if (!tls1_process_sigalgs(s, data, dsize))
1003                                 {
1004                                 *al = SSL_AD_DECODE_ERROR;
1005                                 return 0;
1006                                 }
1007                         }
1008                 else if (type == TLSEXT_TYPE_status_request &&
1009                          s->version != DTLS1_VERSION && s->ctx->tlsext_status_cb)
1010                         {
1011
1012                         if (size < 5)
1013                                 {
1014                                 *al = SSL_AD_DECODE_ERROR;
1015                                 return 0;
1016                                 }
1017
1018                         s->tlsext_status_type = *data++;
1019                         size--;
1020                         if (s->tlsext_status_type == TLSEXT_STATUSTYPE_ocsp)
1021                                 {
1022                                 const unsigned char *sdata;
1023                                 int dsize;
1024                                 /* Read in responder_id_list */
1025                                 n2s(data,dsize);
1026                                 size -= 2;
1027                                 if (dsize > size  )
1028                                         {
1029                                         *al = SSL_AD_DECODE_ERROR;
1030                                         return 0;
1031                                         }
1032                                 while (dsize > 0)
1033                                         {
1034                                         OCSP_RESPID *id;
1035                                         int idsize;
1036                                         if (dsize < 4)
1037                                                 {
1038                                                 *al = SSL_AD_DECODE_ERROR;
1039                                                 return 0;
1040                                                 }
1041                                         n2s(data, idsize);
1042                                         dsize -= 2 + idsize;
1043                                         size -= 2 + idsize;
1044                                         if (dsize < 0)
1045                                                 {
1046                                                 *al = SSL_AD_DECODE_ERROR;
1047                                                 return 0;
1048                                                 }
1049                                         sdata = data;
1050                                         data += idsize;
1051                                         id = d2i_OCSP_RESPID(NULL,
1052                                                                 &sdata, idsize);
1053                                         if (!id)
1054                                                 {
1055                                                 *al = SSL_AD_DECODE_ERROR;
1056                                                 return 0;
1057                                                 }
1058                                         if (data != sdata)
1059                                                 {
1060                                                 OCSP_RESPID_free(id);
1061                                                 *al = SSL_AD_DECODE_ERROR;
1062                                                 return 0;
1063                                                 }
1064                                         if (!s->tlsext_ocsp_ids
1065                                                 && !(s->tlsext_ocsp_ids =
1066                                                 sk_OCSP_RESPID_new_null()))
1067                                                 {
1068                                                 OCSP_RESPID_free(id);
1069                                                 *al = SSL_AD_INTERNAL_ERROR;
1070                                                 return 0;
1071                                                 }
1072                                         if (!sk_OCSP_RESPID_push(
1073                                                         s->tlsext_ocsp_ids, id))
1074                                                 {
1075                                                 OCSP_RESPID_free(id);
1076                                                 *al = SSL_AD_INTERNAL_ERROR;
1077                                                 return 0;
1078                                                 }
1079                                         }
1080
1081                                 /* Read in request_extensions */
1082                                 if (size < 2)
1083                                         {
1084                                         *al = SSL_AD_DECODE_ERROR;
1085                                         return 0;
1086                                         }
1087                                 n2s(data,dsize);
1088                                 size -= 2;
1089                                 if (dsize != size)
1090                                         {
1091                                         *al = SSL_AD_DECODE_ERROR;
1092                                         return 0;
1093                                         }
1094                                 sdata = data;
1095                                 if (dsize > 0)
1096                                         {
1097                                         s->tlsext_ocsp_exts =
1098                                                 d2i_X509_EXTENSIONS(NULL,
1099                                                         &sdata, dsize);
1100                                         if (!s->tlsext_ocsp_exts
1101                                                 || (data + dsize != sdata))
1102                                                 {
1103                                                 *al = SSL_AD_DECODE_ERROR;
1104                                                 return 0;
1105                                                 }
1106                                         }
1107                                 }
1108                                 /* We don't know what to do with any other type
1109                                 * so ignore it.
1110                                 */
1111                                 else
1112                                         s->tlsext_status_type = -1;
1113                         }
1114
1115                 /* session ticket processed earlier */
1116                 data+=size;
1117                 }
1118
1119         *p = data;
1120
1121         ri_check:
1122
1123         /* Need RI if renegotiating */
1124
1125         if (!renegotiate_seen && s->renegotiate &&
1126                 !(s->options & SSL_OP_ALLOW_UNSAFE_LEGACY_RENEGOTIATION))
1127                 {
1128                 *al = SSL_AD_HANDSHAKE_FAILURE;
1129                 SSLerr(SSL_F_SSL_PARSE_CLIENTHELLO_TLSEXT,
1130                                 SSL_R_UNSAFE_LEGACY_RENEGOTIATION_DISABLED);
1131                 return 0;
1132                 }
1133
1134         return 1;
1135         }
1136
1137 int ssl_parse_serverhello_tlsext(SSL *s, unsigned char **p, unsigned char *d, int n, int *al)
1138         {
1139         unsigned short length;
1140         unsigned short type;
1141         unsigned short size;
1142         unsigned char *data = *p;
1143         int tlsext_servername = 0;
1144         int renegotiate_seen = 0;
1145
1146         if (data >= (d+n-2))
1147                 goto ri_check;
1148
1149         n2s(data,length);
1150         if (data+length != d+n)
1151                 {
1152                 *al = SSL_AD_DECODE_ERROR;
1153                 return 0;
1154                 }
1155
1156         while(data <= (d+n-4))
1157                 {
1158                 n2s(data,type);
1159                 n2s(data,size);
