ssl/t1_lib.c

   1 /* ssl/t1_lib.c */
   2 /* Copyright (C) 1995-1998 Eric Young (eay@cryptsoft.com)
   3  * All rights reserved.
   4  *
   5  * This package is an SSL implementation written
   6  * by Eric Young (eay@cryptsoft.com).
   7  * The implementation was written so as to conform with Netscapes SSL.
   8  *
   9  * This library is free for commercial and non-commercial use as long as
  10  * the following conditions are aheared to.  The following conditions
  11  * apply to all code found in this distribution, be it the RC4, RSA,
  12  * lhash, DES, etc., code; not just the SSL code.  The SSL documentation
  13  * included with this distribution is covered by the same copyright terms
  14  * except that the holder is Tim Hudson (tjh@cryptsoft.com).
  15  *
  16  * Copyright remains Eric Young's, and as such any Copyright notices in
  17  * the code are not to be removed.
  18  * If this package is used in a product, Eric Young should be given attribution
  19  * as the author of the parts of the library used.
  20  * This can be in the form of a textual message at program startup or
  21  * in documentation (online or textual) provided with the package.
  22  *
  23  * Redistribution and use in source and binary forms, with or without
  24  * modification, are permitted provided that the following conditions
  25  * are met:
  26  * 1. Redistributions of source code must retain the copyright
  27  *    notice, this list of conditions and the following disclaimer.
  28  * 2. Redistributions in binary form must reproduce the above copyright
  29  *    notice, this list of conditions and the following disclaimer in the
  30  *    documentation and/or other materials provided with the distribution.
  31  * 3. All advertising materials mentioning features or use of this software
  32  *    must display the following acknowledgement:
  33  *    "This product includes cryptographic software written by
  34  *     Eric Young (eay@cryptsoft.com)"
  35  *    The word 'cryptographic' can be left out if the rouines from the library
  36  *    being used are not cryptographic related :-).
  37  * 4. If you include any Windows specific code (or a derivative thereof) from
  38  *    the apps directory (application code) you must include an acknowledgement:
  39  *    "This product includes software written by Tim Hudson (tjh@cryptsoft.com)"
  40  *
  41  * THIS SOFTWARE IS PROVIDED BY ERIC YOUNG ``AS IS'' AND
  42  * ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
  43  * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE
  44  * ARE DISCLAIMED.  IN NO EVENT SHALL THE AUTHOR OR CONTRIBUTORS BE LIABLE
  45  * FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL
  46  * DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS
  47  * OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION)
  48  * HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT
  49  * LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY
  50  * OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF
  51  * SUCH DAMAGE.
  52  *
  53  * The licence and distribution terms for any publically available version or
  54  * derivative of this code cannot be changed.  i.e. this code cannot simply be
  55  * copied and put under another distribution licence
  56  * [including the GNU Public Licence.]
  57  */
  58 /* ====================================================================
  59  * Copyright (c) 1998-2007 The OpenSSL Project.  All rights reserved.
  60  *
  61  * Redistribution and use in source and binary forms, with or without
  62  * modification, are permitted provided that the following conditions
  63  * are met:
  64  *
  65  * 1. Redistributions of source code must retain the above copyright
  66  *    notice, this list of conditions and the following disclaimer.
  67  *
  68  * 2. Redistributions in binary form must reproduce the above copyright
  69  *    notice, this list of conditions and the following disclaimer in
  70  *    the documentation and/or other materials provided with the
  71  *    distribution.
  72  *
  73  * 3. All advertising materials mentioning features or use of this
  74  *    software must display the following acknowledgment:
  75  *    "This product includes software developed by the OpenSSL Project
  76  *    for use in the OpenSSL Toolkit. (http://www.openssl.org/)"
  77  *
  78  * 4. The names "OpenSSL Toolkit" and "OpenSSL Project" must not be used to
  79  *    endorse or promote products derived from this software without
  80  *    prior written permission. For written permission, please contact
  81  *    openssl-core@openssl.org.
  82  *
  83  * 5. Products derived from this software may not be called "OpenSSL"
  84  *    nor may "OpenSSL" appear in their names without prior written
  85  *    permission of the OpenSSL Project.
  86  *
  87  * 6. Redistributions of any form whatsoever must retain the following
  88  *    acknowledgment:
  89  *    "This product includes software developed by the OpenSSL Project
  90  *    for use in the OpenSSL Toolkit (http://www.openssl.org/)"
  91  *
  92  * THIS SOFTWARE IS PROVIDED BY THE OpenSSL PROJECT ``AS IS'' AND ANY
  93  * EXPRESSED OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
  94  * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
  95  * PURPOSE ARE DISCLAIMED.  IN NO EVENT SHALL THE OpenSSL PROJECT OR
  96  * ITS CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL,
  97  * SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT
  98  * NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES;
  99  * LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION)
 100  * HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT,
 101  * STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE)
 102  * ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED
 103  * OF THE POSSIBILITY OF SUCH DAMAGE.
 104  * ====================================================================
 105  *
 106  * This product includes cryptographic software written by Eric Young
 107  * (eay@cryptsoft.com).  This product includes software written by Tim
 108  * Hudson (tjh@cryptsoft.com).
