Make tls1_check_chain return a set of flags indicating checks passed
[openssl.git] / ssl / t1_lib.c
1 /* ssl/t1_lib.c */
2 /* Copyright (C) 1995-1998 Eric Young (eay@cryptsoft.com)
3  * All rights reserved.
4  *
5  * This package is an SSL implementation written
6  * by Eric Young (eay@cryptsoft.com).
7  * The implementation was written so as to conform with Netscapes SSL.
8  * 
9  * This library is free for commercial and non-commercial use as long as
10  * the following conditions are aheared to.  The following conditions
11  * apply to all code found in this distribution, be it the RC4, RSA,
12  * lhash, DES, etc., code; not just the SSL code.  The SSL documentation
13  * included with this distribution is covered by the same copyright terms
14  * except that the holder is Tim Hudson (tjh@cryptsoft.com).
15  * 
16  * Copyright remains Eric Young's, and as such any Copyright notices in
17  * the code are not to be removed.
18  * If this package is used in a product, Eric Young should be given attribution
19  * as the author of the parts of the library used.
20  * This can be in the form of a textual message at program startup or
21  * in documentation (online or textual) provided with the package.
22  * 
23  * Redistribution and use in source and binary forms, with or without
24  * modification, are permitted provided that the following conditions
25  * are met:
26  * 1. Redistributions of source code must retain the copyright
27  *    notice, this list of conditions and the following disclaimer.
28  * 2. Redistributions in binary form must reproduce the above copyright
29  *    notice, this list of conditions and the following disclaimer in the
30  *    documentation and/or other materials provided with the distribution.
31  * 3. All advertising materials mentioning features or use of this software
32  *    must display the following acknowledgement:
33  *    "This product includes cryptographic software written by
34  *     Eric Young (eay@cryptsoft.com)"
35  *    The word 'cryptographic' can be left out if the rouines from the library
36  *    being used are not cryptographic related :-).
37  * 4. If you include any Windows specific code (or a derivative thereof) from 
38  *    the apps directory (application code) you must include an acknowledgement:
39  *    "This product includes software written by Tim Hudson (tjh@cryptsoft.com)"
40  * 
41  * THIS SOFTWARE IS PROVIDED BY ERIC YOUNG ``AS IS'' AND
42  * ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
43  * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE
44  * ARE DISCLAIMED.  IN NO EVENT SHALL THE AUTHOR OR CONTRIBUTORS BE LIABLE
45  * FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL
46  * DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS
47  * OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION)
48  * HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT
49  * LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY
50  * OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF
51  * SUCH DAMAGE.
52  * 
53  * The licence and distribution terms for any publically available version or
54  * derivative of this code cannot be changed.  i.e. this code cannot simply be
55  * copied and put under another distribution licence
56  * [including the GNU Public Licence.]
57  */
58 /* ====================================================================
59  * Copyright (c) 1998-2007 The OpenSSL Project.  All rights reserved.
60  *
61  * Redistribution and use in source and binary forms, with or without
62  * modification, are permitted provided that the following conditions
63  * are met:
64  *
65  * 1. Redistributions of source code must retain the above copyright
66  *    notice, this list of conditions and the following disclaimer. 
67  *
68  * 2. Redistributions in binary form must reproduce the above copyright
69  *    notice, this list of conditions and the following disclaimer in
70  *    the documentation and/or other materials provided with the
71  *    distribution.
72  *
73  * 3. All advertising materials mentioning features or use of this
74  *    software must display the following acknowledgment:
75  *    "This product includes software developed by the OpenSSL Project
76  *    for use in the OpenSSL Toolkit. (http://www.openssl.org/)"
77  *
78  * 4. The names "OpenSSL Toolkit" and "OpenSSL Project" must not be used to
79  *    endorse or promote products derived from this software without
80  *    prior written permission. For written permission, please contact
81  *    openssl-core@openssl.org.
82  *
83  * 5. Products derived from this software may not be called "OpenSSL"
84  *    nor may "OpenSSL" appear in their names without prior written
85  *    permission of the OpenSSL Project.
86  *
87  * 6. Redistributions of any form whatsoever must retain the following
88  *    acknowledgment:
89  *    "This product includes software developed by the OpenSSL Project
90  *    for use in the OpenSSL Toolkit (http://www.openssl.org/)"
91  *
92  * THIS SOFTWARE IS PROVIDED BY THE OpenSSL PROJECT ``AS IS'' AND ANY
93  * EXPRESSED OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
94  * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
95  * PURPOSE ARE DISCLAIMED.  IN NO EVENT SHALL THE OpenSSL PROJECT OR
96  * ITS CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL,
97  * SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT
98  * NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES;
99  * LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION)
100  * HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT,
101  * STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE)
102  * ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED
103  * OF THE POSSIBILITY OF SUCH DAMAGE.
104  * ====================================================================
105  *
106  * This product includes cryptographic software written by Eric Young
107  * (eay@cryptsoft.com).  This product includes software written by Tim
108  * Hudson (tjh@cryptsoft.com).
109  *
110  */
111
112 #include <stdio.h>
113 #include <openssl/objects.h>
114 #include <openssl/evp.h>
115 #include <openssl/hmac.h>
116 #include <openssl/ocsp.h>
117 #include <openssl/rand.h>
118 #include "ssl_locl.h"
119
120 const char tls1_version_str[]="TLSv1" OPENSSL_VERSION_PTEXT;
121
122 #ifndef OPENSSL_NO_TLSEXT
123 static int tls_decrypt_ticket(SSL *s, const unsigned char *tick, int ticklen,
124                                 const unsigned char *sess_id, int sesslen,
125                                 SSL_SESSION **psess);
126 static int ssl_check_clienthello_tlsext_early(SSL *s);
127 int ssl_check_serverhello_tlsext(SSL *s);
128 #endif
129
130 SSL3_ENC_METHOD TLSv1_enc_data={
131         tls1_enc,
132         tls1_mac,
133         tls1_setup_key_block,
134         tls1_generate_master_secret,
135         tls1_change_cipher_state,
136         tls1_final_finish_mac,
137         TLS1_FINISH_MAC_LENGTH,
138         tls1_cert_verify_mac,
139         TLS_MD_CLIENT_FINISH_CONST,TLS_MD_CLIENT_FINISH_CONST_SIZE,
140         TLS_MD_SERVER_FINISH_CONST,TLS_MD_SERVER_FINISH_CONST_SIZE,
141         tls1_alert_code,
142         tls1_export_keying_material,
143         };
144
145 long tls1_default_timeout(void)
146         {
147         /* 2 hours, the 24 hours mentioned in the TLSv1 spec
148          * is way too long for http, the cache would over fill */
149         return(60*60*2);
150         }
151
152 int tls1_new(SSL *s)
153         {
154         if (!ssl3_new(s)) return(0);
155         s->method->ssl_clear(s);
156         return(1);
157         }
158
159 void tls1_free(SSL *s)
160         {
161 #ifndef OPENSSL_NO_TLSEXT
162         if (s->tlsext_session_ticket)
163                 {
164                 OPENSSL_free(s->tlsext_session_ticket);
165                 }
166 #endif /* OPENSSL_NO_TLSEXT */
167         ssl3_free(s);
168         }
169
170 void tls1_clear(SSL *s)
171         {
172         ssl3_clear(s);
173         s->version = s->method->version;
174         }
175
176 #ifndef OPENSSL_NO_EC
177
178 static int nid_list[] =
179         {
180                 NID_sect163k1, /* sect163k1 (1) */
181                 NID_sect163r1, /* sect163r1 (2) */
182                 NID_sect163r2, /* sect163r2 (3) */
183                 NID_sect193r1, /* sect193r1 (4) */ 
184                 NID_sect193r2, /* sect193r2 (5) */ 
185                 NID_sect233k1, /* sect233k1 (6) */
186                 NID_sect233r1, /* sect233r1 (7) */ 
187                 NID_sect239k1, /* sect239k1 (8) */ 
188                 NID_sect283k1, /* sect283k1 (9) */
189                 NID_sect283r1, /* sect283r1 (10) */ 
190                 NID_sect409k1, /* sect409k1 (11) */ 
191                 NID_sect409r1, /* sect409r1 (12) */
192                 NID_sect571k1, /* sect571k1 (13) */ 
193                 NID_sect571r1, /* sect571r1 (14) */ 
194                 NID_secp160k1, /* secp160k1 (15) */
195                 NID_secp160r1, /* secp160r1 (16) */ 
196                 NID_secp160r2, /* secp160r2 (17) */ 
197                 NID_secp192k1, /* secp192k1 (18) */
198                 NID_X9_62_prime192v1, /* secp192r1 (19) */ 
199                 NID_secp224k1, /* secp224k1 (20) */ 
200                 NID_secp224r1, /* secp224r1 (21) */
201                 NID_secp256k1, /* secp256k1 (22) */ 
202                 NID_X9_62_prime256v1, /* secp256r1 (23) */ 
203                 NID_secp384r1, /* secp384r1 (24) */
204                 NID_secp521r1  /* secp521r1 (25) */     
205         };
206
207
208 static const unsigned char ecformats_default[] = 
209         {
210         TLSEXT_ECPOINTFORMAT_uncompressed,
211         TLSEXT_ECPOINTFORMAT_ansiX962_compressed_prime,
212         TLSEXT_ECPOINTFORMAT_ansiX962_compressed_char2
213         };
214
215 static const unsigned char eccurves_default[] =
216         {
217                 0,14, /* sect571r1 (14) */ 
218                 0,13, /* sect571k1 (13) */ 
219                 0,25, /* secp521r1 (25) */      
220                 0,11, /* sect409k1 (11) */ 
221                 0,12, /* sect409r1 (12) */
222                 0,24, /* secp384r1 (24) */
223                 0,9,  /* sect283k1 (9) */
224                 0,10, /* sect283r1 (10) */ 
225                 0,22, /* secp256k1 (22) */ 
226                 0,23, /* secp256r1 (23) */ 
227                 0,8,  /* sect239k1 (8) */ 
228                 0,6,  /* sect233k1 (6) */
229                 0,7,  /* sect233r1 (7) */ 
230                 0,20, /* secp224k1 (20) */ 
231                 0,21, /* secp224r1 (21) */
232                 0,4,  /* sect193r1 (4) */ 
233                 0,5,  /* sect193r2 (5) */ 
234                 0,18, /* secp192k1 (18) */
235                 0,19, /* secp192r1 (19) */ 
236                 0,1,  /* sect163k1 (1) */
237                 0,2,  /* sect163r1 (2) */
238                 0,3,  /* sect163r2 (3) */
239                 0,15, /* secp160k1 (15) */
240                 0,16, /* secp160r1 (16) */ 
241                 0,17, /* secp160r2 (17) */ 
242         };
243
244 int tls1_ec_curve_id2nid(int curve_id)
245         {
246         /* ECC curves from draft-ietf-tls-ecc-12.txt (Oct. 17, 2005) */
247         if ((curve_id < 1) || ((unsigned int)curve_id >
248                                 sizeof(nid_list)/sizeof(nid_list[0])))
249                 return 0;
250         return nid_list[curve_id-1];
251         }
252
253 int tls1_ec_nid2curve_id(int nid)
254         {
255         /* ECC curves from draft-ietf-tls-ecc-12.txt (Oct. 17, 2005) */
256         switch (nid)
257                 {
258         case NID_sect163k1: /* sect163k1 (1) */
259                 return 1;
260         case NID_sect163r1: /* sect163r1 (2) */
261                 return 2;
262         case NID_sect163r2: /* sect163r2 (3) */
263                 return 3;
264         case NID_sect193r1: /* sect193r1 (4) */ 
265                 return 4;
266         case NID_sect193r2: /* sect193r2 (5) */ 
267                 return 5;
268         case NID_sect233k1: /* sect233k1 (6) */
269                 return 6;
270         case NID_sect233r1: /* sect233r1 (7) */ 
271                 return 7;
272         case NID_sect239k1: /* sect239k1 (8) */ 
273                 return 8;
274         case NID_sect283k1: /* sect283k1 (9) */
275                 return 9;
276         case NID_sect283r1: /* sect283r1 (10) */ 
277                 return 10;
278         case NID_sect409k1: /* sect409k1 (11) */ 
279                 return 11;
280         case NID_sect409r1: /* sect409r1 (12) */
281                 return 12;
282         case NID_sect571k1: /* sect571k1 (13) */ 
283                 return 13;
284         case NID_sect571r1: /* sect571r1 (14) */ 
285                 return 14;
286         case NID_secp160k1: /* secp160k1 (15) */
287                 return 15;
288         case NID_secp160r1: /* secp160r1 (16) */ 
289                 return 16;
290         case NID_secp160r2: /* secp160r2 (17) */ 
291                 return 17;
292         case NID_secp192k1: /* secp192k1 (18) */
293                 return 18;
294         case NID_X9_62_prime192v1: /* secp192r1 (19) */ 
295                 return 19;
296         case NID_secp224k1: /* secp224k1 (20) */ 
297                 return 20;
298         case NID_secp224r1: /* secp224r1 (21) */
299                 return 21;
300         case NID_secp256k1: /* secp256k1 (22) */ 
301                 return 22;
302         case NID_X9_62_prime256v1: /* secp256r1 (23) */ 
303                 return 23;
304         case NID_secp384r1: /* secp384r1 (24) */
305                 return 24;
306         case NID_secp521r1:  /* secp521r1 (25) */       
307                 return 25;
308         default:
309                 return 0;
310                 }
311         }
312 /* Get curves list, if "sess" is set return client curves otherwise
313  * preferred list
314  */
315 static void tls1_get_curvelist(SSL *s, int sess,
316                                         const unsigned char **pcurves,
317                                         size_t *pcurveslen)
318         {
319         if (sess)
320                 {
321                 *pcurves = s->session->tlsext_ellipticcurvelist;
322                 *pcurveslen = s->session->tlsext_ellipticcurvelist_length;
323                 }
324         else
325                 {
326                 *pcurves = s->tlsext_ellipticcurvelist;
327                 *pcurveslen = s->tlsext_ellipticcurvelist_length;
328                 }
329         /* If not set use default: for now static structure */
330         if (!*pcurves)
331                 {
332                 *pcurves = eccurves_default;
333                 *pcurveslen = sizeof(eccurves_default);
334                 }
335         }
336 /* Check a curve is one of our preferences */
337 int tls1_check_curve(SSL *s, const unsigned char *p, size_t len)
338         {
339         const unsigned char *curves;
340         size_t curveslen, i;
341         if (len != 3 || p[0] != NAMED_CURVE_TYPE)
342                 return 0;
343         tls1_get_curvelist(s, 0, &curves, &curveslen);
344         for (i = 0; i < curveslen; i += 2, curves += 2)
345                 {
346                 if (p[1] == curves[0] && p[2] == curves[1])
347                         return 1;
348                 }
349         return 0;
350         }
351
352 /* Return nth shared curve. If nmatch == -1 return number of
353  * matches.
