ssl/t1_lib.c

   1 /* ssl/t1_lib.c */
   2 /* Copyright (C) 1995-1998 Eric Young (eay@cryptsoft.com)
   3  * All rights reserved.
   4  *
   5  * This package is an SSL implementation written
   6  * by Eric Young (eay@cryptsoft.com).
   7  * The implementation was written so as to conform with Netscapes SSL.
   8  *
   9  * This library is free for commercial and non-commercial use as long as
  10  * the following conditions are aheared to.  The following conditions
  11  * apply to all code found in this distribution, be it the RC4, RSA,
  12  * lhash, DES, etc., code; not just the SSL code.  The SSL documentation
  13  * included with this distribution is covered by the same copyright terms
  14  * except that the holder is Tim Hudson (tjh@cryptsoft.com).
  15  *
  16  * Copyright remains Eric Young's, and as such any Copyright notices in
  17  * the code are not to be removed.
  18  * If this package is used in a product, Eric Young should be given attribution
  19  * as the author of the parts of the library used.
  20  * This can be in the form of a textual message at program startup or
  21  * in documentation (online or textual) provided with the package.
  22  *
  23  * Redistribution and use in source and binary forms, with or without
  24  * modification, are permitted provided that the following conditions
  25  * are met:
  26  * 1. Redistributions of source code must retain the copyright
  27  *    notice, this list of conditions and the following disclaimer.
  28  * 2. Redistributions in binary form must reproduce the above copyright
  29  *    notice, this list of conditions and the following disclaimer in the
  30  *    documentation and/or other materials provided with the distribution.
  31  * 3. All advertising materials mentioning features or use of this software
  32  *    must display the following acknowledgement:
  33  *    "This product includes cryptographic software written by
  34  *     Eric Young (eay@cryptsoft.com)"
  35  *    The word 'cryptographic' can be left out if the rouines from the library
  36  *    being used are not cryptographic related :-).
  37  * 4. If you include any Windows specific code (or a derivative thereof) from
  38  *    the apps directory (application code) you must include an acknowledgement:
  39  *    "This product includes software written by Tim Hudson (tjh@cryptsoft.com)"
  40  *
  41  * THIS SOFTWARE IS PROVIDED BY ERIC YOUNG ``AS IS'' AND
  42  * ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
  43  * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE
  44  * ARE DISCLAIMED.  IN NO EVENT SHALL THE AUTHOR OR CONTRIBUTORS BE LIABLE
  45  * FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL
  46  * DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS
  47  * OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION)
  48  * HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT
  49  * LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY
  50  * OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF
  51  * SUCH DAMAGE.
  52  *
  53  * The licence and distribution terms for any publically available version or
  54  * derivative of this code cannot be changed.  i.e. this code cannot simply be
  55  * copied and put under another distribution licence
  56  * [including the GNU Public Licence.]
  57  */
  58 /* ====================================================================
  59  * Copyright (c) 1998-2007 The OpenSSL Project.  All rights reserved.
  60  *
  61  * Redistribution and use in source and binary forms, with or without
  62  * modification, are permitted provided that the following conditions
  63  * are met:
  64  *
  65  * 1. Redistributions of source code must retain the above copyright
  66  *    notice, this list of conditions and the following disclaimer.
  67  *
  68  * 2. Redistributions in binary form must reproduce the above copyright
  69  *    notice, this list of conditions and the following disclaimer in
  70  *    the documentation and/or other materials provided with the
  71  *    distribution.
  72  *
  73  * 3. All advertising materials mentioning features or use of this
  74  *    software must display the following acknowledgment:
  75  *    "This product includes software developed by the OpenSSL Project
  76  *    for use in the OpenSSL Toolkit. (http://www.openssl.org/)"
  77  *
  78  * 4. The names "OpenSSL Toolkit" and "OpenSSL Project" must not be used to
  79  *    endorse or promote products derived from this software without
  80  *    prior written permission. For written permission, please contact
  81  *    openssl-core@openssl.org.
  82  *
  83  * 5. Products derived from this software may not be called "OpenSSL"
  84  *    nor may "OpenSSL" appear in their names without prior written
  85  *    permission of the OpenSSL Project.
  86  *
  87  * 6. Redistributions of any form whatsoever must retain the following
  88  *    acknowledgment:
  89  *    "This product includes software developed by the OpenSSL Project
  90  *    for use in the OpenSSL Toolkit (http://www.openssl.org/)"
  91  *
  92  * THIS SOFTWARE IS PROVIDED BY THE OpenSSL PROJECT ``AS IS'' AND ANY
  93  * EXPRESSED OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
  94  * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
  95  * PURPOSE ARE DISCLAIMED.  IN NO EVENT SHALL THE OpenSSL PROJECT OR
  96  * ITS CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL,
  97  * SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT
  98  * NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES;
  99  * LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION)
 100  * HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT,
 101  * STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE)
 102  * ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED
 103  * OF THE POSSIBILITY OF SUCH DAMAGE.
 104  * ====================================================================
 105  *
 106  * This product includes cryptographic software written by Eric Young
 107  * (eay@cryptsoft.com).  This product includes software written by Tim
 108  * Hudson (tjh@cryptsoft.com).
 109  *
 110  */
 111
 112 #include <stdio.h>
 113 #include <openssl/objects.h>
 114 #include <openssl/evp.h>
 115 #include <openssl/hmac.h>
 116 #include <openssl/ocsp.h>
 117 #include <openssl/rand.h>
 118 #include "ssl_locl.h"
 119
 120 const char tls1_version_str[]="TLSv1" OPENSSL_VERSION_PTEXT;
 121
 122 #ifndef OPENSSL_NO_TLSEXT
 123 static int tls_decrypt_ticket(SSL *s, const unsigned char *tick, int ticklen,
 124                                 const unsigned char *sess_id, int sesslen,
 125                                 SSL_SESSION **psess);
 126 static int ssl_check_clienthello_tlsext_early(SSL *s);
 127 int ssl_check_serverhello_tlsext(SSL *s);
 128 #endif
 129
 130 SSL3_ENC_METHOD TLSv1_enc_data={
 131         tls1_enc,
 132         tls1_mac,
 133         tls1_setup_key_block,
 134         tls1_generate_master_secret,
 135         tls1_change_cipher_state,
 136         tls1_final_finish_mac,
 137         TLS1_FINISH_MAC_LENGTH,
 138         tls1_cert_verify_mac,
 139         TLS_MD_CLIENT_FINISH_CONST,TLS_MD_CLIENT_FINISH_CONST_SIZE,
 140         TLS_MD_SERVER_FINISH_CONST,TLS_MD_SERVER_FINISH_CONST_SIZE,
 141         tls1_alert_code,
 142         tls1_export_keying_material,
 143         };
 144
 145 long tls1_default_timeout(void)
 146         {
 147         /* 2 hours, the 24 hours mentioned in the TLSv1 spec
 148          * is way too long for http, the cache would over fill */
 149         return(60*60*2);
 150         }
 151
 152 int tls1_new(SSL *s)
 153         {
 154         if (!ssl3_new(s)) return(0);
 155         s->method->ssl_clear(s);
 156         return(1);
 157         }
 158
 159 void tls1_free(SSL *s)
 160         {
 161 #ifndef OPENSSL_NO_TLSEXT
 162         if (s->tlsext_session_ticket)
 163                 {
 164                 OPENSSL_free(s->tlsext_session_ticket);
 165                 }
 166 #endif /* OPENSSL_NO_TLSEXT */
 167         ssl3_free(s);
 168         }
 169
 170 void tls1_clear(SSL *s)
 171         {
 172         ssl3_clear(s);
 173         s->version = s->method->version;
 174         }
 175
 176 #ifndef OPENSSL_NO_EC
 177
 178 static int nid_list[] =
 179         {
 180                 NID_sect163k1, /* sect163k1 (1) */
 181                 NID_sect163r1, /* sect163r1 (2) */
 182                 NID_sect163r2, /* sect163r2 (3) */
 183                 NID_sect193r1, /* sect193r1 (4) */
 184                 NID_sect193r2, /* sect193r2 (5) */
 185                 NID_sect233k1, /* sect233k1 (6) */
 186                 NID_sect233r1, /* sect233r1 (7) */
 187                 NID_sect239k1, /* sect239k1 (8) */
 188                 NID_sect283k1, /* sect283k1 (9) */
 189                 NID_sect283r1, /* sect283r1 (10) */
 190                 NID_sect409k1, /* sect409k1 (11) */
 191                 NID_sect409r1, /* sect409r1 (12) */
 192                 NID_sect571k1, /* sect571k1 (13) */
 193                 NID_sect571r1, /* sect571r1 (14) */
 194                 NID_secp160k1, /* secp160k1 (15) */
 195                 NID_secp160r1, /* secp160r1 (16) */
 196                 NID_secp160r2, /* secp160r2 (17) */
 197                 NID_secp192k1, /* secp192k1 (18) */
 198                 NID_X9_62_prime192v1, /* secp192r1 (19) */
 199                 NID_secp224k1, /* secp224k1 (20) */
 200                 NID_secp224r1, /* secp224r1 (21) */
 201                 NID_secp256k1, /* secp256k1 (22) */
 202                 NID_X9_62_prime256v1, /* secp256r1 (23) */
 203                 NID_secp384r1, /* secp384r1 (24) */
 204                 NID_secp521r1  /* secp521r1 (25) */
 205         };
 206
 207
 208 static const unsigned char ecformats_default[] =
 209         {
 210         TLSEXT_ECPOINTFORMAT_uncompressed,
 211         TLSEXT_ECPOINTFORMAT_ansiX962_compressed_prime,
 212         TLSEXT_ECPOINTFORMAT_ansiX962_compressed_char2
 213         };
 214
 215 static const unsigned char eccurves_default[] =
 216         {
 217                 0,14, /* sect571r1 (14) */
 218                 0,13, /* sect571k1 (13) */
 219                 0,25, /* secp521r1 (25) */
 220                 0,11, /* sect409k1 (11) */
 221                 0,12, /* sect409r1 (12) */
 222                 0,24, /* secp384r1 (24) */
 223                 0,9,  /* sect283k1 (9) */
 224                 0,10, /* sect283r1 (10) */
 225                 0,22, /* secp256k1 (22) */
 226                 0,23, /* secp256r1 (23) */
 227                 0,8,  /* sect239k1 (8) */
 228                 0,6,  /* sect233k1 (6) */
 229                 0,7,  /* sect233r1 (7) */
 230                 0,20, /* secp224k1 (20) */
 231                 0,21, /* secp224r1 (21) */
 232                 0,4,  /* sect193r1 (4) */
 233                 0,5,  /* sect193r2 (5) */
 234                 0,18, /* secp192k1 (18) */
 235                 0,19, /* secp192r1 (19) */
 236                 0,1,  /* sect163k1 (1) */
 237                 0,2,  /* sect163r1 (2) */
 238                 0,3,  /* sect163r2 (3) */
 239                 0,15, /* secp160k1 (15) */
 240                 0,16, /* secp160r1 (16) */
 241                 0,17, /* secp160r2 (17) */
 242         };
 243
 244 int tls1_ec_curve_id2nid(int curve_id)
 245         {
 246         /* ECC curves from draft-ietf-tls-ecc-12.txt (Oct. 17, 2005) */
 247         if ((curve_id < 1) || ((unsigned int)curve_id >
 248                                 sizeof(nid_list)/sizeof(nid_list[0])))
 249                 return 0;
 250         return nid_list[curve_id-1];
 251         }
 252
 253 int tls1_ec_nid2curve_id(int nid)
 254         {
 255         /* ECC curves from draft-ietf-tls-ecc-12.txt (Oct. 17, 2005) */
 256         switch (nid)
 257                 {
 258         case NID_sect163k1: /* sect163k1 (1) */
 259                 return 1;
 260         case NID_sect163r1: /* sect163r1 (2) */
 261                 return 2;
 262         case NID_sect163r2: /* sect163r2 (3) */
 263                 return 3;
 264         case NID_sect193r1: /* sect193r1 (4) */
 265                 return 4;
 266         case NID_sect193r2: /* sect193r2 (5) */
 267                 return 5;
 268         case NID_sect233k1: /* sect233k1 (6) */
 269                 return 6;
 270         case NID_sect233r1: /* sect233r1 (7) */
 271                 return 7;
 272         case NID_sect239k1: /* sect239k1 (8) */
 273                 return 8;
 274         case NID_sect283k1: /* sect283k1 (9) */
 275                 return 9;
 276         case NID_sect283r1: /* sect283r1 (10) */
 277                 return 10;
 278         case NID_sect409k1: /* sect409k1 (11) */
 279                 return 11;
 280         case NID_sect409r1: /* sect409r1 (12) */
 281                 return 12;
 282         case NID_sect571k1: /* sect571k1 (13) */
 283                 return 13;
 284         case NID_sect571r1: /* sect571r1 (14) */
 285                 return 14;
 286         case NID_secp160k1: /* secp160k1 (15) */
 287                 return 15;
 288         case NID_secp160r1: /* secp160r1 (16) */
 289                 return 16;
 290         case NID_secp160r2: /* secp160r2 (17) */
 291                 return 17;
 292         case NID_secp192k1: /* secp192k1 (18) */
 293                 return 18;
 294         case NID_X9_62_prime192v1: /* secp192r1 (19) */
 295                 return 19;
 296         case NID_secp224k1: /* secp224k1 (20) */
 297                 return 20;
 298         case NID_secp224r1: /* secp224r1 (21) */
 299                 return 21;
 300         case NID_secp256k1: /* secp256k1 (22) */
 301                 return 22;
 302         case NID_X9_62_prime256v1: /* secp256r1 (23) */
 303                 return 23;
 304         case NID_secp384r1: /* secp384r1 (24) */
 305                 return 24;
 306         case NID_secp521r1:  /* secp521r1 (25) */
 307                 return 25;
 308         default:
 309                 return 0;
 310                 }
 311         }
 312 /* Get curves list, if "sess" is set return client curves otherwise
 313  * preferred list
 314  */
 315 static void tls1_get_curvelist(SSL *s, int sess,
 316                                         const unsigned char **pcurves,
 317                                         size_t *pcurveslen)
 318         {
 319         if (sess)
 320                 {
 321                 *pcurves = s->session->tlsext_ellipticcurvelist;
 322                 *pcurveslen = s->session->tlsext_ellipticcurvelist_length;
 323                 }
 324         else
 325                 {
 326                 *pcurves = s->tlsext_ellipticcurvelist;
 327                 *pcurveslen = s->tlsext_ellipticcurvelist_length;
 328                 }
 329         /* If not set use default: for now static structure */
 330         if (!*pcurves)
 331                 {
 332                 *pcurves = eccurves_default;
 333                 *pcurveslen = sizeof(eccurves_default);
 334                 }
 335         }
 336
 337 /* Return nth shared curve. If nmatch == -1 return number of
 338  * matches.
 339  */
 340
 341 int tls1_shared_curve(SSL *s, int nmatch)
 342         {
 343         const unsigned char *pref, *supp;
 344         size_t preflen, supplen, i, j;
 345         int k;
 346         /* Can't do anything on client side */
 347         if (s->server == 0)
 348                 return -1;
 349         tls1_get_curvelist(s, !!(s->options & SSL_OP_CIPHER_SERVER_PREFERENCE),
 350                                 &supp, &supplen);
 351         tls1_get_curvelist(s, !(s->options & SSL_OP_CIPHER_SERVER_PREFERENCE),
 352                                 &pref, &preflen);
 353         preflen /= 2;
 354         supplen /= 2;
 355         k = 0;
 356         for (i = 0; i < preflen; i++, pref+=2)
 357                 {
 358                 const unsigned char *tsupp = supp;
 359                 for (j = 0; j < supplen; j++, tsupp+=2)
 360                         {
 361                         if (pref[0] == tsupp[0] && pref[1] == tsupp[1])
 362                                 {
 363                                 if (nmatch == k)
 364                                         {
 365                                         int id = (pref[0] << 8) | pref[1];
 366                                         return tls1_ec_curve_id2nid(id);
 367                                         }
 368                                 k++;
 369                                 }
 370                         }
 371                 }
 372         if (nmatch == -1)
 373                 return k;
 374         return 0;
 375         }
 376
 377 int tls1_set_curves(unsigned char **pext, size_t *pextlen,
 378                         int *curves, size_t ncurves)
 379         {
 380         unsigned char *clist, *p;
 381         size_t i;
 382         /* Bitmap of curves included to detect duplicates: only works
 383          * while curve ids < 32
 384          */
 385         unsigned long dup_list = 0;
 386         clist = OPENSSL_malloc(ncurves * 2);
 387         if (!clist)
 388                 return 0;
 389         for (i = 0, p = clist; i < ncurves; i++)
 390                 {
 391                 unsigned long idmask;
 392                 int id;
 393                 id = tls1_ec_nid2curve_id(curves[i]);
 394                 idmask = 1L << id;
 395                 if (!id || (dup_list & idmask))
 396                         {
 397                         OPENSSL_free(clist);
 398                         return 0;
 399                         }
 400                 dup_list |= idmask;
 401                 s2n(id, p);
 402                 }
 403         if (*pext)
 404                 OPENSSL_free(*pext);
 405         *pext = clist;
 406         *pextlen = ncurves * 2;
 407         return 1;
 408         }
 409
 410 #define MAX_CURVELIST   25
 411
 412 typedef struct
 413         {
 414         size_t nidcnt;
 415         int nid_arr[MAX_CURVELIST];
 416         } nid_cb_st;
 417
 418 static int nid_cb(const char *elem, int len, void *arg)
 419         {
 420         nid_cb_st *narg = arg;
 421         size_t i;
 422         int nid;
 423         char etmp[20];
 424         if (narg->nidcnt == MAX_CURVELIST)
 425                 return 0;
 426         if (len > (int)(sizeof(etmp) - 1))
 427                 return 0;
 428         memcpy(etmp, elem, len);
 429         etmp[len] = 0;
 430         nid = EC_curve_nist2nid(etmp);
 431         if (nid == NID_undef)
 432                 nid = OBJ_sn2nid(etmp);
 433         if (nid == NID_undef)
 434                 nid = OBJ_ln2nid(etmp);
 435         if (nid == NID_undef)
 436                 return 0;
 437         for (i = 0; i < narg->nidcnt; i++)
 438                 if (narg->nid_arr[i] == nid)
 439                         return 0;
 440         narg->nid_arr[narg->nidcnt++] = nid;
 441         return 1;
 442         }
 443 /* Set curves based on a colon separate list */
 444 int tls1_set_curves_list(unsigned char **pext, size_t *pextlen,
 445                                 const char *str)
 446         {
 447         nid_cb_st ncb;
 448         ncb.nidcnt = 0;
 449         if (!CONF_parse_list(str, ':', 1, nid_cb, &ncb))
 450                 return 0;
 451         return tls1_set_curves(pext, pextlen, ncb.nid_arr, ncb.nidcnt);
 452         }
 453 /* For an EC key set TLS id and required compression based on parameters */
 454 static int tls1_set_ec_id(unsigned char *curve_id, unsigned char *comp_id,
 455                                 EC_KEY *ec)
 456         {
 457         int is_prime, id;
 458         const EC_GROUP *grp;
 459         const EC_POINT *pt;
 460         const EC_METHOD *meth;
 461         if (!ec)
 462                 return 0;
 463         /* Determine if it is a prime field */
 464         grp = EC_KEY_get0_group(ec);
 465         pt = EC_KEY_get0_public_key(ec);
 466         if (!grp || !pt)
 467                 return 0;
 468         meth = EC_GROUP_method_of(grp);
 469         if (!meth)
 470                 return 0;
 471         if (EC_METHOD_get_field_type(meth) == NID_X9_62_prime_field)
 472                 is_prime = 1;
 473         else
 474                 is_prime = 0;
 475         /* Determine curve ID */
 476         id = EC_GROUP_get_curve_name(grp);
 477         id = tls1_ec_nid2curve_id(id);
 478         /* If we have an ID set it, otherwise set arbitrary explicit curve */
 479         if (id)
 480                 {
 481                 curve_id[0] = 0;
 482                 curve_id[1] = (unsigned char)id;
 483                 }
 484         else
 485                 {
 486                 curve_id[0] = 0xff;
 487                 if (is_prime)
 488                         curve_id[1] = 0x01;
 489                 else
 490                         curve_id[1] = 0x02;
 491                 }
 492         if (comp_id)
 493                 {
 494                 if (EC_KEY_get_conv_form(ec) == POINT_CONVERSION_COMPRESSED)
 495                         {
 496                         if (is_prime)
 497                                 *comp_id = TLSEXT_ECPOINTFORMAT_ansiX962_compressed_prime;
 498                         else
 499                                 *comp_id = TLSEXT_ECPOINTFORMAT_ansiX962_compressed_char2;
 500                         }
 501                 else
 502                         *comp_id = TLSEXT_ECPOINTFORMAT_uncompressed;
 503                 }
 504         return 1;
 505         }
 506 /* Check an EC key is compatible with extensions */
 507 static int tls1_check_ec_key(SSL *s,
 508                         unsigned char *curve_id, unsigned char *comp_id)
 509         {
 510         const unsigned char *p;
 511         size_t plen, i;
 512         int j;
 513         /* If point formats extension present check it, otherwise everything
 514          * is supported (see RFC4492).