 109  *
 110  */
 111
 112 #include <stdio.h>
 113 #include <openssl/objects.h>
 114 #include <openssl/evp.h>
 115 #include <openssl/hmac.h>
 116 #include <openssl/ocsp.h>
 117 #include <openssl/rand.h>
 118 #include "ssl_locl.h"
 119
 120 const char tls1_version_str[]="TLSv1" OPENSSL_VERSION_PTEXT;
 121
 122 #ifndef OPENSSL_NO_TLSEXT
 123 static int tls_decrypt_ticket(SSL *s, const unsigned char *tick, int ticklen,
 124                                 const unsigned char *sess_id, int sesslen,
 125                                 SSL_SESSION **psess);
 126 static int ssl_check_clienthello_tlsext_early(SSL *s);
 127 int ssl_check_serverhello_tlsext(SSL *s);
 128 #endif
 129
 130 SSL3_ENC_METHOD TLSv1_enc_data={
 131         tls1_enc,
 132         tls1_mac,
 133         tls1_setup_key_block,
 134         tls1_generate_master_secret,
 135         tls1_change_cipher_state,
 136         tls1_final_finish_mac,
 137         TLS1_FINISH_MAC_LENGTH,
 138         tls1_cert_verify_mac,
 139         TLS_MD_CLIENT_FINISH_CONST,TLS_MD_CLIENT_FINISH_CONST_SIZE,
 140         TLS_MD_SERVER_FINISH_CONST,TLS_MD_SERVER_FINISH_CONST_SIZE,
 141         tls1_alert_code,
 142         tls1_export_keying_material,
 143         };
 144
 145 long tls1_default_timeout(void)
 146         {
 147         /* 2 hours, the 24 hours mentioned in the TLSv1 spec
 148          * is way too long for http, the cache would over fill */
 149         return(60*60*2);
 150         }
 151
 152 int tls1_new(SSL *s)
 153         {
 154         if (!ssl3_new(s)) return(0);
 155         s->method->ssl_clear(s);
 156         return(1);
 157         }
 158
 159 void tls1_free(SSL *s)
 160         {
 161 #ifndef OPENSSL_NO_TLSEXT
 162         if (s->tlsext_session_ticket)
 163                 {
 164                 OPENSSL_free(s->tlsext_session_ticket);
 165                 }
 166 #endif /* OPENSSL_NO_TLSEXT */
 167         ssl3_free(s);
 168         }
 169
 170 void tls1_clear(SSL *s)
 171         {
 172         ssl3_clear(s);
 173         s->version = s->method->version;
 174         }
 175
 176 #ifndef OPENSSL_NO_EC
 177
 178 static int nid_list[] =
 179         {
 180                 NID_sect163k1, /* sect163k1 (1) */
 181                 NID_sect163r1, /* sect163r1 (2) */
 182                 NID_sect163r2, /* sect163r2 (3) */
 183                 NID_sect193r1, /* sect193r1 (4) */
 184                 NID_sect193r2, /* sect193r2 (5) */
 185                 NID_sect233k1, /* sect233k1 (6) */
 186                 NID_sect233r1, /* sect233r1 (7) */
 187                 NID_sect239k1, /* sect239k1 (8) */
 188                 NID_sect283k1, /* sect283k1 (9) */
 189                 NID_sect283r1, /* sect283r1 (10) */
 190                 NID_sect409k1, /* sect409k1 (11) */
 191                 NID_sect409r1, /* sect409r1 (12) */
 192                 NID_sect571k1, /* sect571k1 (13) */
 193                 NID_sect571r1, /* sect571r1 (14) */
 194                 NID_secp160k1, /* secp160k1 (15) */
 195                 NID_secp160r1, /* secp160r1 (16) */
 196                 NID_secp160r2, /* secp160r2 (17) */
 197                 NID_secp192k1, /* secp192k1 (18) */
 198                 NID_X9_62_prime192v1, /* secp192r1 (19) */
 199                 NID_secp224k1, /* secp224k1 (20) */
 200                 NID_secp224r1, /* secp224r1 (21) */
 201                 NID_secp256k1, /* secp256k1 (22) */
 202                 NID_X9_62_prime256v1, /* secp256r1 (23) */
 203                 NID_secp384r1, /* secp384r1 (24) */
 204                 NID_secp521r1  /* secp521r1 (25) */
 205         };
 206
 207
 208 static const unsigned char ecformats_default[] =
 209         {
 210         TLSEXT_ECPOINTFORMAT_uncompressed,
 211         TLSEXT_ECPOINTFORMAT_ansiX962_compressed_prime,
 212         TLSEXT_ECPOINTFORMAT_ansiX962_compressed_char2
 213         };
 214
 215 static const unsigned char eccurves_default[] =
 216         {
 217                 0,14, /* sect571r1 (14) */
 218                 0,13, /* sect571k1 (13) */
 219                 0,25, /* secp521r1 (25) */
 220                 0,11, /* sect409k1 (11) */
 221                 0,12, /* sect409r1 (12) */
 222                 0,24, /* secp384r1 (24) */
 223                 0,9,  /* sect283k1 (9) */
 224                 0,10, /* sect283r1 (10) */
 225                 0,22, /* secp256k1 (22) */
 226                 0,23, /* secp256r1 (23) */
 227                 0,8,  /* sect239k1 (8) */
 228                 0,6,  /* sect233k1 (6) */
 229                 0,7,  /* sect233r1 (7) */
 230                 0,20, /* secp224k1 (20) */
 231                 0,21, /* secp224r1 (21) */
 232                 0,4,  /* sect193r1 (4) */
 233                 0,5,  /* sect193r2 (5) */
 234                 0,18, /* secp192k1 (18) */
 235                 0,19, /* secp192r1 (19) */
 236                 0,1,  /* sect163k1 (1) */
 237                 0,2,  /* sect163r1 (2) */
 238                 0,3,  /* sect163r2 (3) */
 239                 0,15, /* secp160k1 (15) */
 240                 0,16, /* secp160r1 (16) */
 241                 0,17, /* secp160r2 (17) */
 242         };
 243
 244 static const unsigned char suiteb_curves[] =
 245         {
 246                 0, TLSEXT_curve_P_256,
 247                 0, TLSEXT_curve_P_384
 248         };
 249
 250 int tls1_ec_curve_id2nid(int curve_id)
 251         {
 252         /* ECC curves from draft-ietf-tls-ecc-12.txt (Oct. 17, 2005) */
 253         if ((curve_id < 1) || ((unsigned int)curve_id >
 254                                 sizeof(nid_list)/sizeof(nid_list[0])))
 255                 return 0;
 256         return nid_list[curve_id-1];
 257         }
 258
 259 int tls1_ec_nid2curve_id(int nid)
 260         {
 261         /* ECC curves from draft-ietf-tls-ecc-12.txt (Oct. 17, 2005) */
 262         switch (nid)
 263                 {
 264         case NID_sect163k1: /* sect163k1 (1) */
 265                 return 1;
 266         case NID_sect163r1: /* sect163r1 (2) */
 267                 return 2;
 268         case NID_sect163r2: /* sect163r2 (3) */
 269                 return 3;
 270         case NID_sect193r1: /* sect193r1 (4) */
 271                 return 4;
 272         case NID_sect193r2: /* sect193r2 (5) */
 273                 return 5;
 274         case NID_sect233k1: /* sect233k1 (6) */
 275                 return 6;
 276         case NID_sect233r1: /* sect233r1 (7) */
 277                 return 7;
 278         case NID_sect239k1: /* sect239k1 (8) */
 279                 return 8;
 280         case NID_sect283k1: /* sect283k1 (9) */
 281                 return 9;
 282         case NID_sect283r1: /* sect283r1 (10) */
 283                 return 10;
 284         case NID_sect409k1: /* sect409k1 (11) */
 285                 return 11;
 286         case NID_sect409r1: /* sect409r1 (12) */
 287                 return 12;
 288         case NID_sect571k1: /* sect571k1 (13) */
 289                 return 13;
 290         case NID_sect571r1: /* sect571r1 (14) */
 291                 return 14;
 292         case NID_secp160k1: /* secp160k1 (15) */
 293                 return 15;
 294         case NID_secp160r1: /* secp160r1 (16) */
 295                 return 16;