354  */
355
356 int tls1_shared_curve(SSL *s, int nmatch)
357         {
358         const unsigned char *pref, *supp;
359         size_t preflen, supplen, i, j;
360         int k;
361         /* Can't do anything on client side */
362         if (s->server == 0)
363                 return -1;
364         tls1_get_curvelist(s, !!(s->options & SSL_OP_CIPHER_SERVER_PREFERENCE),
365                                 &supp, &supplen);
366         tls1_get_curvelist(s, !(s->options & SSL_OP_CIPHER_SERVER_PREFERENCE),
367                                 &pref, &preflen);
368         preflen /= 2;
369         supplen /= 2;
370         k = 0;
371         for (i = 0; i < preflen; i++, pref+=2)
372                 {
373                 const unsigned char *tsupp = supp;
374                 for (j = 0; j < supplen; j++, tsupp+=2)
375                         {
376                         if (pref[0] == tsupp[0] && pref[1] == tsupp[1])
377                                 {
378                                 if (nmatch == k)
379                                         {
380                                         int id = (pref[0] << 8) | pref[1];
381                                         return tls1_ec_curve_id2nid(id);
382                                         }
383                                 k++;
384                                 }
385                         }
386                 }
387         if (nmatch == -1)
388                 return k;
389         return 0;
390         }
391
392 int tls1_set_curves(unsigned char **pext, size_t *pextlen,
393                         int *curves, size_t ncurves)
394         {
395         unsigned char *clist, *p;
396         size_t i;
397         /* Bitmap of curves included to detect duplicates: only works
398          * while curve ids < 32 
399          */
400         unsigned long dup_list = 0;
401         clist = OPENSSL_malloc(ncurves * 2);
402         if (!clist)
403                 return 0;
404         for (i = 0, p = clist; i < ncurves; i++)
405                 {
406                 unsigned long idmask;
407                 int id;
408                 id = tls1_ec_nid2curve_id(curves[i]);
409                 idmask = 1L << id;
410                 if (!id || (dup_list & idmask))
411                         {
412                         OPENSSL_free(clist);
413                         return 0;
414                         }
415                 dup_list |= idmask;
416                 s2n(id, p);
417                 }
418         if (*pext)
419                 OPENSSL_free(*pext);
420         *pext = clist;
421         *pextlen = ncurves * 2;
422         return 1;
423         }
424
425 #define MAX_CURVELIST   25
426
427 typedef struct
428         {
429         size_t nidcnt;
430         int nid_arr[MAX_CURVELIST];
431         } nid_cb_st;
432
433 static int nid_cb(const char *elem, int len, void *arg)
434         {
435         nid_cb_st *narg = arg;
436         size_t i;
437         int nid;
438         char etmp[20];
439         if (narg->nidcnt == MAX_CURVELIST)
440                 return 0;
441         if (len > (int)(sizeof(etmp) - 1))
442                 return 0;
443         memcpy(etmp, elem, len);
444         etmp[len] = 0;
445         nid = EC_curve_nist2nid(etmp);
446         if (nid == NID_undef)
447                 nid = OBJ_sn2nid(etmp);
448         if (nid == NID_undef)
449                 nid = OBJ_ln2nid(etmp);
450         if (nid == NID_undef)
451                 return 0;
452         for (i = 0; i < narg->nidcnt; i++)
453                 if (narg->nid_arr[i] == nid)
454                         return 0;
455         narg->nid_arr[narg->nidcnt++] = nid;
456         return 1;
457         }
458 /* Set curves based on a colon separate list */
459 int tls1_set_curves_list(unsigned char **pext, size_t *pextlen, 
460                                 const char *str)
461         {
462         nid_cb_st ncb;
463         ncb.nidcnt = 0;
464         if (!CONF_parse_list(str, ':', 1, nid_cb, &ncb))
465                 return 0;
466         return tls1_set_curves(pext, pextlen, ncb.nid_arr, ncb.nidcnt);
467         }
468 /* For an EC key set TLS id and required compression based on parameters */
469 static int tls1_set_ec_id(unsigned char *curve_id, unsigned char *comp_id,
470                                 EC_KEY *ec)
471         {
472         int is_prime, id;
473         const EC_GROUP *grp;
474         const EC_POINT *pt;
475         const EC_METHOD *meth;
476         if (!ec)
477                 return 0;
478         /* Determine if it is a prime field */
479         grp = EC_KEY_get0_group(ec);
480         pt = EC_KEY_get0_public_key(ec);
481         if (!grp || !pt)
482                 return 0;
483         meth = EC_GROUP_method_of(grp);
484         if (!meth)
485                 return 0;
486         if (EC_METHOD_get_field_type(meth) == NID_X9_62_prime_field)
487                 is_prime = 1;
488         else
489                 is_prime = 0;
490         /* Determine curve ID */
491         id = EC_GROUP_get_curve_name(grp);
492         id = tls1_ec_nid2curve_id(id);
493         /* If we have an ID set it, otherwise set arbitrary explicit curve */
494         if (id)
495                 {
496                 curve_id[0] = 0;
497                 curve_id[1] = (unsigned char)id;
498                 }
499         else
500                 {
501                 curve_id[0] = 0xff;
502                 if (is_prime)
503                         curve_id[1] = 0x01;
504                 else
505                         curve_id[1] = 0x02;
506                 }
507         if (comp_id)
508                 {
509                 if (EC_KEY_get_conv_form(ec) == POINT_CONVERSION_COMPRESSED)
510                         {
511                         if (is_prime)
512                                 *comp_id = TLSEXT_ECPOINTFORMAT_ansiX962_compressed_prime;
513                         else
514                                 *comp_id = TLSEXT_ECPOINTFORMAT_ansiX962_compressed_char2;
515                         }
516                 else
517                         *comp_id = TLSEXT_ECPOINTFORMAT_uncompressed;
518                 }
519         return 1;
520         }
521 /* Check an EC key is compatible with extensions */
522 static int tls1_check_ec_key(SSL *s,
523                         unsigned char *curve_id, unsigned char *comp_id)
524         {
525         const unsigned char *p;
526         size_t plen, i;
527         int j;
528         /* If point formats extension present check it, otherwise everything
529          * is supported (see RFC4492).
530          */
531         if (comp_id && s->session->tlsext_ecpointformatlist)
532                 {
533                 p = s->session->tlsext_ecpointformatlist;
534                 plen = s->session->tlsext_ecpointformatlist_length;
535                 for (i = 0; i < plen; i++, p++)
536                         {
537                         if (*comp_id == *p)
538                                 break;
539                         }
540                 if (i == plen)
541                         return 0;
542                 }
543         /* Check curve is consistent with client and server preferences */
544         for (j = 0; j <= 1; j++)
545                 {
546                 tls1_get_curvelist(s, j, &p, &plen);
547                 for (i = 0; i < plen; i+=2, p+=2)
548                         {
549                         if (p[0] == curve_id[0] && p[1] == curve_id[1])
550                                 break;
551                         }
552                 if (i == plen)
553                         return 0;
554                 }
555         return 1;
556         }
557
558 /* Check cert parameters compatible with extensions: currently just checks
559  * EC certificates have compatible curves and compression.
560  */
561 static int tls1_check_cert_param(SSL *s, X509 *x)
562         {
563         unsigned char comp_id, curve_id[2];
564         EVP_PKEY *pkey;
565         int rv;
566         pkey = X509_get_pubkey(x);
567         if (!pkey)
568                 return 0;
569         /* If not EC nothing to do */
570         if (pkey->type != EVP_PKEY_EC)
571                 {
572                 EVP_PKEY_free(pkey);
573                 return 1;
574                 }
575         rv = tls1_set_ec_id(curve_id, &comp_id, pkey->pkey.ec);
576         EVP_PKEY_free(pkey);
577         if (!rv)
578                 return 0;
579         return tls1_check_ec_key(s, curve_id, &comp_id);
580         }
581 /* Check EC temporary key is compatible with client extensions */
582 int tls1_check_ec_tmp_key(SSL *s)
583         {
584         unsigned char curve_id[2];
585         EC_KEY *ec = s->cert->ecdh_tmp;
586         if (s->cert->ecdh_tmp_auto)
587                 {
588                 /* Need a shared curve */
589                 if (tls1_shared_curve(s, 0))
590                         return 1;
591                 else return 0;
592                 }
593         if (!ec)
594                 {
595                 if (s->cert->ecdh_tmp_cb)
596                         return 1;
597                 else
598                         return 0;
599                 }
600         if (!tls1_set_ec_id(curve_id, NULL, ec))
601                 return 0;
602 /* Set this to allow use of invalid curves for testing */
603 #if 0
604         return 1;
605 #else
606         return tls1_check_ec_key(s, curve_id, NULL);
607 #endif
608         }
609
610 #endif /* OPENSSL_NO_EC */
611
612 #ifndef OPENSSL_NO_TLSEXT
613
614 /* List of supported signature algorithms and hashes. Should make this
615  * customisable at some point, for now include everything we support.
616  */
617
618 #ifdef OPENSSL_NO_RSA
619 #define tlsext_sigalg_rsa(md) /* */
620 #else
621 #define tlsext_sigalg_rsa(md) md, TLSEXT_signature_rsa,
622 #endif
623
624 #ifdef OPENSSL_NO_DSA
625 #define tlsext_sigalg_dsa(md) /* */
626 #else
627 #define tlsext_sigalg_dsa(md) md, TLSEXT_signature_dsa,
628 #endif
629
630 #ifdef OPENSSL_NO_ECDSA
631 #define tlsext_sigalg_ecdsa(md) /* */
632 #else
633 #define tlsext_sigalg_ecdsa(md) md, TLSEXT_signature_ecdsa,
634 #endif
635
636 #define tlsext_sigalg(md) \
637                 tlsext_sigalg_rsa(md) \
638                 tlsext_sigalg_dsa(md) \
639                 tlsext_sigalg_ecdsa(md)
640
641 static unsigned char tls12_sigalgs[] = {
642 #ifndef OPENSSL_NO_SHA512
643         tlsext_sigalg(TLSEXT_hash_sha512)
644         tlsext_sigalg(TLSEXT_hash_sha384)
645 #endif
646 #ifndef OPENSSL_NO_SHA256
647         tlsext_sigalg(TLSEXT_hash_sha256)
648         tlsext_sigalg(TLSEXT_hash_sha224)
649 #endif
650 #ifndef OPENSSL_NO_SHA
651         tlsext_sigalg(TLSEXT_hash_sha1)
652 #endif
653 #ifndef OPENSSL_NO_MD5
654         tlsext_sigalg_rsa(TLSEXT_hash_md5)
655 #endif
656 };
657
658 size_t tls12_get_psigalgs(SSL *s, const unsigned char **psigs)
659         {
660         /* If server use client authentication sigalgs if not NULL */
661         if (s->server && s->cert->client_sigalgs)
662                 {
663                 *psigs = s->cert->client_sigalgs;
664                 return s->cert->client_sigalgslen;
665                 }
666         else if (s->cert->conf_sigalgs)
667                 {
668                 *psigs = s->cert->conf_sigalgs;
669                 return s->cert->conf_sigalgslen;
670                 }
671         else
672                 {
673                 *psigs = tls12_sigalgs;
674 #ifdef OPENSSL_FIPS
675                 /* If FIPS mode don't include MD5 which is last */
676                 if (FIPS_mode())
677                         return sizeof(tls12_sigalgs) - 2;
678                 else
679 #endif
680                         return sizeof(tls12_sigalgs);
681                 }
682         }
683 /* Check signature algorithm is consistent with sent supported signature
684  * algorithms and if so return relevant digest.
685  */
686 int tls12_check_peer_sigalg(const EVP_MD **pmd, SSL *s,
687                                 const unsigned char *sig, EVP_PKEY *pkey)
688         {
689         const unsigned char *sent_sigs;
690         size_t sent_sigslen, i;
691         int sigalg = tls12_get_sigid(pkey);
692         /* Should never happen */
693         if (sigalg == -1)
694                 return -1;
695         /* Check key type is consistent with signature */
696         if (sigalg != (int)sig[1])
697                 {
698                 SSLerr(SSL_F_TLS12_CHECK_PEER_SIGALG,SSL_R_WRONG_SIGNATURE_TYPE);
699                 return 0;
700                 }
701         /* Check signature matches a type we sent */
702         sent_sigslen = tls12_get_psigalgs(s, &sent_sigs);
703         for (i = 0; i < sent_sigslen; i+=2, sent_sigs+=2)
704                 {
705                 if (sig[0] == sent_sigs[0] && sig[1] == sent_sigs[1])
706                         break;
707                 }
708         /* Allow fallback to SHA1 if not strict mode */
709         if (i == sent_sigslen && (sig[0] != TLSEXT_hash_sha1 || s->cert->cert_flags & SSL_CERT_FLAG_TLS_STRICT))
710                 {
711                 SSLerr(SSL_F_TLS12_CHECK_PEER_SIGALG,SSL_R_WRONG_SIGNATURE_TYPE);
712                 return 0;
713                 }
714         *pmd = tls12_get_hash(sig[0]);
715         if (*pmd == NULL)
716                 {
717                 SSLerr(SSL_F_TLS12_CHECK_PEER_SIGALG,SSL_R_UNKNOWN_DIGEST);
718                 return 0;
719                 }
720         return 1;
721         }
722 /* Get a mask of disabled algorithms: an algorithm is disabled
723  * if it isn't supported or doesn't appear in supported signature
724  * algorithms. Unlike ssl_cipher_get_disabled this applies to a specific
725  * session and not global settings.
726  * 
727  */
728 void ssl_set_client_disabled(SSL *s)
729         {
730         CERT *c = s->cert;
731         const unsigned char *sigalgs;
732         size_t i, sigalgslen;
733         int have_rsa = 0, have_dsa = 0, have_ecdsa = 0;
734         c->mask_a = 0;
735         c->mask_k = 0;
736         /* If less than TLS 1.2 don't allow TLS 1.2 only ciphers */
737         if (TLS1_get_version(s) < TLS1_2_VERSION)
738                 c->mask_ssl = SSL_TLSV1_2;
739         else
740                 c->mask_ssl = 0;
741         /* Now go through all signature algorithms seeing if we support
742          * any for RSA, DSA, ECDSA. Do this for all versions not just
743          * TLS 1.2.
744          */
745         sigalgslen = tls12_get_psigalgs(s, &sigalgs);
746         for (i = 0; i < sigalgslen; i += 2, sigalgs += 2)
747                 {
748                 switch(sigalgs[1])
749                         {
750 #ifndef OPENSSL_NO_RSA
751                 case TLSEXT_signature_rsa:
752                         have_rsa = 1;
753                         break;
754 #endif
755 #ifndef OPENSSL_NO_DSA
756                 case TLSEXT_signature_dsa:
757                         have_dsa = 1;
758                         break;
759 #endif
760 #ifndef OPENSSL_NO_ECDSA
761                 case TLSEXT_signature_ecdsa:
762                         have_ecdsa = 1;
763                         break;
764 #endif
765                         }
766                 }
767         /* Disable auth and static DH if we don't include any appropriate
768          * signature algorithms.