 515          */
 516         if (comp_id && s->session->tlsext_ecpointformatlist)
 517                 {
 518                 p = s->session->tlsext_ecpointformatlist;
 519                 plen = s->session->tlsext_ecpointformatlist_length;
 520                 for (i = 0; i < plen; i++, p++)
 521                         {
 522                         if (*comp_id == *p)
 523                                 break;
 524                         }
 525                 if (i == plen)
 526                         return 0;
 527                 }
 528         /* Check curve is consistent with client and server preferences */
 529         for (j = 0; j <= 1; j++)
 530                 {
 531                 tls1_get_curvelist(s, j, &p, &plen);
 532                 for (i = 0; i < plen; i+=2, p+=2)
 533                         {
 534                         if (p[0] == curve_id[0] && p[1] == curve_id[1])
 535                                 break;
 536                         }
 537                 if (i == plen)
 538                         return 0;
 539                 }
 540         return 1;
 541         }
 542
 543 /* Check cert parameters compatible with extensions: currently just checks
 544  * EC certificates have compatible curves and compression.
 545  */
 546 static int tls1_check_cert_param(SSL *s, X509 *x)
 547         {
 548         unsigned char comp_id, curve_id[2];
 549         EVP_PKEY *pkey;
 550         int rv;
 551         pkey = X509_get_pubkey(x);
 552         if (!pkey)
 553                 return 0;
 554         /* If not EC nothing to do */
 555         if (pkey->type != EVP_PKEY_EC)
 556                 {
 557                 EVP_PKEY_free(pkey);
 558                 return 1;
 559                 }
 560         rv = tls1_set_ec_id(curve_id, &comp_id, pkey->pkey.ec);
 561         EVP_PKEY_free(pkey);
 562         if (!rv)
 563                 return 0;
 564         return tls1_check_ec_key(s, curve_id, &comp_id);
 565         }
 566 /* Check EC temporary key is compatible with client extensions */
 567 int tls1_check_ec_tmp_key(SSL *s)
 568         {
 569         unsigned char curve_id[2];
 570         EC_KEY *ec = s->cert->ecdh_tmp;
 571         if (s->cert->ecdh_tmp_auto)
 572                 {
 573                 /* Need a shared curve */
 574                 if (tls1_shared_curve(s, 0))
 575                         return 1;
 576                 else return 0;
 577                 }
 578         if (!ec)
 579                 {
 580                 if (s->cert->ecdh_tmp_cb)
 581                         return 1;
 582                 else
 583                         return 0;
 584                 }
 585         if (!tls1_set_ec_id(curve_id, NULL, ec))
 586                 return 1;
 587         return tls1_check_ec_key(s, curve_id, NULL);
 588         }
 589
 590 #endif /* OPENSSL_NO_EC */
 591
 592 #ifndef OPENSSL_NO_TLSEXT
 593
 594 /* List of supported signature algorithms and hashes. Should make this
 595  * customisable at some point, for now include everything we support.
 596  */
 597
 598 #ifdef OPENSSL_NO_RSA
 599 #define tlsext_sigalg_rsa(md) /* */
 600 #else
 601 #define tlsext_sigalg_rsa(md) md, TLSEXT_signature_rsa,
 602 #endif
 603
 604 #ifdef OPENSSL_NO_DSA
 605 #define tlsext_sigalg_dsa(md) /* */
 606 #else
 607 #define tlsext_sigalg_dsa(md) md, TLSEXT_signature_dsa,
 608 #endif
 609
 610 #ifdef OPENSSL_NO_ECDSA
 611 #define tlsext_sigalg_ecdsa(md) /* */
 612 #else
 613 #define tlsext_sigalg_ecdsa(md) md, TLSEXT_signature_ecdsa,
 614 #endif
 615
 616 #define tlsext_sigalg(md) \
 617                 tlsext_sigalg_rsa(md) \
 618                 tlsext_sigalg_dsa(md) \
 619                 tlsext_sigalg_ecdsa(md)
 620
 621 static unsigned char tls12_sigalgs[] = {
 622 #ifndef OPENSSL_NO_SHA512
 623         tlsext_sigalg(TLSEXT_hash_sha512)
 624         tlsext_sigalg(TLSEXT_hash_sha384)
 625 #endif
 626 #ifndef OPENSSL_NO_SHA256
 627         tlsext_sigalg(TLSEXT_hash_sha256)
 628         tlsext_sigalg(TLSEXT_hash_sha224)
 629 #endif
 630 #ifndef OPENSSL_NO_SHA
 631         tlsext_sigalg(TLSEXT_hash_sha1)
 632 #endif
 633 #ifndef OPENSSL_NO_MD5
 634         tlsext_sigalg_rsa(TLSEXT_hash_md5)
 635 #endif
 636 };
 637
 638 size_t tls12_get_sig_algs(SSL *s, unsigned char *p)
 639         {
 640         const unsigned char *sigs;
 641         size_t sigslen;
 642         sigs = s->cert->conf_sigalgs;
 643
 644         if (sigs)
 645                 sigslen = s->cert->conf_sigalgslen;
 646         else
 647                 {
 648                 sigs = tls12_sigalgs;
 649                 sigslen = sizeof(tls12_sigalgs);
 650 #ifdef OPENSSL_FIPS
 651                 /* If FIPS mode don't include MD5 which is last */
 652                 if (FIPS_mode())
 653                         sigslen -= 2;
 654 #endif
 655                 }
 656
 657         if (p)
 658                 memcpy(p, sigs, sigslen);
 659         return sigslen;
 660         }
 661
 662 /* byte_compare is a compare function for qsort(3) that compares bytes. */
 663 static int byte_compare(const void *in_a, const void *in_b)
 664         {
 665         unsigned char a = *((const unsigned char*) in_a);
 666         unsigned char b = *((const unsigned char*) in_b);
 667
 668         if (a > b)
 669                 return 1;
 670         else if (a < b)
 671                 return -1;
 672         return 0;
 673 }
 674
 675 unsigned char *ssl_add_clienthello_tlsext(SSL *s, unsigned char *p, unsigned char *limit)
 676         {
 677         int extdatalen=0;
 678         unsigned char *ret = p;
 679 #ifndef OPENSSL_NO_EC
 680         /* See if we support any ECC ciphersuites */
 681         int using_ecc = 0;
 682         if (s->version != DTLS1_VERSION && s->version >= TLS1_VERSION)
 683                 {
 684                 int i;
 685                 unsigned long alg_k, alg_a;
 686                 STACK_OF(SSL_CIPHER) *cipher_stack = SSL_get_ciphers(s);
 687
 688                 for (i = 0; i < sk_SSL_CIPHER_num(cipher_stack); i++)
 689                         {
 690                         SSL_CIPHER *c = sk_SSL_CIPHER_value(cipher_stack, i);
 691
 692                         alg_k = c->algorithm_mkey;
 693                         alg_a = c->algorithm_auth;
 694                         if ((alg_k & (SSL_kEECDH|SSL_kECDHr|SSL_kECDHe)
 695                                 || (alg_a & SSL_aECDSA)))
 696                                 {
 697                                 using_ecc = 1;
 698                                 break;
 699                                 }
 700                         }
 701                 }
 702 #endif
 703
 704         /* don't add extensions for SSLv3 unless doing secure renegotiation */
 705         if (s->client_version == SSL3_VERSION
 706                                         && !s->s3->send_connection_binding)
 707                 return p;
 708
 709         ret+=2;
 710
 711         if (ret>=limit) return NULL; /* this really never occurs, but ... */
 712
 713         if (s->tlsext_hostname != NULL)
 714                 {
 715                 /* Add TLS extension servername to the Client Hello message */
 716                 unsigned long size_str;
 717                 long lenmax;
 718
 719                 /* check for enough space.
 720                    4 for the servername type and entension length
 721                    2 for servernamelist length
 722                    1 for the hostname type
 723                    2 for hostname length
 724                    + hostname length
 725                 */
 726
 727                 if ((lenmax = limit - ret - 9) < 0
 728                     || (size_str = strlen(s->tlsext_hostname)) > (unsigned long)lenmax)
 729                         return NULL;
 730
 731                 /* extension type and length */
 732                 s2n(TLSEXT_TYPE_server_name,ret);
 733                 s2n(size_str+5,ret);
 734
 735                 /* length of servername list */
 736                 s2n(size_str+3,ret);
 737
 738                 /* hostname type, length and hostname */
 739                 *(ret++) = (unsigned char) TLSEXT_NAMETYPE_host_name;
 740                 s2n(size_str,ret);
 741                 memcpy(ret, s->tlsext_hostname, size_str);
 742                 ret+=size_str;
 743                 }
 744
 745         /* Add RI if renegotiating */
 746         if (s->renegotiate)
 747           {
 748           int el;
 749
 750           if(!ssl_add_clienthello_renegotiate_ext(s, 0, &el, 0))
 751               {
 752               SSLerr(SSL_F_SSL_ADD_CLIENTHELLO_TLSEXT, ERR_R_INTERNAL_ERROR);
 753               return NULL;
 754               }
 755
 756           if((limit - p - 4 - el) < 0) return NULL;
 757
 758           s2n(TLSEXT_TYPE_renegotiate,ret);
 759           s2n(el,ret);
 760
 761           if(!ssl_add_clienthello_renegotiate_ext(s, ret, &el, el))
 762               {
 763               SSLerr(SSL_F_SSL_ADD_CLIENTHELLO_TLSEXT, ERR_R_INTERNAL_ERROR);
 764               return NULL;
 765               }
 766
 767           ret += el;
 768         }
 769
 770 #ifndef OPENSSL_NO_SRP
 771         /* Add SRP username if there is one */
 772         if (s->srp_ctx.login != NULL)
 773                 { /* Add TLS extension SRP username to the Client Hello message */
 774
 775                 int login_len = strlen(s->srp_ctx.login);
 776                 if (login_len > 255 || login_len == 0)
 777                         {
 778                         SSLerr(SSL_F_SSL_ADD_CLIENTHELLO_TLSEXT, ERR_R_INTERNAL_ERROR);
 779                         return NULL;
 780                         }
 781
 782                 /* check for enough space.
 783                    4 for the srp type type and entension length
 784                    1 for the srp user identity
 785                    + srp user identity length
 786                 */
 787                 if ((limit - ret - 5 - login_len) < 0) return NULL;
 788
 789                 /* fill in the extension */
 790                 s2n(TLSEXT_TYPE_srp,ret);
 791                 s2n(login_len+1,ret);
 792                 (*ret++) = (unsigned char) login_len;
 793                 memcpy(ret, s->srp_ctx.login, login_len);
 794                 ret+=login_len;
 795                 }
 796 #endif
 797
 798 #ifndef OPENSSL_NO_EC
 799         if (using_ecc)
 800                 {
 801                 /* Add TLS extension ECPointFormats to the ClientHello message */
 802                 long lenmax;
 803                 const unsigned char *plist;
 804                 size_t plistlen;
 805                 /* If we have a custom point format list use it otherwise
 806                  * use default */
 807                 plist = s->tlsext_ecpointformatlist;
 808                 if (plist)
 809                         plistlen = s->tlsext_ecpointformatlist_length;
 810                 else
 811                         {
 812                         plist = ecformats_default;
 813                         plistlen = sizeof(ecformats_default);
 814                         }
 815
 816                 if ((lenmax = limit - ret - 5) < 0) return NULL;
 817                 if (plistlen > (size_t)lenmax) return NULL;
 818                 if (plistlen > 255)
 819                         {
 820                         SSLerr(SSL_F_SSL_ADD_CLIENTHELLO_TLSEXT, ERR_R_INTERNAL_ERROR);
 821                         return NULL;
 822                         }
 823
 824                 s2n(TLSEXT_TYPE_ec_point_formats,ret);
 825                 s2n(plistlen + 1,ret);
 826                 *(ret++) = (unsigned char)plistlen ;
 827                 memcpy(ret, plist, plistlen);
 828                 ret+=plistlen;
 829
 830                 /* Add TLS extension EllipticCurves to the ClientHello message */
 831                 plist = s->tlsext_ellipticcurvelist;
 832                 tls1_get_curvelist(s, 0, &plist, &plistlen);
 833
 834                 if ((lenmax = limit - ret - 6) < 0) return NULL;
 835                 if (plistlen > (size_t)lenmax) return NULL;
 836                 if (plistlen > 65532)
 837                         {
 838                         SSLerr(SSL_F_SSL_ADD_CLIENTHELLO_TLSEXT, ERR_R_INTERNAL_ERROR);
 839                         return NULL;
 840                         }
 841
 842                 s2n(TLSEXT_TYPE_elliptic_curves,ret);
 843                 s2n(plistlen + 2, ret);
 844
 845                 /* NB: draft-ietf-tls-ecc-12.txt uses a one-byte prefix for
 846                  * elliptic_curve_list, but the examples use two bytes.
 847                  * http://www1.ietf.org/mail-archive/web/tls/current/msg00538.html
 848                  * resolves this to two bytes.