 296         case NID_secp160r2: /* secp160r2 (17) */
 297                 return 17;
 298         case NID_secp192k1: /* secp192k1 (18) */
 299                 return 18;
 300         case NID_X9_62_prime192v1: /* secp192r1 (19) */
 301                 return 19;
 302         case NID_secp224k1: /* secp224k1 (20) */
 303                 return 20;
 304         case NID_secp224r1: /* secp224r1 (21) */
 305                 return 21;
 306         case NID_secp256k1: /* secp256k1 (22) */
 307                 return 22;
 308         case NID_X9_62_prime256v1: /* secp256r1 (23) */
 309                 return 23;
 310         case NID_secp384r1: /* secp384r1 (24) */
 311                 return 24;
 312         case NID_secp521r1:  /* secp521r1 (25) */
 313                 return 25;
 314         default:
 315                 return 0;
 316                 }
 317         }
 318 /* Get curves list, if "sess" is set return client curves otherwise
 319  * preferred list
 320  */
 321 static void tls1_get_curvelist(SSL *s, int sess,
 322                                         const unsigned char **pcurves,
 323                                         size_t *pcurveslen)
 324         {
 325         if (sess)
 326                 {
 327                 *pcurves = s->session->tlsext_ellipticcurvelist;
 328                 *pcurveslen = s->session->tlsext_ellipticcurvelist_length;
 329                 return;
 330                 }
 331         /* For Suite B mode only include P-256, P-384 */
 332         switch (tls1_suiteb(s))
 333                 {
 334         case SSL_CERT_FLAG_SUITEB_128_LOS:
 335                 *pcurves = suiteb_curves;
 336                 *pcurveslen = sizeof(suiteb_curves);
 337                 break;
 338
 339         case SSL_CERT_FLAG_SUITEB_128_LOS_ONLY:
 340                 *pcurves = suiteb_curves;
 341                 *pcurveslen = 2;
 342                 break;
 343
 344         case SSL_CERT_FLAG_SUITEB_192_LOS:
 345                 *pcurves = suiteb_curves + 2;
 346                 *pcurveslen = 2;
 347                 break;
 348         default:
 349                 *pcurves = s->tlsext_ellipticcurvelist;
 350                 *pcurveslen = s->tlsext_ellipticcurvelist_length;
 351                 }
 352         if (!*pcurves)
 353                 {
 354                 *pcurves = eccurves_default;
 355                 *pcurveslen = sizeof(eccurves_default);
 356                 }
 357         }
 358 /* Check a curve is one of our preferences */
 359 int tls1_check_curve(SSL *s, const unsigned char *p, size_t len)
 360         {
 361         const unsigned char *curves;
 362         size_t curveslen, i;
 363         unsigned int suiteb_flags = tls1_suiteb(s);
 364         if (len != 3 || p[0] != NAMED_CURVE_TYPE)
 365                 return 0;
 366         /* Check curve matches Suite B preferences */
 367         if (suiteb_flags)
 368                 {
 369                 unsigned long cid = s->s3->tmp.new_cipher->id;
 370                 if (p[1])
 371                         return 0;
 372                 if (cid == TLS1_CK_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256)
 373                         {
 374                         if (p[2] != TLSEXT_curve_P_256)
 375                                 return 0;
 376                         }
 377                 else if (cid == TLS1_CK_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384)
 378                         {
 379                         if (p[2] != TLSEXT_curve_P_384)
 380                                 return 0;
 381                         }
 382                 else    /* Should never happen */
 383                         return 0;
 384                 }
 385         tls1_get_curvelist(s, 0, &curves, &curveslen);
 386         for (i = 0; i < curveslen; i += 2, curves += 2)
 387                 {
 388                 if (p[1] == curves[0] && p[2] == curves[1])
 389                         return 1;
 390                 }
 391         return 0;
 392         }
 393
 394 /* Return nth shared curve. If nmatch == -1 return number of
 395  * matches. For nmatch == -2 return the NID of the curve to use for
 396  * an EC tmp key.
 397  */
 398
 399 int tls1_shared_curve(SSL *s, int nmatch)
 400         {
 401         const unsigned char *pref, *supp;
 402         size_t preflen, supplen, i, j;
 403         int k;
 404         /* Can't do anything on client side */
 405         if (s->server == 0)
 406                 return -1;
 407         if (nmatch == -2)
 408                 {
 409                 if (tls1_suiteb(s))
 410                         {
 411                         /* For Suite B ciphersuite determines curve: we
 412                          * already know these are acceptable due to previous
 413                          * checks.
 414                          */
 415                         unsigned long cid = s->s3->tmp.new_cipher->id;
 416                         if (cid == TLS1_CK_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256)
 417                                 return NID_X9_62_prime256v1; /* P-256 */
 418                         if (cid == TLS1_CK_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384)
 419                                 return NID_secp384r1; /* P-384 */
 420                         /* Should never happen */
 421                         return NID_undef;
 422                         }
 423                 /* If not Suite B just return first preference shared curve */
 424                 nmatch = 0;
 425                 }
 426         tls1_get_curvelist(s, !!(s->options & SSL_OP_CIPHER_SERVER_PREFERENCE),
 427                                 &supp, &supplen);
 428         tls1_get_curvelist(s, !(s->options & SSL_OP_CIPHER_SERVER_PREFERENCE),
 429                                 &pref, &preflen);
 430         preflen /= 2;
 431         supplen /= 2;
 432         k = 0;
 433         for (i = 0; i < preflen; i++, pref+=2)
 434                 {
 435                 const unsigned char *tsupp = supp;
 436                 for (j = 0; j < supplen; j++, tsupp+=2)
 437                         {
 438                         if (pref[0] == tsupp[0] && pref[1] == tsupp[1])
 439                                 {
 440                                 if (nmatch == k)
 441                                         {
 442                                         int id = (pref[0] << 8) | pref[1];
 443                                         return tls1_ec_curve_id2nid(id);
 444                                         }
 445                                 k++;
 446                                 }
 447                         }
 448                 }
 449         if (nmatch == -1)
 450                 return k;
 451         return 0;
 452         }
 453
 454 int tls1_set_curves(unsigned char **pext, size_t *pextlen,
 455                         int *curves, size_t ncurves)
 456         {
 457         unsigned char *clist, *p;
 458         size_t i;
 459         /* Bitmap of curves included to detect duplicates: only works
 460          * while curve ids < 32
 461          */
 462         unsigned long dup_list = 0;
 463         clist = OPENSSL_malloc(ncurves * 2);