1160
1161                 if (data+size > (d+n))
1162                         goto ri_check;
1163
1164                 if (s->tlsext_debug_cb)
1165                         s->tlsext_debug_cb(s, 1, type, data, size,
1166                                                 s->tlsext_debug_arg);
1167
1168                 if (type == TLSEXT_TYPE_server_name)
1169                         {
1170                         if (s->tlsext_hostname == NULL || size > 0)
1171                                 {
1172                                 *al = TLS1_AD_UNRECOGNIZED_NAME;
1173                                 return 0;
1174                                 }
1175                         tlsext_servername = 1;
1176                         }
1177
1178 #ifndef OPENSSL_NO_EC
1179                 else if (type == TLSEXT_TYPE_ec_point_formats &&
1180                      s->version != DTLS1_VERSION)
1181                         {
1182                         unsigned char *sdata = data;
1183                         int ecpointformatlist_length = *(sdata++);
1184
1185                         if (ecpointformatlist_length != size - 1)
1186                                 {
1187                                 *al = TLS1_AD_DECODE_ERROR;
1188                                 return 0;
1189                                 }
1190                         s->session->tlsext_ecpointformatlist_length = 0;
1191                         if (s->session->tlsext_ecpointformatlist != NULL) OPENSSL_free(s->session->tlsext_ecpointformatlist);
1192                         if ((s->session->tlsext_ecpointformatlist = OPENSSL_malloc(ecpointformatlist_length)) == NULL)
1193                                 {
1194                                 *al = TLS1_AD_INTERNAL_ERROR;
1195                                 return 0;
1196                                 }
1197                         s->session->tlsext_ecpointformatlist_length = ecpointformatlist_length;
1198                         memcpy(s->session->tlsext_ecpointformatlist, sdata, ecpointformatlist_length);
1199 #if 0
1200                         fprintf(stderr,"ssl_parse_serverhello_tlsext s->session->tlsext_ecpointformatlist ");
1201                         sdata = s->session->tlsext_ecpointformatlist;
1202                         for (i = 0; i < s->session->tlsext_ecpointformatlist_length; i++)
1203                                 fprintf(stderr,"%i ",*(sdata++));
1204                         fprintf(stderr,"\n");
1205 #endif
1206                         }
1207 #endif /* OPENSSL_NO_EC */
1208
1209                 else if (type == TLSEXT_TYPE_session_ticket)
1210                         {
1211                         if (s->tls_session_ticket_ext_cb &&
1212                             !s->tls_session_ticket_ext_cb(s, data, size, s->tls_session_ticket_ext_cb_arg))
1213                                 {
1214                                 *al = TLS1_AD_INTERNAL_ERROR;
1215                                 return 0;
1216                                 }
1217                         if ((SSL_get_options(s) & SSL_OP_NO_TICKET)
1218                                 || (size > 0))
1219                                 {
1220                                 *al = TLS1_AD_UNSUPPORTED_EXTENSION;
1221                                 return 0;
1222                                 }
1223                         s->tlsext_ticket_expected = 1;
1224                         }
1225 #ifdef TLSEXT_TYPE_opaque_prf_input
1226                 else if (type == TLSEXT_TYPE_opaque_prf_input &&
1227                      s->version != DTLS1_VERSION)
1228                         {
1229                         unsigned char *sdata = data;
1230
1231                         if (size < 2)
1232                                 {
1233                                 *al = SSL_AD_DECODE_ERROR;
1234                                 return 0;
1235                                 }
1236                         n2s(sdata, s->s3->server_opaque_prf_input_len);
1237                         if (s->s3->server_opaque_prf_input_len != size - 2)
1238                                 {
1239                                 *al = SSL_AD_DECODE_ERROR;
1240                                 return 0;
1241                                 }
1242
1243                         if (s->s3->server_opaque_prf_input != NULL) /* shouldn't really happen */
1244                                 OPENSSL_free(s->s3->server_opaque_prf_input);
1245                         if (s->s3->server_opaque_prf_input_len == 0)
1246                                 s->s3->server_opaque_prf_input = OPENSSL_malloc(1); /* dummy byte just to get non-NULL */
1247                         else
1248                                 s->s3->server_opaque_prf_input = BUF_memdup(sdata, s->s3->server_opaque_prf_input_len);
1249
1250                         if (s->s3->server_opaque_prf_input == NULL)
1251                                 {
1252                                 *al = TLS1_AD_INTERNAL_ERROR;
1253                                 return 0;
1254                                 }
1255                         }
1256 #endif
1257                 else if (type == TLSEXT_TYPE_status_request &&
1258                          s->version != DTLS1_VERSION)
1259                         {
1260                         /* MUST be empty and only sent if we've requested
1261                          * a status request message.
1262                          */
1263                         if ((s->tlsext_status_type == -1) || (size > 0))
1264                                 {
1265                                 *al = TLS1_AD_UNSUPPORTED_EXTENSION;
1266                                 return 0;
1267                                 }
1268                         /* Set flag to expect CertificateStatus message */
1269                         s->tlsext_status_expected = 1;
1270                         }
1271                 else if (type == TLSEXT_TYPE_renegotiate)
1272                         {
1273                         if(!ssl_parse_serverhello_renegotiate_ext(s, data, size, al))
1274                                 return 0;
1275                         renegotiate_seen = 1;
1276                         }
1277                 data+=size;
1278                 }
1279
1280         if (data != d+n)
1281                 {
1282                 *al = SSL_AD_DECODE_ERROR;
1283                 return 0;
1284                 }
1285
1286         if (!s->hit && tlsext_servername == 1)
1287                 {
1288                 if (s->tlsext_hostname)
1289                         {
1290                         if (s->session->tlsext_hostname == NULL)
1291                                 {
1292                                 s->session->tlsext_hostname = BUF_strdup(s->tlsext_hostname);
1293                                 if (!s->session->tlsext_hostname)
1294                                         {
1295                                         *al = SSL_AD_UNRECOGNIZED_NAME;
1296                                         return 0;
1297                                         }
1298                                 }
1299                         else
1300                                 {
1301                                 *al = SSL_AD_DECODE_ERROR;
1302                                 return 0;
1303                                 }
1304                         }
1305                 }
1306
1307         *p = data;
1308
1309         ri_check:
1310
1311         /* Determine if we need to see RI. Strictly speaking if we want to
1312          * avoid an attack we should *always* see RI even on initial server
1313          * hello because the client doesn't see any renegotiation during an
1314          * attack. However this would mean we could not connect to any server
1315          * which doesn't support RI so for the immediate future tolerate RI
1316          * absence on initial connect only.