 849                  */
 850                 s2n(plistlen, ret);
 851                 memcpy(ret, plist, plistlen);
 852                 ret+=plistlen;
 853                 }
 854 #endif /* OPENSSL_NO_EC */
 855
 856         if (!(SSL_get_options(s) & SSL_OP_NO_TICKET))
 857                 {
 858                 int ticklen;
 859                 if (!s->new_session && s->session && s->session->tlsext_tick)
 860                         ticklen = s->session->tlsext_ticklen;
 861                 else if (s->session && s->tlsext_session_ticket &&
 862                          s->tlsext_session_ticket->data)
 863                         {
 864                         ticklen = s->tlsext_session_ticket->length;
 865                         s->session->tlsext_tick = OPENSSL_malloc(ticklen);
 866                         if (!s->session->tlsext_tick)
 867                                 return NULL;
 868                         memcpy(s->session->tlsext_tick,
 869                                s->tlsext_session_ticket->data,
 870                                ticklen);
 871                         s->session->tlsext_ticklen = ticklen;
 872                         }
 873                 else
 874                         ticklen = 0;
 875                 if (ticklen == 0 && s->tlsext_session_ticket &&
 876                     s->tlsext_session_ticket->data == NULL)
 877                         goto skip_ext;
 878                 /* Check for enough room 2 for extension type, 2 for len
 879                  * rest for ticket
 880                  */
 881                 if ((long)(limit - ret - 4 - ticklen) < 0) return NULL;
 882                 s2n(TLSEXT_TYPE_session_ticket,ret);
 883                 s2n(ticklen,ret);
 884                 if (ticklen)
 885                         {
 886                         memcpy(ret, s->session->tlsext_tick, ticklen);
 887                         ret += ticklen;
 888                         }
 889                 }
 890                 skip_ext:
 891
 892         if (TLS1_get_client_version(s) >= TLS1_2_VERSION)
 893                 {
 894                 size_t salglen;
 895                 salglen = tls12_get_sig_algs(s, NULL);
 896                 if ((size_t)(limit - ret) < salglen + 6)
 897                         return NULL;
 898                 s2n(TLSEXT_TYPE_signature_algorithms,ret);
 899                 s2n(salglen + 2, ret);
 900                 s2n(salglen, ret);
 901                 tls12_get_sig_algs(s, ret);
 902                 ret += salglen;
 903                 }
 904
 905 #ifdef TLSEXT_TYPE_opaque_prf_input
 906         if (s->s3->client_opaque_prf_input != NULL &&
 907             s->version != DTLS1_VERSION)
 908                 {
 909                 size_t col = s->s3->client_opaque_prf_input_len;
 910
 911                 if ((long)(limit - ret - 6 - col < 0))
 912                         return NULL;
 913                 if (col > 0xFFFD) /* can't happen */
 914                         return NULL;
 915
 916                 s2n(TLSEXT_TYPE_opaque_prf_input, ret);
 917                 s2n(col + 2, ret);
 918                 s2n(col, ret);
 919                 memcpy(ret, s->s3->client_opaque_prf_input, col);
 920                 ret += col;
 921                 }
 922 #endif
 923
 924         if (s->tlsext_status_type == TLSEXT_STATUSTYPE_ocsp &&
 925             s->version != DTLS1_VERSION)
 926                 {
 927                 int i;
 928                 long extlen, idlen, itmp;
 929                 OCSP_RESPID *id;
 930
 931                 idlen = 0;
 932                 for (i = 0; i < sk_OCSP_RESPID_num(s->tlsext_ocsp_ids); i++)
 933                         {
 934                         id = sk_OCSP_RESPID_value(s->tlsext_ocsp_ids, i);
 935                         itmp = i2d_OCSP_RESPID(id, NULL);
 936                         if (itmp <= 0)
 937                                 return NULL;
 938                         idlen += itmp + 2;
 939                         }
 940
 941                 if (s->tlsext_ocsp_exts)
 942                         {
 943                         extlen = i2d_X509_EXTENSIONS(s->tlsext_ocsp_exts, NULL);
 944                         if (extlen < 0)
 945                                 return NULL;
 946                         }
 947                 else
 948                         extlen = 0;
 949
 950                 if ((long)(limit - ret - 7 - extlen - idlen) < 0) return NULL;
 951                 s2n(TLSEXT_TYPE_status_request, ret);
 952                 if (extlen + idlen > 0xFFF0)
 953                         return NULL;
 954                 s2n(extlen + idlen + 5, ret);
 955                 *(ret++) = TLSEXT_STATUSTYPE_ocsp;
 956                 s2n(idlen, ret);
 957                 for (i = 0; i < sk_OCSP_RESPID_num(s->tlsext_ocsp_ids); i++)
 958                         {
 959                         /* save position of id len */
 960                         unsigned char *q = ret;
 961                         id = sk_OCSP_RESPID_value(s->tlsext_ocsp_ids, i);
 962                         /* skip over id len */
 963                         ret += 2;
 964                         itmp = i2d_OCSP_RESPID(id, &ret);
 965                         /* write id len */
 966                         s2n(itmp, q);
 967                         }
 968                 s2n(extlen, ret);
 969                 if (extlen > 0)
 970                         i2d_X509_EXTENSIONS(s->tlsext_ocsp_exts, &ret);
 971                 }
 972
 973 #ifndef OPENSSL_NO_HEARTBEATS
 974         /* Add Heartbeat extension */
 975         s2n(TLSEXT_TYPE_heartbeat,ret);
 976         s2n(1,ret);
 977         /* Set mode:
 978          * 1: peer may send requests
 979          * 2: peer not allowed to send requests
 980          */
 981         if (s->tlsext_heartbeat & SSL_TLSEXT_HB_DONT_RECV_REQUESTS)
 982                 *(ret++) = SSL_TLSEXT_HB_DONT_SEND_REQUESTS;
 983         else
 984                 *(ret++) = SSL_TLSEXT_HB_ENABLED;
 985 #endif
 986
 987 #ifndef OPENSSL_NO_NEXTPROTONEG
 988         if (s->ctx->next_proto_select_cb && !s->s3->tmp.finish_md_len)
 989                 {
 990                 /* The client advertises an emtpy extension to indicate its
 991                  * support for Next Protocol Negotiation */
 992                 if (limit - ret - 4 < 0)
 993                         return NULL;
 994                 s2n(TLSEXT_TYPE_next_proto_neg,ret);
 995                 s2n(0,ret);
 996                 }
 997 #endif
 998
 999         if(SSL_get_srtp_profiles(s))
1000                 {
1001                 int el;
1002
1003                 ssl_add_clienthello_use_srtp_ext(s, 0, &el, 0);
1004
1005                 if((limit - p - 4 - el) < 0) return NULL;
1006
1007                 s2n(TLSEXT_TYPE_use_srtp,ret);
1008                 s2n(el,ret);
1009
1010                 if(ssl_add_clienthello_use_srtp_ext(s, ret, &el, el))
1011                         {
1012                         SSLerr(SSL_F_SSL_ADD_CLIENTHELLO_TLSEXT, ERR_R_INTERNAL_ERROR);
1013                         return NULL;
1014                         }
1015                 ret += el;
1016                 }
1017
1018         /* Add TLS extension Server_Authz_DataFormats to the ClientHello */
1019         /* 2 bytes for extension type */
1020         /* 2 bytes for extension length */
1021         /* 1 byte for the list length */
1022         /* 1 byte for the list (we only support audit proofs) */
1023         if (s->ctx->tlsext_authz_server_audit_proof_cb != NULL)
1024                 {
1025                 size_t lenmax;
1026                 const unsigned short ext_len = 2;
1027                 const unsigned char list_len = 1;
1028
1029                 if ((lenmax = limit - ret - 6) < 0) return NULL;
1030
1031                 s2n(TLSEXT_TYPE_server_authz, ret);
1032                 /* Extension length: 2 bytes */
1033                 s2n(ext_len, ret);
1034                 *(ret++) = list_len;
1035                 *(ret++) = TLSEXT_AUTHZDATAFORMAT_audit_proof;
1036                 }
1037
1038         if ((extdatalen = ret-p-2) == 0)
1039                 return p;
1040
1041         s2n(extdatalen,p);
1042         return ret;
1043         }
1044
1045 unsigned char *ssl_add_serverhello_tlsext(SSL *s, unsigned char *p, unsigned char *limit)
1046         {
1047         int extdatalen=0;
1048         unsigned char *ret = p;
1049 #ifndef OPENSSL_NO_NEXTPROTONEG
1050         int next_proto_neg_seen;
1051 #endif
1052
1053         /* don't add extensions for SSLv3, unless doing secure renegotiation */
1054         if (s->version == SSL3_VERSION && !s->s3->send_connection_binding)
1055                 return p;
1056
1057         ret+=2;
1058         if (ret>=limit) return NULL; /* this really never occurs, but ... */
1059
1060         if (!s->hit && s->servername_done == 1 && s->session->tlsext_hostname != NULL)
1061                 {
1062                 if ((long)(limit - ret - 4) < 0) return NULL;
1063
1064                 s2n(TLSEXT_TYPE_server_name,ret);
1065                 s2n(0,ret);
1066                 }
1067
1068         if(s->s3->send_connection_binding)
1069         {
1070           int el;
1071
1072           if(!ssl_add_serverhello_renegotiate_ext(s, 0, &el, 0))
1073               {
1074               SSLerr(SSL_F_SSL_ADD_SERVERHELLO_TLSEXT, ERR_R_INTERNAL_ERROR);
1075               return NULL;
1076               }
1077
1078           if((limit - p - 4 - el) < 0) return NULL;
1079
1080           s2n(TLSEXT_TYPE_renegotiate,ret);
1081           s2n(el,ret);
1082
1083           if(!ssl_add_serverhello_renegotiate_ext(s, ret, &el, el))
1084               {
1085               SSLerr(SSL_F_SSL_ADD_SERVERHELLO_TLSEXT, ERR_R_INTERNAL_ERROR);
1086               return NULL;
1087               }
1088
1089           ret += el;
1090         }
1091
1092 #ifndef OPENSSL_NO_EC
1093         if (s->tlsext_ecpointformatlist != NULL &&
1094             s->version != DTLS1_VERSION)
1095                 {
1096                 /* Add TLS extension ECPointFormats to the ServerHello message */
1097                 long lenmax;
1098
1099                 if ((lenmax = limit - ret - 5) < 0) return NULL;
1100                 if (s->tlsext_ecpointformatlist_length > (unsigned long)lenmax) return NULL;
1101                 if (s->tlsext_ecpointformatlist_length > 255)
1102                         {
1103                         SSLerr(SSL_F_SSL_ADD_SERVERHELLO_TLSEXT, ERR_R_INTERNAL_ERROR);
1104                         return NULL;
1105                         }
1106
1107                 s2n(TLSEXT_TYPE_ec_point_formats,ret);
1108                 s2n(s->tlsext_ecpointformatlist_length + 1,ret);
1109                 *(ret++) = (unsigned char) s->tlsext_ecpointformatlist_length;
1110                 memcpy(ret, s->tlsext_ecpointformatlist, s->tlsext_ecpointformatlist_length);
1111                 ret+=s->tlsext_ecpointformatlist_length;
1112
1113                 }
1114         /* Currently the server should not respond with a SupportedCurves extension */
1115 #endif /* OPENSSL_NO_EC */
1116
1117         if (s->tlsext_ticket_expected
1118                 && !(SSL_get_options(s) & SSL_OP_NO_TICKET))
1119                 {
1120                 if ((long)(limit - ret - 4) < 0) return NULL;
1121                 s2n(TLSEXT_TYPE_session_ticket,ret);
1122                 s2n(0,ret);
1123                 }
1124
1125         if (s->tlsext_status_expected)
1126                 {
1127                 if ((long)(limit - ret - 4) < 0) return NULL;
1128                 s2n(TLSEXT_TYPE_status_request,ret);
1129                 s2n(0,ret);
1130                 }
1131
1132 #ifdef TLSEXT_TYPE_opaque_prf_input
1133         if (s->s3->server_opaque_prf_input != NULL &&
1134             s->version != DTLS1_VERSION)
1135                 {
1136                 size_t sol = s->s3->server_opaque_prf_input_len;
1137
1138                 if ((long)(limit - ret - 6 - sol) < 0)
1139                         return NULL;
1140                 if (sol > 0xFFFD) /* can't happen */
1141                         return NULL;
1142
1143                 s2n(TLSEXT_TYPE_opaque_prf_input, ret);
1144                 s2n(sol + 2, ret);
1145                 s2n(sol, ret);
1146                 memcpy(ret, s->s3->server_opaque_prf_input, sol);
1147                 ret += sol;
1148                 }
1149 #endif
1150
1151         if(s->srtp_profile)
1152                 {
1153                 int el;
1154
1155                 ssl_add_serverhello_use_srtp_ext(s, 0, &el, 0);
1156
1157                 if((limit - p - 4 - el) < 0) return NULL;
1158
1159                 s2n(TLSEXT_TYPE_use_srtp,ret);
1160                 s2n(el,ret);
1161
1162                 if(ssl_add_serverhello_use_srtp_ext(s, ret, &el, el))
1163                         {
1164                         SSLerr(SSL_F_SSL_ADD_SERVERHELLO_TLSEXT, ERR_R_INTERNAL_ERROR);
1165                         return NULL;
1166                         }
1167                 ret+=el;
1168                 }
1169
1170         if (((s->s3->tmp.new_cipher->id & 0xFFFF)==0x80 || (s->s3->tmp.new_cipher->id & 0xFFFF)==0x81)
1171                 && (SSL_get_options(s) & SSL_OP_CRYPTOPRO_TLSEXT_BUG))
1172                 { const unsigned char cryptopro_ext[36] = {
1173                         0xfd, 0xe8, /*65000*/
1174                         0x00, 0x20, /*32 bytes length*/
1175                         0x30, 0x1e, 0x30, 0x08, 0x06, 0x06, 0x2a, 0x85,
1176                         0x03,   0x02, 0x02, 0x09, 0x30, 0x08, 0x06, 0x06,
1177                         0x2a, 0x85, 0x03, 0x02, 0x02, 0x16, 0x30, 0x08,
1178                         0x06, 0x06, 0x2a, 0x85, 0x03, 0x02, 0x02, 0x17};
1179                         if (limit-ret<36) return NULL;
1180                         memcpy(ret,cryptopro_ext,36);
1181                         ret+=36;
1182
1183                 }
1184
1185 #ifndef OPENSSL_NO_HEARTBEATS
1186         /* Add Heartbeat extension if we've received one */
1187         if (s->tlsext_heartbeat & SSL_TLSEXT_HB_ENABLED)
1188                 {
1189                 s2n(TLSEXT_TYPE_heartbeat,ret);
1190                 s2n(1,ret);
1191                 /* Set mode:
1192                  * 1: peer may send requests
1193                  * 2: peer not allowed to send requests
1194                  */
1195                 if (s->tlsext_heartbeat & SSL_TLSEXT_HB_DONT_RECV_REQUESTS)
1196                         *(ret++) = SSL_TLSEXT_HB_DONT_SEND_REQUESTS;
1197                 else
1198                         *(ret++) = SSL_TLSEXT_HB_ENABLED;
1199
1200                 }
1201 #endif
1202
1203 #ifndef OPENSSL_NO_NEXTPROTONEG
1204         next_proto_neg_seen = s->s3->next_proto_neg_seen;
1205         s->s3->next_proto_neg_seen = 0;
1206         if (next_proto_neg_seen && s->ctx->next_protos_advertised_cb)
1207                 {
1208                 const unsigned char *npa;
1209                 unsigned int npalen;
1210                 int r;
1211
1212                 r = s->ctx->next_protos_advertised_cb(s, &npa, &npalen, s->ctx->next_protos_advertised_cb_arg);
1213                 if (r == SSL_TLSEXT_ERR_OK)
1214                         {
1215                         if ((long)(limit - ret - 4 - npalen) < 0) return NULL;
1216                         s2n(TLSEXT_TYPE_next_proto_neg,ret);
1217                         s2n(npalen,ret);
1218                         memcpy(ret, npa, npalen);
1219                         ret += npalen;
1220                         s->s3->next_proto_neg_seen = 1;
1221                         }
1222                 }
1223 #endif
1224
1225         /* If the client supports authz then see whether we have any to offer
1226          * to it. */
1227         if (s->s3->tlsext_authz_client_types_len)
1228                 {
1229                 size_t authz_length;
1230                 /* By now we already know the new cipher, so we can look ahead
1231                  * to see whether the cert we are going to send
1232                  * has any authz data attached to it. */
1233                 const unsigned char* authz = ssl_get_authz_data(s, &authz_length);
1234                 const unsigned char* const orig_authz = authz;
1235                 size_t i;
1236                 unsigned authz_count = 0;
1237
1238                 /* The authz data contains a number of the following structures:
1239                  *      uint8_t authz_type
1240                  *      uint16_t length
1241                  *      uint8_t data[length]
1242                  *
1243                  * First we walk over it to find the number of authz elements. */
1244                 for (i = 0; i < authz_length; i++)
1245                         {
1246                         unsigned short length;
1247                         unsigned char type;
1248
1249                         type = *(authz++);
1250                         if (memchr(s->s3->tlsext_authz_client_types,
1251                                    type,
1252                                    s->s3->tlsext_authz_client_types_len) != NULL)
1253                                 authz_count++;
1254
1255                         n2s(authz, length);
1256                         /* n2s increments authz by 2 */
1257                         i += 2;
1258                         authz += length;
1259                         i += length;
1260                         }
1261
1262                 if (authz_count)
1263                         {
1264                         /* Add TLS extension server_authz to the ServerHello message
1265                          * 2 bytes for extension type
1266                          * 2 bytes for extension length
1267                          * 1 byte for the list length
1268                          * n bytes for the list */
1269                         const unsigned short ext_len = 1 + authz_count;
1270
1271                         if ((long)(limit - ret - 4 - ext_len) < 0) return NULL;
1272                         s2n(TLSEXT_TYPE_server_authz, ret);
1273                         s2n(ext_len, ret);
1274                         *(ret++) = authz_count;
1275                         s->s3->tlsext_authz_promised_to_client = 1;
1276                         }
1277
1278                 authz = orig_authz;
1279                 for (i = 0; i < authz_length; i++)
1280                         {
1281                         unsigned short length;
1282                         unsigned char type;
1283
1284                         authz_count++;
1285                         type = *(authz++);
1286                         if (memchr(s->s3->tlsext_authz_client_types,
1287                                    type,
1288                                    s->s3->tlsext_authz_client_types_len) != NULL)
1289                                 *(ret++) = type;
1290                         n2s(authz, length);
1291                         /* n2s increments authz by 2 */
1292                         i += 2;
1293                         authz += length;
1294                         i += length;
1295                         }
1296                 }
1297
1298         if ((extdatalen = ret-p-2)== 0)
1299                 return p;
1300
1301         s2n(extdatalen,p);
1302         return ret;
1303         }
1304
1305 static int ssl_scan_clienthello_tlsext(SSL *s, unsigned char **p, unsigned char *d, int n, int *al)
1306         {
1307         unsigned short type;
1308         unsigned short size;
1309         unsigned short len;
1310         unsigned char *data = *p;
1311         int renegotiate_seen = 0;
1312
1313         s->servername_done = 0;
1314         s->tlsext_status_type = -1;
1315 #ifndef OPENSSL_NO_NEXTPROTONEG
1316         s->s3->next_proto_neg_seen = 0;
1317 #endif
1318
1319 #ifndef OPENSSL_NO_HEARTBEATS
1320         s->tlsext_heartbeat &= ~(SSL_TLSEXT_HB_ENABLED |
1321                                SSL_TLSEXT_HB_DONT_SEND_REQUESTS);
1322 #endif
1323         /* Clear any signature algorithms extension received */
1324         if (s->cert->peer_sigalgs)
1325                 {
1326                 OPENSSL_free(s->cert->peer_sigalgs);
1327                 s->cert->peer_sigalgs = NULL;
1328                 }
1329         /* Clear any shared sigtnature algorithms */
1330         if (s->cert->shared_sigalgs)
1331                 {
1332                 OPENSSL_free(s->cert->shared_sigalgs);
1333                 s->cert->shared_sigalgs = NULL;
1334                 }
1335
1336         if (data >= (d+n-2))
1337                 goto ri_check;
1338         n2s(data,len);
1339
1340         if (data > (d+n-len))
1341                 goto ri_check;
1342
1343         while (data <= (d+n-4))
1344                 {
1345                 n2s(data,type);
1346                 n2s(data,size);
1347
1348                 if (data+size > (d+n))
1349                         goto ri_check;
1350 #if 0
1351                 fprintf(stderr,"Received extension type %d size %d\n",type,size);
1352 #endif
1353                 if (s->tlsext_debug_cb)
1354                         s->tlsext_debug_cb(s, 0, type, data, size,
1355                                                 s->tlsext_debug_arg);
1356 /* The servername extension is treated as follows:
1357
1358    - Only the hostname type is supported with a maximum length of 255.