 464         if (!clist)
 465                 return 0;
 466         for (i = 0, p = clist; i < ncurves; i++)
 467                 {
 468                 unsigned long idmask;
 469                 int id;
 470                 id = tls1_ec_nid2curve_id(curves[i]);
 471                 idmask = 1L << id;
 472                 if (!id || (dup_list & idmask))
 473                         {
 474                         OPENSSL_free(clist);
 475                         return 0;
 476                         }
 477                 dup_list |= idmask;
 478                 s2n(id, p);
 479                 }
 480         if (*pext)
 481                 OPENSSL_free(*pext);
 482         *pext = clist;
 483         *pextlen = ncurves * 2;
 484         return 1;
 485         }
 486
 487 #define MAX_CURVELIST   25
 488
 489 typedef struct
 490         {
 491         size_t nidcnt;
 492         int nid_arr[MAX_CURVELIST];
 493         } nid_cb_st;
 494
 495 static int nid_cb(const char *elem, int len, void *arg)
 496         {
 497         nid_cb_st *narg = arg;
 498         size_t i;
 499         int nid;
 500         char etmp[20];
 501         if (narg->nidcnt == MAX_CURVELIST)
 502                 return 0;
 503         if (len > (int)(sizeof(etmp) - 1))
 504                 return 0;
 505         memcpy(etmp, elem, len);
 506         etmp[len] = 0;
 507         nid = EC_curve_nist2nid(etmp);
 508         if (nid == NID_undef)
 509                 nid = OBJ_sn2nid(etmp);
 510         if (nid == NID_undef)
 511                 nid = OBJ_ln2nid(etmp);
 512         if (nid == NID_undef)
 513                 return 0;
 514         for (i = 0; i < narg->nidcnt; i++)
 515                 if (narg->nid_arr[i] == nid)
 516                         return 0;
 517         narg->nid_arr[narg->nidcnt++] = nid;
 518         return 1;
 519         }
 520 /* Set curves based on a colon separate list */
 521 int tls1_set_curves_list(unsigned char **pext, size_t *pextlen,
 522                                 const char *str)
 523         {
 524         nid_cb_st ncb;
 525         ncb.nidcnt = 0;
 526         if (!CONF_parse_list(str, ':', 1, nid_cb, &ncb))
 527                 return 0;
 528         return tls1_set_curves(pext, pextlen, ncb.nid_arr, ncb.nidcnt);
 529         }
 530 /* For an EC key set TLS id and required compression based on parameters */
 531 static int tls1_set_ec_id(unsigned char *curve_id, unsigned char *comp_id,
 532                                 EC_KEY *ec)
 533         {
 534         int is_prime, id;
 535         const EC_GROUP *grp;
 536         const EC_POINT *pt;
 537         const EC_METHOD *meth;
 538         if (!ec)
 539                 return 0;
 540         /* Determine if it is a prime field */
 541         grp = EC_KEY_get0_group(ec);
 542         pt = EC_KEY_get0_public_key(ec);
 543         if (!grp || !pt)
 544                 return 0;
 545         meth = EC_GROUP_method_of(grp);
 546         if (!meth)
 547                 return 0;
 548         if (EC_METHOD_get_field_type(meth) == NID_X9_62_prime_field)
 549                 is_prime = 1;
 550         else
 551                 is_prime = 0;
 552         /* Determine curve ID */
 553         id = EC_GROUP_get_curve_name(grp);
 554         id = tls1_ec_nid2curve_id(id);
 555         /* If we have an ID set it, otherwise set arbitrary explicit curve */
 556         if (id)
 557                 {
 558                 curve_id[0] = 0;
 559                 curve_id[1] = (unsigned char)id;
 560                 }
 561         else
 562                 {
 563                 curve_id[0] = 0xff;
 564                 if (is_prime)
 565                         curve_id[1] = 0x01;
 566                 else
 567                         curve_id[1] = 0x02;
 568                 }
 569         if (comp_id)
 570                 {
 571                 if (EC_KEY_get_conv_form(ec) == POINT_CONVERSION_COMPRESSED)
 572                         {
 573                         if (is_prime)
 574                                 *comp_id = TLSEXT_ECPOINTFORMAT_ansiX962_compressed_prime;
 575                         else
 576                                 *comp_id = TLSEXT_ECPOINTFORMAT_ansiX962_compressed_char2;
 577                         }
 578                 else
 579                         *comp_id = TLSEXT_ECPOINTFORMAT_uncompressed;
 580                 }
 581         return 1;
 582         }
 583 /* Check an EC key is compatible with extensions */
 584 static int tls1_check_ec_key(SSL *s,
 585                         unsigned char *curve_id, unsigned char *comp_id)
 586         {
 587         const unsigned char *p;
 588         size_t plen, i;
 589         int j;
 590         /* If point formats extension present check it, otherwise everything
 591          * is supported (see RFC4492).
 592          */
 593         if (comp_id && s->session->tlsext_ecpointformatlist)
 594                 {
 595                 p = s->session->tlsext_ecpointformatlist;
 596                 plen = s->session->tlsext_ecpointformatlist_length;
 597                 for (i = 0; i < plen; i++, p++)
 598                         {
 599                         if (*comp_id == *p)
 600                                 break;
 601                         }
 602                 if (i == plen)
 603                         return 0;
 604                 }
 605         if (!curve_id)
 606                 return 1;
 607         /* Check curve is consistent with client and server preferences */
 608         for (j = 0; j <= 1; j++)
 609                 {
 610                 tls1_get_curvelist(s, j, &p, &plen);
 611                 for (i = 0; i < plen; i+=2, p+=2)
 612                         {
 613                         if (p[0] == curve_id[0] && p[1] == curve_id[1])
 614                                 break;
 615                         }
 616                 if (i == plen)
 617                         return 0;
 618                 /* For clients can only check sent curve list */
 619                 if (!s->server)
 620                         return 1;
 621                 }
 622         return 1;
 623         }
 624
 625 static void tls1_get_formatlist(SSL *s, const unsigned char **pformats,
 626                                         size_t *pformatslen)
 627         {
 628         /* If we have a custom point format list use it otherwise
 629          * use default */
 630         if (s->tlsext_ecpointformatlist)
 631                 {
 632                 *pformats = s->tlsext_ecpointformatlist;
 633                 *pformatslen = s->tlsext_ecpointformatlist_length;
 634                 }
 635         else
 636                 {
 637                 *pformats = ecformats_default;
 638                 /* For Suite B we don't support char2 fields */
 639                 if (tls1_suiteb(s))
 640                         *pformatslen = sizeof(ecformats_default) - 1;
 641                 else
 642                         *pformatslen = sizeof(ecformats_default);
 643                 }
 644         }
 645
 646 /* Check cert parameters compatible with extensions: currently just checks
 647  * EC certificates have compatible curves and compression.