769          */
770         if (!have_rsa)
771                 {
772                 c->mask_a |= SSL_aRSA;
773                 c->mask_k |= SSL_kDHr|SSL_kECDHr;
774                 }
775         if (!have_dsa)
776                 {
777                 c->mask_a |= SSL_aDSS;
778                 c->mask_k |= SSL_kDHd;
779                 }
780         if (!have_ecdsa)
781                 {
782                 c->mask_a |= SSL_aECDSA;
783                 c->mask_k |= SSL_kECDHe;
784                 }
785 #ifndef OPENSSL_NO_KRB5
786         if (!kssl_tgt_is_available(s->kssl_ctx))
787                 {
788                 c->mask_a |= SSL_aKRB5;
789                 c->mask_k |= SSL_kKRB5;
790                 }
791 #endif
792 #ifndef OPENSSL_NO_PSK
793         /* with PSK there must be client callback set */
794         if (!s->psk_client_callback)
795                 {
796                 c->mask_a |= SSL_aPSK;
797                 c->mask_k |= SSL_kPSK;
798                 }
799 #endif /* OPENSSL_NO_PSK */
800         c->valid = 1;
801         }
802
803 /* byte_compare is a compare function for qsort(3) that compares bytes. */
804 static int byte_compare(const void *in_a, const void *in_b)
805         {
806         unsigned char a = *((const unsigned char*) in_a);
807         unsigned char b = *((const unsigned char*) in_b);
808
809         if (a > b)
810                 return 1;
811         else if (a < b)
812                 return -1;
813         return 0;
814 }
815
816 unsigned char *ssl_add_clienthello_tlsext(SSL *s, unsigned char *p, unsigned char *limit)
817         {
818         int extdatalen=0;
819         unsigned char *ret = p;
820 #ifndef OPENSSL_NO_EC
821         /* See if we support any ECC ciphersuites */
822         int using_ecc = 0;
823         if (s->version != DTLS1_VERSION && s->version >= TLS1_VERSION)
824                 {
825                 int i;
826                 unsigned long alg_k, alg_a;
827                 STACK_OF(SSL_CIPHER) *cipher_stack = SSL_get_ciphers(s);
828
829                 for (i = 0; i < sk_SSL_CIPHER_num(cipher_stack); i++)
830                         {
831                         SSL_CIPHER *c = sk_SSL_CIPHER_value(cipher_stack, i);
832
833                         alg_k = c->algorithm_mkey;
834                         alg_a = c->algorithm_auth;
835                         if ((alg_k & (SSL_kEECDH|SSL_kECDHr|SSL_kECDHe)
836                                 || (alg_a & SSL_aECDSA)))
837                                 {
838                                 using_ecc = 1;
839                                 break;
840                                 }
841                         }
842                 }
843 #endif
844
845         /* don't add extensions for SSLv3 unless doing secure renegotiation */
846         if (s->client_version == SSL3_VERSION
847                                         && !s->s3->send_connection_binding)
848                 return p;
849
850         ret+=2;
851
852         if (ret>=limit) return NULL; /* this really never occurs, but ... */
853
854         if (s->tlsext_hostname != NULL)
855                 { 
856                 /* Add TLS extension servername to the Client Hello message */
857                 unsigned long size_str;
858                 long lenmax; 
859
860                 /* check for enough space.
861                    4 for the servername type and entension length
862                    2 for servernamelist length
863                    1 for the hostname type
864                    2 for hostname length
865                    + hostname length 
866                 */
867                    
868                 if ((lenmax = limit - ret - 9) < 0 
869                     || (size_str = strlen(s->tlsext_hostname)) > (unsigned long)lenmax) 
870                         return NULL;
871                         
872                 /* extension type and length */
873                 s2n(TLSEXT_TYPE_server_name,ret); 
874                 s2n(size_str+5,ret);
875                 
876                 /* length of servername list */
877                 s2n(size_str+3,ret);
878         
879                 /* hostname type, length and hostname */
880                 *(ret++) = (unsigned char) TLSEXT_NAMETYPE_host_name;
881                 s2n(size_str,ret);
882                 memcpy(ret, s->tlsext_hostname, size_str);
883                 ret+=size_str;
884                 }
885
886         /* Add RI if renegotiating */
887         if (s->renegotiate)
888           {
889           int el;
890           
891           if(!ssl_add_clienthello_renegotiate_ext(s, 0, &el, 0))
892               {
893               SSLerr(SSL_F_SSL_ADD_CLIENTHELLO_TLSEXT, ERR_R_INTERNAL_ERROR);
894               return NULL;
895               }
896
897           if((limit - p - 4 - el) < 0) return NULL;
898           
899           s2n(TLSEXT_TYPE_renegotiate,ret);
900           s2n(el,ret);
901
902           if(!ssl_add_clienthello_renegotiate_ext(s, ret, &el, el))
903               {
904               SSLerr(SSL_F_SSL_ADD_CLIENTHELLO_TLSEXT, ERR_R_INTERNAL_ERROR);
905               return NULL;
906               }
907
908           ret += el;
909         }
910
911 #ifndef OPENSSL_NO_SRP
912         /* Add SRP username if there is one */
913         if (s->srp_ctx.login != NULL)
914                 { /* Add TLS extension SRP username to the Client Hello message */
915
916                 int login_len = strlen(s->srp_ctx.login);       
917                 if (login_len > 255 || login_len == 0)
918                         {
919                         SSLerr(SSL_F_SSL_ADD_CLIENTHELLO_TLSEXT, ERR_R_INTERNAL_ERROR);
920                         return NULL;
921                         } 
922
923                 /* check for enough space.
924                    4 for the srp type type and entension length
925                    1 for the srp user identity
926                    + srp user identity length 
927                 */
928                 if ((limit - ret - 5 - login_len) < 0) return NULL; 
929
930                 /* fill in the extension */
931                 s2n(TLSEXT_TYPE_srp,ret);
932                 s2n(login_len+1,ret);
933                 (*ret++) = (unsigned char) login_len;
934                 memcpy(ret, s->srp_ctx.login, login_len);
935                 ret+=login_len;
936                 }
937 #endif
938
939 #ifndef OPENSSL_NO_EC
940         if (using_ecc)
941                 {
942                 /* Add TLS extension ECPointFormats to the ClientHello message */
943                 long lenmax; 
944                 const unsigned char *plist;
945                 size_t plistlen;
946                 /* If we have a custom point format list use it otherwise
947                  * use default */
948                 plist = s->tlsext_ecpointformatlist;
949                 if (plist)
950                         plistlen = s->tlsext_ecpointformatlist_length;
951                 else
952                         {
953                         plist = ecformats_default;
954                         plistlen = sizeof(ecformats_default);
955                         }
956
957                 if ((lenmax = limit - ret - 5) < 0) return NULL; 
958                 if (plistlen > (size_t)lenmax) return NULL;
959                 if (plistlen > 255)
960                         {
961                         SSLerr(SSL_F_SSL_ADD_CLIENTHELLO_TLSEXT, ERR_R_INTERNAL_ERROR);
962                         return NULL;
963                         }
964                 
965                 s2n(TLSEXT_TYPE_ec_point_formats,ret);
966                 s2n(plistlen + 1,ret);
967                 *(ret++) = (unsigned char)plistlen ;
968                 memcpy(ret, plist, plistlen);
969                 ret+=plistlen;
970
971                 /* Add TLS extension EllipticCurves to the ClientHello message */
972                 plist = s->tlsext_ellipticcurvelist;
973                 tls1_get_curvelist(s, 0, &plist, &plistlen);
974
975                 if ((lenmax = limit - ret - 6) < 0) return NULL; 
976                 if (plistlen > (size_t)lenmax) return NULL;
977                 if (plistlen > 65532)
978                         {
979                         SSLerr(SSL_F_SSL_ADD_CLIENTHELLO_TLSEXT, ERR_R_INTERNAL_ERROR);
980                         return NULL;
981                         }
982                 
983                 s2n(TLSEXT_TYPE_elliptic_curves,ret);
984                 s2n(plistlen + 2, ret);
985
986                 /* NB: draft-ietf-tls-ecc-12.txt uses a one-byte prefix for
987                  * elliptic_curve_list, but the examples use two bytes.
988                  * http://www1.ietf.org/mail-archive/web/tls/current/msg00538.html
989                  * resolves this to two bytes.
990                  */
991                 s2n(plistlen, ret);
992                 memcpy(ret, plist, plistlen);
993                 ret+=plistlen;
994                 }
995 #endif /* OPENSSL_NO_EC */
996
997         if (!(SSL_get_options(s) & SSL_OP_NO_TICKET))
998                 {
999                 int ticklen;
1000                 if (!s->new_session && s->session && s->session->tlsext_tick)
1001                         ticklen = s->session->tlsext_ticklen;
1002                 else if (s->session && s->tlsext_session_ticket &&
1003                          s->tlsext_session_ticket->data)
1004                         {
1005                         ticklen = s->tlsext_session_ticket->length;
1006                         s->session->tlsext_tick = OPENSSL_malloc(ticklen);
1007                         if (!s->session->tlsext_tick)
1008                                 return NULL;
1009                         memcpy(s->session->tlsext_tick,
1010                                s->tlsext_session_ticket->data,
1011                                ticklen);
1012                         s->session->tlsext_ticklen = ticklen;
1013                         }
1014                 else
1015                         ticklen = 0;
1016                 if (ticklen == 0 && s->tlsext_session_ticket &&
1017                     s->tlsext_session_ticket->data == NULL)
1018                         goto skip_ext;
1019                 /* Check for enough room 2 for extension type, 2 for len
1020                  * rest for ticket
1021                  */
1022                 if ((long)(limit - ret - 4 - ticklen) < 0) return NULL;
1023                 s2n(TLSEXT_TYPE_session_ticket,ret); 
1024                 s2n(ticklen,ret);
1025                 if (ticklen)
1026                         {
1027                         memcpy(ret, s->session->tlsext_tick, ticklen);
1028                         ret += ticklen;
1029                         }
1030                 }
1031                 skip_ext:
1032
1033         if (TLS1_get_client_version(s) >= TLS1_2_VERSION)
1034                 {
1035                 size_t salglen;
1036                 const unsigned char *salg;
1037                 salglen = tls12_get_psigalgs(s, &salg);
1038                 if ((size_t)(limit - ret) < salglen + 6)
1039                         return NULL; 
1040                 s2n(TLSEXT_TYPE_signature_algorithms,ret);
1041                 s2n(salglen + 2, ret);
1042                 s2n(salglen, ret);
1043                 memcpy(ret, salg, salglen);
1044                 ret += salglen;
1045                 }
1046
1047 #ifdef TLSEXT_TYPE_opaque_prf_input
1048         if (s->s3->client_opaque_prf_input != NULL &&
1049             s->version != DTLS1_VERSION)
1050                 {
1051                 size_t col = s->s3->client_opaque_prf_input_len;
1052                 
1053                 if ((long)(limit - ret - 6 - col < 0))
1054                         return NULL;
1055                 if (col > 0xFFFD) /* can't happen */
1056                         return NULL;
1057
1058                 s2n(TLSEXT_TYPE_opaque_prf_input, ret); 
1059                 s2n(col + 2, ret);
1060                 s2n(col, ret);
1061                 memcpy(ret, s->s3->client_opaque_prf_input, col);
1062                 ret += col;
1063                 }
1064 #endif
1065
1066         if (s->tlsext_status_type == TLSEXT_STATUSTYPE_ocsp &&
1067             s->version != DTLS1_VERSION)
1068                 {
1069                 int i;
1070                 long extlen, idlen, itmp;
1071                 OCSP_RESPID *id;
1072
1073                 idlen = 0;
1074                 for (i = 0; i < sk_OCSP_RESPID_num(s->tlsext_ocsp_ids); i++)
1075                         {
1076                         id = sk_OCSP_RESPID_value(s->tlsext_ocsp_ids, i);
1077                         itmp = i2d_OCSP_RESPID(id, NULL);
1078                         if (itmp <= 0)
1079                                 return NULL;
1080                         idlen += itmp + 2;
1081                         }
1082
1083                 if (s->tlsext_ocsp_exts)
1084                         {
1085                         extlen = i2d_X509_EXTENSIONS(s->tlsext_ocsp_exts, NULL);
1086                         if (extlen < 0)
1087                                 return NULL;
1088                         }
1089                 else
1090                         extlen = 0;
1091                         
1092                 if ((long)(limit - ret - 7 - extlen - idlen) < 0) return NULL;
1093                 s2n(TLSEXT_TYPE_status_request, ret);
1094                 if (extlen + idlen > 0xFFF0)
1095                         return NULL;
1096                 s2n(extlen + idlen + 5, ret);
1097                 *(ret++) = TLSEXT_STATUSTYPE_ocsp;
1098                 s2n(idlen, ret);
1099                 for (i = 0; i < sk_OCSP_RESPID_num(s->tlsext_ocsp_ids); i++)
1100                         {
1101                         /* save position of id len */
1102                         unsigned char *q = ret;
1103                         id = sk_OCSP_RESPID_value(s->tlsext_ocsp_ids, i);
1104                         /* skip over id len */
1105                         ret += 2;
1106                         itmp = i2d_OCSP_RESPID(id, &ret);
1107                         /* write id len */
1108                         s2n(itmp, q);
1109                         }
1110                 s2n(extlen, ret);
1111                 if (extlen > 0)
1112                         i2d_X509_EXTENSIONS(s->tlsext_ocsp_exts, &ret);
1113                 }
1114
1115 #ifndef OPENSSL_NO_HEARTBEATS
1116         /* Add Heartbeat extension */
1117         s2n(TLSEXT_TYPE_heartbeat,ret);
1118         s2n(1,ret);
1119         /* Set mode:
1120          * 1: peer may send requests
1121          * 2: peer not allowed to send requests
1122          */
1123         if (s->tlsext_heartbeat & SSL_TLSEXT_HB_DONT_RECV_REQUESTS)
1124                 *(ret++) = SSL_TLSEXT_HB_DONT_SEND_REQUESTS;
1125         else
1126                 *(ret++) = SSL_TLSEXT_HB_ENABLED;
1127 #endif
1128
1129 #ifndef OPENSSL_NO_NEXTPROTONEG
1130         if (s->ctx->next_proto_select_cb && !s->s3->tmp.finish_md_len)
1131                 {
1132                 /* The client advertises an emtpy extension to indicate its
1133                  * support for Next Protocol Negotiation */
1134                 if (limit - ret - 4 < 0)
1135                         return NULL;
1136                 s2n(TLSEXT_TYPE_next_proto_neg,ret);
1137                 s2n(0,ret);
1138                 }
1139 #endif
1140
1141         if(SSL_get_srtp_profiles(s))
1142                 {
1143                 int el;
1144
1145                 ssl_add_clienthello_use_srtp_ext(s, 0, &el, 0);
1146                 
1147                 if((limit - p - 4 - el) < 0) return NULL;
1148
1149                 s2n(TLSEXT_TYPE_use_srtp,ret);
1150                 s2n(el,ret);
1151
1152                 if(ssl_add_clienthello_use_srtp_ext(s, ret, &el, el))
1153                         {
1154                         SSLerr(SSL_F_SSL_ADD_CLIENTHELLO_TLSEXT, ERR_R_INTERNAL_ERROR);