1317          */
1318         if (!renegotiate_seen
1319                 && !(s->options & SSL_OP_LEGACY_SERVER_CONNECT)
1320                 && !(s->options & SSL_OP_ALLOW_UNSAFE_LEGACY_RENEGOTIATION))
1321                 {
1322                 *al = SSL_AD_HANDSHAKE_FAILURE;
1323                 SSLerr(SSL_F_SSL_PARSE_SERVERHELLO_TLSEXT,
1324                                 SSL_R_UNSAFE_LEGACY_RENEGOTIATION_DISABLED);
1325                 return 0;
1326                 }
1327
1328         return 1;
1329         }
1330
1331
1332 int ssl_prepare_clienthello_tlsext(SSL *s)
1333         {
1334 #ifndef OPENSSL_NO_EC
1335         /* If we are client and using an elliptic curve cryptography cipher suite, send the point formats
1336          * and elliptic curves we support.
1337          */
1338         int using_ecc = 0;
1339         int i;
1340         unsigned char *j;
1341         unsigned long alg_k, alg_a;
1342         STACK_OF(SSL_CIPHER) *cipher_stack = SSL_get_ciphers(s);
1343
1344         for (i = 0; i < sk_SSL_CIPHER_num(cipher_stack); i++)
1345                 {
1346                 SSL_CIPHER *c = sk_SSL_CIPHER_value(cipher_stack, i);
1347
1348                 alg_k = c->algorithm_mkey;
1349                 alg_a = c->algorithm_auth;
1350                 if ((alg_k & (SSL_kEECDH|SSL_kECDHr|SSL_kECDHe) || (alg_a & SSL_aECDSA)))
1351                         {
1352                         using_ecc = 1;
1353                         break;
1354                         }
1355                 }
1356         using_ecc = using_ecc && (s->version >= TLS1_VERSION);
1357         if (using_ecc)
1358                 {
1359                 if (s->tlsext_ecpointformatlist != NULL) OPENSSL_free(s->tlsext_ecpointformatlist);
1360                 if ((s->tlsext_ecpointformatlist = OPENSSL_malloc(3)) == NULL)
1361                         {
1362                         SSLerr(SSL_F_SSL_PREPARE_CLIENTHELLO_TLSEXT,ERR_R_MALLOC_FAILURE);
1363                         return -1;
1364                         }
1365                 s->tlsext_ecpointformatlist_length = 3;
1366                 s->tlsext_ecpointformatlist[0] = TLSEXT_ECPOINTFORMAT_uncompressed;
1367                 s->tlsext_ecpointformatlist[1] = TLSEXT_ECPOINTFORMAT_ansiX962_compressed_prime;
1368                 s->tlsext_ecpointformatlist[2] = TLSEXT_ECPOINTFORMAT_ansiX962_compressed_char2;
1369
1370                 /* we support all named elliptic curves in draft-ietf-tls-ecc-12 */
1371                 if (s->tlsext_ellipticcurvelist != NULL) OPENSSL_free(s->tlsext_ellipticcurvelist);
1372                 s->tlsext_ellipticcurvelist_length = sizeof(nid_list)/sizeof(nid_list[0]) * 2;
1373                 if ((s->tlsext_ellipticcurvelist = OPENSSL_malloc(s->tlsext_ellipticcurvelist_length)) == NULL)
1374                         {
1375                         s->tlsext_ellipticcurvelist_length = 0;
1376                         SSLerr(SSL_F_SSL_PREPARE_CLIENTHELLO_TLSEXT,ERR_R_MALLOC_FAILURE);
1377                         return -1;
1378                         }
1379                 for (i = 1, j = s->tlsext_ellipticcurvelist; (unsigned int)i <=
1380                                 sizeof(nid_list)/sizeof(nid_list[0]); i++)
1381                         s2n(i,j);
1382                 }
1383 #endif /* OPENSSL_NO_EC */
1384
1385 #ifdef TLSEXT_TYPE_opaque_prf_input
1386         {
1387                 int r = 1;
1388
1389                 if (s->ctx->tlsext_opaque_prf_input_callback != 0)
1390                         {
1391                         r = s->ctx->tlsext_opaque_prf_input_callback(s, NULL, 0, s->ctx->tlsext_opaque_prf_input_callback_arg);
1392                         if (!r)
1393                                 return -1;
1394                         }
1395
1396                 if (s->tlsext_opaque_prf_input != NULL)
1397                         {
1398                         if (s->s3->client_opaque_prf_input != NULL) /* shouldn't really happen */
1399                                 OPENSSL_free(s->s3->client_opaque_prf_input);
1400
1401                         if (s->tlsext_opaque_prf_input_len == 0)
1402                                 s->s3->client_opaque_prf_input = OPENSSL_malloc(1); /* dummy byte just to get non-NULL */
1403                         else
1404                                 s->s3->client_opaque_prf_input = BUF_memdup(s->tlsext_opaque_prf_input, s->tlsext_opaque_prf_input_len);
1405                         if (s->s3->client_opaque_prf_input == NULL)
1406                                 {
1407                                 SSLerr(SSL_F_SSL_PREPARE_CLIENTHELLO_TLSEXT,ERR_R_MALLOC_FAILURE);
1408                                 return -1;
1409                                 }
1410                         s->s3->client_opaque_prf_input_len = s->tlsext_opaque_prf_input_len;
1411                         }
1412
1413                 if (r == 2)
1414                         /* at callback's request, insist on receiving an appropriate server opaque PRF input */
1415                         s->s3->server_opaque_prf_input_len = s->tlsext_opaque_prf_input_len;
1416         }
1417 #endif
1418
1419         return 1;
1420         }
1421
1422 int ssl_prepare_serverhello_tlsext(SSL *s)
1423         {
1424 #ifndef OPENSSL_NO_EC
1425         /* If we are server and using an ECC cipher suite, send the point formats we support
1426          * if the client sent us an ECPointsFormat extension.  Note that the server is not
1427          * supposed to send an EllipticCurves extension.