 648  */
 649 static int tls1_check_cert_param(SSL *s, X509 *x, int set_ee_md)
 650         {
 651         unsigned char comp_id, curve_id[2];
 652         EVP_PKEY *pkey;
 653         int rv;
 654         pkey = X509_get_pubkey(x);
 655         if (!pkey)
 656                 return 0;
 657         /* If not EC nothing to do */
 658         if (pkey->type != EVP_PKEY_EC)
 659                 {
 660                 EVP_PKEY_free(pkey);
 661                 return 1;
 662                 }
 663         rv = tls1_set_ec_id(curve_id, &comp_id, pkey->pkey.ec);
 664         EVP_PKEY_free(pkey);
 665         if (!rv)
 666                 return 0;
 667         /* Can't check curve_id for client certs as we don't have a
 668          * supported curves extension.
 669          */
 670         rv = tls1_check_ec_key(s, s->server ? curve_id : NULL, &comp_id);
 671         if (!rv)
 672                 return 0;
 673         /* Special case for suite B. We *MUST* sign using SHA256+P-256 or
 674          * SHA384+P-384, adjust digest if necessary.
 675          */
 676         if (set_ee_md && tls1_suiteb(s))
 677                 {
 678                 int check_md;
 679                 size_t i;
 680                 CERT *c = s->cert;
 681                 if (curve_id[0])
 682                         return 0;
 683                 /* Check to see we have necessary signing algorithm */
 684                 if (curve_id[1] == TLSEXT_curve_P_256)
 685                         check_md = NID_ecdsa_with_SHA256;
 686                 else if (curve_id[1] == TLSEXT_curve_P_384)
 687                         check_md = NID_ecdsa_with_SHA384;
 688                 else
 689                         return 0; /* Should never happen */
 690                 for (i = 0; i < c->shared_sigalgslen; i++)
 691                         if (check_md == c->shared_sigalgs[i].signandhash_nid)
 692                                 break;
 693                 if (i == c->shared_sigalgslen)
 694                         return 0;
 695                 if (set_ee_md == 2)
 696                         {
 697                         if (check_md == NID_ecdsa_with_SHA256)
 698                                 c->pkeys[SSL_PKEY_ECC].digest = EVP_sha256();
 699                         else
 700                                 c->pkeys[SSL_PKEY_ECC].digest = EVP_sha384();
 701                         }
 702                 }
 703         return rv;
 704         }
 705 /* Check EC temporary key is compatible with client extensions */
 706 int tls1_check_ec_tmp_key(SSL *s, unsigned long cid)
 707         {
 708         unsigned char curve_id[2];
 709         EC_KEY *ec = s->cert->ecdh_tmp;
 710         /* If Suite B, AES128 MUST use P-256 and AES256 MUST use P-384,
 711          * no other curves permitted.
 712          */
 713         if (tls1_suiteb(s))
 714                 {
 715                 /* Curve to check determined by ciphersuite */
 716                 if (cid == TLS1_CK_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256)
 717                         curve_id[1] = TLSEXT_curve_P_256;
 718                 else if (cid == TLS1_CK_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384)
 719                         curve_id[1] = TLSEXT_curve_P_384;
 720                 else
 721                         return 0;
 722                 curve_id[0] = 0;
 723                 /* Check this curve is acceptable */
 724                 if (!tls1_check_ec_key(s, curve_id, NULL))
 725                         return 0;
 726                 /* If auto or setting curve from callback assume OK */
 727                 if (s->cert->ecdh_tmp_auto || s->cert->ecdh_tmp_cb)
 728                         return 1;
 729                 /* Otherwise check curve is acceptable */
 730                 else
 731                         {
 732                         unsigned char curve_tmp[2];
 733                         if (!ec)
 734                                 return 0;
 735                         if (!tls1_set_ec_id(curve_tmp, NULL, ec))
 736                                 return 0;
 737                         if (!curve_tmp[0] || curve_tmp[1] == curve_id[1])
 738                                 return 1;
 739                         return 0;
 740                         }
 741
 742                 }
 743         if (s->cert->ecdh_tmp_auto)
 744                 {
 745                 /* Need a shared curve */
 746                 if (tls1_shared_curve(s, 0))
 747                         return 1;
 748                 else return 0;
 749                 }
 750         if (!ec)
 751                 {
 752                 if (s->cert->ecdh_tmp_cb)
 753                         return 1;
 754                 else
 755                         return 0;
 756                 }
 757         if (!tls1_set_ec_id(curve_id, NULL, ec))
 758                 return 0;
 759 /* Set this to allow use of invalid curves for testing */
 760 #if 0
 761         return 1;
 762 #else
 763         return tls1_check_ec_key(s, curve_id, NULL);
 764 #endif
 765         }
 766
 767 #endif /* OPENSSL_NO_EC */
 768
 769 #ifndef OPENSSL_NO_TLSEXT
 770
 771 /* List of supported signature algorithms and hashes. Should make this
 772  * customisable at some point, for now include everything we support.
 773  */
 774
 775 #ifdef OPENSSL_NO_RSA
 776 #define tlsext_sigalg_rsa(md) /* */
 777 #else
 778 #define tlsext_sigalg_rsa(md) md, TLSEXT_signature_rsa,
 779 #endif
 780
 781 #ifdef OPENSSL_NO_DSA
 782 #define tlsext_sigalg_dsa(md) /* */
 783 #else
 784 #define tlsext_sigalg_dsa(md) md, TLSEXT_signature_dsa,
 785 #endif
 786
 787 #ifdef OPENSSL_NO_ECDSA
 788 #define tlsext_sigalg_ecdsa(md) /* */
 789 #else
 790 #define tlsext_sigalg_ecdsa(md) md, TLSEXT_signature_ecdsa,
 791 #endif
 792
 793 #define tlsext_sigalg(md) \
 794                 tlsext_sigalg_rsa(md) \
 795                 tlsext_sigalg_dsa(md) \
 796                 tlsext_sigalg_ecdsa(md)
 797
 798 static unsigned char tls12_sigalgs[] = {
 799 #ifndef OPENSSL_NO_SHA512
 800         tlsext_sigalg(TLSEXT_hash_sha512)
 801         tlsext_sigalg(TLSEXT_hash_sha384)
 802 #endif
 803 #ifndef OPENSSL_NO_SHA256
 804         tlsext_sigalg(TLSEXT_hash_sha256)
 805         tlsext_sigalg(TLSEXT_hash_sha224)
 806 #endif
 807 #ifndef OPENSSL_NO_SHA
 808         tlsext_sigalg(TLSEXT_hash_sha1)
 809 #endif
 810 #ifndef OPENSSL_NO_MD5
 811         tlsext_sigalg_rsa(TLSEXT_hash_md5)
 812 #endif
 813 };
 814
 815 static unsigned char suiteb_sigalgs[] = {
 816         tlsext_sigalg_ecdsa(TLSEXT_hash_sha256)
 817         tlsext_sigalg_ecdsa(TLSEXT_hash_sha384)
 818 };
 819
 820 size_t tls12_get_psigalgs(SSL *s, const unsigned char **psigs)
 821         {
 822         /* If Suite B mode use Suite B sigalgs only, ignore any other
 823          * preferences.