1155                         return NULL;
1156                         }
1157                 ret += el;
1158                 }
1159
1160         /* Add TLS extension Server_Authz_DataFormats to the ClientHello */
1161         /* 2 bytes for extension type */
1162         /* 2 bytes for extension length */
1163         /* 1 byte for the list length */
1164         /* 1 byte for the list (we only support audit proofs) */
1165         if (s->ctx->tlsext_authz_server_audit_proof_cb != NULL)
1166                 {
1167                 size_t lenmax;
1168                 const unsigned short ext_len = 2;
1169                 const unsigned char list_len = 1;
1170
1171                 if ((lenmax = limit - ret - 6) < 0) return NULL;
1172
1173                 s2n(TLSEXT_TYPE_server_authz, ret);
1174                 /* Extension length: 2 bytes */
1175                 s2n(ext_len, ret);
1176                 *(ret++) = list_len;
1177                 *(ret++) = TLSEXT_AUTHZDATAFORMAT_audit_proof;
1178                 }
1179
1180         if ((extdatalen = ret-p-2) == 0)
1181                 return p;
1182
1183         s2n(extdatalen,p);
1184         return ret;
1185         }
1186
1187 unsigned char *ssl_add_serverhello_tlsext(SSL *s, unsigned char *p, unsigned char *limit)
1188         {
1189         int extdatalen=0;
1190         unsigned char *ret = p;
1191 #ifndef OPENSSL_NO_NEXTPROTONEG
1192         int next_proto_neg_seen;
1193 #endif
1194
1195         /* don't add extensions for SSLv3, unless doing secure renegotiation */
1196         if (s->version == SSL3_VERSION && !s->s3->send_connection_binding)
1197                 return p;
1198         
1199         ret+=2;
1200         if (ret>=limit) return NULL; /* this really never occurs, but ... */
1201
1202         if (!s->hit && s->servername_done == 1 && s->session->tlsext_hostname != NULL)
1203                 { 
1204                 if ((long)(limit - ret - 4) < 0) return NULL; 
1205
1206                 s2n(TLSEXT_TYPE_server_name,ret);
1207                 s2n(0,ret);
1208                 }
1209
1210         if(s->s3->send_connection_binding)
1211         {
1212           int el;
1213           
1214           if(!ssl_add_serverhello_renegotiate_ext(s, 0, &el, 0))
1215               {
1216               SSLerr(SSL_F_SSL_ADD_SERVERHELLO_TLSEXT, ERR_R_INTERNAL_ERROR);
1217               return NULL;
1218               }
1219
1220           if((limit - p - 4 - el) < 0) return NULL;
1221           
1222           s2n(TLSEXT_TYPE_renegotiate,ret);
1223           s2n(el,ret);
1224
1225           if(!ssl_add_serverhello_renegotiate_ext(s, ret, &el, el))
1226               {
1227               SSLerr(SSL_F_SSL_ADD_SERVERHELLO_TLSEXT, ERR_R_INTERNAL_ERROR);
1228               return NULL;
1229               }
1230
1231           ret += el;
1232         }
1233
1234 #ifndef OPENSSL_NO_EC
1235         if (s->tlsext_ecpointformatlist != NULL &&
1236             s->version != DTLS1_VERSION)
1237                 {
1238                 /* Add TLS extension ECPointFormats to the ServerHello message */
1239                 long lenmax; 
1240
1241                 if ((lenmax = limit - ret - 5) < 0) return NULL; 
1242                 if (s->tlsext_ecpointformatlist_length > (unsigned long)lenmax) return NULL;
1243                 if (s->tlsext_ecpointformatlist_length > 255)
1244                         {
1245                         SSLerr(SSL_F_SSL_ADD_SERVERHELLO_TLSEXT, ERR_R_INTERNAL_ERROR);
1246                         return NULL;
1247                         }
1248                 
1249                 s2n(TLSEXT_TYPE_ec_point_formats,ret);
1250                 s2n(s->tlsext_ecpointformatlist_length + 1,ret);
1251                 *(ret++) = (unsigned char) s->tlsext_ecpointformatlist_length;
1252                 memcpy(ret, s->tlsext_ecpointformatlist, s->tlsext_ecpointformatlist_length);
1253                 ret+=s->tlsext_ecpointformatlist_length;
1254
1255                 }
1256         /* Currently the server should not respond with a SupportedCurves extension */
1257 #endif /* OPENSSL_NO_EC */
1258
1259         if (s->tlsext_ticket_expected
1260                 && !(SSL_get_options(s) & SSL_OP_NO_TICKET)) 
1261                 { 
1262                 if ((long)(limit - ret - 4) < 0) return NULL; 
1263                 s2n(TLSEXT_TYPE_session_ticket,ret);
1264                 s2n(0,ret);
1265                 }
1266
1267         if (s->tlsext_status_expected)
1268                 { 
1269                 if ((long)(limit - ret - 4) < 0) return NULL; 
1270                 s2n(TLSEXT_TYPE_status_request,ret);
1271                 s2n(0,ret);
1272                 }
1273
1274 #ifdef TLSEXT_TYPE_opaque_prf_input
1275         if (s->s3->server_opaque_prf_input != NULL &&
1276             s->version != DTLS1_VERSION)
1277                 {
1278                 size_t sol = s->s3->server_opaque_prf_input_len;
1279                 
1280                 if ((long)(limit - ret - 6 - sol) < 0)
1281                         return NULL;
1282                 if (sol > 0xFFFD) /* can't happen */
1283                         return NULL;
1284
1285                 s2n(TLSEXT_TYPE_opaque_prf_input, ret); 
1286                 s2n(sol + 2, ret);
1287                 s2n(sol, ret);
1288                 memcpy(ret, s->s3->server_opaque_prf_input, sol);
1289                 ret += sol;
1290                 }
1291 #endif
1292
1293         if(s->srtp_profile)
1294                 {
1295                 int el;
1296
1297                 ssl_add_serverhello_use_srtp_ext(s, 0, &el, 0);
1298                 
1299                 if((limit - p - 4 - el) < 0) return NULL;
1300
1301                 s2n(TLSEXT_TYPE_use_srtp,ret);
1302                 s2n(el,ret);
1303
1304                 if(ssl_add_serverhello_use_srtp_ext(s, ret, &el, el))
1305                         {
1306                         SSLerr(SSL_F_SSL_ADD_SERVERHELLO_TLSEXT, ERR_R_INTERNAL_ERROR);
1307                         return NULL;
1308                         }
1309                 ret+=el;
1310                 }
1311
1312         if (((s->s3->tmp.new_cipher->id & 0xFFFF)==0x80 || (s->s3->tmp.new_cipher->id & 0xFFFF)==0x81) 
1313                 && (SSL_get_options(s) & SSL_OP_CRYPTOPRO_TLSEXT_BUG))
1314                 { const unsigned char cryptopro_ext[36] = {
1315                         0xfd, 0xe8, /*65000*/
1316                         0x00, 0x20, /*32 bytes length*/
1317                         0x30, 0x1e, 0x30, 0x08, 0x06, 0x06, 0x2a, 0x85, 
1318                         0x03,   0x02, 0x02, 0x09, 0x30, 0x08, 0x06, 0x06, 
1319                         0x2a, 0x85, 0x03, 0x02, 0x02, 0x16, 0x30, 0x08, 
1320                         0x06, 0x06, 0x2a, 0x85, 0x03, 0x02, 0x02, 0x17};
1321                         if (limit-ret<36) return NULL;
1322                         memcpy(ret,cryptopro_ext,36);
1323                         ret+=36;
1324
1325                 }
1326
1327 #ifndef OPENSSL_NO_HEARTBEATS
1328         /* Add Heartbeat extension if we've received one */
1329         if (s->tlsext_heartbeat & SSL_TLSEXT_HB_ENABLED)
1330                 {
1331                 s2n(TLSEXT_TYPE_heartbeat,ret);
1332                 s2n(1,ret);
1333                 /* Set mode:
1334                  * 1: peer may send requests
1335                  * 2: peer not allowed to send requests
1336                  */
1337                 if (s->tlsext_heartbeat & SSL_TLSEXT_HB_DONT_RECV_REQUESTS)
1338                         *(ret++) = SSL_TLSEXT_HB_DONT_SEND_REQUESTS;
1339                 else
1340                         *(ret++) = SSL_TLSEXT_HB_ENABLED;
1341
1342                 }
1343 #endif
1344
1345 #ifndef OPENSSL_NO_NEXTPROTONEG
1346         next_proto_neg_seen = s->s3->next_proto_neg_seen;
1347         s->s3->next_proto_neg_seen = 0;
1348         if (next_proto_neg_seen && s->ctx->next_protos_advertised_cb)
1349                 {
1350                 const unsigned char *npa;
1351                 unsigned int npalen;
1352                 int r;
1353
1354                 r = s->ctx->next_protos_advertised_cb(s, &npa, &npalen, s->ctx->next_protos_advertised_cb_arg);
1355                 if (r == SSL_TLSEXT_ERR_OK)
1356                         {
1357                         if ((long)(limit - ret - 4 - npalen) < 0) return NULL;
1358                         s2n(TLSEXT_TYPE_next_proto_neg,ret);
1359                         s2n(npalen,ret);
1360                         memcpy(ret, npa, npalen);
1361                         ret += npalen;
1362                         s->s3->next_proto_neg_seen = 1;
1363                         }
1364                 }
1365 #endif
1366
1367         /* If the client supports authz then see whether we have any to offer
1368          * to it. */
1369         if (s->s3->tlsext_authz_client_types_len)
1370                 {
1371                 size_t authz_length;
1372                 /* By now we already know the new cipher, so we can look ahead
1373                  * to see whether the cert we are going to send
1374                  * has any authz data attached to it. */
1375                 const unsigned char* authz = ssl_get_authz_data(s, &authz_length);
1376                 const unsigned char* const orig_authz = authz;
1377                 size_t i;
1378                 unsigned authz_count = 0;
1379
1380                 /* The authz data contains a number of the following structures:
1381                  *      uint8_t authz_type
1382                  *      uint16_t length
1383                  *      uint8_t data[length]
1384                  *
1385                  * First we walk over it to find the number of authz elements. */
1386                 for (i = 0; i < authz_length; i++)
1387                         {
1388                         unsigned short length;
1389                         unsigned char type;
1390
1391                         type = *(authz++);
1392                         if (memchr(s->s3->tlsext_authz_client_types,
1393                                    type,
1394                                    s->s3->tlsext_authz_client_types_len) != NULL)
1395                                 authz_count++;
1396
1397                         n2s(authz, length);
1398                         /* n2s increments authz by 2 */
1399                         i += 2;
1400                         authz += length;
1401                         i += length;
1402                         }
1403
1404                 if (authz_count)
1405                         {
1406                         /* Add TLS extension server_authz to the ServerHello message
1407                          * 2 bytes for extension type
1408                          * 2 bytes for extension length
1409                          * 1 byte for the list length
1410                          * n bytes for the list */
1411                         const unsigned short ext_len = 1 + authz_count;
1412
1413                         if ((long)(limit - ret - 4 - ext_len) < 0) return NULL;
1414                         s2n(TLSEXT_TYPE_server_authz, ret);
1415                         s2n(ext_len, ret);
1416                         *(ret++) = authz_count;
1417                         s->s3->tlsext_authz_promised_to_client = 1;
1418                         }
1419
1420                 authz = orig_authz;
1421                 for (i = 0; i < authz_length; i++)
1422                         {
1423                         unsigned short length;
1424                         unsigned char type;
1425
1426                         authz_count++;
1427                         type = *(authz++);
1428                         if (memchr(s->s3->tlsext_authz_client_types,
1429                                    type,
1430                                    s->s3->tlsext_authz_client_types_len) != NULL)
1431                                 *(ret++) = type;
1432                         n2s(authz, length);
1433                         /* n2s increments authz by 2 */
1434                         i += 2;
1435                         authz += length;
1436                         i += length;
1437                         }
1438                 }
1439
1440         if ((extdatalen = ret-p-2)== 0) 
1441                 return p;
1442
1443         s2n(extdatalen,p);
1444         return ret;
1445         }
1446
1447 static int ssl_scan_clienthello_tlsext(SSL *s, unsigned char **p, unsigned char *d, int n, int *al) 
1448         {       
1449         unsigned short type;
1450         unsigned short size;
1451         unsigned short len;
1452         unsigned char *data = *p;
1453         int renegotiate_seen = 0;
1454         size_t i;
1455
1456         s->servername_done = 0;
1457         s->tlsext_status_type = -1;
1458 #ifndef OPENSSL_NO_NEXTPROTONEG
1459         s->s3->next_proto_neg_seen = 0;
1460 #endif
1461
1462 #ifndef OPENSSL_NO_HEARTBEATS
1463         s->tlsext_heartbeat &= ~(SSL_TLSEXT_HB_ENABLED |
1464                                SSL_TLSEXT_HB_DONT_SEND_REQUESTS);
1465 #endif
1466         /* Clear any signature algorithms extension received */
1467         if (s->cert->peer_sigalgs)
1468                 {
1469                 OPENSSL_free(s->cert->peer_sigalgs);
1470                 s->cert->peer_sigalgs = NULL;
1471                 }
1472         /* Clear any shared sigtnature algorithms */
1473         if (s->cert->shared_sigalgs)
1474                 {
1475                 OPENSSL_free(s->cert->shared_sigalgs);
1476                 s->cert->shared_sigalgs = NULL;
1477                 }
1478         /* Clear certificate digests and validity flags */
1479         for (i = 0; i < SSL_PKEY_NUM; i++)
1480                 {
1481                 s->cert->pkeys[i].digest = NULL;
1482                 s->cert->pkeys[i].valid_flags = 0;
1483                 }
1484
1485         if (data >= (d+n-2))
1486                 goto ri_check;
1487         n2s(data,len);
1488
1489         if (data > (d+n-len)) 
1490                 goto ri_check;
1491
1492         while (data <= (d+n-4))
1493                 {
1494                 n2s(data,type);
1495                 n2s(data,size);
1496
1497                 if (data+size > (d+n))
1498                         goto ri_check;
1499 #if 0
1500                 fprintf(stderr,"Received extension type %d size %d\n",type,size);
1501 #endif
1502                 if (s->tlsext_debug_cb)
1503                         s->tlsext_debug_cb(s, 0, type, data, size,
1504                                                 s->tlsext_debug_arg);
1505 /* The servername extension is treated as follows:
1506
1507    - Only the hostname type is supported with a maximum length of 255.
1508    - The servername is rejected if too long or if it contains zeros,
1509      in which case an fatal alert is generated.
1510    - The servername field is maintained together with the session cache.
1511    - When a session is resumed, the servername call back invoked in order
1512      to allow the application to position itself to the right context. 
1513    - The servername is acknowledged if it is new for a session or when 
1514      it is identical to a previously used for the same session. 
1515      Applications can control the behaviour.  They can at any time
1516      set a 'desirable' servername for a new SSL object. This can be the
1517      case for example with HTTPS when a Host: header field is received and
1518      a renegotiation is requested. In this case, a possible servername
1519      presented in the new client hello is only acknowledged if it matches
1520      the value of the Host: field. 
1521    - Applications must  use SSL_OP_NO_SESSION_RESUMPTION_ON_RENEGOTIATION
1522      if they provide for changing an explicit servername context for the session,
1523      i.e. when the session has been established with a servername extension. 
1524    - On session reconnect, the servername extension may be absent. 