1428          */
1429
1430         unsigned long alg_k = s->s3->tmp.new_cipher->algorithm_mkey;
1431         unsigned long alg_a = s->s3->tmp.new_cipher->algorithm_auth;
1432         int using_ecc = (alg_k & (SSL_kEECDH|SSL_kECDHr|SSL_kECDHe)) || (alg_a & SSL_aECDSA);
1433         using_ecc = using_ecc && (s->session->tlsext_ecpointformatlist != NULL);
1434
1435         if (using_ecc)
1436                 {
1437                 if (s->tlsext_ecpointformatlist != NULL) OPENSSL_free(s->tlsext_ecpointformatlist);
1438                 if ((s->tlsext_ecpointformatlist = OPENSSL_malloc(3)) == NULL)
1439                         {
1440                         SSLerr(SSL_F_SSL_PREPARE_SERVERHELLO_TLSEXT,ERR_R_MALLOC_FAILURE);
1441                         return -1;
1442                         }
1443                 s->tlsext_ecpointformatlist_length = 3;
1444                 s->tlsext_ecpointformatlist[0] = TLSEXT_ECPOINTFORMAT_uncompressed;
1445                 s->tlsext_ecpointformatlist[1] = TLSEXT_ECPOINTFORMAT_ansiX962_compressed_prime;
1446                 s->tlsext_ecpointformatlist[2] = TLSEXT_ECPOINTFORMAT_ansiX962_compressed_char2;
1447                 }
1448 #endif /* OPENSSL_NO_EC */
1449
1450         return 1;
1451         }
1452
1453 int ssl_check_clienthello_tlsext(SSL *s)
1454         {
1455         int ret=SSL_TLSEXT_ERR_NOACK;
1456         int al = SSL_AD_UNRECOGNIZED_NAME;
1457
1458 #ifndef OPENSSL_NO_EC
1459         /* The handling of the ECPointFormats extension is done elsewhere, namely in
1460          * ssl3_choose_cipher in s3_lib.c.
1461          */
1462         /* The handling of the EllipticCurves extension is done elsewhere, namely in
1463          * ssl3_choose_cipher in s3_lib.c.
1464          */
1465 #endif
1466
1467         if (s->ctx != NULL && s->ctx->tlsext_servername_callback != 0)
1468                 ret = s->ctx->tlsext_servername_callback(s, &al, s->ctx->tlsext_servername_arg);
1469         else if (s->initial_ctx != NULL && s->initial_ctx->tlsext_servername_callback != 0)
1470                 ret = s->initial_ctx->tlsext_servername_callback(s, &al, s->initial_ctx->tlsext_servername_arg);
1471
1472         /* If status request then ask callback what to do.
1473          * Note: this must be called after servername callbacks in case
1474          * the certificate has changed.
1475          */
1476         if ((s->tlsext_status_type != -1) && s->ctx && s->ctx->tlsext_status_cb)
1477                 {
1478                 int r;
1479                 r = s->ctx->tlsext_status_cb(s, s->ctx->tlsext_status_arg);
1480                 switch (r)
1481                         {
1482                         /* We don't want to send a status request response */
1483                         case SSL_TLSEXT_ERR_NOACK:
1484                                 s->tlsext_status_expected = 0;
1485                                 break;
1486                         /* status request response should be sent */
1487                         case SSL_TLSEXT_ERR_OK:
1488                                 if (s->tlsext_ocsp_resp)
1489                                         s->tlsext_status_expected = 1;
1490                                 else
1491                                         s->tlsext_status_expected = 0;
1492                                 break;
1493                         /* something bad happened */
1494                         case SSL_TLSEXT_ERR_ALERT_FATAL:
1495                                 ret = SSL_TLSEXT_ERR_ALERT_FATAL;
1496                                 al = SSL_AD_INTERNAL_ERROR;
1497                                 goto err;
1498                         }
1499                 }
1500         else
1501                 s->tlsext_status_expected = 0;
1502
1503 #ifdef TLSEXT_TYPE_opaque_prf_input
1504         {
1505                 /* This sort of belongs into ssl_prepare_serverhello_tlsext(),
1506                  * but we might be sending an alert in response to the client hello,
1507                  * so this has to happen here in ssl_check_clienthello_tlsext(). */
1508
1509                 int r = 1;
1510
1511                 if (s->ctx->tlsext_opaque_prf_input_callback != 0)
1512                         {
1513                         r = s->ctx->tlsext_opaque_prf_input_callback(s, NULL, 0, s->ctx->tlsext_opaque_prf_input_callback_arg);
1514                         if (!r)
1515                                 {
1516                                 ret = SSL_TLSEXT_ERR_ALERT_FATAL;
1517                                 al = SSL_AD_INTERNAL_ERROR;
1518                                 goto err;
1519                                 }
1520                         }
1521
1522                 if (s->s3->server_opaque_prf_input != NULL) /* shouldn't really happen */
1523                         OPENSSL_free(s->s3->server_opaque_prf_input);
1524                 s->s3->server_opaque_prf_input = NULL;
1525
1526                 if (s->tlsext_opaque_prf_input != NULL)
1527                         {