1359    - The servername is rejected if too long or if it contains zeros,
1360      in which case an fatal alert is generated.
1361    - The servername field is maintained together with the session cache.
1362    - When a session is resumed, the servername call back invoked in order
1363      to allow the application to position itself to the right context.
1364    - The servername is acknowledged if it is new for a session or when
1365      it is identical to a previously used for the same session.
1366      Applications can control the behaviour.  They can at any time
1367      set a 'desirable' servername for a new SSL object. This can be the
1368      case for example with HTTPS when a Host: header field is received and
1369      a renegotiation is requested. In this case, a possible servername
1370      presented in the new client hello is only acknowledged if it matches
1371      the value of the Host: field.
1372    - Applications must  use SSL_OP_NO_SESSION_RESUMPTION_ON_RENEGOTIATION
1373      if they provide for changing an explicit servername context for the session,
1374      i.e. when the session has been established with a servername extension.
1375    - On session reconnect, the servername extension may be absent.
1376
1377 */
1378
1379                 if (type == TLSEXT_TYPE_server_name)
1380                         {
1381                         unsigned char *sdata;
1382                         int servname_type;
1383                         int dsize;
1384
1385                         if (size < 2)
1386                                 {
1387                                 *al = SSL_AD_DECODE_ERROR;
1388                                 return 0;
1389                                 }
1390                         n2s(data,dsize);
1391                         size -= 2;
1392                         if (dsize > size  )
1393                                 {
1394                                 *al = SSL_AD_DECODE_ERROR;
1395                                 return 0;
1396                                 }
1397
1398                         sdata = data;
1399                         while (dsize > 3)
1400                                 {
1401                                 servname_type = *(sdata++);
1402                                 n2s(sdata,len);
1403                                 dsize -= 3;
1404
1405                                 if (len > dsize)
1406                                         {
1407                                         *al = SSL_AD_DECODE_ERROR;
1408                                         return 0;
1409                                         }
1410                                 if (s->servername_done == 0)
1411                                 switch (servname_type)
1412                                         {
1413                                 case TLSEXT_NAMETYPE_host_name:
1414                                         if (!s->hit)
1415                                                 {
1416                                                 if(s->session->tlsext_hostname)
1417                                                         {
1418                                                         *al = SSL_AD_DECODE_ERROR;
1419                                                         return 0;
1420                                                         }
1421                                                 if (len > TLSEXT_MAXLEN_host_name)
1422                                                         {
1423                                                         *al = TLS1_AD_UNRECOGNIZED_NAME;
1424                                                         return 0;
1425                                                         }
1426                                                 if ((s->session->tlsext_hostname = OPENSSL_malloc(len+1)) == NULL)
1427                                                         {
1428                                                         *al = TLS1_AD_INTERNAL_ERROR;
1429                                                         return 0;
1430                                                         }
1431                                                 memcpy(s->session->tlsext_hostname, sdata, len);
1432                                                 s->session->tlsext_hostname[len]='\0';
1433                                                 if (strlen(s->session->tlsext_hostname) != len) {
1434                                                         OPENSSL_free(s->session->tlsext_hostname);
1435                                                         s->session->tlsext_hostname = NULL;
1436                                                         *al = TLS1_AD_UNRECOGNIZED_NAME;
1437                                                         return 0;
1438                                                 }
1439                                                 s->servername_done = 1;
1440
1441                                                 }
1442                                         else
1443                                                 s->servername_done = s->session->tlsext_hostname
1444                                                         && strlen(s->session->tlsext_hostname) == len
1445                                                         && strncmp(s->session->tlsext_hostname, (char *)sdata, len) == 0;
1446
1447                                         break;
1448
1449                                 default:
1450                                         break;
1451                                         }
1452
1453                                 dsize -= len;
1454                                 }
1455                         if (dsize != 0)
1456                                 {
1457                                 *al = SSL_AD_DECODE_ERROR;
1458                                 return 0;
1459                                 }
1460
1461                         }
1462 #ifndef OPENSSL_NO_SRP
1463                 else if (type == TLSEXT_TYPE_srp)
1464                         {
1465                         if (size <= 0 || ((len = data[0])) != (size -1))
1466                                 {
1467                                 *al = SSL_AD_DECODE_ERROR;
1468                                 return 0;
1469                                 }
1470                         if (s->srp_ctx.login != NULL)
1471                                 {
1472                                 *al = SSL_AD_DECODE_ERROR;
1473                                 return 0;
1474                                 }
1475                         if ((s->srp_ctx.login = OPENSSL_malloc(len+1)) == NULL)
1476                                 return -1;
1477                         memcpy(s->srp_ctx.login, &data[1], len);
1478                         s->srp_ctx.login[len]='\0';
1479
1480                         if (strlen(s->srp_ctx.login) != len)
1481                                 {
1482                                 *al = SSL_AD_DECODE_ERROR;
1483                                 return 0;
1484                                 }
1485                         }
1486 #endif
1487
1488 #ifndef OPENSSL_NO_EC
1489                 else if (type == TLSEXT_TYPE_ec_point_formats &&
1490                      s->version != DTLS1_VERSION)
1491                         {
1492                         unsigned char *sdata = data;
1493                         int ecpointformatlist_length = *(sdata++);
1494
1495                         if (ecpointformatlist_length != size - 1)
1496                                 {
1497                                 *al = TLS1_AD_DECODE_ERROR;
1498                                 return 0;
1499                                 }
1500                         if (!s->hit)
1501                                 {
1502                                 if(s->session->tlsext_ecpointformatlist)
1503                                         {
1504                                         OPENSSL_free(s->session->tlsext_ecpointformatlist);
1505                                         s->session->tlsext_ecpointformatlist = NULL;
1506                                         }
1507                                 s->session->tlsext_ecpointformatlist_length = 0;
1508                                 if ((s->session->tlsext_ecpointformatlist = OPENSSL_malloc(ecpointformatlist_length)) == NULL)
1509                                         {
1510                                         *al = TLS1_AD_INTERNAL_ERROR;
1511                                         return 0;
1512                                         }
1513                                 s->session->tlsext_ecpointformatlist_length = ecpointformatlist_length;
1514                                 memcpy(s->session->tlsext_ecpointformatlist, sdata, ecpointformatlist_length);
1515                                 }
1516 #if 0
1517                         fprintf(stderr,"ssl_parse_clienthello_tlsext s->session->tlsext_ecpointformatlist (length=%i) ", s->session->tlsext_ecpointformatlist_length);
1518                         sdata = s->session->tlsext_ecpointformatlist;
1519                         for (i = 0; i < s->session->tlsext_ecpointformatlist_length; i++)
1520                                 fprintf(stderr,"%i ",*(sdata++));
1521                         fprintf(stderr,"\n");
1522 #endif
1523                         }
1524                 else if (type == TLSEXT_TYPE_elliptic_curves &&
1525                      s->version != DTLS1_VERSION)
1526                         {
1527                         unsigned char *sdata = data;
1528                         int ellipticcurvelist_length = (*(sdata++) << 8);
1529                         ellipticcurvelist_length += (*(sdata++));
1530
1531                         if (ellipticcurvelist_length != size - 2 ||
1532                                 ellipticcurvelist_length < 1)
1533                                 {
1534                                 *al = TLS1_AD_DECODE_ERROR;
1535                                 return 0;
1536                                 }
1537                         if (!s->hit)
1538                                 {
1539                                 if(s->session->tlsext_ellipticcurvelist)
1540                                         {
1541                                         *al = TLS1_AD_DECODE_ERROR;
1542                                         return 0;
1543                                         }
1544                                 s->session->tlsext_ellipticcurvelist_length = 0;
1545                                 if ((s->session->tlsext_ellipticcurvelist = OPENSSL_malloc(ellipticcurvelist_length)) == NULL)
1546                                         {
1547                                         *al = TLS1_AD_INTERNAL_ERROR;
1548                                         return 0;
1549                                         }
1550                                 s->session->tlsext_ellipticcurvelist_length = ellipticcurvelist_length;
1551                                 memcpy(s->session->tlsext_ellipticcurvelist, sdata, ellipticcurvelist_length);
1552                                 }
1553 #if 0
1554                         fprintf(stderr,"ssl_parse_clienthello_tlsext s->session->tlsext_ellipticcurvelist (length=%i) ", s->session->tlsext_ellipticcurvelist_length);
1555                         sdata = s->session->tlsext_ellipticcurvelist;
1556                         for (i = 0; i < s->session->tlsext_ellipticcurvelist_length; i++)
1557                                 fprintf(stderr,"%i ",*(sdata++));
1558                         fprintf(stderr,"\n");
1559 #endif
1560                         }
1561 #endif /* OPENSSL_NO_EC */
1562 #ifdef TLSEXT_TYPE_opaque_prf_input
1563                 else if (type == TLSEXT_TYPE_opaque_prf_input &&
1564                      s->version != DTLS1_VERSION)
1565                         {
1566                         unsigned char *sdata = data;
1567
1568                         if (size < 2)
1569                                 {
1570                                 *al = SSL_AD_DECODE_ERROR;
1571                                 return 0;
1572                                 }
1573                         n2s(sdata, s->s3->client_opaque_prf_input_len);
1574                         if (s->s3->client_opaque_prf_input_len != size - 2)
1575                                 {
1576                                 *al = SSL_AD_DECODE_ERROR;
1577                                 return 0;
1578                                 }
1579
1580                         if (s->s3->client_opaque_prf_input != NULL) /* shouldn't really happen */
1581                                 OPENSSL_free(s->s3->client_opaque_prf_input);
1582                         if (s->s3->client_opaque_prf_input_len == 0)
1583                                 s->s3->client_opaque_prf_input = OPENSSL_malloc(1); /* dummy byte just to get non-NULL */
1584                         else
1585                                 s->s3->client_opaque_prf_input = BUF_memdup(sdata, s->s3->client_opaque_prf_input_len);
1586                         if (s->s3->client_opaque_prf_input == NULL)
1587                                 {
1588                                 *al = TLS1_AD_INTERNAL_ERROR;
1589                                 return 0;
1590                                 }
1591                         }
1592 #endif
1593                 else if (type == TLSEXT_TYPE_session_ticket)
1594                         {
1595                         if (s->tls_session_ticket_ext_cb &&
1596                             !s->tls_session_ticket_ext_cb(s, data, size, s->tls_session_ticket_ext_cb_arg))
1597                                 {
1598                                 *al = TLS1_AD_INTERNAL_ERROR;
1599                                 return 0;
1600                                 }
1601                         }
1602                 else if (type == TLSEXT_TYPE_renegotiate)
1603                         {
1604                         if(!ssl_parse_clienthello_renegotiate_ext(s, data, size, al))
1605                                 return 0;
1606                         renegotiate_seen = 1;
1607                         }
1608                 else if (type == TLSEXT_TYPE_signature_algorithms)
1609                         {
1610                         int dsize;
1611                         if (s->cert->peer_sigalgs || size < 2)
1612                                 {
1613                                 *al = SSL_AD_DECODE_ERROR;
1614                                 return 0;
1615                                 }
1616                         n2s(data,dsize);
1617                         size -= 2;
1618                         if (dsize != size || dsize & 1 || !dsize)
1619                                 {
1620                                 *al = SSL_AD_DECODE_ERROR;
1621                                 return 0;
1622                                 }
1623                         if (!tls1_process_sigalgs(s, data, dsize))
1624                                 {
1625                                 *al = SSL_AD_DECODE_ERROR;
1626                                 return 0;
1627                                 }
1628                         /* If sigalgs received and no shared algorithms fatal
1629                          * error.
1630                          */
1631                         if (s->cert->peer_sigalgs && !s->cert->shared_sigalgs)
1632                                 {
1633                                 SSLerr(SSL_F_SSL_SCAN_CLIENTHELLO_TLSEXT,
1634                                         SSL_R_NO_SHARED_SIGATURE_ALGORITHMS);
1635                                 *al = SSL_AD_ILLEGAL_PARAMETER;
1636                                 return 0;
1637                                 }
1638                         }
1639                 else if (type == TLSEXT_TYPE_status_request &&
1640                          s->version != DTLS1_VERSION && s->ctx->tlsext_status_cb)
1641                         {
1642
1643                         if (size < 5)
1644                                 {
1645                                 *al = SSL_AD_DECODE_ERROR;
1646                                 return 0;
1647                                 }
1648
1649                         s->tlsext_status_type = *data++;
1650                         size--;
1651                         if (s->tlsext_status_type == TLSEXT_STATUSTYPE_ocsp)
1652                                 {
1653                                 const unsigned char *sdata;
1654                                 int dsize;
1655                                 /* Read in responder_id_list */
1656                                 n2s(data,dsize);
1657                                 size -= 2;
1658                                 if (dsize > size  )
1659                                         {
1660                                         *al = SSL_AD_DECODE_ERROR;
1661                                         return 0;
1662                                         }
1663                                 while (dsize > 0)
1664                                         {
1665                                         OCSP_RESPID *id;
1666                                         int idsize;
1667                                         if (dsize < 4)
1668                                                 {
1669                                                 *al = SSL_AD_DECODE_ERROR;
1670                                                 return 0;
1671                                                 }
1672                                         n2s(data, idsize);
1673                                         dsize -= 2 + idsize;
1674                                         size -= 2 + idsize;
1675                                         if (dsize < 0)
1676                                                 {
1677                                                 *al = SSL_AD_DECODE_ERROR;
1678                                                 return 0;
1679                                                 }
1680                                         sdata = data;
1681                                         data += idsize;
1682                                         id = d2i_OCSP_RESPID(NULL,
1683                                                                 &sdata, idsize);
1684                                         if (!id)
1685                                                 {
1686                                                 *al = SSL_AD_DECODE_ERROR;
1687                                                 return 0;
1688                                                 }
1689                                         if (data != sdata)
1690                                                 {
1691                                                 OCSP_RESPID_free(id);
1692                                                 *al = SSL_AD_DECODE_ERROR;
1693                                                 return 0;
1694                                                 }
1695                                         if (!s->tlsext_ocsp_ids
1696                                                 && !(s->tlsext_ocsp_ids =
1697                                                 sk_OCSP_RESPID_new_null()))
1698                                                 {
1699                                                 OCSP_RESPID_free(id);
1700                                                 *al = SSL_AD_INTERNAL_ERROR;
1701                                                 return 0;
1702                                                 }
1703                                         if (!sk_OCSP_RESPID_push(
1704                                                         s->tlsext_ocsp_ids, id))
1705                                                 {
1706                                                 OCSP_RESPID_free(id);
1707                                                 *al = SSL_AD_INTERNAL_ERROR;
1708                                                 return 0;
1709                                                 }
1710                                         }
1711
1712                                 /* Read in request_extensions */
1713                                 if (size < 2)
1714                                         {
1715                                         *al = SSL_AD_DECODE_ERROR;
1716                                         return 0;
1717                                         }
1718                                 n2s(data,dsize);
1719                                 size -= 2;
1720                                 if (dsize != size)
1721                                         {
1722                                         *al = SSL_AD_DECODE_ERROR;
1723                                         return 0;
1724                                         }
1725                                 sdata = data;
1726                                 if (dsize > 0)
1727                                         {
1728                                         if (s->tlsext_ocsp_exts)
1729                                                 {
1730                                                 sk_X509_EXTENSION_pop_free(s->tlsext_ocsp_exts,
1731                                                                            X509_EXTENSION_free);
1732                                                 }
1733
1734                                         s->tlsext_ocsp_exts =
1735                                                 d2i_X509_EXTENSIONS(NULL,
1736                                                         &sdata, dsize);
1737                                         if (!s->tlsext_ocsp_exts
1738                                                 || (data + dsize != sdata))
1739                                                 {
1740                                                 *al = SSL_AD_DECODE_ERROR;
1741                                                 return 0;
1742                                                 }
1743                                         }
1744                                 }
1745                                 /* We don't know what to do with any other type
1746                                 * so ignore it.
1747                                 */
1748                                 else
1749                                         s->tlsext_status_type = -1;
1750                         }
1751 #ifndef OPENSSL_NO_HEARTBEATS
1752                 else if (type == TLSEXT_TYPE_heartbeat)
1753                         {
1754                         switch(data[0])
1755                                 {
1756                                 case 0x01:      /* Client allows us to send HB requests */
1757                                                         s->tlsext_heartbeat |= SSL_TLSEXT_HB_ENABLED;
1758                                                         break;
1759                                 case 0x02:      /* Client doesn't accept HB requests */
1760                                                         s->tlsext_heartbeat |= SSL_TLSEXT_HB_ENABLED;
1761                                                         s->tlsext_heartbeat |= SSL_TLSEXT_HB_DONT_SEND_REQUESTS;
1762                                                         break;
1763                                 default:        *al = SSL_AD_ILLEGAL_PARAMETER;
1764                                                         return 0;
1765                                 }
1766                         }
1767 #endif
1768 #ifndef OPENSSL_NO_NEXTPROTONEG
1769                 else if (type == TLSEXT_TYPE_next_proto_neg &&
1770                          s->s3->tmp.finish_md_len == 0)
1771                         {
1772                         /* We shouldn't accept this extension on a
1773                          * renegotiation.
1774                          *
1775                          * s->new_session will be set on renegotiation, but we
1776                          * probably shouldn't rely that it couldn't be set on
1777                          * the initial renegotation too in certain cases (when
1778                          * there's some other reason to disallow resuming an
1779                          * earlier session -- the current code won't be doing
1780                          * anything like that, but this might change).