1525
1526 */      
1527
1528                 if (type == TLSEXT_TYPE_server_name)
1529                         {
1530                         unsigned char *sdata;
1531                         int servname_type;
1532                         int dsize; 
1533                 
1534                         if (size < 2) 
1535                                 {
1536                                 *al = SSL_AD_DECODE_ERROR;
1537                                 return 0;
1538                                 }
1539                         n2s(data,dsize);  
1540                         size -= 2;
1541                         if (dsize > size  ) 
1542                                 {
1543                                 *al = SSL_AD_DECODE_ERROR;
1544                                 return 0;
1545                                 } 
1546
1547                         sdata = data;
1548                         while (dsize > 3) 
1549                                 {
1550                                 servname_type = *(sdata++); 
1551                                 n2s(sdata,len);
1552                                 dsize -= 3;
1553
1554                                 if (len > dsize) 
1555                                         {
1556                                         *al = SSL_AD_DECODE_ERROR;
1557                                         return 0;
1558                                         }
1559                                 if (s->servername_done == 0)
1560                                 switch (servname_type)
1561                                         {
1562                                 case TLSEXT_NAMETYPE_host_name:
1563                                         if (!s->hit)
1564                                                 {
1565                                                 if(s->session->tlsext_hostname)
1566                                                         {
1567                                                         *al = SSL_AD_DECODE_ERROR;
1568                                                         return 0;
1569                                                         }
1570                                                 if (len > TLSEXT_MAXLEN_host_name)
1571                                                         {
1572                                                         *al = TLS1_AD_UNRECOGNIZED_NAME;
1573                                                         return 0;
1574                                                         }
1575                                                 if ((s->session->tlsext_hostname = OPENSSL_malloc(len+1)) == NULL)
1576                                                         {
1577                                                         *al = TLS1_AD_INTERNAL_ERROR;
1578                                                         return 0;
1579                                                         }
1580                                                 memcpy(s->session->tlsext_hostname, sdata, len);
1581                                                 s->session->tlsext_hostname[len]='\0';
1582                                                 if (strlen(s->session->tlsext_hostname) != len) {
1583                                                         OPENSSL_free(s->session->tlsext_hostname);
1584                                                         s->session->tlsext_hostname = NULL;
1585                                                         *al = TLS1_AD_UNRECOGNIZED_NAME;
1586                                                         return 0;
1587                                                 }
1588                                                 s->servername_done = 1; 
1589
1590                                                 }
1591                                         else 
1592                                                 s->servername_done = s->session->tlsext_hostname
1593                                                         && strlen(s->session->tlsext_hostname) == len 
1594                                                         && strncmp(s->session->tlsext_hostname, (char *)sdata, len) == 0;
1595                                         
1596                                         break;
1597
1598                                 default:
1599                                         break;
1600                                         }
1601                                  
1602                                 dsize -= len;
1603                                 }
1604                         if (dsize != 0) 
1605                                 {
1606                                 *al = SSL_AD_DECODE_ERROR;
1607                                 return 0;
1608                                 }
1609
1610                         }
1611 #ifndef OPENSSL_NO_SRP
1612                 else if (type == TLSEXT_TYPE_srp)
1613                         {
1614                         if (size <= 0 || ((len = data[0])) != (size -1))
1615                                 {
1616                                 *al = SSL_AD_DECODE_ERROR;
1617                                 return 0;
1618                                 }
1619                         if (s->srp_ctx.login != NULL)
1620                                 {
1621                                 *al = SSL_AD_DECODE_ERROR;
1622                                 return 0;
1623                                 }
1624                         if ((s->srp_ctx.login = OPENSSL_malloc(len+1)) == NULL)
1625                                 return -1;
1626                         memcpy(s->srp_ctx.login, &data[1], len);
1627                         s->srp_ctx.login[len]='\0';
1628   
1629                         if (strlen(s->srp_ctx.login) != len) 
1630                                 {
1631                                 *al = SSL_AD_DECODE_ERROR;
1632                                 return 0;
1633                                 }
1634                         }
1635 #endif
1636
1637 #ifndef OPENSSL_NO_EC
1638                 else if (type == TLSEXT_TYPE_ec_point_formats &&
1639                      s->version != DTLS1_VERSION)
1640                         {
1641                         unsigned char *sdata = data;
1642                         int ecpointformatlist_length = *(sdata++);
1643
1644                         if (ecpointformatlist_length != size - 1)
1645                                 {
1646                                 *al = TLS1_AD_DECODE_ERROR;
1647                                 return 0;
1648                                 }
1649                         if (!s->hit)
1650                                 {
1651                                 if(s->session->tlsext_ecpointformatlist)
1652                                         {
1653                                         OPENSSL_free(s->session->tlsext_ecpointformatlist);
1654                                         s->session->tlsext_ecpointformatlist = NULL;
1655                                         }
1656                                 s->session->tlsext_ecpointformatlist_length = 0;
1657                                 if ((s->session->tlsext_ecpointformatlist = OPENSSL_malloc(ecpointformatlist_length)) == NULL)
1658                                         {
1659                                         *al = TLS1_AD_INTERNAL_ERROR;
1660                                         return 0;
1661                                         }
1662                                 s->session->tlsext_ecpointformatlist_length = ecpointformatlist_length;
1663                                 memcpy(s->session->tlsext_ecpointformatlist, sdata, ecpointformatlist_length);
1664                                 }
1665 #if 0
1666                         fprintf(stderr,"ssl_parse_clienthello_tlsext s->session->tlsext_ecpointformatlist (length=%i) ", s->session->tlsext_ecpointformatlist_length);
1667                         sdata = s->session->tlsext_ecpointformatlist;
1668                         for (i = 0; i < s->session->tlsext_ecpointformatlist_length; i++)
1669                                 fprintf(stderr,"%i ",*(sdata++));
1670                         fprintf(stderr,"\n");
1671 #endif
1672                         }
1673                 else if (type == TLSEXT_TYPE_elliptic_curves &&
1674                      s->version != DTLS1_VERSION)
1675                         {
1676                         unsigned char *sdata = data;
1677                         int ellipticcurvelist_length = (*(sdata++) << 8);
1678                         ellipticcurvelist_length += (*(sdata++));
1679
1680                         if (ellipticcurvelist_length != size - 2 ||
1681                                 ellipticcurvelist_length < 1)
1682                                 {
1683                                 *al = TLS1_AD_DECODE_ERROR;
1684                                 return 0;
1685                                 }
1686                         if (!s->hit)
1687                                 {
1688                                 if(s->session->tlsext_ellipticcurvelist)
1689                                         {
1690                                         *al = TLS1_AD_DECODE_ERROR;
1691                                         return 0;
1692                                         }
1693                                 s->session->tlsext_ellipticcurvelist_length = 0;
1694                                 if ((s->session->tlsext_ellipticcurvelist = OPENSSL_malloc(ellipticcurvelist_length)) == NULL)
1695                                         {
1696                                         *al = TLS1_AD_INTERNAL_ERROR;
1697                                         return 0;
1698                                         }
1699                                 s->session->tlsext_ellipticcurvelist_length = ellipticcurvelist_length;
1700                                 memcpy(s->session->tlsext_ellipticcurvelist, sdata, ellipticcurvelist_length);
1701                                 }
1702 #if 0
1703                         fprintf(stderr,"ssl_parse_clienthello_tlsext s->session->tlsext_ellipticcurvelist (length=%i) ", s->session->tlsext_ellipticcurvelist_length);
1704                         sdata = s->session->tlsext_ellipticcurvelist;
1705                         for (i = 0; i < s->session->tlsext_ellipticcurvelist_length; i++)
1706                                 fprintf(stderr,"%i ",*(sdata++));
1707                         fprintf(stderr,"\n");
1708 #endif
1709                         }
1710 #endif /* OPENSSL_NO_EC */
1711 #ifdef TLSEXT_TYPE_opaque_prf_input
1712                 else if (type == TLSEXT_TYPE_opaque_prf_input &&
1713                      s->version != DTLS1_VERSION)
1714                         {
1715                         unsigned char *sdata = data;
1716
1717                         if (size < 2)
1718                                 {
1719                                 *al = SSL_AD_DECODE_ERROR;
1720                                 return 0;
1721                                 }
1722                         n2s(sdata, s->s3->client_opaque_prf_input_len);
1723                         if (s->s3->client_opaque_prf_input_len != size - 2)
1724                                 {
1725                                 *al = SSL_AD_DECODE_ERROR;
1726                                 return 0;
1727                                 }
1728
1729                         if (s->s3->client_opaque_prf_input != NULL) /* shouldn't really happen */
1730                                 OPENSSL_free(s->s3->client_opaque_prf_input);
1731                         if (s->s3->client_opaque_prf_input_len == 0)
1732                                 s->s3->client_opaque_prf_input = OPENSSL_malloc(1); /* dummy byte just to get non-NULL */
1733                         else
1734                                 s->s3->client_opaque_prf_input = BUF_memdup(sdata, s->s3->client_opaque_prf_input_len);
1735                         if (s->s3->client_opaque_prf_input == NULL)
1736                                 {
1737                                 *al = TLS1_AD_INTERNAL_ERROR;
1738                                 return 0;
1739                                 }
1740                         }
1741 #endif
1742                 else if (type == TLSEXT_TYPE_session_ticket)
1743                         {
1744                         if (s->tls_session_ticket_ext_cb &&
1745                             !s->tls_session_ticket_ext_cb(s, data, size, s->tls_session_ticket_ext_cb_arg))
1746                                 {
1747                                 *al = TLS1_AD_INTERNAL_ERROR;
1748                                 return 0;
1749                                 }
1750                         }
1751                 else if (type == TLSEXT_TYPE_renegotiate)
1752                         {
1753                         if(!ssl_parse_clienthello_renegotiate_ext(s, data, size, al))
1754                                 return 0;
1755                         renegotiate_seen = 1;
1756                         }
1757                 else if (type == TLSEXT_TYPE_signature_algorithms)
1758                         {
1759                         int dsize;
1760                         if (s->cert->peer_sigalgs || size < 2) 
1761                                 {
1762                                 *al = SSL_AD_DECODE_ERROR;
1763                                 return 0;
1764                                 }
1765                         n2s(data,dsize);
1766                         size -= 2;
1767                         if (dsize != size || dsize & 1 || !dsize) 
1768                                 {
1769                                 *al = SSL_AD_DECODE_ERROR;
1770                                 return 0;
1771                                 }
1772                         if (!tls1_process_sigalgs(s, data, dsize))
1773                                 {
1774                                 *al = SSL_AD_DECODE_ERROR;
1775                                 return 0;
1776                                 }
1777                         /* If sigalgs received and no shared algorithms fatal
1778                          * error.
1779                          */
1780                         if (s->cert->peer_sigalgs && !s->cert->shared_sigalgs)
1781                                 {
1782                                 SSLerr(SSL_F_SSL_SCAN_CLIENTHELLO_TLSEXT,
1783                                         SSL_R_NO_SHARED_SIGATURE_ALGORITHMS);
1784                                 *al = SSL_AD_ILLEGAL_PARAMETER;
1785                                 return 0;
1786                                 }
1787                         }
1788                 else if (type == TLSEXT_TYPE_status_request &&
1789                          s->version != DTLS1_VERSION && s->ctx->tlsext_status_cb)
1790                         {
1791                 
1792                         if (size < 5) 
1793                                 {
1794                                 *al = SSL_AD_DECODE_ERROR;
1795                                 return 0;
1796                                 }
1797
1798                         s->tlsext_status_type = *data++;
1799                         size--;
1800                         if (s->tlsext_status_type == TLSEXT_STATUSTYPE_ocsp)
1801                                 {
1802                                 const unsigned char *sdata;
1803                                 int dsize;
1804                                 /* Read in responder_id_list */
1805                                 n2s(data,dsize);
1806                                 size -= 2;
1807                                 if (dsize > size  ) 
1808                                         {
1809                                         *al = SSL_AD_DECODE_ERROR;
1810                                         return 0;
1811                                         }
1812                                 while (dsize > 0)
1813                                         {
1814                                         OCSP_RESPID *id;
1815                                         int idsize;
1816                                         if (dsize < 4)
1817                                                 {
1818                                                 *al = SSL_AD_DECODE_ERROR;
1819                                                 return 0;
1820                                                 }
1821                                         n2s(data, idsize);
1822                                         dsize -= 2 + idsize;
1823                                         size -= 2 + idsize;
1824                                         if (dsize < 0)
1825                                                 {
1826                                                 *al = SSL_AD_DECODE_ERROR;
1827                                                 return 0;
1828                                                 }
1829                                         sdata = data;
1830                                         data += idsize;
1831                                         id = d2i_OCSP_RESPID(NULL,
1832                                                                 &sdata, idsize);
1833                                         if (!id)
1834                                                 {
1835                                                 *al = SSL_AD_DECODE_ERROR;
1836                                                 return 0;
1837                                                 }
1838                                         if (data != sdata)
1839                                                 {
1840                                                 OCSP_RESPID_free(id);
1841                                                 *al = SSL_AD_DECODE_ERROR;
1842                                                 return 0;
1843                                                 }
1844                                         if (!s->tlsext_ocsp_ids
1845                                                 && !(s->tlsext_ocsp_ids =
1846                                                 sk_OCSP_RESPID_new_null()))
1847                                                 {
1848                                                 OCSP_RESPID_free(id);
1849                                                 *al = SSL_AD_INTERNAL_ERROR;
1850                                                 return 0;
1851                                                 }
1852                                         if (!sk_OCSP_RESPID_push(
1853                                                         s->tlsext_ocsp_ids, id))
1854                                                 {
1855                                                 OCSP_RESPID_free(id);
1856                                                 *al = SSL_AD_INTERNAL_ERROR;
1857                                                 return 0;
1858                                                 }
1859                                         }
1860
1861                                 /* Read in request_extensions */
1862                                 if (size < 2)
1863                                         {
1864                                         *al = SSL_AD_DECODE_ERROR;
1865                                         return 0;
1866                                         }
1867                                 n2s(data,dsize);
1868                                 size -= 2;
1869                                 if (dsize != size)
1870                                         {
1871                                         *al = SSL_AD_DECODE_ERROR;
1872                                         return 0;
1873                                         }
1874                                 sdata = data;
1875                                 if (dsize > 0)
1876                                         {
1877                                         if (s->tlsext_ocsp_exts)
1878                                                 {
1879                                                 sk_X509_EXTENSION_pop_free(s->tlsext_ocsp_exts,
1880                                                                            X509_EXTENSION_free);
1881                                                 }
1882
1883                                         s->tlsext_ocsp_exts =
1884                                                 d2i_X509_EXTENSIONS(NULL,
1885                                                         &sdata, dsize);
1886                                         if (!s->tlsext_ocsp_exts
1887                                                 || (data + dsize != sdata))
1888                                                 {
1889                                                 *al = SSL_AD_DECODE_ERROR;
1890                                                 return 0;
1891                                                 }
1892                                         }
1893                                 }
1894                                 /* We don't know what to do with any other type
1895                                 * so ignore it.
1896                                 */
1897                                 else
1898                                         s->tlsext_status_type = -1;
1899                         }
1900 #ifndef OPENSSL_NO_HEARTBEATS
1901                 else if (type == TLSEXT_TYPE_heartbeat)
1902                         {
1903                         switch(data[0])
1904                                 {
1905                                 case 0x01:      /* Client allows us to send HB requests */
1906                                                         s->tlsext_heartbeat |= SSL_TLSEXT_HB_ENABLED;
1907                                                         break;
1908                                 case 0x02:      /* Client doesn't accept HB requests */
1909                                                         s->tlsext_heartbeat |= SSL_TLSEXT_HB_ENABLED;
1910                                                         s->tlsext_heartbeat |= SSL_TLSEXT_HB_DONT_SEND_REQUESTS;
1911                                                         break;
1912                                 default:        *al = SSL_AD_ILLEGAL_PARAMETER;
1913                                                         return 0;
1914                                 }
1915                         }
1916 #endif
1917 #ifndef OPENSSL_NO_NEXTPROTONEG
1918                 else if (type == TLSEXT_TYPE_next_proto_neg &&
1919                          s->s3->tmp.finish_md_len == 0)
1920                         {
1921                         /* We shouldn't accept this extension on a
1922                          * renegotiation.
1923                          *
1924                          * s->new_session will be set on renegotiation, but we
1925                          * probably shouldn't rely that it couldn't be set on
1926                          * the initial renegotation too in certain cases (when
1927                          * there's some other reason to disallow resuming an
1928                          * earlier session -- the current code won't be doing
1929                          * anything like that, but this might change).