1528                         if (s->s3->client_opaque_prf_input != NULL &&
1529                                 s->s3->client_opaque_prf_input_len == s->tlsext_opaque_prf_input_len)
1530                                 {
1531                                 /* can only use this extension if we have a server opaque PRF input
1532                                  * of the same length as the client opaque PRF input! */
1533
1534                                 if (s->tlsext_opaque_prf_input_len == 0)
1535                                         s->s3->server_opaque_prf_input = OPENSSL_malloc(1); /* dummy byte just to get non-NULL */
1536                                 else
1537                                         s->s3->server_opaque_prf_input = BUF_memdup(s->tlsext_opaque_prf_input, s->tlsext_opaque_prf_input_len);
1538                                 if (s->s3->server_opaque_prf_input == NULL)
1539                                         {
1540                                         ret = SSL_TLSEXT_ERR_ALERT_FATAL;
1541                                         al = SSL_AD_INTERNAL_ERROR;
1542                                         goto err;
1543                                         }
1544                                 s->s3->server_opaque_prf_input_len = s->tlsext_opaque_prf_input_len;
1545                                 }
1546                         }
1547
1548                 if (r == 2 && s->s3->server_opaque_prf_input == NULL)
1549                         {
1550                         /* The callback wants to enforce use of the extension,
1551                          * but we can't do that with the client opaque PRF input;
1552                          * abort the handshake.
1553                          */
1554                         ret = SSL_TLSEXT_ERR_ALERT_FATAL;
1555                         al = SSL_AD_HANDSHAKE_FAILURE;
1556                         }
1557         }
1558
1559 #endif
1560  err:
1561         switch (ret)
1562                 {
1563                 case SSL_TLSEXT_ERR_ALERT_FATAL:
1564                         ssl3_send_alert(s,SSL3_AL_FATAL,al);
1565                         return -1;
1566
1567                 case SSL_TLSEXT_ERR_ALERT_WARNING:
1568                         ssl3_send_alert(s,SSL3_AL_WARNING,al);
1569                         return 1;
1570
1571                 case SSL_TLSEXT_ERR_NOACK:
1572                         s->servername_done=0;
1573                         default:
1574                 return 1;
1575                 }
1576         }
1577
1578 int ssl_check_serverhello_tlsext(SSL *s)
1579         {
1580         int ret=SSL_TLSEXT_ERR_NOACK;
1581         int al = SSL_AD_UNRECOGNIZED_NAME;
1582
1583 #ifndef OPENSSL_NO_EC
1584         /* If we are client and using an elliptic curve cryptography cipher
1585          * suite, then if server returns an EC point formats lists extension
1586          * it must contain uncompressed.
1587          */
1588         unsigned long alg_k = s->s3->tmp.new_cipher->algorithm_mkey;
1589         unsigned long alg_a = s->s3->tmp.new_cipher->algorithm_auth;
1590         if ((s->tlsext_ecpointformatlist != NULL) && (s->tlsext_ecpointformatlist_length > 0) &&
1591             (s->session->tlsext_ecpointformatlist != NULL) && (s->session->tlsext_ecpointformatlist_length > 0) &&
1592             ((alg_k & (SSL_kEECDH|SSL_kECDHr|SSL_kECDHe)) || (alg_a & SSL_aECDSA)))
1593                 {
1594                 /* we are using an ECC cipher */
1595                 size_t i;
1596                 unsigned char *list;
1597                 int found_uncompressed = 0;
1598                 list = s->session->tlsext_ecpointformatlist;
1599                 for (i = 0; i < s->session->tlsext_ecpointformatlist_length; i++)
1600                         {
1601                         if (*(list++) == TLSEXT_ECPOINTFORMAT_uncompressed)
1602                                 {
1603                                 found_uncompressed = 1;
1604                                 break;
1605                                 }
1606                         }
1607                 if (!found_uncompressed)
1608                         {
1609                         SSLerr(SSL_F_SSL_CHECK_SERVERHELLO_TLSEXT,SSL_R_TLS_INVALID_ECPOINTFORMAT_LIST);
1610                         return -1;
1611                         }
1612                 }
1613         ret = SSL_TLSEXT_ERR_OK;
1614 #endif /* OPENSSL_NO_EC */
1615
1616         if (s->ctx != NULL && s->ctx->tlsext_servername_callback != 0)
1617                 ret = s->ctx->tlsext_servername_callback(s, &al, s->ctx->tlsext_servername_arg);
1618         else if (s->initial_ctx != NULL && s->initial_ctx->tlsext_servername_callback != 0)
1619                 ret = s->initial_ctx->tlsext_servername_callback(s, &al, s->initial_ctx->tlsext_servername_arg);
1620
1621 #ifdef TLSEXT_TYPE_opaque_prf_input
1622         if (s->s3->server_opaque_prf_input_len > 0)
1623                 {
1624                 /* This case may indicate that we, as a client, want to insist on using opaque PRF inputs.