1781
1782                          * A valid sign that there's been a previous handshake
1783                          * in this connection is if s->s3->tmp.finish_md_len >
1784                          * 0.  (We are talking about a check that will happen
1785                          * in the Hello protocol round, well before a new
1786                          * Finished message could have been computed.) */
1787                         s->s3->next_proto_neg_seen = 1;
1788                         }
1789 #endif
1790
1791                 /* session ticket processed earlier */
1792                 else if (type == TLSEXT_TYPE_use_srtp)
1793                         {
1794                         if(ssl_parse_clienthello_use_srtp_ext(s, data, size,
1795                                                               al))
1796                                 return 0;
1797                         }
1798
1799                 else if (type == TLSEXT_TYPE_server_authz)
1800                         {
1801                         unsigned char *sdata = data;
1802                         unsigned char server_authz_dataformatlist_length;
1803
1804                         if (size == 0)
1805                                 {
1806                                 *al = TLS1_AD_DECODE_ERROR;
1807                                 return 0;
1808                                 }
1809
1810                         server_authz_dataformatlist_length = *(sdata++);
1811
1812                         if (server_authz_dataformatlist_length != size - 1)
1813                                 {
1814                                 *al = TLS1_AD_DECODE_ERROR;
1815                                 return 0;
1816                                 }
1817
1818                         /* Successful session resumption uses the same authz
1819                          * information as the original session so we ignore this
1820                          * in the case of a session resumption. */
1821                         if (!s->hit)
1822                                 {
1823                                 size_t i;
1824                                 if (s->s3->tlsext_authz_client_types != NULL)
1825                                         OPENSSL_free(s->s3->tlsext_authz_client_types);
1826                                 s->s3->tlsext_authz_client_types =
1827                                         OPENSSL_malloc(server_authz_dataformatlist_length);
1828                                 if (!s->s3->tlsext_authz_client_types)
1829                                         {
1830                                         *al = TLS1_AD_INTERNAL_ERROR;
1831                                         return 0;
1832                                         }
1833
1834                                 s->s3->tlsext_authz_client_types_len =
1835                                         server_authz_dataformatlist_length;
1836                                 memcpy(s->s3->tlsext_authz_client_types,
1837                                        sdata,
1838                                        server_authz_dataformatlist_length);
1839
1840                                 /* Sort the types in order to check for duplicates. */
1841                                 qsort(s->s3->tlsext_authz_client_types,
1842                                       server_authz_dataformatlist_length,
1843                                       1 /* element size */,
1844                                       byte_compare);
1845
1846                                 for (i = 0; i < server_authz_dataformatlist_length; i++)
1847                                         {
1848                                         if (i > 0 &&
1849                                             s->s3->tlsext_authz_client_types[i] ==
1850                                               s->s3->tlsext_authz_client_types[i-1])
1851                                                 {
1852                                                 *al = TLS1_AD_DECODE_ERROR;
1853                                                 return 0;
1854                                                 }
1855                                         }
1856                                 }
1857                         }
1858
1859                 data+=size;
1860                 }
1861
1862         *p = data;
1863
1864         ri_check:
1865
1866         /* Need RI if renegotiating */
1867
1868         if (!renegotiate_seen && s->renegotiate &&
1869                 !(s->options & SSL_OP_ALLOW_UNSAFE_LEGACY_RENEGOTIATION))
1870                 {
1871                 *al = SSL_AD_HANDSHAKE_FAILURE;
1872                 SSLerr(SSL_F_SSL_SCAN_CLIENTHELLO_TLSEXT,
1873                                 SSL_R_UNSAFE_LEGACY_RENEGOTIATION_DISABLED);
1874                 return 0;
1875                 }
1876         /* If no signature algorithms extension set default values */
1877         if (!s->cert->peer_sigalgs)
1878                 ssl_cert_set_default_md(s->cert);
1879
1880         return 1;
1881         }
1882
1883 int ssl_parse_clienthello_tlsext(SSL *s, unsigned char **p, unsigned char *d, int n)
1884         {
1885         int al = -1;
1886         if (ssl_scan_clienthello_tlsext(s, p, d, n, &al) <= 0)
1887                 {
1888                 ssl3_send_alert(s,SSL3_AL_FATAL,al);
1889                 return 0;
1890                 }
1891
1892         if (ssl_check_clienthello_tlsext_early(s) <= 0)
1893                 {
1894                 SSLerr(SSL_F_SSL_PARSE_CLIENTHELLO_TLSEXT,SSL_R_CLIENTHELLO_TLSEXT);
1895                 return 0;
1896                 }
1897         return 1;
1898 }
1899
1900 #ifndef OPENSSL_NO_NEXTPROTONEG
1901 /* ssl_next_proto_validate validates a Next Protocol Negotiation block. No
1902  * elements of zero length are allowed and the set of elements must exactly fill
1903  * the length of the block. */
1904 static char ssl_next_proto_validate(unsigned char *d, unsigned len)
1905         {
1906         unsigned int off = 0;
1907
1908         while (off < len)
1909                 {
1910                 if (d[off] == 0)
1911                         return 0;
1912                 off += d[off];
1913                 off++;
1914                 }
1915
1916         return off == len;
1917         }
1918 #endif
1919
1920 static int ssl_scan_serverhello_tlsext(SSL *s, unsigned char **p, unsigned char *d, int n, int *al)
1921         {
1922         unsigned short length;
1923         unsigned short type;
1924         unsigned short size;
1925         unsigned char *data = *p;
1926         int tlsext_servername = 0;
1927         int renegotiate_seen = 0;
1928
1929 #ifndef OPENSSL_NO_NEXTPROTONEG
1930         s->s3->next_proto_neg_seen = 0;
1931 #endif
1932
1933 #ifndef OPENSSL_NO_HEARTBEATS
1934         s->tlsext_heartbeat &= ~(SSL_TLSEXT_HB_ENABLED |
1935                                SSL_TLSEXT_HB_DONT_SEND_REQUESTS);
1936 #endif
1937
1938         if (data >= (d+n-2))
1939                 goto ri_check;
1940
1941         n2s(data,length);
1942         if (data+length != d+n)
1943                 {
1944                 *al = SSL_AD_DECODE_ERROR;
1945                 return 0;
1946                 }
1947
1948         while(data <= (d+n-4))
1949                 {
1950                 n2s(data,type);
1951                 n2s(data,size);
1952
1953                 if (data+size > (d+n))
1954                         goto ri_check;
1955
1956                 if (s->tlsext_debug_cb)
1957                         s->tlsext_debug_cb(s, 1, type, data, size,
1958                                                 s->tlsext_debug_arg);
1959
1960                 if (type == TLSEXT_TYPE_server_name)
1961                         {
1962                         if (s->tlsext_hostname == NULL || size > 0)
1963                                 {
1964                                 *al = TLS1_AD_UNRECOGNIZED_NAME;
1965                                 return 0;
1966                                 }
1967                         tlsext_servername = 1;
1968                         }
1969
1970 #ifndef OPENSSL_NO_EC
1971                 else if (type == TLSEXT_TYPE_ec_point_formats &&
1972                      s->version != DTLS1_VERSION)
1973                         {
1974                         unsigned char *sdata = data;
1975                         int ecpointformatlist_length = *(sdata++);
1976
1977                         if (ecpointformatlist_length != size - 1 ||
1978                                 ecpointformatlist_length < 1)
1979                                 {
1980                                 *al = TLS1_AD_DECODE_ERROR;
1981                                 return 0;
1982                                 }
1983                         s->session->tlsext_ecpointformatlist_length = 0;
1984                         if (s->session->tlsext_ecpointformatlist != NULL) OPENSSL_free(s->session->tlsext_ecpointformatlist);
1985                         if ((s->session->tlsext_ecpointformatlist = OPENSSL_malloc(ecpointformatlist_length)) == NULL)
1986                                 {
1987                                 *al = TLS1_AD_INTERNAL_ERROR;
1988                                 return 0;
1989                                 }
1990                         s->session->tlsext_ecpointformatlist_length = ecpointformatlist_length;
1991                         memcpy(s->session->tlsext_ecpointformatlist, sdata, ecpointformatlist_length);
1992 #if 0
1993                         fprintf(stderr,"ssl_parse_serverhello_tlsext s->session->tlsext_ecpointformatlist ");
1994                         sdata = s->session->tlsext_ecpointformatlist;
1995                         for (i = 0; i < s->session->tlsext_ecpointformatlist_length; i++)
1996                                 fprintf(stderr,"%i ",*(sdata++));
1997                         fprintf(stderr,"\n");
1998 #endif
1999                         }
2000 #endif /* OPENSSL_NO_EC */
2001
2002                 else if (type == TLSEXT_TYPE_session_ticket)
2003                         {
2004                         if (s->tls_session_ticket_ext_cb &&
2005                             !s->tls_session_ticket_ext_cb(s, data, size, s->tls_session_ticket_ext_cb_arg))
2006                                 {
2007                                 *al = TLS1_AD_INTERNAL_ERROR;
2008                                 return 0;
2009                                 }
2010                         if ((SSL_get_options(s) & SSL_OP_NO_TICKET)
2011                                 || (size > 0))
2012                                 {
2013                                 *al = TLS1_AD_UNSUPPORTED_EXTENSION;
2014                                 return 0;
2015                                 }
2016                         s->tlsext_ticket_expected = 1;
2017                         }
2018 #ifdef TLSEXT_TYPE_opaque_prf_input
2019                 else if (type == TLSEXT_TYPE_opaque_prf_input &&
2020                      s->version != DTLS1_VERSION)
2021                         {
2022                         unsigned char *sdata = data;
2023
2024                         if (size < 2)
2025                                 {
2026                                 *al = SSL_AD_DECODE_ERROR;
2027                                 return 0;
2028                                 }
2029                         n2s(sdata, s->s3->server_opaque_prf_input_len);
2030                         if (s->s3->server_opaque_prf_input_len != size - 2)
2031                                 {
2032                                 *al = SSL_AD_DECODE_ERROR;
2033                                 return 0;
2034                                 }
2035
2036                         if (s->s3->server_opaque_prf_input != NULL) /* shouldn't really happen */
2037                                 OPENSSL_free(s->s3->server_opaque_prf_input);
2038                         if (s->s3->server_opaque_prf_input_len == 0)
2039                                 s->s3->server_opaque_prf_input = OPENSSL_malloc(1); /* dummy byte just to get non-NULL */
2040                         else
2041                                 s->s3->server_opaque_prf_input = BUF_memdup(sdata, s->s3->server_opaque_prf_input_len);
2042
2043                         if (s->s3->server_opaque_prf_input == NULL)
2044                                 {
2045                                 *al = TLS1_AD_INTERNAL_ERROR;
2046                                 return 0;
2047                                 }
2048                         }
2049 #endif
2050                 else if (type == TLSEXT_TYPE_status_request &&
2051                          s->version != DTLS1_VERSION)
2052                         {
2053                         /* MUST be empty and only sent if we've requested
2054                          * a status request message.
2055                          */
2056                         if ((s->tlsext_status_type == -1) || (size > 0))
2057                                 {
2058                                 *al = TLS1_AD_UNSUPPORTED_EXTENSION;
2059                                 return 0;
2060                                 }
2061                         /* Set flag to expect CertificateStatus message */
2062                         s->tlsext_status_expected = 1;
2063                         }
2064 #ifndef OPENSSL_NO_NEXTPROTONEG
2065                 else if (type == TLSEXT_TYPE_next_proto_neg &&
2066                          s->s3->tmp.finish_md_len == 0)
2067                         {
2068                         unsigned char *selected;
2069                         unsigned char selected_len;
2070
2071                         /* We must have requested it. */
2072                         if ((s->ctx->next_proto_select_cb == NULL))
2073                                 {
2074                                 *al = TLS1_AD_UNSUPPORTED_EXTENSION;
2075                                 return 0;
2076                                 }
2077                         /* The data must be valid */
2078                         if (!ssl_next_proto_validate(data, size))
2079                                 {
2080                                 *al = TLS1_AD_DECODE_ERROR;
2081                                 return 0;
2082                                 }
2083                         if (s->ctx->next_proto_select_cb(s, &selected, &selected_len, data, size, s->ctx->next_proto_select_cb_arg) != SSL_TLSEXT_ERR_OK)
2084                                 {
2085                                 *al = TLS1_AD_INTERNAL_ERROR;
2086                                 return 0;
2087                                 }
2088                         s->next_proto_negotiated = OPENSSL_malloc(selected_len);
2089                         if (!s->next_proto_negotiated)
2090                                 {
2091                                 *al = TLS1_AD_INTERNAL_ERROR;
2092                                 return 0;
2093                                 }
2094                         memcpy(s->next_proto_negotiated, selected, selected_len);
2095                         s->next_proto_negotiated_len = selected_len;
2096                         s->s3->next_proto_neg_seen = 1;
2097                         }
2098 #endif
2099                 else if (type == TLSEXT_TYPE_renegotiate)
2100                         {
2101                         if(!ssl_parse_serverhello_renegotiate_ext(s, data, size, al))
2102                                 return 0;
2103                         renegotiate_seen = 1;
2104                         }
2105 #ifndef OPENSSL_NO_HEARTBEATS
2106                 else if (type == TLSEXT_TYPE_heartbeat)
2107                         {
2108                         switch(data[0])
2109                                 {
2110                                 case 0x01:      /* Server allows us to send HB requests */
2111                                                         s->tlsext_heartbeat |= SSL_TLSEXT_HB_ENABLED;
2112                                                         break;
2113                                 case 0x02:      /* Server doesn't accept HB requests */
2114                                                         s->tlsext_heartbeat |= SSL_TLSEXT_HB_ENABLED;
2115                                                         s->tlsext_heartbeat |= SSL_TLSEXT_HB_DONT_SEND_REQUESTS;
2116                                                         break;
2117                                 default:        *al = SSL_AD_ILLEGAL_PARAMETER;
2118                                                         return 0;
2119                                 }
2120                         }
2121 #endif
2122                 else if (type == TLSEXT_TYPE_use_srtp)
2123                         {
2124                         if(ssl_parse_serverhello_use_srtp_ext(s, data, size,
2125                                                               al))
2126                                 return 0;
2127                         }
2128
2129                 else if (type == TLSEXT_TYPE_server_authz)
2130                         {
2131                         /* We only support audit proofs. It's an error to send
2132                          * an authz hello extension if the client
2133                          * didn't request a proof. */
2134                         unsigned char *sdata = data;
2135                         unsigned char server_authz_dataformatlist_length;
2136
2137                         if (!s->ctx->tlsext_authz_server_audit_proof_cb)
2138                                 {
2139                                 *al = TLS1_AD_UNSUPPORTED_EXTENSION;
2140                                 return 0;
2141                                 }
2142
2143                         if (!size)
2144                                 {
2145                                 *al = TLS1_AD_DECODE_ERROR;
2146                                 return 0;
2147                                 }
2148
2149                         server_authz_dataformatlist_length = *(sdata++);
2150                         if (server_authz_dataformatlist_length != size - 1)
2151                                 {
2152                                 *al = TLS1_AD_DECODE_ERROR;
2153                                 return 0;
2154                                 }
2155
2156                         /* We only support audit proofs, so a legal ServerHello
2157                          * authz list contains exactly one entry. */
2158                         if (server_authz_dataformatlist_length != 1 ||
2159                                 sdata[0] != TLSEXT_AUTHZDATAFORMAT_audit_proof)
2160                                 {
2161                                 *al = TLS1_AD_UNSUPPORTED_EXTENSION;
2162                                 return 0;
2163                                 }
2164
2165                         s->s3->tlsext_authz_server_promised = 1;
2166                         }
2167
2168                 data += size;
2169                 }
2170
2171         if (data != d+n)
2172                 {
2173                 *al = SSL_AD_DECODE_ERROR;
2174                 return 0;
2175                 }
2176
2177         if (!s->hit && tlsext_servername == 1)
2178                 {
2179                 if (s->tlsext_hostname)
2180                         {
2181                         if (s->session->tlsext_hostname == NULL)
2182                                 {
2183                                 s->session->tlsext_hostname = BUF_strdup(s->tlsext_hostname);
2184                                 if (!s->session->tlsext_hostname)
2185                                         {
2186                                         *al = SSL_AD_UNRECOGNIZED_NAME;
2187                                         return 0;
2188                                         }
2189                                 }
2190                         else
2191                                 {
2192                                 *al = SSL_AD_DECODE_ERROR;
2193                                 return 0;
2194                                 }
2195                         }
2196                 }
2197
2198         *p = data;
2199
2200         ri_check:
2201
2202         /* Determine if we need to see RI. Strictly speaking if we want to
2203          * avoid an attack we should *always* see RI even on initial server
2204          * hello because the client doesn't see any renegotiation during an
2205          * attack. However this would mean we could not connect to any server
2206          * which doesn't support RI so for the immediate future tolerate RI
2207          * absence on initial connect only.