1930
1931                          * A valid sign that there's been a previous handshake
1932                          * in this connection is if s->s3->tmp.finish_md_len >
1933                          * 0.  (We are talking about a check that will happen
1934                          * in the Hello protocol round, well before a new
1935                          * Finished message could have been computed.) */
1936                         s->s3->next_proto_neg_seen = 1;
1937                         }
1938 #endif
1939
1940                 /* session ticket processed earlier */
1941                 else if (type == TLSEXT_TYPE_use_srtp)
1942                         {
1943                         if(ssl_parse_clienthello_use_srtp_ext(s, data, size,
1944                                                               al))
1945                                 return 0;
1946                         }
1947
1948                 else if (type == TLSEXT_TYPE_server_authz)
1949                         {
1950                         unsigned char *sdata = data;
1951                         unsigned char server_authz_dataformatlist_length;
1952
1953                         if (size == 0)
1954                                 {
1955                                 *al = TLS1_AD_DECODE_ERROR;
1956                                 return 0;
1957                                 }
1958
1959                         server_authz_dataformatlist_length = *(sdata++);
1960
1961                         if (server_authz_dataformatlist_length != size - 1)
1962                                 {
1963                                 *al = TLS1_AD_DECODE_ERROR;
1964                                 return 0;
1965                                 }
1966
1967                         /* Successful session resumption uses the same authz
1968                          * information as the original session so we ignore this
1969                          * in the case of a session resumption. */
1970                         if (!s->hit)
1971                                 {
1972                                 if (s->s3->tlsext_authz_client_types != NULL)
1973                                         OPENSSL_free(s->s3->tlsext_authz_client_types);
1974                                 s->s3->tlsext_authz_client_types =
1975                                         OPENSSL_malloc(server_authz_dataformatlist_length);
1976                                 if (!s->s3->tlsext_authz_client_types)
1977                                         {
1978                                         *al = TLS1_AD_INTERNAL_ERROR;
1979                                         return 0;
1980                                         }
1981
1982                                 s->s3->tlsext_authz_client_types_len =
1983                                         server_authz_dataformatlist_length;
1984                                 memcpy(s->s3->tlsext_authz_client_types,
1985                                        sdata,
1986                                        server_authz_dataformatlist_length);
1987
1988                                 /* Sort the types in order to check for duplicates. */
1989                                 qsort(s->s3->tlsext_authz_client_types,
1990                                       server_authz_dataformatlist_length,
1991                                       1 /* element size */,
1992                                       byte_compare);
1993
1994                                 for (i = 0; i < server_authz_dataformatlist_length; i++)
1995                                         {
1996                                         if (i > 0 &&
1997                                             s->s3->tlsext_authz_client_types[i] ==
1998                                               s->s3->tlsext_authz_client_types[i-1])
1999                                                 {
2000                                                 *al = TLS1_AD_DECODE_ERROR;
2001                                                 return 0;
2002                                                 }
2003                                         }
2004                                 }
2005                         }
2006
2007                 data+=size;
2008                 }
2009
2010         *p = data;
2011
2012         ri_check:
2013
2014         /* Need RI if renegotiating */
2015
2016         if (!renegotiate_seen && s->renegotiate &&
2017                 !(s->options & SSL_OP_ALLOW_UNSAFE_LEGACY_RENEGOTIATION))
2018                 {
2019                 *al = SSL_AD_HANDSHAKE_FAILURE;
2020                 SSLerr(SSL_F_SSL_SCAN_CLIENTHELLO_TLSEXT,
2021                                 SSL_R_UNSAFE_LEGACY_RENEGOTIATION_DISABLED);
2022                 return 0;
2023                 }
2024         /* If no signature algorithms extension set default values */
2025         if (!s->cert->peer_sigalgs)
2026                 ssl_cert_set_default_md(s->cert);
2027
2028         return 1;
2029         }
2030
2031 int ssl_parse_clienthello_tlsext(SSL *s, unsigned char **p, unsigned char *d, int n) 
2032         {
2033         int al = -1;
2034         if (ssl_scan_clienthello_tlsext(s, p, d, n, &al) <= 0) 
2035                 {
2036                 ssl3_send_alert(s,SSL3_AL_FATAL,al); 
2037                 return 0;
2038                 }
2039
2040         if (ssl_check_clienthello_tlsext_early(s) <= 0) 
2041                 {
2042                 SSLerr(SSL_F_SSL_PARSE_CLIENTHELLO_TLSEXT,SSL_R_CLIENTHELLO_TLSEXT);
2043                 return 0;
2044                 }
2045         return 1;
2046 }
2047
2048 #ifndef OPENSSL_NO_NEXTPROTONEG
2049 /* ssl_next_proto_validate validates a Next Protocol Negotiation block. No
2050  * elements of zero length are allowed and the set of elements must exactly fill
2051  * the length of the block. */
2052 static char ssl_next_proto_validate(unsigned char *d, unsigned len)
2053         {
2054         unsigned int off = 0;
2055
2056         while (off < len)
2057                 {
2058                 if (d[off] == 0)
2059                         return 0;
2060                 off += d[off];
2061                 off++;
2062                 }
2063
2064         return off == len;
2065         }
2066 #endif
2067
2068 static int ssl_scan_serverhello_tlsext(SSL *s, unsigned char **p, unsigned char *d, int n, int *al)
2069         {
2070         unsigned short length;
2071         unsigned short type;
2072         unsigned short size;
2073         unsigned char *data = *p;
2074         int tlsext_servername = 0;
2075         int renegotiate_seen = 0;
2076
2077 #ifndef OPENSSL_NO_NEXTPROTONEG
2078         s->s3->next_proto_neg_seen = 0;
2079 #endif
2080
2081 #ifndef OPENSSL_NO_HEARTBEATS
2082         s->tlsext_heartbeat &= ~(SSL_TLSEXT_HB_ENABLED |
2083                                SSL_TLSEXT_HB_DONT_SEND_REQUESTS);
2084 #endif
2085
2086         if (data >= (d+n-2))
2087                 goto ri_check;
2088
2089         n2s(data,length);
2090         if (data+length != d+n)
2091                 {
2092                 *al = SSL_AD_DECODE_ERROR;
2093                 return 0;
2094                 }
2095
2096         while(data <= (d+n-4))
2097                 {
2098                 n2s(data,type);
2099                 n2s(data,size);
2100
2101                 if (data+size > (d+n))
2102                         goto ri_check;
2103
2104                 if (s->tlsext_debug_cb)
2105                         s->tlsext_debug_cb(s, 1, type, data, size,
2106                                                 s->tlsext_debug_arg);
2107
2108                 if (type == TLSEXT_TYPE_server_name)
2109                         {
2110                         if (s->tlsext_hostname == NULL || size > 0)
2111                                 {
2112                                 *al = TLS1_AD_UNRECOGNIZED_NAME;
2113                                 return 0;
2114                                 }
2115                         tlsext_servername = 1;   
2116                         }
2117
2118 #ifndef OPENSSL_NO_EC
2119                 else if (type == TLSEXT_TYPE_ec_point_formats &&
2120                      s->version != DTLS1_VERSION)
2121                         {
2122                         unsigned char *sdata = data;
2123                         int ecpointformatlist_length = *(sdata++);
2124
2125                         if (ecpointformatlist_length != size - 1 || 
2126                                 ecpointformatlist_length < 1)
2127                                 {
2128                                 *al = TLS1_AD_DECODE_ERROR;
2129                                 return 0;
2130                                 }
2131                         s->session->tlsext_ecpointformatlist_length = 0;
2132                         if (s->session->tlsext_ecpointformatlist != NULL) OPENSSL_free(s->session->tlsext_ecpointformatlist);
2133                         if ((s->session->tlsext_ecpointformatlist = OPENSSL_malloc(ecpointformatlist_length)) == NULL)
2134                                 {
2135                                 *al = TLS1_AD_INTERNAL_ERROR;
2136                                 return 0;
2137                                 }
2138                         s->session->tlsext_ecpointformatlist_length = ecpointformatlist_length;
2139                         memcpy(s->session->tlsext_ecpointformatlist, sdata, ecpointformatlist_length);
2140 #if 0
2141                         fprintf(stderr,"ssl_parse_serverhello_tlsext s->session->tlsext_ecpointformatlist ");
2142                         sdata = s->session->tlsext_ecpointformatlist;
2143                         for (i = 0; i < s->session->tlsext_ecpointformatlist_length; i++)
2144                                 fprintf(stderr,"%i ",*(sdata++));
2145                         fprintf(stderr,"\n");
2146 #endif
2147                         }
2148 #endif /* OPENSSL_NO_EC */
2149
2150                 else if (type == TLSEXT_TYPE_session_ticket)
2151                         {
2152                         if (s->tls_session_ticket_ext_cb &&
2153                             !s->tls_session_ticket_ext_cb(s, data, size, s->tls_session_ticket_ext_cb_arg))
2154                                 {
2155                                 *al = TLS1_AD_INTERNAL_ERROR;
2156                                 return 0;
2157                                 }
2158                         if ((SSL_get_options(s) & SSL_OP_NO_TICKET)
2159                                 || (size > 0))
2160                                 {
2161                                 *al = TLS1_AD_UNSUPPORTED_EXTENSION;
2162                                 return 0;
2163                                 }
2164                         s->tlsext_ticket_expected = 1;
2165                         }
2166 #ifdef TLSEXT_TYPE_opaque_prf_input
2167                 else if (type == TLSEXT_TYPE_opaque_prf_input &&
2168                      s->version != DTLS1_VERSION)
2169                         {
2170                         unsigned char *sdata = data;
2171
2172                         if (size < 2)
2173                                 {
2174                                 *al = SSL_AD_DECODE_ERROR;
2175                                 return 0;
2176                                 }
2177                         n2s(sdata, s->s3->server_opaque_prf_input_len);
2178                         if (s->s3->server_opaque_prf_input_len != size - 2)
2179                                 {
2180                                 *al = SSL_AD_DECODE_ERROR;
2181                                 return 0;
2182                                 }
2183                         
2184                         if (s->s3->server_opaque_prf_input != NULL) /* shouldn't really happen */
2185                                 OPENSSL_free(s->s3->server_opaque_prf_input);
2186                         if (s->s3->server_opaque_prf_input_len == 0)
2187                                 s->s3->server_opaque_prf_input = OPENSSL_malloc(1); /* dummy byte just to get non-NULL */
2188                         else
2189                                 s->s3->server_opaque_prf_input = BUF_memdup(sdata, s->s3->server_opaque_prf_input_len);
2190
2191                         if (s->s3->server_opaque_prf_input == NULL)
2192                                 {
2193                                 *al = TLS1_AD_INTERNAL_ERROR;
2194                                 return 0;
2195                                 }
2196                         }
2197 #endif
2198                 else if (type == TLSEXT_TYPE_status_request &&
2199                          s->version != DTLS1_VERSION)
2200                         {
2201                         /* MUST be empty and only sent if we've requested
2202                          * a status request message.
2203                          */ 
2204                         if ((s->tlsext_status_type == -1) || (size > 0))
2205                                 {
2206                                 *al = TLS1_AD_UNSUPPORTED_EXTENSION;
2207                                 return 0;
2208                                 }
2209                         /* Set flag to expect CertificateStatus message */
2210                         s->tlsext_status_expected = 1;
2211                         }
2212 #ifndef OPENSSL_NO_NEXTPROTONEG
2213                 else if (type == TLSEXT_TYPE_next_proto_neg &&
2214                          s->s3->tmp.finish_md_len == 0)
2215                         {
2216                         unsigned char *selected;
2217                         unsigned char selected_len;
2218
2219                         /* We must have requested it. */
2220                         if ((s->ctx->next_proto_select_cb == NULL))
2221                                 {
2222                                 *al = TLS1_AD_UNSUPPORTED_EXTENSION;
2223                                 return 0;
2224                                 }
2225                         /* The data must be valid */
2226                         if (!ssl_next_proto_validate(data, size))
2227                                 {
2228                                 *al = TLS1_AD_DECODE_ERROR;
2229                                 return 0;
2230                                 }
2231                         if (s->ctx->next_proto_select_cb(s, &selected, &selected_len, data, size, s->ctx->next_proto_select_cb_arg) != SSL_TLSEXT_ERR_OK)
2232                                 {
2233                                 *al = TLS1_AD_INTERNAL_ERROR;
2234                                 return 0;
2235                                 }
2236                         s->next_proto_negotiated = OPENSSL_malloc(selected_len);
2237                         if (!s->next_proto_negotiated)
2238                                 {
2239                                 *al = TLS1_AD_INTERNAL_ERROR;
2240                                 return 0;
2241                                 }
2242                         memcpy(s->next_proto_negotiated, selected, selected_len);
2243                         s->next_proto_negotiated_len = selected_len;
2244                         s->s3->next_proto_neg_seen = 1;
2245                         }
2246 #endif
2247                 else if (type == TLSEXT_TYPE_renegotiate)
2248                         {
2249                         if(!ssl_parse_serverhello_renegotiate_ext(s, data, size, al))
2250                                 return 0;
2251                         renegotiate_seen = 1;
2252                         }
2253 #ifndef OPENSSL_NO_HEARTBEATS
2254                 else if (type == TLSEXT_TYPE_heartbeat)
2255                         {
2256                         switch(data[0])
2257                                 {
2258                                 case 0x01:      /* Server allows us to send HB requests */
2259                                                         s->tlsext_heartbeat |= SSL_TLSEXT_HB_ENABLED;
2260                                                         break;
2261                                 case 0x02:      /* Server doesn't accept HB requests */
2262                                                         s->tlsext_heartbeat |= SSL_TLSEXT_HB_ENABLED;
2263                                                         s->tlsext_heartbeat |= SSL_TLSEXT_HB_DONT_SEND_REQUESTS;
2264                                                         break;
2265                                 default:        *al = SSL_AD_ILLEGAL_PARAMETER;
2266                                                         return 0;
2267                                 }
2268                         }
2269 #endif
2270                 else if (type == TLSEXT_TYPE_use_srtp)
2271                         {
2272                         if(ssl_parse_serverhello_use_srtp_ext(s, data, size,
2273                                                               al))
2274                                 return 0;
2275                         }
2276
2277                 else if (type == TLSEXT_TYPE_server_authz)
2278                         {
2279                         /* We only support audit proofs. It's an error to send
2280                          * an authz hello extension if the client
2281                          * didn't request a proof. */
2282                         unsigned char *sdata = data;
2283                         unsigned char server_authz_dataformatlist_length;
2284
2285                         if (!s->ctx->tlsext_authz_server_audit_proof_cb)
2286                                 {
2287                                 *al = TLS1_AD_UNSUPPORTED_EXTENSION;
2288                                 return 0;
2289                                 }
2290
2291                         if (!size)
2292                                 {
2293                                 *al = TLS1_AD_DECODE_ERROR;
2294                                 return 0;
2295                                 }
2296
2297                         server_authz_dataformatlist_length = *(sdata++);
2298                         if (server_authz_dataformatlist_length != size - 1)
2299                                 {
2300                                 *al = TLS1_AD_DECODE_ERROR;
2301                                 return 0;
2302                                 }
2303
2304                         /* We only support audit proofs, so a legal ServerHello
2305                          * authz list contains exactly one entry. */
2306                         if (server_authz_dataformatlist_length != 1 ||
2307                                 sdata[0] != TLSEXT_AUTHZDATAFORMAT_audit_proof)
2308                                 {
2309                                 *al = TLS1_AD_UNSUPPORTED_EXTENSION;
2310                                 return 0;
2311                                 }
2312
2313                         s->s3->tlsext_authz_server_promised = 1;
2314                         }
2315  
2316                 data += size;
2317                 }
2318
2319         if (data != d+n)
2320                 {
2321                 *al = SSL_AD_DECODE_ERROR;
2322                 return 0;
2323                 }
2324
2325         if (!s->hit && tlsext_servername == 1)
2326                 {
2327                 if (s->tlsext_hostname)
2328                         {
2329                         if (s->session->tlsext_hostname == NULL)
2330                                 {
2331                                 s->session->tlsext_hostname = BUF_strdup(s->tlsext_hostname);   
2332                                 if (!s->session->tlsext_hostname)
2333                                         {
2334                                         *al = SSL_AD_UNRECOGNIZED_NAME;
2335                                         return 0;
2336                                         }
2337                                 }
2338                         else 
2339                                 {
2340                                 *al = SSL_AD_DECODE_ERROR;
2341                                 return 0;
2342                                 }
2343                         }
2344                 }
2345
2346         *p = data;
2347
2348         ri_check:
2349
2350         /* Determine if we need to see RI. Strictly speaking if we want to
2351          * avoid an attack we should *always* see RI even on initial server
2352          * hello because the client doesn't see any renegotiation during an
2353          * attack. However this would mean we could not connect to any server
2354          * which doesn't support RI so for the immediate future tolerate RI
2355          * absence on initial connect only.