 824          */
 825         switch (tls1_suiteb(s))
 826                 {
 827         case SSL_CERT_FLAG_SUITEB_128_LOS:
 828                 *psigs = suiteb_sigalgs;
 829                 return sizeof(suiteb_sigalgs);
 830
 831         case SSL_CERT_FLAG_SUITEB_128_LOS_ONLY:
 832                 *psigs = suiteb_sigalgs;
 833                 return 2;
 834
 835         case SSL_CERT_FLAG_SUITEB_192_LOS:
 836                 *psigs = suiteb_sigalgs + 2;
 837                 return 2;
 838                 }
 839
 840         /* If server use client authentication sigalgs if not NULL */
 841         if (s->server && s->cert->client_sigalgs)
 842                 {
 843                 *psigs = s->cert->client_sigalgs;
 844                 return s->cert->client_sigalgslen;
 845                 }
 846         else if (s->cert->conf_sigalgs)
 847                 {
 848                 *psigs = s->cert->conf_sigalgs;
 849                 return s->cert->conf_sigalgslen;
 850                 }
 851         else
 852                 {
 853                 *psigs = tls12_sigalgs;
 854 #ifdef OPENSSL_FIPS
 855                 /* If FIPS mode don't include MD5 which is last */
 856                 if (FIPS_mode())
 857                         return sizeof(tls12_sigalgs) - 2;
 858                 else
 859 #endif
 860                         return sizeof(tls12_sigalgs);
 861                 }
 862         }
 863 /* Check signature algorithm is consistent with sent supported signature
 864  * algorithms and if so return relevant digest.
 865  */
 866 int tls12_check_peer_sigalg(const EVP_MD **pmd, SSL *s,
 867                                 const unsigned char *sig, EVP_PKEY *pkey)
 868         {
 869         const unsigned char *sent_sigs;
 870         size_t sent_sigslen, i;
 871         int sigalg = tls12_get_sigid(pkey);
 872         /* Should never happen */
 873         if (sigalg == -1)
 874                 return -1;
 875         /* Check key type is consistent with signature */
 876         if (sigalg != (int)sig[1])
 877                 {
 878                 SSLerr(SSL_F_TLS12_CHECK_PEER_SIGALG,SSL_R_WRONG_SIGNATURE_TYPE);
 879                 return 0;
 880                 }
 881         if (pkey->type == EVP_PKEY_EC)
 882                 {
 883                 unsigned char curve_id[2], comp_id;
 884                 /* Check compression and curve matches extensions */
 885                 if (!tls1_set_ec_id(curve_id, &comp_id, pkey->pkey.ec))
 886                         return 0;
 887                 if (!s->server && !tls1_check_ec_key(s, curve_id, &comp_id))
 888                         return 0;
 889                 /* If Suite B only P-384+SHA384 or P-256+SHA-256 allowed */
 890                 if (tls1_suiteb(s))
 891                         {
 892                         if (curve_id[0])
 893                                 return 0;
 894                         if (curve_id[1] == TLSEXT_curve_P_256)
 895                                 {
 896                                 if (sig[0] != TLSEXT_hash_sha256)
 897                                         {
 898                                         SSLerr(SSL_F_TLS12_CHECK_PEER_SIGALG,
 899                                                 SSL_R_ILLEGAL_SUITEB_DIGEST);
 900                                         return 0;
 901                                         }
 902                                 }
 903                         else if (curve_id[1] == TLSEXT_curve_P_384)
 904                                 {
 905                                 if (sig[0] != TLSEXT_hash_sha384)
 906                                         {
 907                                         SSLerr(SSL_F_TLS12_CHECK_PEER_SIGALG,
 908                                                 SSL_R_ILLEGAL_SUITEB_DIGEST);
 909                                         return 0;
 910                                         }
 911                                 }
 912                         else
 913                                 return 0;
 914                         }
 915                 }
 916         else if (tls1_suiteb(s))
 917                 return 0;
 918
 919         /* Check signature matches a type we sent */
 920         sent_sigslen = tls12_get_psigalgs(s, &sent_sigs);
 921         for (i = 0; i < sent_sigslen; i+=2, sent_sigs+=2)
 922                 {
 923                 if (sig[0] == sent_sigs[0] && sig[1] == sent_sigs[1])
 924                         break;
 925                 }
 926         /* Allow fallback to SHA1 if not strict mode */
 927         if (i == sent_sigslen && (sig[0] != TLSEXT_hash_sha1 || s->cert->cert_flags & SSL_CERT_FLAGS_CHECK_TLS_STRICT))
 928                 {
 929                 SSLerr(SSL_F_TLS12_CHECK_PEER_SIGALG,SSL_R_WRONG_SIGNATURE_TYPE);
 930                 return 0;
 931                 }
 932         *pmd = tls12_get_hash(sig[0]);
 933         if (*pmd == NULL)
 934                 {
 935                 SSLerr(SSL_F_TLS12_CHECK_PEER_SIGALG,SSL_R_UNKNOWN_DIGEST);
 936                 return 0;
 937                 }
 938         /* Store the digest used so applications can retrieve it if they
 939          * wish.
 940          */
 941         if (s->session && s->session->sess_cert)
 942                 s->session->sess_cert->peer_key->digest = *pmd;
 943         return 1;
 944         }
 945 /* Get a mask of disabled algorithms: an algorithm is disabled
 946  * if it isn't supported or doesn't appear in supported signature
 947  * algorithms. Unlike ssl_cipher_get_disabled this applies to a specific
 948  * session and not global settings.
 949  *
 950  */
 951 void ssl_set_client_disabled(SSL *s)
 952         {
 953         CERT *c = s->cert;
 954         const unsigned char *sigalgs;
 955         size_t i, sigalgslen;
 956         int have_rsa = 0, have_dsa = 0, have_ecdsa = 0;
 957         c->mask_a = 0;
 958         c->mask_k = 0;
 959         /* If less than TLS 1.2 don't allow TLS 1.2 only ciphers */
 960         if (TLS1_get_client_version(s) < TLS1_2_VERSION)
 961                 c->mask_ssl = SSL_TLSV1_2;
 962         else
 963                 c->mask_ssl = 0;
 964         /* Now go through all signature algorithms seeing if we support
 965          * any for RSA, DSA, ECDSA. Do this for all versions not just
 966          * TLS 1.2.