2208          */
2209         if (!renegotiate_seen
2210                 && !(s->options & SSL_OP_LEGACY_SERVER_CONNECT)
2211                 && !(s->options & SSL_OP_ALLOW_UNSAFE_LEGACY_RENEGOTIATION))
2212                 {
2213                 *al = SSL_AD_HANDSHAKE_FAILURE;
2214                 SSLerr(SSL_F_SSL_SCAN_SERVERHELLO_TLSEXT,
2215                                 SSL_R_UNSAFE_LEGACY_RENEGOTIATION_DISABLED);
2216                 return 0;
2217                 }
2218
2219         return 1;
2220         }
2221
2222
2223 int ssl_prepare_clienthello_tlsext(SSL *s)
2224         {
2225
2226 #ifdef TLSEXT_TYPE_opaque_prf_input
2227         {
2228                 int r = 1;
2229
2230                 if (s->ctx->tlsext_opaque_prf_input_callback != 0)
2231                         {
2232                         r = s->ctx->tlsext_opaque_prf_input_callback(s, NULL, 0, s->ctx->tlsext_opaque_prf_input_callback_arg);
2233                         if (!r)
2234                                 return -1;
2235                         }
2236
2237                 if (s->tlsext_opaque_prf_input != NULL)
2238                         {
2239                         if (s->s3->client_opaque_prf_input != NULL) /* shouldn't really happen */
2240                                 OPENSSL_free(s->s3->client_opaque_prf_input);
2241
2242                         if (s->tlsext_opaque_prf_input_len == 0)
2243                                 s->s3->client_opaque_prf_input = OPENSSL_malloc(1); /* dummy byte just to get non-NULL */
2244                         else
2245                                 s->s3->client_opaque_prf_input = BUF_memdup(s->tlsext_opaque_prf_input, s->tlsext_opaque_prf_input_len);
2246                         if (s->s3->client_opaque_prf_input == NULL)
2247                                 {
2248                                 SSLerr(SSL_F_SSL_PREPARE_CLIENTHELLO_TLSEXT,ERR_R_MALLOC_FAILURE);
2249                                 return -1;
2250                                 }
2251                         s->s3->client_opaque_prf_input_len = s->tlsext_opaque_prf_input_len;
2252                         }
2253
2254                 if (r == 2)
2255                         /* at callback's request, insist on receiving an appropriate server opaque PRF input */
2256                         s->s3->server_opaque_prf_input_len = s->tlsext_opaque_prf_input_len;
2257         }
2258 #endif
2259
2260         return 1;
2261         }
2262
2263 int ssl_prepare_serverhello_tlsext(SSL *s)
2264         {
2265 #ifndef OPENSSL_NO_EC
2266         /* If we are server and using an ECC cipher suite, send the point formats we support
2267          * if the client sent us an ECPointsFormat extension.  Note that the server is not
2268          * supposed to send an EllipticCurves extension.
2269          */
2270
2271         unsigned long alg_k = s->s3->tmp.new_cipher->algorithm_mkey;
2272         unsigned long alg_a = s->s3->tmp.new_cipher->algorithm_auth;
2273         int using_ecc = (alg_k & (SSL_kEECDH|SSL_kECDHr|SSL_kECDHe)) || (alg_a & SSL_aECDSA);
2274         using_ecc = using_ecc && (s->session->tlsext_ecpointformatlist != NULL);
2275
2276         if (using_ecc)
2277                 {
2278                 if (s->tlsext_ecpointformatlist != NULL) OPENSSL_free(s->tlsext_ecpointformatlist);
2279                 if ((s->tlsext_ecpointformatlist = OPENSSL_malloc(3)) == NULL)
2280                         {
2281                         SSLerr(SSL_F_SSL_PREPARE_SERVERHELLO_TLSEXT,ERR_R_MALLOC_FAILURE);
2282                         return -1;
2283                         }
2284                 s->tlsext_ecpointformatlist_length = 3;
2285                 s->tlsext_ecpointformatlist[0] = TLSEXT_ECPOINTFORMAT_uncompressed;
2286                 s->tlsext_ecpointformatlist[1] = TLSEXT_ECPOINTFORMAT_ansiX962_compressed_prime;
2287                 s->tlsext_ecpointformatlist[2] = TLSEXT_ECPOINTFORMAT_ansiX962_compressed_char2;
2288                 }
2289 #endif /* OPENSSL_NO_EC */
2290
2291         return 1;
2292         }
2293
2294 static int ssl_check_clienthello_tlsext_early(SSL *s)
2295         {
2296         int ret=SSL_TLSEXT_ERR_NOACK;
2297         int al = SSL_AD_UNRECOGNIZED_NAME;
2298
2299 #ifndef OPENSSL_NO_EC
2300         /* The handling of the ECPointFormats extension is done elsewhere, namely in
2301          * ssl3_choose_cipher in s3_lib.c.
2302          */
2303         /* The handling of the EllipticCurves extension is done elsewhere, namely in
2304          * ssl3_choose_cipher in s3_lib.c.
2305          */
2306 #endif
2307
2308         if (s->ctx != NULL && s->ctx->tlsext_servername_callback != 0)
2309                 ret = s->ctx->tlsext_servername_callback(s, &al, s->ctx->tlsext_servername_arg);
2310         else if (s->initial_ctx != NULL && s->initial_ctx->tlsext_servername_callback != 0)
2311                 ret = s->initial_ctx->tlsext_servername_callback(s, &al, s->initial_ctx->tlsext_servername_arg);
2312
2313 #ifdef TLSEXT_TYPE_opaque_prf_input
2314         {
2315                 /* This sort of belongs into ssl_prepare_serverhello_tlsext(),
2316                  * but we might be sending an alert in response to the client hello,
2317                  * so this has to happen here in
2318                  * ssl_check_clienthello_tlsext_early(). */
2319
2320                 int r = 1;
2321
2322                 if (s->ctx->tlsext_opaque_prf_input_callback != 0)
2323                         {
2324                         r = s->ctx->tlsext_opaque_prf_input_callback(s, NULL, 0, s->ctx->tlsext_opaque_prf_input_callback_arg);
2325                         if (!r)
2326                                 {
2327                                 ret = SSL_TLSEXT_ERR_ALERT_FATAL;
2328                                 al = SSL_AD_INTERNAL_ERROR;
2329                                 goto err;
2330                                 }
2331                         }
2332
2333                 if (s->s3->server_opaque_prf_input != NULL) /* shouldn't really happen */
2334                         OPENSSL_free(s->s3->server_opaque_prf_input);
2335                 s->s3->server_opaque_prf_input = NULL;
2336
2337                 if (s->tlsext_opaque_prf_input != NULL)
2338                         {
2339                         if (s->s3->client_opaque_prf_input != NULL &&
2340                                 s->s3->client_opaque_prf_input_len == s->tlsext_opaque_prf_input_len)
2341                                 {
2342                                 /* can only use this extension if we have a server opaque PRF input
2343                                  * of the same length as the client opaque PRF input! */
2344
2345                                 if (s->tlsext_opaque_prf_input_len == 0)
2346                                         s->s3->server_opaque_prf_input = OPENSSL_malloc(1); /* dummy byte just to get non-NULL */
2347                                 else
2348                                         s->s3->server_opaque_prf_input = BUF_memdup(s->tlsext_opaque_prf_input, s->tlsext_opaque_prf_input_len);
2349                                 if (s->s3->server_opaque_prf_input == NULL)
2350                                         {
2351                                         ret = SSL_TLSEXT_ERR_ALERT_FATAL;
2352                                         al = SSL_AD_INTERNAL_ERROR;
2353                                         goto err;
2354                                         }
2355                                 s->s3->server_opaque_prf_input_len = s->tlsext_opaque_prf_input_len;
2356                                 }
2357                         }
2358
2359                 if (r == 2 && s->s3->server_opaque_prf_input == NULL)
2360                         {
2361                         /* The callback wants to enforce use of the extension,
2362                          * but we can't do that with the client opaque PRF input;
2363                          * abort the handshake.
2364                          */
2365                         ret = SSL_TLSEXT_ERR_ALERT_FATAL;
2366                         al = SSL_AD_HANDSHAKE_FAILURE;
2367                         }
2368         }
2369
2370  err:
2371 #endif
2372         switch (ret)
2373                 {
2374                 case SSL_TLSEXT_ERR_ALERT_FATAL:
2375                         ssl3_send_alert(s,SSL3_AL_FATAL,al);
2376                         return -1;
2377
2378                 case SSL_TLSEXT_ERR_ALERT_WARNING:
2379                         ssl3_send_alert(s,SSL3_AL_WARNING,al);
2380                         return 1;
2381
2382                 case SSL_TLSEXT_ERR_NOACK:
2383                         s->servername_done=0;
2384                         default:
2385                 return 1;
2386                 }
2387         }
2388
2389 int ssl_check_clienthello_tlsext_late(SSL *s)
2390         {
2391         int ret = SSL_TLSEXT_ERR_OK;
2392         int al;
2393
2394         /* If status request then ask callback what to do.
2395          * Note: this must be called after servername callbacks in case
2396          * the certificate has changed, and must be called after the cipher
2397          * has been chosen because this may influence which certificate is sent
2398          */
2399         if ((s->tlsext_status_type != -1) && s->ctx && s->ctx->tlsext_status_cb)
2400                 {
2401                 int r;
2402                 CERT_PKEY *certpkey;
2403                 certpkey = ssl_get_server_send_pkey(s);
2404                 /* If no certificate can't return certificate status */
2405                 if (certpkey == NULL)
2406                         {
2407                         s->tlsext_status_expected = 0;
2408                         return 1;
2409                         }
2410                 /* Set current certificate to one we will use so
2411                  * SSL_get_certificate et al can pick it up.
2412                  */
2413                 s->cert->key = certpkey;
2414                 r = s->ctx->tlsext_status_cb(s, s->ctx->tlsext_status_arg);
2415                 switch (r)
2416                         {
2417                         /* We don't want to send a status request response */
2418                         case SSL_TLSEXT_ERR_NOACK:
2419                                 s->tlsext_status_expected = 0;
2420                                 break;
2421                         /* status request response should be sent */
2422                         case SSL_TLSEXT_ERR_OK:
2423                                 if (s->tlsext_ocsp_resp)
2424                                         s->tlsext_status_expected = 1;
2425                                 else
2426                                         s->tlsext_status_expected = 0;
2427                                 break;
2428                         /* something bad happened */
2429                         case SSL_TLSEXT_ERR_ALERT_FATAL:
2430                                 ret = SSL_TLSEXT_ERR_ALERT_FATAL;
2431                                 al = SSL_AD_INTERNAL_ERROR;
2432                                 goto err;
2433                         }
2434                 }
2435         else
2436                 s->tlsext_status_expected = 0;
2437
2438  err:
2439         switch (ret)
2440                 {
2441                 case SSL_TLSEXT_ERR_ALERT_FATAL:
2442                         ssl3_send_alert(s, SSL3_AL_FATAL,al);
2443                         return -1;
2444
2445                 case SSL_TLSEXT_ERR_ALERT_WARNING:
2446                         ssl3_send_alert(s, SSL3_AL_WARNING,al);
2447                         return 1;
2448
2449                 default:
2450                         return 1;
2451                 }
2452         }
2453
2454 int ssl_check_serverhello_tlsext(SSL *s)
2455         {
2456         int ret=SSL_TLSEXT_ERR_NOACK;
2457         int al = SSL_AD_UNRECOGNIZED_NAME;
2458
2459 #ifndef OPENSSL_NO_EC
2460         /* If we are client and using an elliptic curve cryptography cipher
2461          * suite, then if server returns an EC point formats lists extension
2462          * it must contain uncompressed.
2463          */
2464         unsigned long alg_k = s->s3->tmp.new_cipher->algorithm_mkey;
2465         unsigned long alg_a = s->s3->tmp.new_cipher->algorithm_auth;
2466         if ((s->tlsext_ecpointformatlist != NULL) && (s->tlsext_ecpointformatlist_length > 0) &&
2467             (s->session->tlsext_ecpointformatlist != NULL) && (s->session->tlsext_ecpointformatlist_length > 0) &&
2468             ((alg_k & (SSL_kEECDH|SSL_kECDHr|SSL_kECDHe)) || (alg_a & SSL_aECDSA)))
2469                 {
2470                 /* we are using an ECC cipher */
2471                 size_t i;
2472                 unsigned char *list;
2473                 int found_uncompressed = 0;
2474                 list = s->session->tlsext_ecpointformatlist;
2475                 for (i = 0; i < s->session->tlsext_ecpointformatlist_length; i++)
2476                         {
2477                         if (*(list++) == TLSEXT_ECPOINTFORMAT_uncompressed)
2478                                 {
2479                                 found_uncompressed = 1;
2480                                 break;
2481                                 }
2482                         }
2483                 if (!found_uncompressed)
2484                         {
2485                         SSLerr(SSL_F_SSL_CHECK_SERVERHELLO_TLSEXT,SSL_R_TLS_INVALID_ECPOINTFORMAT_LIST);
2486                         return -1;
2487                         }
2488                 }
2489         ret = SSL_TLSEXT_ERR_OK;
2490 #endif /* OPENSSL_NO_EC */
2491
2492         if (s->ctx != NULL && s->ctx->tlsext_servername_callback != 0)
2493                 ret = s->ctx->tlsext_servername_callback(s, &al, s->ctx->tlsext_servername_arg);
2494         else if (s->initial_ctx != NULL && s->initial_ctx->tlsext_servername_callback != 0)
2495                 ret = s->initial_ctx->tlsext_servername_callback(s, &al, s->initial_ctx->tlsext_servername_arg);
2496
2497 #ifdef TLSEXT_TYPE_opaque_prf_input
2498         if (s->s3->server_opaque_prf_input_len > 0)
2499                 {
2500                 /* This case may indicate that we, as a client, want to insist on using opaque PRF inputs.
2501                  * So first verify that we really have a value from the server too. */
2502
2503                 if (s->s3->server_opaque_prf_input == NULL)
2504                         {
2505                         ret = SSL_TLSEXT_ERR_ALERT_FATAL;
2506                         al = SSL_AD_HANDSHAKE_FAILURE;
2507                         }
2508
2509                 /* Anytime the server *has* sent an opaque PRF input, we need to check
2510                  * that we have a client opaque PRF input of the same size. */
2511                 if (s->s3->client_opaque_prf_input == NULL ||
2512                     s->s3->client_opaque_prf_input_len != s->s3->server_opaque_prf_input_len)
2513                         {
2514                         ret = SSL_TLSEXT_ERR_ALERT_FATAL;
2515                         al = SSL_AD_ILLEGAL_PARAMETER;
2516                         }
2517                 }
2518 #endif
2519
2520         /* If we've requested certificate status and we wont get one
2521          * tell the callback
2522          */
2523         if ((s->tlsext_status_type != -1) && !(s->tlsext_status_expected)
2524                         && s->ctx && s->ctx->tlsext_status_cb)
2525                 {
2526                 int r;
2527                 /* Set resp to NULL, resplen to -1 so callback knows
2528                  * there is no response.
2529                  */
2530                 if (s->tlsext_ocsp_resp)
2531                         {
2532                         OPENSSL_free(s->tlsext_ocsp_resp);
2533                         s->tlsext_ocsp_resp = NULL;
2534                         }
2535                 s->tlsext_ocsp_resplen = -1;
2536                 r = s->ctx->tlsext_status_cb(s, s->ctx->tlsext_status_arg);
2537                 if (r == 0)
2538                         {
2539                         al = SSL_AD_BAD_CERTIFICATE_STATUS_RESPONSE;
2540                         ret = SSL_TLSEXT_ERR_ALERT_FATAL;
2541                         }
2542                 if (r < 0)
2543                         {
2544                         al = SSL_AD_INTERNAL_ERROR;
2545                         ret = SSL_TLSEXT_ERR_ALERT_FATAL;
2546                         }
2547                 }
2548
2549         switch (ret)
2550                 {
2551                 case SSL_TLSEXT_ERR_ALERT_FATAL:
2552                         ssl3_send_alert(s,SSL3_AL_FATAL,al);
2553                         return -1;
2554
2555                 case SSL_TLSEXT_ERR_ALERT_WARNING:
2556                         ssl3_send_alert(s,SSL3_AL_WARNING,al);
2557                         return 1;
2558
2559                 case SSL_TLSEXT_ERR_NOACK:
2560                         s->servername_done=0;
2561                         default:
2562                 return 1;
2563                 }
2564         }
2565
2566 int ssl_parse_serverhello_tlsext(SSL *s, unsigned char **p, unsigned char *d, int n)
2567         {
2568         int al = -1;
2569         if (s->version < SSL3_VERSION)
2570                 return 1;
2571         if (ssl_scan_serverhello_tlsext(s, p, d, n, &al) <= 0)
2572                 {
2573                 ssl3_send_alert(s,SSL3_AL_FATAL,al);
2574                 return 0;
2575                 }
2576
2577         if (ssl_check_serverhello_tlsext(s) <= 0)
2578                 {
2579                 SSLerr(SSL_F_SSL_PARSE_SERVERHELLO_TLSEXT,SSL_R_SERVERHELLO_TLSEXT);
2580                 return 0;
2581                 }
2582         return 1;
2583 }
2584
2585 /* Since the server cache lookup is done early on in the processing of the
2586  * ClientHello, and other operations depend on the result, we need to handle
2587  * any TLS session ticket extension at the same time.
2588  *
2589  *   session_id: points at the session ID in the ClientHello. This code will
2590  *       read past the end of this in order to parse out the session ticket
2591  *       extension, if any.
2592  *   len: the length of the session ID.
2593  *   limit: a pointer to the first byte after the ClientHello.
2594  *   ret: (output) on return, if a ticket was decrypted, then this is set to
2595  *       point to the resulting session.
2596  *
2597  * If s->tls_session_secret_cb is set then we are expecting a pre-shared key
2598  * ciphersuite, in which case we have no use for session tickets and one will
2599  * never be decrypted, nor will s->tlsext_ticket_expected be set to 1.
2600  *
2601  * Returns:
2602  *   -1: fatal error, either from parsing or decrypting the ticket.
2603  *    0: no ticket was found (or was ignored, based on settings).
2604  *    1: a zero length extension was found, indicating that the client supports
2605  *       session tickets but doesn't currently have one to offer.
2606  *    2: either s->tls_session_secret_cb was set, or a ticket was offered but
2607  *       couldn't be decrypted because of a non-fatal error.
2608  *    3: a ticket was successfully decrypted and *ret was set.
2609  *
2610  * Side effects:
2611  *   Sets s->tlsext_ticket_expected to 1 if the server will have to issue
2612  *   a new session ticket to the client because the client indicated support
2613  *   (and s->tls_session_secret_cb is NULL) but the client either doesn't have
2614  *   a session ticket or we couldn't use the one it gave us, or if
2615  *   s->ctx->tlsext_ticket_key_cb asked to renew the client's ticket.
2616  *   Otherwise, s->tlsext_ticket_expected is set to 0.
2617  */
2618 int tls1_process_ticket(SSL *s, unsigned char *session_id, int len,
2619                         const unsigned char *limit, SSL_SESSION **ret)
2620         {
2621         /* Point after session ID in client hello */
2622         const unsigned char *p = session_id + len;
2623         unsigned short i;
2624
2625         *ret = NULL;
2626         s->tlsext_ticket_expected = 0;
2627
2628         /* If tickets disabled behave as if no ticket present
2629          * to permit stateful resumption.