2356          */
2357         if (!renegotiate_seen
2358                 && !(s->options & SSL_OP_LEGACY_SERVER_CONNECT)
2359                 && !(s->options & SSL_OP_ALLOW_UNSAFE_LEGACY_RENEGOTIATION))
2360                 {
2361                 *al = SSL_AD_HANDSHAKE_FAILURE;
2362                 SSLerr(SSL_F_SSL_SCAN_SERVERHELLO_TLSEXT,
2363                                 SSL_R_UNSAFE_LEGACY_RENEGOTIATION_DISABLED);
2364                 return 0;
2365                 }
2366
2367         return 1;
2368         }
2369
2370
2371 int ssl_prepare_clienthello_tlsext(SSL *s)
2372         {
2373
2374 #ifdef TLSEXT_TYPE_opaque_prf_input
2375         {
2376                 int r = 1;
2377         
2378                 if (s->ctx->tlsext_opaque_prf_input_callback != 0)
2379                         {
2380                         r = s->ctx->tlsext_opaque_prf_input_callback(s, NULL, 0, s->ctx->tlsext_opaque_prf_input_callback_arg);
2381                         if (!r)
2382                                 return -1;
2383                         }
2384
2385                 if (s->tlsext_opaque_prf_input != NULL)
2386                         {
2387                         if (s->s3->client_opaque_prf_input != NULL) /* shouldn't really happen */
2388                                 OPENSSL_free(s->s3->client_opaque_prf_input);
2389
2390                         if (s->tlsext_opaque_prf_input_len == 0)
2391                                 s->s3->client_opaque_prf_input = OPENSSL_malloc(1); /* dummy byte just to get non-NULL */
2392                         else
2393                                 s->s3->client_opaque_prf_input = BUF_memdup(s->tlsext_opaque_prf_input, s->tlsext_opaque_prf_input_len);
2394                         if (s->s3->client_opaque_prf_input == NULL)
2395                                 {
2396                                 SSLerr(SSL_F_SSL_PREPARE_CLIENTHELLO_TLSEXT,ERR_R_MALLOC_FAILURE);
2397                                 return -1;
2398                                 }
2399                         s->s3->client_opaque_prf_input_len = s->tlsext_opaque_prf_input_len;
2400                         }
2401
2402                 if (r == 2)
2403                         /* at callback's request, insist on receiving an appropriate server opaque PRF input */
2404                         s->s3->server_opaque_prf_input_len = s->tlsext_opaque_prf_input_len;
2405         }
2406 #endif
2407
2408         return 1;
2409         }
2410
2411 int ssl_prepare_serverhello_tlsext(SSL *s)
2412         {
2413 #ifndef OPENSSL_NO_EC
2414         /* If we are server and using an ECC cipher suite, send the point formats we support 
2415          * if the client sent us an ECPointsFormat extension.  Note that the server is not
2416          * supposed to send an EllipticCurves extension.
2417          */
2418
2419         unsigned long alg_k = s->s3->tmp.new_cipher->algorithm_mkey;
2420         unsigned long alg_a = s->s3->tmp.new_cipher->algorithm_auth;
2421         int using_ecc = (alg_k & (SSL_kEECDH|SSL_kECDHr|SSL_kECDHe)) || (alg_a & SSL_aECDSA);
2422         using_ecc = using_ecc && (s->session->tlsext_ecpointformatlist != NULL);
2423         
2424         if (using_ecc)
2425                 {
2426                 if (s->tlsext_ecpointformatlist != NULL) OPENSSL_free(s->tlsext_ecpointformatlist);
2427                 if ((s->tlsext_ecpointformatlist = OPENSSL_malloc(3)) == NULL)
2428                         {
2429                         SSLerr(SSL_F_SSL_PREPARE_SERVERHELLO_TLSEXT,ERR_R_MALLOC_FAILURE);
2430                         return -1;
2431                         }
2432                 s->tlsext_ecpointformatlist_length = 3;
2433                 s->tlsext_ecpointformatlist[0] = TLSEXT_ECPOINTFORMAT_uncompressed;
2434                 s->tlsext_ecpointformatlist[1] = TLSEXT_ECPOINTFORMAT_ansiX962_compressed_prime;
2435                 s->tlsext_ecpointformatlist[2] = TLSEXT_ECPOINTFORMAT_ansiX962_compressed_char2;
2436                 }
2437 #endif /* OPENSSL_NO_EC */
2438
2439         return 1;
2440         }
2441
2442 static int ssl_check_clienthello_tlsext_early(SSL *s)
2443         {
2444         int ret=SSL_TLSEXT_ERR_NOACK;
2445         int al = SSL_AD_UNRECOGNIZED_NAME;
2446
2447 #ifndef OPENSSL_NO_EC
2448         /* The handling of the ECPointFormats extension is done elsewhere, namely in 
2449          * ssl3_choose_cipher in s3_lib.c.
2450          */
2451         /* The handling of the EllipticCurves extension is done elsewhere, namely in 
2452          * ssl3_choose_cipher in s3_lib.c.
2453          */
2454 #endif
2455
2456         if (s->ctx != NULL && s->ctx->tlsext_servername_callback != 0) 
2457                 ret = s->ctx->tlsext_servername_callback(s, &al, s->ctx->tlsext_servername_arg);
2458         else if (s->initial_ctx != NULL && s->initial_ctx->tlsext_servername_callback != 0)             
2459                 ret = s->initial_ctx->tlsext_servername_callback(s, &al, s->initial_ctx->tlsext_servername_arg);
2460
2461 #ifdef TLSEXT_TYPE_opaque_prf_input
2462         {
2463                 /* This sort of belongs into ssl_prepare_serverhello_tlsext(),
2464                  * but we might be sending an alert in response to the client hello,
2465                  * so this has to happen here in
2466                  * ssl_check_clienthello_tlsext_early(). */
2467
2468                 int r = 1;
2469         
2470                 if (s->ctx->tlsext_opaque_prf_input_callback != 0)
2471                         {
2472                         r = s->ctx->tlsext_opaque_prf_input_callback(s, NULL, 0, s->ctx->tlsext_opaque_prf_input_callback_arg);
2473                         if (!r)
2474                                 {
2475                                 ret = SSL_TLSEXT_ERR_ALERT_FATAL;
2476                                 al = SSL_AD_INTERNAL_ERROR;
2477                                 goto err;
2478                                 }
2479                         }
2480
2481                 if (s->s3->server_opaque_prf_input != NULL) /* shouldn't really happen */
2482                         OPENSSL_free(s->s3->server_opaque_prf_input);
2483                 s->s3->server_opaque_prf_input = NULL;
2484
2485                 if (s->tlsext_opaque_prf_input != NULL)
2486                         {
2487                         if (s->s3->client_opaque_prf_input != NULL &&
2488                                 s->s3->client_opaque_prf_input_len == s->tlsext_opaque_prf_input_len)
2489                                 {
2490                                 /* can only use this extension if we have a server opaque PRF input
2491                                  * of the same length as the client opaque PRF input! */
2492
2493                                 if (s->tlsext_opaque_prf_input_len == 0)
2494                                         s->s3->server_opaque_prf_input = OPENSSL_malloc(1); /* dummy byte just to get non-NULL */
2495                                 else
2496                                         s->s3->server_opaque_prf_input = BUF_memdup(s->tlsext_opaque_prf_input, s->tlsext_opaque_prf_input_len);
2497                                 if (s->s3->server_opaque_prf_input == NULL)
2498                                         {
2499                                         ret = SSL_TLSEXT_ERR_ALERT_FATAL;
2500                                         al = SSL_AD_INTERNAL_ERROR;
2501                                         goto err;
2502                                         }
2503                                 s->s3->server_opaque_prf_input_len = s->tlsext_opaque_prf_input_len;
2504                                 }
2505                         }
2506
2507                 if (r == 2 && s->s3->server_opaque_prf_input == NULL)
2508                         {
2509                         /* The callback wants to enforce use of the extension,
2510                          * but we can't do that with the client opaque PRF input;
2511                          * abort the handshake.
2512                          */
2513                         ret = SSL_TLSEXT_ERR_ALERT_FATAL;
2514                         al = SSL_AD_HANDSHAKE_FAILURE;
2515                         }
2516         }
2517
2518  err:
2519 #endif
2520         switch (ret)
2521                 {
2522                 case SSL_TLSEXT_ERR_ALERT_FATAL:
2523                         ssl3_send_alert(s,SSL3_AL_FATAL,al); 
2524                         return -1;
2525
2526                 case SSL_TLSEXT_ERR_ALERT_WARNING:
2527                         ssl3_send_alert(s,SSL3_AL_WARNING,al);
2528                         return 1; 
2529                                         
2530                 case SSL_TLSEXT_ERR_NOACK:
2531                         s->servername_done=0;
2532                         default:
2533                 return 1;
2534                 }
2535         }
2536
2537 int ssl_check_clienthello_tlsext_late(SSL *s)
2538         {
2539         int ret = SSL_TLSEXT_ERR_OK;
2540         int al;
2541
2542         /* If status request then ask callback what to do.
2543          * Note: this must be called after servername callbacks in case
2544          * the certificate has changed, and must be called after the cipher
2545          * has been chosen because this may influence which certificate is sent
2546          */
2547         if ((s->tlsext_status_type != -1) && s->ctx && s->ctx->tlsext_status_cb)
2548                 {
2549                 int r;
2550                 CERT_PKEY *certpkey;
2551                 certpkey = ssl_get_server_send_pkey(s);
2552                 /* If no certificate can't return certificate status */
2553                 if (certpkey == NULL)
2554                         {
2555                         s->tlsext_status_expected = 0;
2556                         return 1;
2557                         }
2558                 /* Set current certificate to one we will use so
2559                  * SSL_get_certificate et al can pick it up.
2560                  */
2561                 s->cert->key = certpkey;
2562                 r = s->ctx->tlsext_status_cb(s, s->ctx->tlsext_status_arg);
2563                 switch (r)
2564                         {
2565                         /* We don't want to send a status request response */
2566                         case SSL_TLSEXT_ERR_NOACK:
2567                                 s->tlsext_status_expected = 0;
2568                                 break;
2569                         /* status request response should be sent */
2570                         case SSL_TLSEXT_ERR_OK:
2571                                 if (s->tlsext_ocsp_resp)
2572                                         s->tlsext_status_expected = 1;
2573                                 else
2574                                         s->tlsext_status_expected = 0;
2575                                 break;
2576                         /* something bad happened */
2577                         case SSL_TLSEXT_ERR_ALERT_FATAL:
2578                                 ret = SSL_TLSEXT_ERR_ALERT_FATAL;
2579                                 al = SSL_AD_INTERNAL_ERROR;
2580                                 goto err;
2581                         }
2582                 }
2583         else
2584                 s->tlsext_status_expected = 0;
2585
2586  err:
2587         switch (ret)
2588                 {
2589                 case SSL_TLSEXT_ERR_ALERT_FATAL:
2590                         ssl3_send_alert(s, SSL3_AL_FATAL,al);
2591                         return -1;
2592
2593                 case SSL_TLSEXT_ERR_ALERT_WARNING:
2594                         ssl3_send_alert(s, SSL3_AL_WARNING,al);
2595                         return 1; 
2596
2597                 default:
2598                         return 1;
2599                 }
2600         }
2601
2602 int ssl_check_serverhello_tlsext(SSL *s)
2603         {
2604         int ret=SSL_TLSEXT_ERR_NOACK;
2605         int al = SSL_AD_UNRECOGNIZED_NAME;
2606
2607 #ifndef OPENSSL_NO_EC
2608         /* If we are client and using an elliptic curve cryptography cipher
2609          * suite, then if server returns an EC point formats lists extension
2610          * it must contain uncompressed.
2611          */
2612         unsigned long alg_k = s->s3->tmp.new_cipher->algorithm_mkey;
2613         unsigned long alg_a = s->s3->tmp.new_cipher->algorithm_auth;
2614         if ((s->tlsext_ecpointformatlist != NULL) && (s->tlsext_ecpointformatlist_length > 0) && 
2615             (s->session->tlsext_ecpointformatlist != NULL) && (s->session->tlsext_ecpointformatlist_length > 0) && 
2616             ((alg_k & (SSL_kEECDH|SSL_kECDHr|SSL_kECDHe)) || (alg_a & SSL_aECDSA)))
2617                 {
2618                 /* we are using an ECC cipher */
2619                 size_t i;
2620                 unsigned char *list;
2621                 int found_uncompressed = 0;
2622                 list = s->session->tlsext_ecpointformatlist;
2623                 for (i = 0; i < s->session->tlsext_ecpointformatlist_length; i++)
2624                         {
2625                         if (*(list++) == TLSEXT_ECPOINTFORMAT_uncompressed)
2626                                 {
2627                                 found_uncompressed = 1;
2628                                 break;
2629                                 }
2630                         }
2631                 if (!found_uncompressed)
2632                         {
2633                         SSLerr(SSL_F_SSL_CHECK_SERVERHELLO_TLSEXT,SSL_R_TLS_INVALID_ECPOINTFORMAT_LIST);
2634                         return -1;
2635                         }
2636                 }
2637         ret = SSL_TLSEXT_ERR_OK;
2638 #endif /* OPENSSL_NO_EC */
2639
2640         if (s->ctx != NULL && s->ctx->tlsext_servername_callback != 0) 
2641                 ret = s->ctx->tlsext_servername_callback(s, &al, s->ctx->tlsext_servername_arg);
2642         else if (s->initial_ctx != NULL && s->initial_ctx->tlsext_servername_callback != 0)             
2643                 ret = s->initial_ctx->tlsext_servername_callback(s, &al, s->initial_ctx->tlsext_servername_arg);
2644
2645 #ifdef TLSEXT_TYPE_opaque_prf_input
2646         if (s->s3->server_opaque_prf_input_len > 0)
2647                 {
2648                 /* This case may indicate that we, as a client, want to insist on using opaque PRF inputs.
2649                  * So first verify that we really have a value from the server too. */
2650
2651                 if (s->s3->server_opaque_prf_input == NULL)
2652                         {
2653                         ret = SSL_TLSEXT_ERR_ALERT_FATAL;
2654                         al = SSL_AD_HANDSHAKE_FAILURE;
2655                         }
2656                 
2657                 /* Anytime the server *has* sent an opaque PRF input, we need to check
2658                  * that we have a client opaque PRF input of the same size. */
2659                 if (s->s3->client_opaque_prf_input == NULL ||
2660                     s->s3->client_opaque_prf_input_len != s->s3->server_opaque_prf_input_len)
2661                         {
2662                         ret = SSL_TLSEXT_ERR_ALERT_FATAL;
2663                         al = SSL_AD_ILLEGAL_PARAMETER;
2664                         }
2665                 }
2666 #endif
2667
2668         /* If we've requested certificate status and we wont get one
2669          * tell the callback
2670          */
2671         if ((s->tlsext_status_type != -1) && !(s->tlsext_status_expected)
2672                         && s->ctx && s->ctx->tlsext_status_cb)
2673                 {
2674                 int r;
2675                 /* Set resp to NULL, resplen to -1 so callback knows
2676                  * there is no response.