 967          */
 968         sigalgslen = tls12_get_psigalgs(s, &sigalgs);
 969         for (i = 0; i < sigalgslen; i += 2, sigalgs += 2)
 970                 {
 971                 switch(sigalgs[1])
 972                         {
 973 #ifndef OPENSSL_NO_RSA
 974                 case TLSEXT_signature_rsa:
 975                         have_rsa = 1;
 976                         break;
 977 #endif
 978 #ifndef OPENSSL_NO_DSA
 979                 case TLSEXT_signature_dsa:
 980                         have_dsa = 1;
 981                         break;
 982 #endif
 983 #ifndef OPENSSL_NO_ECDSA
 984                 case TLSEXT_signature_ecdsa:
 985                         have_ecdsa = 1;
 986                         break;
 987 #endif
 988                         }
 989                 }
 990         /* Disable auth and static DH if we don't include any appropriate
 991          * signature algorithms.
 992          */
 993         if (!have_rsa)
 994                 {
 995                 c->mask_a |= SSL_aRSA;
 996                 c->mask_k |= SSL_kDHr|SSL_kECDHr;
 997                 }
 998         if (!have_dsa)
 999                 {
1000                 c->mask_a |= SSL_aDSS;
1001                 c->mask_k |= SSL_kDHd;
1002                 }
1003         if (!have_ecdsa)
1004                 {
1005                 c->mask_a |= SSL_aECDSA;
1006                 c->mask_k |= SSL_kECDHe;
1007                 }
1008 #ifndef OPENSSL_NO_KRB5
1009         if (!kssl_tgt_is_available(s->kssl_ctx))
1010                 {
1011                 c->mask_a |= SSL_aKRB5;
1012                 c->mask_k |= SSL_kKRB5;
1013                 }
1014 #endif
1015 #ifndef OPENSSL_NO_PSK
1016         /* with PSK there must be client callback set */
1017         if (!s->psk_client_callback)
1018                 {
1019                 c->mask_a |= SSL_aPSK;
1020                 c->mask_k |= SSL_kPSK;
1021                 }
1022 #endif /* OPENSSL_NO_PSK */
1023         c->valid = 1;
1024         }
1025
1026 /* byte_compare is a compare function for qsort(3) that compares bytes. */
1027 static int byte_compare(const void *in_a, const void *in_b)
1028         {
1029         unsigned char a = *((const unsigned char*) in_a);
1030         unsigned char b = *((const unsigned char*) in_b);
1031
1032         if (a > b)
1033                 return 1;
1034         else if (a < b)
1035                 return -1;
1036         return 0;
1037 }
1038
1039 unsigned char *ssl_add_clienthello_tlsext(SSL *s, unsigned char *p, unsigned char *limit)
1040         {
1041         int extdatalen=0;
1042         unsigned char *ret = p;
1043 #ifndef OPENSSL_NO_EC
1044         /* See if we support any ECC ciphersuites */
1045         int using_ecc = 0;
1046         if (s->version != DTLS1_VERSION && s->version >= TLS1_VERSION)
1047                 {
1048                 int i;
1049                 unsigned long alg_k, alg_a;
1050                 STACK_OF(SSL_CIPHER) *cipher_stack = SSL_get_ciphers(s);
1051
1052                 for (i = 0; i < sk_SSL_CIPHER_num(cipher_stack); i++)
1053                         {
1054                         SSL_CIPHER *c = sk_SSL_CIPHER_value(cipher_stack, i);
1055
1056                         alg_k = c->algorithm_mkey;
1057                         alg_a = c->algorithm_auth;
1058                         if ((alg_k & (SSL_kEECDH|SSL_kECDHr|SSL_kECDHe)
1059                                 || (alg_a & SSL_aECDSA)))
1060                                 {
1061                                 using_ecc = 1;
1062                                 break;
1063                                 }
1064                         }
1065                 }
1066 #endif
1067
1068         /* don't add extensions for SSLv3 unless doing secure renegotiation */
1069         if (s->client_version == SSL3_VERSION
1070                                         && !s->s3->send_connection_binding)
1071                 return p;
1072
1073         ret+=2;
1074
1075         if (ret>=limit) return NULL; /* this really never occurs, but ... */
1076
1077         if (s->tlsext_hostname != NULL)
1078                 {
1079                 /* Add TLS extension servername to the Client Hello message */
1080                 unsigned long size_str;
1081                 long lenmax;
1082
1083                 /* check for enough space.
1084                    4 for the servername type and entension length
1085                    2 for servernamelist length
1086                    1 for the hostname type
1087                    2 for hostname length
1088                    + hostname length
1089                 */
1090
1091                 if ((lenmax = limit - ret - 9) < 0
1092                     || (size_str = strlen(s->tlsext_hostname)) > (unsigned long)lenmax)
1093                         return NULL;
1094
1095                 /* extension type and length */
1096                 s2n(TLSEXT_TYPE_server_name,ret);
1097                 s2n(size_str+5,ret);
1098
1099                 /* length of servername list */
1100                 s2n(size_str+3,ret);
1101
1102                 /* hostname type, length and hostname */
1103                 *(ret++) = (unsigned char) TLSEXT_NAMETYPE_host_name;
1104                 s2n(size_str,ret);
1105                 memcpy(ret, s->tlsext_hostname, size_str);
1106                 ret+=size_str;
1107                 }
1108
1109         /* Add RI if renegotiating */
1110         if (s->renegotiate)
1111           {
1112           int el;
1113
1114           if(!ssl_add_clienthello_renegotiate_ext(s, 0, &el, 0))
1115               {
1116               SSLerr(SSL_F_SSL_ADD_CLIENTHELLO_TLSEXT, ERR_R_INTERNAL_ERROR);
1117               return NULL;
1118               }
1119
1120           if((limit - p - 4 - el) < 0) return NULL;
1121
1122           s2n(TLSEXT_TYPE_renegotiate,ret);
1123           s2n(el,ret);
1124
1125           if(!ssl_add_clienthello_renegotiate_ext(s, ret, &el, el))
1126               {
1127               SSLerr(SSL_F_SSL_ADD_CLIENTHELLO_TLSEXT, ERR_R_INTERNAL_ERROR);
1128               return NULL;
1129               }
1130
1131           ret += el;
1132         }
1133
1134 #ifndef OPENSSL_NO_SRP
1135         /* Add SRP username if there is one */
1136         if (s->srp_ctx.login != NULL)
1137                 { /* Add TLS extension SRP username to the Client Hello message */
1138
1139                 int login_len = strlen(s->srp_ctx.login);
1140                 if (login_len > 255 || login_len == 0)
1141                         {
1142                         SSLerr(SSL_F_SSL_ADD_CLIENTHELLO_TLSEXT, ERR_R_INTERNAL_ERROR);
1143                         return NULL;
1144                         }
1145
1146                 /* check for enough space.