1625                  * So first verify that we really have a value from the server too. */
1626
1627                 if (s->s3->server_opaque_prf_input == NULL)
1628                         {
1629                         ret = SSL_TLSEXT_ERR_ALERT_FATAL;
1630                         al = SSL_AD_HANDSHAKE_FAILURE;
1631                         }
1632
1633                 /* Anytime the server *has* sent an opaque PRF input, we need to check
1634                  * that we have a client opaque PRF input of the same size. */
1635                 if (s->s3->client_opaque_prf_input == NULL ||
1636                     s->s3->client_opaque_prf_input_len != s->s3->server_opaque_prf_input_len)
1637                         {
1638                         ret = SSL_TLSEXT_ERR_ALERT_FATAL;
1639                         al = SSL_AD_ILLEGAL_PARAMETER;
1640                         }
1641                 }
1642 #endif
1643
1644         /* If we've requested certificate status and we wont get one
1645          * tell the callback
1646          */
1647         if ((s->tlsext_status_type != -1) && !(s->tlsext_status_expected)
1648                         && s->ctx && s->ctx->tlsext_status_cb)
1649                 {
1650                 int r;
1651                 /* Set resp to NULL, resplen to -1 so callback knows
1652                  * there is no response.
1653                  */
1654                 if (s->tlsext_ocsp_resp)
1655                         {
1656                         OPENSSL_free(s->tlsext_ocsp_resp);
1657                         s->tlsext_ocsp_resp = NULL;
1658                         }
1659                 s->tlsext_ocsp_resplen = -1;
1660                 r = s->ctx->tlsext_status_cb(s, s->ctx->tlsext_status_arg);
1661                 if (r == 0)
1662                         {
1663                         al = SSL_AD_BAD_CERTIFICATE_STATUS_RESPONSE;
1664                         ret = SSL_TLSEXT_ERR_ALERT_FATAL;
1665                         }
1666                 if (r < 0)
1667                         {
1668                         al = SSL_AD_INTERNAL_ERROR;
1669                         ret = SSL_TLSEXT_ERR_ALERT_FATAL;
1670                         }
1671                 }
1672
1673         switch (ret)
1674                 {
1675                 case SSL_TLSEXT_ERR_ALERT_FATAL:
1676                         ssl3_send_alert(s,SSL3_AL_FATAL,al);
1677                         return -1;
1678
1679                 case SSL_TLSEXT_ERR_ALERT_WARNING:
1680                         ssl3_send_alert(s,SSL3_AL_WARNING,al);
1681                         return 1;
1682
1683                 case SSL_TLSEXT_ERR_NOACK:
1684                         s->servername_done=0;
1685                         default:
1686                 return 1;
1687                 }
1688         }
1689
1690 /* Since the server cache lookup is done early on in the processing of client
1691  * hello and other operations depend on the result we need to handle any TLS
1692  * session ticket extension at the same time.
1693  */
1694
1695 int tls1_process_ticket(SSL *s, unsigned char *session_id, int len,
1696                                 const unsigned char *limit, SSL_SESSION **ret)
1697         {
1698         /* Point after session ID in client hello */
1699         const unsigned char *p = session_id + len;
1700         unsigned short i;
1701
1702         /* If tickets disabled behave as if no ticket present
1703          * to permit stateful resumption.
1704          */
1705         if (SSL_get_options(s) & SSL_OP_NO_TICKET)
1706                 return 1;
1707
1708         if ((s->version <= SSL3_VERSION) || !limit)
1709                 return 1;
1710         if (p >= limit)
1711                 return -1;
1712         /* Skip past DTLS cookie */
1713         if (s->version == DTLS1_VERSION || s->version == DTLS1_BAD_VER)
1714                 {
1715                 i = *(p++);
1716                 p+= i;
1717                 if (p >= limit)
1718                         return -1;
1719                 }
1720         /* Skip past cipher list */
1721         n2s(p, i);
1722         p+= i;
1723         if (p >= limit)
1724                 return -1;
1725         /* Skip past compression algorithm list */
1726         i = *(p++);
1727         p += i;
1728         if (p > limit)
1729                 return -1;
1730         /* Now at start of extensions */
1731         if ((p + 2) >= limit)
1732                 return 1;
1733         n2s(p, i);
1734         while ((p + 4) <= limit)
1735                 {
1736                 unsigned short type, size;
1737                 n2s(p, type);
1738                 n2s(p, size);
1739                 if (p + size > limit)
1740                         return 1;
1741                 if (type == TLSEXT_TYPE_session_ticket)
1742                         {
1743                         /* If tickets disabled indicate cache miss which will
1744                          * trigger a full handshake
1745                          */
1746                         if (SSL_get_options(s) & SSL_OP_NO_TICKET)
1747                                 return 1;
1748                         /* If zero length note client will accept a ticket
1749                          * and indicate cache miss to trigger full handshake
1750                          */
1751                         if (size == 0)
1752                                 {
1753                                 s->tlsext_ticket_expected = 1;
1754                                 return 0;       /* Cache miss */
1755                                 }
1756                         if (s->tls_session_secret_cb)
1757                                 {