2630          */
2631         if (SSL_get_options(s) & SSL_OP_NO_TICKET)
2632                 return 0;
2633         if ((s->version <= SSL3_VERSION) || !limit)
2634                 return 0;
2635         if (p >= limit)
2636                 return -1;
2637         /* Skip past DTLS cookie */
2638         if (s->version == DTLS1_VERSION || s->version == DTLS1_BAD_VER)
2639                 {
2640                 i = *(p++);
2641                 p+= i;
2642                 if (p >= limit)
2643                         return -1;
2644                 }
2645         /* Skip past cipher list */
2646         n2s(p, i);
2647         p+= i;
2648         if (p >= limit)
2649                 return -1;
2650         /* Skip past compression algorithm list */
2651         i = *(p++);
2652         p += i;
2653         if (p > limit)
2654                 return -1;
2655         /* Now at start of extensions */
2656         if ((p + 2) >= limit)
2657                 return 0;
2658         n2s(p, i);
2659         while ((p + 4) <= limit)
2660                 {
2661                 unsigned short type, size;
2662                 n2s(p, type);
2663                 n2s(p, size);
2664                 if (p + size > limit)
2665                         return 0;
2666                 if (type == TLSEXT_TYPE_session_ticket)
2667                         {
2668                         int r;
2669                         if (size == 0)
2670                                 {
2671                                 /* The client will accept a ticket but doesn't
2672                                  * currently have one. */
2673                                 s->tlsext_ticket_expected = 1;
2674                                 return 1;
2675                                 }
2676                         if (s->tls_session_secret_cb)
2677                                 {
2678                                 /* Indicate that the ticket couldn't be
2679                                  * decrypted rather than generating the session
2680                                  * from ticket now, trigger abbreviated
2681                                  * handshake based on external mechanism to
2682                                  * calculate the master secret later. */
2683                                 return 2;
2684                                 }
2685                         r = tls_decrypt_ticket(s, p, size, session_id, len, ret);
2686                         switch (r)
2687                                 {
2688                                 case 2: /* ticket couldn't be decrypted */
2689                                         s->tlsext_ticket_expected = 1;
2690                                         return 2;
2691                                 case 3: /* ticket was decrypted */
2692                                         return r;
2693                                 case 4: /* ticket decrypted but need to renew */
2694                                         s->tlsext_ticket_expected = 1;
2695                                         return 3;
2696                                 default: /* fatal error */
2697                                         return -1;
2698                                 }
2699                         }
2700                 p += size;
2701                 }
2702         return 0;
2703         }
2704
2705 /* tls_decrypt_ticket attempts to decrypt a session ticket.
2706  *
2707  *   etick: points to the body of the session ticket extension.
2708  *   eticklen: the length of the session tickets extenion.
2709  *   sess_id: points at the session ID.
2710  *   sesslen: the length of the session ID.
2711  *   psess: (output) on return, if a ticket was decrypted, then this is set to
2712  *       point to the resulting session.
2713  *
2714  * Returns:
2715  *   -1: fatal error, either from parsing or decrypting the ticket.
2716  *    2: the ticket couldn't be decrypted.
2717  *    3: a ticket was successfully decrypted and *psess was set.
2718  *    4: same as 3, but the ticket needs to be renewed.
2719  */
2720 static int tls_decrypt_ticket(SSL *s, const unsigned char *etick, int eticklen,
2721                                 const unsigned char *sess_id, int sesslen,
2722                                 SSL_SESSION **psess)
2723         {
2724         SSL_SESSION *sess;
2725         unsigned char *sdec;
2726         const unsigned char *p;
2727         int slen, mlen, renew_ticket = 0;
2728         unsigned char tick_hmac[EVP_MAX_MD_SIZE];
2729         HMAC_CTX hctx;
2730         EVP_CIPHER_CTX ctx;
2731         SSL_CTX *tctx = s->initial_ctx;
2732         /* Need at least keyname + iv + some encrypted data */
2733         if (eticklen < 48)
2734                 return 2;
2735         /* Initialize session ticket encryption and HMAC contexts */
2736         HMAC_CTX_init(&hctx);
2737         EVP_CIPHER_CTX_init(&ctx);
2738         if (tctx->tlsext_ticket_key_cb)
2739                 {
2740                 unsigned char *nctick = (unsigned char *)etick;
2741                 int rv = tctx->tlsext_ticket_key_cb(s, nctick, nctick + 16,
2742                                                         &ctx, &hctx, 0);
2743                 if (rv < 0)
2744                         return -1;
2745                 if (rv == 0)
2746                         return 2;
2747                 if (rv == 2)
2748                         renew_ticket = 1;
2749                 }
2750         else
2751                 {
2752                 /* Check key name matches */
2753                 if (memcmp(etick, tctx->tlsext_tick_key_name, 16))
2754                         return 2;
2755                 HMAC_Init_ex(&hctx, tctx->tlsext_tick_hmac_key, 16,
2756                                         tlsext_tick_md(), NULL);
2757                 EVP_DecryptInit_ex(&ctx, EVP_aes_128_cbc(), NULL,
2758                                 tctx->tlsext_tick_aes_key, etick + 16);
2759                 }
2760         /* Attempt to process session ticket, first conduct sanity and
2761          * integrity checks on ticket.
2762          */
2763         mlen = HMAC_size(&hctx);
2764         if (mlen < 0)
2765                 {
2766                 EVP_CIPHER_CTX_cleanup(&ctx);
2767                 return -1;
2768                 }
2769         eticklen -= mlen;
2770         /* Check HMAC of encrypted ticket */
2771         HMAC_Update(&hctx, etick, eticklen);
2772         HMAC_Final(&hctx, tick_hmac, NULL);
2773         HMAC_CTX_cleanup(&hctx);
2774         if (memcmp(tick_hmac, etick + eticklen, mlen))
2775                 return 2;
2776         /* Attempt to decrypt session data */
2777         /* Move p after IV to start of encrypted ticket, update length */
2778         p = etick + 16 + EVP_CIPHER_CTX_iv_length(&ctx);
2779         eticklen -= 16 + EVP_CIPHER_CTX_iv_length(&ctx);
2780         sdec = OPENSSL_malloc(eticklen);
2781         if (!sdec)
2782                 {
2783                 EVP_CIPHER_CTX_cleanup(&ctx);
2784                 return -1;
2785                 }
2786         EVP_DecryptUpdate(&ctx, sdec, &slen, p, eticklen);
2787         if (EVP_DecryptFinal(&ctx, sdec + slen, &mlen) <= 0)
2788                 return 2;
2789         slen += mlen;
2790         EVP_CIPHER_CTX_cleanup(&ctx);
2791         p = sdec;
2792
2793         sess = d2i_SSL_SESSION(NULL, &p, slen);
2794         OPENSSL_free(sdec);
2795         if (sess)
2796                 {
2797                 /* The session ID, if non-empty, is used by some clients to
2798                  * detect that the ticket has been accepted. So we copy it to
2799                  * the session structure. If it is empty set length to zero
2800                  * as required by standard.
2801                  */
2802                 if (sesslen)
2803                         memcpy(sess->session_id, sess_id, sesslen);
2804                 sess->session_id_length = sesslen;
2805                 *psess = sess;
2806                 if (renew_ticket)
2807                         return 4;
2808                 else
2809                         return 3;
2810                 }
2811         ERR_clear_error();
2812         /* For session parse failure, indicate that we need to send a new
2813          * ticket. */
2814         return 2;
2815         }
2816
2817 /* Tables to translate from NIDs to TLS v1.2 ids */
2818
2819 typedef struct
2820         {
2821         int nid;
2822         int id;
2823         } tls12_lookup;
2824
2825 static tls12_lookup tls12_md[] = {
2826         {NID_md5, TLSEXT_hash_md5},
2827         {NID_sha1, TLSEXT_hash_sha1},
2828         {NID_sha224, TLSEXT_hash_sha224},
2829         {NID_sha256, TLSEXT_hash_sha256},
2830         {NID_sha384, TLSEXT_hash_sha384},
2831         {NID_sha512, TLSEXT_hash_sha512}
2832 };
2833
2834 static tls12_lookup tls12_sig[] = {
2835         {EVP_PKEY_RSA, TLSEXT_signature_rsa},
2836         {EVP_PKEY_DSA, TLSEXT_signature_dsa},
2837         {EVP_PKEY_EC, TLSEXT_signature_ecdsa}
2838 };
2839
2840 static int tls12_find_id(int nid, tls12_lookup *table, size_t tlen)
2841         {
2842         size_t i;
2843         for (i = 0; i < tlen; i++)
2844                 {
2845                 if (table[i].nid == nid)
2846                         return table[i].id;
2847                 }
2848         return -1;
2849         }
2850
2851 static int tls12_find_nid(int id, tls12_lookup *table, size_t tlen)
2852         {
2853         size_t i;
2854         for (i = 0; i < tlen; i++)
2855                 {
2856                 if ((table[i].id) == id)
2857                         return table[i].nid;
2858                 }
2859         return NID_undef;
2860         }
2861
2862 int tls12_get_sigandhash(unsigned char *p, const EVP_PKEY *pk, const EVP_MD *md)
2863         {
2864         int sig_id, md_id;
2865         if (!md)
2866                 return 0;
2867         md_id = tls12_find_id(EVP_MD_type(md), tls12_md,
2868                                 sizeof(tls12_md)/sizeof(tls12_lookup));
2869         if (md_id == -1)
2870                 return 0;
2871         sig_id = tls12_get_sigid(pk);
2872         if (sig_id == -1)
2873                 return 0;
2874         p[0] = (unsigned char)md_id;
2875         p[1] = (unsigned char)sig_id;
2876         return 1;
2877         }
2878
2879 int tls12_get_sigid(const EVP_PKEY *pk)
2880         {
2881         return tls12_find_id(pk->type, tls12_sig,
2882                                 sizeof(tls12_sig)/sizeof(tls12_lookup));
2883         }
2884
2885 const EVP_MD *tls12_get_hash(unsigned char hash_alg)
2886         {
2887         switch(hash_alg)
2888                 {
2889 #ifndef OPENSSL_NO_MD5
2890                 case TLSEXT_hash_md5:
2891 #ifdef OPENSSL_FIPS
2892                 if (FIPS_mode())
2893                         return NULL;
2894 #endif
2895                 return EVP_md5();
2896 #endif
2897 #ifndef OPENSSL_NO_SHA
2898                 case TLSEXT_hash_sha1:
2899                 return EVP_sha1();
2900 #endif
2901 #ifndef OPENSSL_NO_SHA256
2902                 case TLSEXT_hash_sha224:
2903                 return EVP_sha224();
2904
2905                 case TLSEXT_hash_sha256:
2906                 return EVP_sha256();
2907 #endif
2908 #ifndef OPENSSL_NO_SHA512
2909                 case TLSEXT_hash_sha384:
2910                 return EVP_sha384();
2911
2912                 case TLSEXT_hash_sha512:
2913                 return EVP_sha512();
2914 #endif
2915                 default:
2916                 return NULL;
2917
2918                 }
2919         }
2920
2921 static int tls12_get_pkey_idx(unsigned char sig_alg)
2922         {
2923         switch(sig_alg)
2924                 {
2925 #ifndef OPENSSL_NO_RSA
2926         case TLSEXT_signature_rsa:
2927                 return SSL_PKEY_RSA_SIGN;
2928 #endif
2929 #ifndef OPENSSL_NO_DSA
2930         case TLSEXT_signature_dsa:
2931                 return SSL_PKEY_DSA_SIGN;
2932 #endif
2933 #ifndef OPENSSL_NO_ECDSA
2934         case TLSEXT_signature_ecdsa:
2935                 return SSL_PKEY_ECC;
2936 #endif
2937                 }
2938         return -1;
2939         }
2940
2941 /* Convert TLS 1.2 signature algorithm extension values into NIDs */
2942 static void tls1_lookup_sigalg(int *phash_nid, int *psign_nid,
2943                         int *psignhash_nid, const unsigned char *data)
2944         {
2945         int sign_nid, hash_nid;
2946         if (!phash_nid && !psign_nid && !psignhash_nid)
2947                 return;
2948         if (phash_nid || psignhash_nid)
2949                 {
2950                 hash_nid = tls12_find_nid(data[0], tls12_md,
2951                                         sizeof(tls12_md)/sizeof(tls12_lookup));
2952                 if (phash_nid)
2953                         *phash_nid = hash_nid;
2954                 }
2955         if (psign_nid || psignhash_nid)
2956                 {
2957                 sign_nid = tls12_find_nid(data[1], tls12_sig,
2958                                         sizeof(tls12_sig)/sizeof(tls12_lookup));
2959                 if (psign_nid)
2960                         *psign_nid = sign_nid;
2961                 }
2962         if (psignhash_nid)
2963                 {
2964                 if (sign_nid && hash_nid)
2965                         OBJ_find_sigid_by_algs(psignhash_nid,
2966                                                         hash_nid, sign_nid);
2967                 else
2968                         *psignhash_nid = NID_undef;
2969                 }
2970         }
2971 /* Given preference and allowed sigalgs set shared sigalgs */
2972 static int tls12_do_shared_sigalgs(TLS_SIGALGS *shsig,
2973                                 const unsigned char *pref, size_t preflen,
2974                                 const unsigned char *allow, size_t allowlen)
2975         {
2976         const unsigned char *ptmp, *atmp;
2977         size_t i, j, nmatch = 0;
2978         for (i = 0, ptmp = pref; i < preflen; i+=2, ptmp+=2)
2979                 {
2980                 /* Skip disabled hashes or signature algorithms */
2981                 if (tls12_get_hash(ptmp[0]) == NULL)
2982                         continue;
2983                 if (tls12_get_pkey_idx(ptmp[1]) == -1)
2984                         continue;
2985                 for (j = 0, atmp = allow; j < allowlen; j+=2, atmp+=2)
2986                         {
2987                         if (ptmp[0] == atmp[0] && ptmp[1] == atmp[1])
2988                                 {
2989                                 nmatch++;
2990                                 if (shsig)
2991                                         {
2992                                         shsig->rhash = ptmp[0];
2993                                         shsig->rsign = ptmp[1];
2994                                         tls1_lookup_sigalg(&shsig->hash_nid,
2995                                                 &shsig->sign_nid,
2996                                                 &shsig->signandhash_nid,
2997                                                 ptmp);
2998                                         shsig++;
2999                                         }
3000                                 break;
3001                                 }
3002                         }
3003                 }
3004         return nmatch;
3005         }
3006
3007 /* Set shared signature algorithms for SSL structures */
3008 static int tls1_set_shared_sigalgs(SSL *s)
3009         {
3010         const unsigned char *pref, *allow, *conf;
3011         size_t preflen, allowlen, conflen;
3012         size_t nmatch;
3013         TLS_SIGALGS *salgs = NULL;
3014         CERT *c = s->cert;
3015         conf = c->conf_sigalgs;
3016         if (conf)
3017                 conflen = c->conf_sigalgslen;
3018         else
3019                 {
3020                 conf = tls12_sigalgs;
3021                 conflen = sizeof(tls12_sigalgs);
3022 #ifdef OPENSSL_FIPS
3023                 if (FIPS_mode())
3024                         conflen -= 2;
3025 #endif
3026                 }
3027         if(s->options & SSL_OP_CIPHER_SERVER_PREFERENCE)
3028                 {
3029                 pref = conf;
3030                 preflen = conflen;
3031                 allow = c->peer_sigalgs;
3032                 allowlen = c->peer_sigalgslen;
3033                 }
3034         else
3035                 {
3036                 allow = conf;
3037                 allowlen = conflen;
3038                 pref = c->peer_sigalgs;
3039                 preflen = c->peer_sigalgslen;
3040                 }
3041         nmatch = tls12_do_shared_sigalgs(NULL, pref, preflen, allow, allowlen);
3042         if (!nmatch)
3043                 return 1;
3044         salgs = OPENSSL_malloc(nmatch * sizeof(TLS_SIGALGS));
3045         if (!salgs)
3046                 return 0;
3047         nmatch = tls12_do_shared_sigalgs(salgs, pref, preflen, allow, allowlen);
3048         c->shared_sigalgs = salgs;
3049         c->shared_sigalgslen = nmatch;
3050         return 1;
3051         }
3052
3053
3054 /* Set preferred digest for each key type */
3055
3056 int tls1_process_sigalgs(SSL *s, const unsigned char *data, int dsize)
3057         {
3058         int idx;
3059         size_t i;
3060         const EVP_MD *md;
3061         CERT *c = s->cert;
3062         TLS_SIGALGS *sigptr;
3063         /* Extension ignored for TLS versions below 1.2 */
3064         if (TLS1_get_version(s) < TLS1_2_VERSION)
3065                 return 1;
3066         /* Should never happen */
3067         if (!c)
3068                 return 0;
3069
3070         c->pkeys[SSL_PKEY_DSA_SIGN].digest = NULL;
3071         c->pkeys[SSL_PKEY_RSA_SIGN].digest = NULL;
3072         c->pkeys[SSL_PKEY_RSA_ENC].digest = NULL;
3073         c->pkeys[SSL_PKEY_ECC].digest = NULL;
3074
3075         c->peer_sigalgs = OPENSSL_malloc(dsize);
3076         if (!c->peer_sigalgs)
3077                 return 0;
3078         c->peer_sigalgslen = dsize;
3079         memcpy(c->peer_sigalgs, data, dsize);
3080
3081         tls1_set_shared_sigalgs(s);
3082
3083         for (i = 0, sigptr = c->shared_sigalgs;
3084                         i < c->shared_sigalgslen; i++, sigptr++)
3085                 {
3086                 idx = tls12_get_pkey_idx(sigptr->rsign);
3087                 if (idx > 0 && c->pkeys[idx].digest == NULL)
3088                         {
3089                         md = tls12_get_hash(sigptr->rhash);
3090                         c->pkeys[idx].digest = md;
3091                         if (idx == SSL_PKEY_RSA_SIGN)
3092                                 c->pkeys[SSL_PKEY_RSA_ENC].digest = md;
3093                         }
3094
3095                 }
3096         /* In strict mode leave unset digests as NULL to indicate we can't
3097          * use the certificate for signing.