2677                  */
2678                 if (s->tlsext_ocsp_resp)
2679                         {
2680                         OPENSSL_free(s->tlsext_ocsp_resp);
2681                         s->tlsext_ocsp_resp = NULL;
2682                         }
2683                 s->tlsext_ocsp_resplen = -1;
2684                 r = s->ctx->tlsext_status_cb(s, s->ctx->tlsext_status_arg);
2685                 if (r == 0)
2686                         {
2687                         al = SSL_AD_BAD_CERTIFICATE_STATUS_RESPONSE;
2688                         ret = SSL_TLSEXT_ERR_ALERT_FATAL;
2689                         }
2690                 if (r < 0)
2691                         {
2692                         al = SSL_AD_INTERNAL_ERROR;
2693                         ret = SSL_TLSEXT_ERR_ALERT_FATAL;
2694                         }
2695                 }
2696
2697         switch (ret)
2698                 {
2699                 case SSL_TLSEXT_ERR_ALERT_FATAL:
2700                         ssl3_send_alert(s,SSL3_AL_FATAL,al); 
2701                         return -1;
2702
2703                 case SSL_TLSEXT_ERR_ALERT_WARNING:
2704                         ssl3_send_alert(s,SSL3_AL_WARNING,al);
2705                         return 1; 
2706                                         
2707                 case SSL_TLSEXT_ERR_NOACK:
2708                         s->servername_done=0;
2709                         default:
2710                 return 1;
2711                 }
2712         }
2713
2714 int ssl_parse_serverhello_tlsext(SSL *s, unsigned char **p, unsigned char *d, int n) 
2715         {
2716         int al = -1;
2717         if (s->version < SSL3_VERSION)
2718                 return 1;
2719         if (ssl_scan_serverhello_tlsext(s, p, d, n, &al) <= 0) 
2720                 {
2721                 ssl3_send_alert(s,SSL3_AL_FATAL,al); 
2722                 return 0;
2723                 }
2724
2725         if (ssl_check_serverhello_tlsext(s) <= 0) 
2726                 {
2727                 SSLerr(SSL_F_SSL_PARSE_SERVERHELLO_TLSEXT,SSL_R_SERVERHELLO_TLSEXT);
2728                 return 0;
2729                 }
2730         return 1;
2731 }
2732
2733 /* Since the server cache lookup is done early on in the processing of the
2734  * ClientHello, and other operations depend on the result, we need to handle
2735  * any TLS session ticket extension at the same time.
2736  *
2737  *   session_id: points at the session ID in the ClientHello. This code will
2738  *       read past the end of this in order to parse out the session ticket
2739  *       extension, if any.
2740  *   len: the length of the session ID.
2741  *   limit: a pointer to the first byte after the ClientHello.
2742  *   ret: (output) on return, if a ticket was decrypted, then this is set to
2743  *       point to the resulting session.
2744  *
2745  * If s->tls_session_secret_cb is set then we are expecting a pre-shared key
2746  * ciphersuite, in which case we have no use for session tickets and one will
2747  * never be decrypted, nor will s->tlsext_ticket_expected be set to 1.
2748  *
2749  * Returns:
2750  *   -1: fatal error, either from parsing or decrypting the ticket.
2751  *    0: no ticket was found (or was ignored, based on settings).
2752  *    1: a zero length extension was found, indicating that the client supports
2753  *       session tickets but doesn't currently have one to offer.
2754  *    2: either s->tls_session_secret_cb was set, or a ticket was offered but
2755  *       couldn't be decrypted because of a non-fatal error.
2756  *    3: a ticket was successfully decrypted and *ret was set.
2757  *
2758  * Side effects:
2759  *   Sets s->tlsext_ticket_expected to 1 if the server will have to issue
2760  *   a new session ticket to the client because the client indicated support
2761  *   (and s->tls_session_secret_cb is NULL) but the client either doesn't have
2762  *   a session ticket or we couldn't use the one it gave us, or if
2763  *   s->ctx->tlsext_ticket_key_cb asked to renew the client's ticket.
2764  *   Otherwise, s->tlsext_ticket_expected is set to 0.
2765  */
2766 int tls1_process_ticket(SSL *s, unsigned char *session_id, int len,
2767                         const unsigned char *limit, SSL_SESSION **ret)
2768         {
2769         /* Point after session ID in client hello */
2770         const unsigned char *p = session_id + len;
2771         unsigned short i;
2772
2773         *ret = NULL;
2774         s->tlsext_ticket_expected = 0;
2775
2776         /* If tickets disabled behave as if no ticket present
2777          * to permit stateful resumption.
2778          */
2779         if (SSL_get_options(s) & SSL_OP_NO_TICKET)
2780                 return 0;
2781         if ((s->version <= SSL3_VERSION) || !limit)
2782                 return 0;
2783         if (p >= limit)
2784                 return -1;
2785         /* Skip past DTLS cookie */
2786         if (s->version == DTLS1_VERSION || s->version == DTLS1_BAD_VER)
2787                 {
2788                 i = *(p++);
2789                 p+= i;
2790                 if (p >= limit)
2791                         return -1;
2792                 }
2793         /* Skip past cipher list */
2794         n2s(p, i);
2795         p+= i;
2796         if (p >= limit)
2797                 return -1;
2798         /* Skip past compression algorithm list */
2799         i = *(p++);
2800         p += i;
2801         if (p > limit)
2802                 return -1;
2803         /* Now at start of extensions */
2804         if ((p + 2) >= limit)
2805                 return 0;
2806         n2s(p, i);
2807         while ((p + 4) <= limit)
2808                 {
2809                 unsigned short type, size;
2810                 n2s(p, type);
2811                 n2s(p, size);
2812                 if (p + size > limit)
2813                         return 0;
2814                 if (type == TLSEXT_TYPE_session_ticket)
2815                         {
2816                         int r;
2817                         if (size == 0)
2818                                 {
2819                                 /* The client will accept a ticket but doesn't
2820                                  * currently have one. */
2821                                 s->tlsext_ticket_expected = 1;
2822                                 return 1;
2823                                 }
2824                         if (s->tls_session_secret_cb)
2825                                 {
2826                                 /* Indicate that the ticket couldn't be
2827                                  * decrypted rather than generating the session
2828                                  * from ticket now, trigger abbreviated
2829                                  * handshake based on external mechanism to
2830                                  * calculate the master secret later. */
2831                                 return 2;
2832                                 }
2833                         r = tls_decrypt_ticket(s, p, size, session_id, len, ret);
2834                         switch (r)
2835                                 {
2836                                 case 2: /* ticket couldn't be decrypted */
2837                                         s->tlsext_ticket_expected = 1;
2838                                         return 2;
2839                                 case 3: /* ticket was decrypted */
2840                                         return r;
2841                                 case 4: /* ticket decrypted but need to renew */
2842                                         s->tlsext_ticket_expected = 1;
2843                                         return 3;
2844                                 default: /* fatal error */
2845                                         return -1;
2846                                 }
2847                         }
2848                 p += size;
2849                 }
2850         return 0;
2851         }
2852
2853 /* tls_decrypt_ticket attempts to decrypt a session ticket.
2854  *
2855  *   etick: points to the body of the session ticket extension.
2856  *   eticklen: the length of the session tickets extenion.
2857  *   sess_id: points at the session ID.
2858  *   sesslen: the length of the session ID.
2859  *   psess: (output) on return, if a ticket was decrypted, then this is set to
2860  *       point to the resulting session.
2861  *
2862  * Returns:
2863  *   -1: fatal error, either from parsing or decrypting the ticket.
2864  *    2: the ticket couldn't be decrypted.
2865  *    3: a ticket was successfully decrypted and *psess was set.
2866  *    4: same as 3, but the ticket needs to be renewed.
2867  */
2868 static int tls_decrypt_ticket(SSL *s, const unsigned char *etick, int eticklen,
2869                                 const unsigned char *sess_id, int sesslen,
2870                                 SSL_SESSION **psess)
2871         {
2872         SSL_SESSION *sess;
2873         unsigned char *sdec;
2874         const unsigned char *p;
2875         int slen, mlen, renew_ticket = 0;
2876         unsigned char tick_hmac[EVP_MAX_MD_SIZE];
2877         HMAC_CTX hctx;
2878         EVP_CIPHER_CTX ctx;
2879         SSL_CTX *tctx = s->initial_ctx;
2880         /* Need at least keyname + iv + some encrypted data */
2881         if (eticklen < 48)
2882                 return 2;
2883         /* Initialize session ticket encryption and HMAC contexts */
2884         HMAC_CTX_init(&hctx);
2885         EVP_CIPHER_CTX_init(&ctx);
2886         if (tctx->tlsext_ticket_key_cb)
2887                 {
2888                 unsigned char *nctick = (unsigned char *)etick;
2889                 int rv = tctx->tlsext_ticket_key_cb(s, nctick, nctick + 16,
2890                                                         &ctx, &hctx, 0);
2891                 if (rv < 0)
2892                         return -1;
2893                 if (rv == 0)
2894                         return 2;
2895                 if (rv == 2)
2896                         renew_ticket = 1;
2897                 }
2898         else
2899                 {
2900                 /* Check key name matches */
2901                 if (memcmp(etick, tctx->tlsext_tick_key_name, 16))
2902                         return 2;
2903                 HMAC_Init_ex(&hctx, tctx->tlsext_tick_hmac_key, 16,
2904                                         tlsext_tick_md(), NULL);
2905                 EVP_DecryptInit_ex(&ctx, EVP_aes_128_cbc(), NULL,
2906                                 tctx->tlsext_tick_aes_key, etick + 16);
2907                 }
2908         /* Attempt to process session ticket, first conduct sanity and
2909          * integrity checks on ticket.
2910          */
2911         mlen = HMAC_size(&hctx);
2912         if (mlen < 0)
2913                 {
2914                 EVP_CIPHER_CTX_cleanup(&ctx);
2915                 return -1;
2916                 }
2917         eticklen -= mlen;
2918         /* Check HMAC of encrypted ticket */
2919         HMAC_Update(&hctx, etick, eticklen);
2920         HMAC_Final(&hctx, tick_hmac, NULL);
2921         HMAC_CTX_cleanup(&hctx);
2922         if (memcmp(tick_hmac, etick + eticklen, mlen))
2923                 return 2;
2924         /* Attempt to decrypt session data */
2925         /* Move p after IV to start of encrypted ticket, update length */
2926         p = etick + 16 + EVP_CIPHER_CTX_iv_length(&ctx);
2927         eticklen -= 16 + EVP_CIPHER_CTX_iv_length(&ctx);
2928         sdec = OPENSSL_malloc(eticklen);
2929         if (!sdec)
2930                 {
2931                 EVP_CIPHER_CTX_cleanup(&ctx);
2932                 return -1;
2933                 }
2934         EVP_DecryptUpdate(&ctx, sdec, &slen, p, eticklen);
2935         if (EVP_DecryptFinal(&ctx, sdec + slen, &mlen) <= 0)
2936                 return 2;
2937         slen += mlen;
2938         EVP_CIPHER_CTX_cleanup(&ctx);
2939         p = sdec;
2940
2941         sess = d2i_SSL_SESSION(NULL, &p, slen);
2942         OPENSSL_free(sdec);
2943         if (sess)
2944                 {
2945                 /* The session ID, if non-empty, is used by some clients to
2946                  * detect that the ticket has been accepted. So we copy it to
2947                  * the session structure. If it is empty set length to zero
2948                  * as required by standard.
2949                  */
2950                 if (sesslen)
2951                         memcpy(sess->session_id, sess_id, sesslen);
2952                 sess->session_id_length = sesslen;
2953                 *psess = sess;
2954                 if (renew_ticket)
2955                         return 4;
2956                 else
2957                         return 3;
2958                 }
2959         ERR_clear_error();
2960         /* For session parse failure, indicate that we need to send a new
2961          * ticket. */
2962         return 2;
2963         }
2964
2965 /* Tables to translate from NIDs to TLS v1.2 ids */
2966
2967 typedef struct 
2968         {
2969         int nid;
2970         int id;
2971         } tls12_lookup;
2972
2973 static tls12_lookup tls12_md[] = {
2974         {NID_md5, TLSEXT_hash_md5},
2975         {NID_sha1, TLSEXT_hash_sha1},
2976         {NID_sha224, TLSEXT_hash_sha224},
2977         {NID_sha256, TLSEXT_hash_sha256},
2978         {NID_sha384, TLSEXT_hash_sha384},
2979         {NID_sha512, TLSEXT_hash_sha512}
2980 };
2981
2982 static tls12_lookup tls12_sig[] = {
2983         {EVP_PKEY_RSA, TLSEXT_signature_rsa},
2984         {EVP_PKEY_DSA, TLSEXT_signature_dsa},
2985         {EVP_PKEY_EC, TLSEXT_signature_ecdsa}
2986 };
2987
2988 static int tls12_find_id(int nid, tls12_lookup *table, size_t tlen)
2989         {
2990         size_t i;
2991         for (i = 0; i < tlen; i++)
2992                 {
2993                 if (table[i].nid == nid)
2994                         return table[i].id;
2995                 }
2996         return -1;
2997         }
2998
2999 static int tls12_find_nid(int id, tls12_lookup *table, size_t tlen)
3000         {
3001         size_t i;
3002         for (i = 0; i < tlen; i++)
3003                 {
3004                 if ((table[i].id) == id)
3005                         return table[i].nid;
3006                 }
3007         return NID_undef;
3008         }
3009
3010 int tls12_get_sigandhash(unsigned char *p, const EVP_PKEY *pk, const EVP_MD *md)
3011         {
3012         int sig_id, md_id;
3013         if (!md)
3014                 return 0;
3015         md_id = tls12_find_id(EVP_MD_type(md), tls12_md,
3016                                 sizeof(tls12_md)/sizeof(tls12_lookup));
3017         if (md_id == -1)
3018                 return 0;
3019         sig_id = tls12_get_sigid(pk);
3020         if (sig_id == -1)
3021                 return 0;
3022         p[0] = (unsigned char)md_id;
3023         p[1] = (unsigned char)sig_id;
3024         return 1;
3025         }
3026
3027 int tls12_get_sigid(const EVP_PKEY *pk)
3028         {
3029         return tls12_find_id(pk->type, tls12_sig,
3030                                 sizeof(tls12_sig)/sizeof(tls12_lookup));
3031         }
3032
3033 const EVP_MD *tls12_get_hash(unsigned char hash_alg)
3034         {
3035         switch(hash_alg)
3036                 {
3037 #ifndef OPENSSL_NO_MD5
3038                 case TLSEXT_hash_md5:
3039 #ifdef OPENSSL_FIPS
3040                 if (FIPS_mode())
3041                         return NULL;
3042 #endif
3043                 return EVP_md5();
3044 #endif
3045 #ifndef OPENSSL_NO_SHA
3046                 case TLSEXT_hash_sha1:
3047                 return EVP_sha1();
3048 #endif
3049 #ifndef OPENSSL_NO_SHA256
3050                 case TLSEXT_hash_sha224:
3051                 return EVP_sha224();
3052
3053                 case TLSEXT_hash_sha256:
3054                 return EVP_sha256();
3055 #endif
3056 #ifndef OPENSSL_NO_SHA512
3057                 case TLSEXT_hash_sha384:
3058                 return EVP_sha384();
3059
3060                 case TLSEXT_hash_sha512:
3061                 return EVP_sha512();
3062 #endif
3063                 default:
3064                 return NULL;
3065
3066                 }
3067         }
3068
3069 static int tls12_get_pkey_idx(unsigned char sig_alg)