1758                                 /* Indicate cache miss here and instead of
1759                                  * generating the session from ticket now,
1760                                  * trigger abbreviated handshake based on
1761                                  * external mechanism to calculate the master
1762                                  * secret later. */
1763                                 return 0;
1764                                 }
1765                         return tls_decrypt_ticket(s, p, size, session_id, len,
1766                                                                         ret);
1767                         }
1768                 p += size;
1769                 }
1770         return 1;
1771         }
1772
1773 static int tls_decrypt_ticket(SSL *s, const unsigned char *etick, int eticklen,
1774                                 const unsigned char *sess_id, int sesslen,
1775                                 SSL_SESSION **psess)
1776         {
1777         SSL_SESSION *sess;
1778         unsigned char *sdec;
1779         const unsigned char *p;
1780         int slen, mlen, renew_ticket = 0;
1781         unsigned char tick_hmac[EVP_MAX_MD_SIZE];
1782         HMAC_CTX hctx;
1783         EVP_CIPHER_CTX ctx;
1784         SSL_CTX *tctx = s->initial_ctx;
1785         /* Need at least keyname + iv + some encrypted data */
1786         if (eticklen < 48)
1787                 goto tickerr;
1788         /* Initialize session ticket encryption and HMAC contexts */
1789         HMAC_CTX_init(&hctx);
1790         EVP_CIPHER_CTX_init(&ctx);
1791         if (tctx->tlsext_ticket_key_cb)
1792                 {
1793                 unsigned char *nctick = (unsigned char *)etick;
1794                 int rv = tctx->tlsext_ticket_key_cb(s, nctick, nctick + 16,
1795                                                         &ctx, &hctx, 0);
1796                 if (rv < 0)
1797                         return -1;
1798                 if (rv == 0)
1799                         goto tickerr;
1800                 if (rv == 2)
1801                         renew_ticket = 1;
1802                 }
1803         else
1804                 {
1805                 /* Check key name matches */
1806                 if (memcmp(etick, tctx->tlsext_tick_key_name, 16))
1807                         goto tickerr;
1808                 HMAC_Init_ex(&hctx, tctx->tlsext_tick_hmac_key, 16,
1809                                         tlsext_tick_md(), NULL);
1810                 EVP_DecryptInit_ex(&ctx, EVP_aes_128_cbc(), NULL,
1811                                 tctx->tlsext_tick_aes_key, etick + 16);
1812                 }
1813         /* Attempt to process session ticket, first conduct sanity and
1814          * integrity checks on ticket.
1815          */
1816         mlen = HMAC_size(&hctx);
1817         if (mlen < 0)
1818                 {
1819                 EVP_CIPHER_CTX_cleanup(&ctx);
1820                 return -1;
1821                 }
1822         eticklen -= mlen;
1823         /* Check HMAC of encrypted ticket */
1824         HMAC_Update(&hctx, etick, eticklen);
1825         HMAC_Final(&hctx, tick_hmac, NULL);
1826         HMAC_CTX_cleanup(&hctx);
1827         if (memcmp(tick_hmac, etick + eticklen, mlen))
1828                 goto tickerr;
1829         /* Attempt to decrypt session data */
1830         /* Move p after IV to start of encrypted ticket, update length */
1831         p = etick + 16 + EVP_CIPHER_CTX_iv_length(&ctx);
1832         eticklen -= 16 + EVP_CIPHER_CTX_iv_length(&ctx);
1833         sdec = OPENSSL_malloc(eticklen);
1834         if (!sdec)
1835                 {
1836                 EVP_CIPHER_CTX_cleanup(&ctx);
1837                 return -1;
1838                 }
1839         EVP_DecryptUpdate(&ctx, sdec, &slen, p, eticklen);
1840         if (EVP_DecryptFinal(&ctx, sdec + slen, &mlen) <= 0)
1841                 goto tickerr;
1842         slen += mlen;
1843         EVP_CIPHER_CTX_cleanup(&ctx);
1844         p = sdec;
1845
1846         sess = d2i_SSL_SESSION(NULL, &p, slen);
1847         OPENSSL_free(sdec);
1848         if (sess)
1849                 {
1850                 /* The session ID if non-empty is used by some clients to
1851                  * detect that the ticket has been accepted. So we copy it to
1852                  * the session structure. If it is empty set length to zero
1853                  * as required by standard.
1854                  */
1855                 if (sesslen)
1856                         memcpy(sess->session_id, sess_id, sesslen);
1857                 sess->session_id_length = sesslen;
1858                 *psess = sess;
1859                 s->tlsext_ticket_expected = renew_ticket;
1860                 return 1;
1861                 }
1862         /* If session decrypt failure indicate a cache miss and set state to
1863          * send a new ticket
1864          */
1865         tickerr:
1866         s->tlsext_ticket_expected = 1;
1867         return 0;
1868         }
1869
1870 /* Tables to translate from NIDs to TLS v1.2 ids */
1871
1872 typedef struct
1873         {
1874         int nid;
1875         int id;
1876         } tls12_lookup;
1877
1878 static tls12_lookup tls12_md[] = {
1879 #ifndef OPENSSL_NO_MD5
1880         {NID_md5, TLSEXT_hash_md5},
1881 #endif
1882 #ifndef OPENSSL_NO_SHA
1883         {NID_sha1, TLSEXT_hash_sha1},
1884 #endif
1885 #ifndef OPENSSL_NO_SHA256
1886         {NID_sha224, TLSEXT_hash_sha224},
1887         {NID_sha256, TLSEXT_hash_sha256},
1888 #endif
1889 #ifndef OPENSSL_NO_SHA512
1890         {NID_sha384, TLSEXT_hash_sha384},
1891         {NID_sha512, TLSEXT_hash_sha512}