3098          */
3099         if (!(s->cert->cert_flags & SSL_CERT_FLAG_TLS_STRICT))
3100                 {
3101                 /* Set any remaining keys to default values. NOTE: if alg is
3102                  * not supported it stays as NULL.
3103                  */
3104 #ifndef OPENSSL_NO_DSA
3105                 if (!c->pkeys[SSL_PKEY_DSA_SIGN].digest)
3106                         c->pkeys[SSL_PKEY_DSA_SIGN].digest = EVP_sha1();
3107 #endif
3108 #ifndef OPENSSL_NO_RSA
3109                 if (!c->pkeys[SSL_PKEY_RSA_SIGN].digest)
3110                         {
3111                         c->pkeys[SSL_PKEY_RSA_SIGN].digest = EVP_sha1();
3112                         c->pkeys[SSL_PKEY_RSA_ENC].digest = EVP_sha1();
3113                         }
3114 #endif
3115 #ifndef OPENSSL_NO_ECDSA
3116                 if (!c->pkeys[SSL_PKEY_ECC].digest)
3117                         c->pkeys[SSL_PKEY_ECC].digest = EVP_sha1();
3118 #endif
3119                 }
3120         return 1;
3121         }
3122
3123
3124 int SSL_get_sigalgs(SSL *s, int idx,
3125                         int *psign, int *phash, int *psignhash,
3126                         unsigned char *rsig, unsigned char *rhash)
3127         {
3128         const unsigned char *psig = s->cert->peer_sigalgs;
3129         if (psig == NULL)
3130                 return 0;
3131         if (idx >= 0)
3132                 {
3133                 idx <<= 1;
3134                 if (idx >= (int)s->cert->peer_sigalgslen)
3135                         return 0;
3136                 psig += idx;
3137                 if (rhash)
3138                         *rhash = psig[0];
3139                 if (rsig)
3140                         *rsig = psig[1];
3141                 tls1_lookup_sigalg(phash, psign, psignhash, psig);
3142                 }
3143         return s->cert->peer_sigalgslen / 2;
3144         }
3145
3146 int SSL_get_shared_sigalgs(SSL *s, int idx,
3147                         int *psign, int *phash, int *psignhash,
3148                         unsigned char *rsig, unsigned char *rhash)
3149         {
3150         TLS_SIGALGS *shsigalgs = s->cert->shared_sigalgs;
3151         if (!shsigalgs || idx >= (int)s->cert->shared_sigalgslen)
3152                 return 0;
3153         shsigalgs += idx;
3154         if (phash)
3155                 *phash = shsigalgs->hash_nid;
3156         if (psign)
3157                 *psign = shsigalgs->sign_nid;
3158         if (psignhash)
3159                 *psignhash = shsigalgs->signandhash_nid;
3160         if (rsig)
3161                 *rsig = shsigalgs->rsign;
3162         if (rhash)
3163                 *rhash = shsigalgs->rhash;
3164         return s->cert->shared_sigalgslen;
3165         }
3166
3167
3168 #ifndef OPENSSL_NO_HEARTBEATS
3169 int
3170 tls1_process_heartbeat(SSL *s)
3171         {
3172         unsigned char *p = &s->s3->rrec.data[0], *pl;
3173         unsigned short hbtype;
3174         unsigned int payload;
3175         unsigned int padding = 16; /* Use minimum padding */
3176
3177         /* Read type and payload length first */
3178         hbtype = *p++;
3179         n2s(p, payload);
3180         pl = p;
3181
3182         if (s->msg_callback)
3183                 s->msg_callback(0, s->version, TLS1_RT_HEARTBEAT,
3184                         &s->s3->rrec.data[0], s->s3->rrec.length,
3185                         s, s->msg_callback_arg);
3186
3187         if (hbtype == TLS1_HB_REQUEST)
3188                 {
3189                 unsigned char *buffer, *bp;
3190                 int r;
3191
3192                 /* Allocate memory for the response, size is 1 bytes
3193                  * message type, plus 2 bytes payload length, plus
3194                  * payload, plus padding
3195                  */
3196                 buffer = OPENSSL_malloc(1 + 2 + payload + padding);
3197                 bp = buffer;
3198
3199                 /* Enter response type, length and copy payload */
3200                 *bp++ = TLS1_HB_RESPONSE;
3201                 s2n(payload, bp);
3202                 memcpy(bp, pl, payload);
3203                 bp += payload;
3204                 /* Random padding */
3205                 RAND_pseudo_bytes(bp, padding);
3206
3207                 r = ssl3_write_bytes(s, TLS1_RT_HEARTBEAT, buffer, 3 + payload + padding);
3208
3209                 if (r >= 0 && s->msg_callback)
3210                         s->msg_callback(1, s->version, TLS1_RT_HEARTBEAT,
3211                                 buffer, 3 + payload + padding,
3212                                 s, s->msg_callback_arg);
3213
3214                 OPENSSL_free(buffer);
3215
3216                 if (r < 0)
3217                         return r;
3218                 }
3219         else if (hbtype == TLS1_HB_RESPONSE)
3220                 {
3221                 unsigned int seq;
3222
3223                 /* We only send sequence numbers (2 bytes unsigned int),
3224                  * and 16 random bytes, so we just try to read the
3225                  * sequence number */
3226                 n2s(pl, seq);
3227
3228                 if (payload == 18 && seq == s->tlsext_hb_seq)
3229                         {
3230                         s->tlsext_hb_seq++;
3231                         s->tlsext_hb_pending = 0;
3232                         }
3233                 }
3234
3235         return 0;
3236         }
3237
3238 int
3239 tls1_heartbeat(SSL *s)
3240         {
3241         unsigned char *buf, *p;
3242         int ret;
3243         unsigned int payload = 18; /* Sequence number + random bytes */
3244         unsigned int padding = 16; /* Use minimum padding */
3245
3246         /* Only send if peer supports and accepts HB requests... */
3247         if (!(s->tlsext_heartbeat & SSL_TLSEXT_HB_ENABLED) ||
3248             s->tlsext_heartbeat & SSL_TLSEXT_HB_DONT_SEND_REQUESTS)
3249                 {
3250                 SSLerr(SSL_F_TLS1_HEARTBEAT,SSL_R_TLS_HEARTBEAT_PEER_DOESNT_ACCEPT);
3251                 return -1;
3252                 }
3253
3254         /* ...and there is none in flight yet... */
3255         if (s->tlsext_hb_pending)
3256                 {
3257                 SSLerr(SSL_F_TLS1_HEARTBEAT,SSL_R_TLS_HEARTBEAT_PENDING);
3258                 return -1;
3259                 }
3260
3261         /* ...and no handshake in progress. */
3262         if (SSL_in_init(s) || s->in_handshake)
3263                 {
3264                 SSLerr(SSL_F_TLS1_HEARTBEAT,SSL_R_UNEXPECTED_MESSAGE);
3265                 return -1;
3266                 }
3267
3268         /* Check if padding is too long, payload and padding
3269          * must not exceed 2^14 - 3 = 16381 bytes in total.
3270          */
3271         OPENSSL_assert(payload + padding <= 16381);
3272
3273         /* Create HeartBeat message, we just use a sequence number
3274          * as payload to distuingish different messages and add
3275          * some random stuff.
3276          *  - Message Type, 1 byte
3277          *  - Payload Length, 2 bytes (unsigned int)
3278          *  - Payload, the sequence number (2 bytes uint)
3279          *  - Payload, random bytes (16 bytes uint)
3280          *  - Padding
3281          */
3282         buf = OPENSSL_malloc(1 + 2 + payload + padding);
3283         p = buf;
3284         /* Message Type */
3285         *p++ = TLS1_HB_REQUEST;
3286         /* Payload length (18 bytes here) */
3287         s2n(payload, p);
3288         /* Sequence number */
3289         s2n(s->tlsext_hb_seq, p);
3290         /* 16 random bytes */
3291         RAND_pseudo_bytes(p, 16);
3292         p += 16;
3293         /* Random padding */
3294         RAND_pseudo_bytes(p, padding);
3295
3296         ret = ssl3_write_bytes(s, TLS1_RT_HEARTBEAT, buf, 3 + payload + padding);
3297         if (ret >= 0)
3298                 {
3299                 if (s->msg_callback)
3300                         s->msg_callback(1, s->version, TLS1_RT_HEARTBEAT,
3301                                 buf, 3 + payload + padding,
3302                                 s, s->msg_callback_arg);
3303
3304                 s->tlsext_hb_pending = 1;
3305                 }
3306
3307         OPENSSL_free(buf);
3308
3309         return ret;
3310         }
3311 #endif
3312
3313 #define MAX_SIGALGLEN   (TLSEXT_hash_num * TLSEXT_signature_num * 2)
3314
3315 typedef struct
3316         {
3317         size_t sigalgcnt;
3318         int sigalgs[MAX_SIGALGLEN];
3319         } sig_cb_st;
3320
3321 static int sig_cb(const char *elem, int len, void *arg)
3322         {
3323         sig_cb_st *sarg = arg;
3324         size_t i;
3325         char etmp[20], *p;
3326         int sig_alg, hash_alg;
3327         if (sarg->sigalgcnt == MAX_SIGALGLEN)
3328                 return 0;
3329         if (len > (int)(sizeof(etmp) - 1))
3330                 return 0;
3331         memcpy(etmp, elem, len);
3332         etmp[len] = 0;
3333         p = strchr(etmp, '+');
3334         if (!p)
3335                 return 0;
3336         *p = 0;
3337         p++;
3338         if (!*p)
3339                 return 0;
3340
3341         if (!strcmp(etmp, "RSA"))
3342                 sig_alg = EVP_PKEY_RSA;
3343         else if (!strcmp(etmp, "DSA"))
3344                 sig_alg = EVP_PKEY_DSA;
3345         else if (!strcmp(etmp, "ECDSA"))
3346                 sig_alg = EVP_PKEY_EC;
3347         else return 0;
3348
3349         hash_alg = OBJ_sn2nid(p);
3350         if (hash_alg == NID_undef)
3351                 hash_alg = OBJ_ln2nid(p);
3352         if (hash_alg == NID_undef)
3353                 return 0;
3354
3355         for (i = 0; i < sarg->sigalgcnt; i+=2)
3356                 {
3357                 if (sarg->sigalgs[i] == sig_alg
3358                         && sarg->sigalgs[i + 1] == hash_alg)
3359                         return 0;
3360                 }
3361         sarg->sigalgs[sarg->sigalgcnt++] = hash_alg;
3362         sarg->sigalgs[sarg->sigalgcnt++] = sig_alg;
3363         return 1;
3364         }
3365
3366 /* Set suppored signature algorithms based on a colon separated list
3367  * of the form sig+hash e.g. RSA+SHA512:DSA+SHA512 */
3368 int tls1_set_sigalgs_list(CERT *c, const char *str)
3369         {
3370         sig_cb_st sig;
3371         sig.sigalgcnt = 0;
3372         if (!CONF_parse_list(str, ':', 1, sig_cb, &sig))
3373                 return 0;
3374         return tls1_set_sigalgs(c, sig.sigalgs, sig.sigalgcnt);
3375         }
3376
3377 int tls1_set_sigalgs(CERT *c, const int *psig_nids, size_t salglen)
3378         {
3379         unsigned char *sigalgs, *sptr;
3380         int rhash, rsign;
3381         size_t i;
3382         if (salglen & 1)
3383                 return 0;
3384         sigalgs = OPENSSL_malloc(salglen);
3385         if (sigalgs == NULL)
3386                 return 0;
3387         for (i = 0, sptr = sigalgs; i < salglen; i+=2)
3388                 {
3389                 rhash = tls12_find_id(*psig_nids++, tls12_md,
3390                                         sizeof(tls12_md)/sizeof(tls12_lookup));
3391                 rsign = tls12_find_id(*psig_nids++, tls12_sig,
3392                                 sizeof(tls12_sig)/sizeof(tls12_lookup));
3393
3394                 if (rhash == -1 || rsign == -1)
3395                         goto err;
3396                 *sptr++ = rhash;
3397                 *sptr++ = rsign;
3398                 }
3399
3400         if (c->conf_sigalgs)
3401                 OPENSSL_free(c->conf_sigalgs);
3402
3403         c->conf_sigalgs = sigalgs;
3404         c->conf_sigalgslen = salglen;
3405         return 1;
3406
3407         err:
3408         OPENSSL_free(sigalgs);
3409         return 0;
3410         }
3411
3412 static int tls1_check_sig_alg(CERT *c, X509 *x, int default_nid)
3413         {
3414         int sig_nid;
3415         size_t i;
3416         if (default_nid == -1)
3417                 return 1;
3418         sig_nid = X509_get_signature_nid(x);
3419         if (default_nid)
3420                 return sig_nid == default_nid ? 1 : 0;
3421         for (i = 0; i < c->shared_sigalgslen; i++)
3422                 if (sig_nid == c->shared_sigalgs[i].signandhash_nid)
3423                         return 1;
3424         return 0;
3425         }
3426
3427 /* Check certificate chain is consistent with TLS extensions and is
3428  * usable by server.
3429  */
3430 int tls1_check_chain(SSL *s, X509 *x, EVP_PKEY *pk, STACK_OF(X509) *chain,
3431                                                                         int idx)
3432         {
3433         int i;
3434         int rv = CERT_PKEY_INVALID;
3435         CERT_PKEY *cpk = NULL;
3436         CERT *c = s->cert;
3437         if (idx != -1)
3438                 {
3439                 cpk = c->pkeys + idx;
3440                 x = cpk->x509;
3441                 pk = cpk->privatekey;
3442                 chain = cpk->chain;
3443                 /* If no cert or key, forget it */
3444                 if (!x || !pk)
3445                         goto end;
3446                 }
3447         else
3448                 {
3449                 idx = ssl_cert_type(x, pk);
3450                 if (idx == -1)
3451                         goto end;
3452                 }
3453
3454         /* Check all signature algorithms are consistent with
3455          * signature algorithms extension if TLS 1.2 or later
3456          * and strict mode.
3457          */
3458         if (TLS1_get_version(s) >= TLS1_2_VERSION
3459                 && c->cert_flags & SSL_CERT_FLAG_TLS_STRICT)
3460                 {
3461                 int default_nid;
3462                 unsigned char rsign = 0;
3463                 if (c->peer_sigalgs)
3464                         default_nid = 0;
3465                 /* If no sigalgs extension use defaults from RFC5246 */
3466                 else
3467                         {
3468                         switch(idx)
3469                                 {
3470                         case SSL_PKEY_RSA_ENC:
3471                         case SSL_PKEY_RSA_SIGN:
3472                         case SSL_PKEY_DH_RSA:
3473                                 rsign = TLSEXT_signature_rsa;
3474                                 default_nid = NID_sha1WithRSAEncryption;
3475                                 break;
3476
3477                         case SSL_PKEY_DSA_SIGN:
3478                         case SSL_PKEY_DH_DSA:
3479                                 rsign = TLSEXT_signature_dsa;
3480                                 default_nid = NID_dsaWithSHA1;
3481                                 break;
3482
3483                         case SSL_PKEY_ECC:
3484                                 rsign = TLSEXT_signature_ecdsa;
3485                                 default_nid = NID_ecdsa_with_SHA1;
3486                                 break;
3487
3488                         default:
3489                                 default_nid = -1;
3490                                 break;
3491                                 }
3492                         }
3493                 /* If peer sent no signature algorithms extension and we
3494                  * have set preferred signature algorithms check we support
3495                  * sha1.
3496                  */
3497                 if (default_nid > 0 && c->conf_sigalgs)
3498                         {
3499                         size_t j;
3500                         const unsigned char *p = c->conf_sigalgs;
3501                         for (j = 0; j < c->conf_sigalgslen; j += 2, p += 2)
3502                                 {
3503                                 if (p[0] == TLSEXT_hash_sha1 && p[1] == rsign)
3504                                         break;
3505                                 }
3506                         if (j == c->conf_sigalgslen)
3507                                 goto end;
3508                         }
3509                 /* Check signature algorithm of each cert in chain */
3510                 if (!tls1_check_sig_alg(c, x, default_nid))
3511                         goto end;
3512                 for (i = 0; i < sk_X509_num(chain); i++)
3513                         {
3514                         if (!tls1_check_sig_alg(c, sk_X509_value(chain, i),
3515                                                         default_nid))
3516                                 goto end;
3517                         }
3518                 }
3519
3520         /* Check cert parameters are consistent */
3521         if (!tls1_check_cert_param(s, x))
3522                 goto end;
3523         /* In strict mode check rest of chain too */
3524         if (c->cert_flags & SSL_CERT_FLAG_TLS_STRICT)
3525                 {
3526                 for (i = 0; i < sk_X509_num(chain); i++)
3527                         {
3528                         if (!tls1_check_cert_param(s, sk_X509_value(chain, i)))
3529                                 goto end;
3530                         }
3531                 }
3532         rv = CERT_PKEY_VALID;
3533
3534         end:
3535         if (cpk)
3536                 {
3537                 if (rv && cpk->digest)
3538                         rv |= CERT_PKEY_SIGN;
3539                 cpk->valid_flags = rv;
3540                 }
3541         return rv;
3542         }
3543
3544 /* Set validity of certificates in an SSL structure */
3545 void tls1_set_cert_validity(SSL *s)
3546         {
3547         tls1_check_chain(s, NULL, NULL, NULL, SSL_PKEY_RSA_ENC);
3548         tls1_check_chain(s, NULL, NULL, NULL, SSL_PKEY_RSA_SIGN);
3549         tls1_check_chain(s, NULL, NULL, NULL, SSL_PKEY_DSA_SIGN);
3550         tls1_check_chain(s, NULL, NULL, NULL, SSL_PKEY_DH_RSA);
3551         tls1_check_chain(s, NULL, NULL, NULL, SSL_PKEY_DH_DSA);
3552         tls1_check_chain(s, NULL, NULL, NULL, SSL_PKEY_ECC);
3553         }
3554 /* User level utiity function to check a chain is suitable */
3555 int SSL_check_chain(SSL *s, X509 *x, EVP_PKEY *pk, STACK_OF(X509) *chain)
3556         {
3557         return tls1_check_chain(s, x, pk, chain, -1);
3558         }
3559
3560 #endif