1892 #endif
1893 };
1894
1895 static tls12_lookup tls12_sig[] = {
1896 #ifndef OPENSSL_NO_RSA
1897         {EVP_PKEY_RSA, TLSEXT_signature_rsa},
1898 #endif
1899 #ifndef OPENSSL_NO_RSA
1900         {EVP_PKEY_DSA, TLSEXT_signature_dsa},
1901 #endif
1902 #ifndef OPENSSL_NO_ECDSA
1903         {EVP_PKEY_EC, TLSEXT_signature_ecdsa}
1904 #endif
1905 };
1906
1907 static int tls12_find_id(int nid, tls12_lookup *table, size_t tlen)
1908         {
1909         size_t i;
1910         for (i = 0; i < tlen; i++)
1911                 {
1912                 if (table[i].nid == nid)
1913                         return table[i].id;
1914                 }
1915         return -1;
1916         }
1917 #if 0
1918 static int tls12_find_nid(int id, tls12_lookup *table, size_t tlen)
1919         {
1920         size_t i;
1921         for (i = 0; i < tlen; i++)
1922                 {
1923                 if (table[i].id == id)
1924                         return table[i].nid;
1925                 }
1926         return -1;
1927         }
1928 #endif
1929
1930 int tls12_get_sigandhash(unsigned char *p, const EVP_PKEY *pk, const EVP_MD *md)
1931         {
1932         int sig_id, md_id;
1933         md_id = tls12_find_id(EVP_MD_type(md), tls12_md,
1934                                 sizeof(tls12_md)/sizeof(tls12_lookup));
1935         if (md_id == -1)
1936                 return 0;
1937         sig_id = tls12_get_sigid(pk);
1938         if (sig_id == -1)
1939                 return 0;
1940         p[0] = (unsigned char)md_id;
1941         p[1] = (unsigned char)sig_id;
1942         return 1;
1943         }
1944
1945 int tls12_get_sigid(const EVP_PKEY *pk)
1946         {
1947         return tls12_find_id(pk->type, tls12_sig,
1948                                 sizeof(tls12_sig)/sizeof(tls12_lookup));
1949         }
1950
1951 const EVP_MD *tls12_get_hash(unsigned char hash_alg)
1952         {
1953         switch(hash_alg)
1954                 {
1955 #ifndef OPENSSL_NO_MD5
1956                 case TLSEXT_hash_md5:
1957                 return EVP_md5();
1958 #endif
1959 #ifndef OPENSSL_NO_SHA
1960                 case TLSEXT_hash_sha1:
1961                 return EVP_sha1();
1962 #endif
1963 #ifndef OPENSSL_NO_SHA256
1964                 case TLSEXT_hash_sha224:
1965                 return EVP_sha224();
1966
1967                 case TLSEXT_hash_sha256:
1968                 return EVP_sha256();
1969 #endif
1970 #ifndef OPENSSL_NO_SHA512
1971                 case TLSEXT_hash_sha384:
1972                 return EVP_sha384();
1973
1974                 case TLSEXT_hash_sha512:
1975                 return EVP_sha512();
1976 #endif
1977                 default:
1978                 return NULL;
1979
1980                 }
1981         }
1982
1983 /* Set preferred digest for each key type */
1984
1985 int tls1_process_sigalgs(SSL *s, const unsigned char *data, int dsize)
1986         {
1987         int i, idx;
1988         const EVP_MD *md;
1989         CERT *c = s->cert;
1990         /* Extension ignored for TLS versions below 1.2 */
1991         if (s->version < TLS1_2_VERSION)
1992                 return 1;
1993         /* Should never happen */
1994         if (!c)
1995                 return 0;
1996
1997         c->pkeys[SSL_PKEY_DSA_SIGN].digest = NULL;
1998         c->pkeys[SSL_PKEY_RSA_SIGN].digest = NULL;
1999         c->pkeys[SSL_PKEY_RSA_ENC].digest = NULL;
2000         c->pkeys[SSL_PKEY_ECC].digest = NULL;
2001
2002         for (i = 0; i < dsize; i += 2)
2003                 {
2004                 unsigned char hash_alg = data[i], sig_alg = data[i+1];
2005
2006                 switch(sig_alg)
2007                         {
2008 #ifndef OPENSSL_NO_RSA
2009                         case TLSEXT_signature_rsa:
2010                         idx = SSL_PKEY_RSA_SIGN;
2011                         break;
2012 #endif
2013 #ifndef OPENSSL_NO_DSA
2014                         case TLSEXT_signature_dsa:
2015                         idx = SSL_PKEY_DSA_SIGN;
2016                         break;
2017 #endif
2018 #ifndef OPENSSL_NO_ECDSA
2019                         case TLSEXT_signature_ecdsa:
2020                         idx = SSL_PKEY_ECC;
2021                         break;
2022 #endif
2023                         default:
2024                         continue;
2025                         }
2026
2027                 if (c->pkeys[idx].digest == NULL)
2028                         {
2029                         md = tls12_get_hash(hash_alg);
2030                         if (md)
2031                                 {
2032                                 c->pkeys[idx].digest = md;
2033                                 if (idx == SSL_PKEY_RSA_SIGN)
2034                                         c->pkeys[SSL_PKEY_RSA_ENC].digest = md;
2035                                 }
2036                         }
2037
2038                 }
2039
2040
2041         /* Set any remaining keys to default values. NOTE: if alg is not
2042          * supported it stays as NULL.
2043          */
2044 #ifndef OPENSSL_NO_DSA
2045         if (!c->pkeys[SSL_PKEY_DSA_SIGN].digest)
2046                 c->pkeys[SSL_PKEY_DSA_SIGN].digest = EVP_dss1();
2047 #endif
2048 #ifndef OPENSSL_NO_RSA
2049         if (!c->pkeys[SSL_PKEY_RSA_SIGN].digest)
2050                 {
2051                 c->pkeys[SSL_PKEY_RSA_SIGN].digest = EVP_sha1();
2052                 c->pkeys[SSL_PKEY_RSA_ENC].digest = EVP_sha1();
2053                 }
2054 #endif
2055 #ifndef OPENSSL_NO_ECDSA
2056         if (!c->pkeys[SSL_PKEY_ECC].digest)
2057                 c->pkeys[SSL_PKEY_ECC].digest = EVP_ecdsa();
2058 #endif
2059         return 1;
2060         }
2061
2062 #endif