1147                    4 for the srp type type and entension length
1148                    1 for the srp user identity
1149                    + srp user identity length
1150                 */
1151                 if ((limit - ret - 5 - login_len) < 0) return NULL;
1152
1153                 /* fill in the extension */
1154                 s2n(TLSEXT_TYPE_srp,ret);
1155                 s2n(login_len+1,ret);
1156                 (*ret++) = (unsigned char) login_len;
1157                 memcpy(ret, s->srp_ctx.login, login_len);
1158                 ret+=login_len;
1159                 }
1160 #endif
1161
1162 #ifndef OPENSSL_NO_EC
1163         if (using_ecc)
1164                 {
1165                 /* Add TLS extension ECPointFormats to the ClientHello message */
1166                 long lenmax;
1167                 const unsigned char *plist;
1168                 size_t plistlen;
1169
1170                 tls1_get_formatlist(s, &plist, &plistlen);
1171
1172                 if ((lenmax = limit - ret - 5) < 0) return NULL;
1173                 if (plistlen > (size_t)lenmax) return NULL;
1174                 if (plistlen > 255)
1175                         {
1176                         SSLerr(SSL_F_SSL_ADD_CLIENTHELLO_TLSEXT, ERR_R_INTERNAL_ERROR);
1177                         return NULL;
1178                         }
1179
1180                 s2n(TLSEXT_TYPE_ec_point_formats,ret);
1181                 s2n(plistlen + 1,ret);
1182                 *(ret++) = (unsigned char)plistlen ;
1183                 memcpy(ret, plist, plistlen);
1184                 ret+=plistlen;
1185
1186                 /* Add TLS extension EllipticCurves to the ClientHello message */
1187                 plist = s->tlsext_ellipticcurvelist;
1188                 tls1_get_curvelist(s, 0, &plist, &plistlen);
1189
1190                 if ((lenmax = limit - ret - 6) < 0) return NULL;
1191                 if (plistlen > (size_t)lenmax) return NULL;
1192                 if (plistlen > 65532)
1193                         {
1194                         SSLerr(SSL_F_SSL_ADD_CLIENTHELLO_TLSEXT, ERR_R_INTERNAL_ERROR);
1195                         return NULL;
1196                         }
1197
1198                 s2n(TLSEXT_TYPE_elliptic_curves,ret);
1199                 s2n(plistlen + 2, ret);
1200
1201                 /* NB: draft-ietf-tls-ecc-12.txt uses a one-byte prefix for
1202                  * elliptic_curve_list, but the examples use two bytes.
1203                  * http://www1.ietf.org/mail-archive/web/tls/current/msg00538.html
1204                  * resolves this to two bytes.
1205                  */
1206                 s2n(plistlen, ret);
1207                 memcpy(ret, plist, plistlen);
1208                 ret+=plistlen;
1209                 }
1210 #endif /* OPENSSL_NO_EC */
1211
1212         if (!(SSL_get_options(s) & SSL_OP_NO_TICKET))
1213                 {
1214                 int ticklen;
1215                 if (!s->new_session && s->session && s->session->tlsext_tick)
1216                         ticklen = s->session->tlsext_ticklen;
1217                 else if (s->session && s->tlsext_session_ticket &&
1218                          s->tlsext_session_ticket->data)
1219                         {
1220                         ticklen = s->tlsext_session_ticket->length;
1221                         s->session->tlsext_tick = OPENSSL_malloc(ticklen);
1222                         if (!s->session->tlsext_tick)
1223                                 return NULL;
1224                         memcpy(s->session->tlsext_tick,
1225                                s->tlsext_session_ticket->data,
1226                                ticklen);
1227                         s->session->tlsext_ticklen = ticklen;
1228                         }
1229                 else
1230                         ticklen = 0;
1231                 if (ticklen == 0 && s->tlsext_session_ticket &&
1232                     s->tlsext_session_ticket->data == NULL)
1233                         goto skip_ext;
1234                 /* Check for enough room 2 for extension type, 2 for len
1235                  * rest for ticket
1236                  */
1237                 if ((long)(limit - ret - 4 - ticklen) < 0) return NULL;
1238                 s2n(TLSEXT_TYPE_session_ticket,ret);
1239                 s2n(ticklen,ret);
1240                 if (ticklen)
1241                         {
1242                         memcpy(ret, s->session->tlsext_tick, ticklen);
1243                         ret += ticklen;
1244                         }
1245                 }
1246                 skip_ext:
1247
1248         if (TLS1_get_client_version(s) >= TLS1_2_VERSION)
1249                 {
1250                 size_t salglen;
1251                 const unsigned char *salg;
1252                 salglen = tls12_get_psigalgs(s, &salg);
1253                 if ((size_t)(limit - ret) < salglen + 6)
1254                         return NULL;
1255                 s2n(TLSEXT_TYPE_signature_algorithms,ret);
1256                 s2n(salglen + 2, ret);
1257                 s2n(salglen, ret);
1258                 memcpy(ret, salg, salglen);
1259                 ret += salglen;
1260                 }
1261
1262 #ifdef TLSEXT_TYPE_opaque_prf_input
1263         if (s->s3->client_opaque_prf_input != NULL &&
1264             s->version != DTLS1_VERSION)
1265                 {
1266                 size_t col = s->s3->client_opaque_prf_input_len;
1267
1268                 if ((long)(limit - ret - 6 - col < 0))
1269                         return NULL;
1270                 if (col > 0xFFFD) /* can't happen */
1271                         return NULL;
1272
1273                 s2n(TLSEXT_TYPE_opaque_prf_input, ret);
1274                 s2n(col + 2, ret);
1275                 s2n(col, ret);
1276                 memcpy(ret, s->s3->client_opaque_prf_input, col);
1277                 ret += col;
1278                 }
1279 #endif
1280
1281         if (s->tlsext_status_type == TLSEXT_STATUSTYPE_ocsp &&
1282             s->version != DTLS1_VERSION)
1283                 {
1284                 int i;
1285                 long extlen, idlen, itmp;
1286                 OCSP_RESPID *id;
1287
1288                 idlen = 0;
1289                 for (i = 0; i < sk_OCSP_RESPID_num(s->tlsext_ocsp_ids); i++)
1290                         {
1291                         id = sk_OCSP_RESPID_value(s->tlsext_ocsp_ids, i);
1292                         itmp = i2d_OCSP_RESPID(id, NULL);
1293                         if (itmp <= 0)
1294                                 return NULL;
1295                         idlen += itmp + 2;
1296                         }
1297
1298                 if (s->tlsext_ocsp_exts)
1299                         {
1300                         extlen = i2d_X509_EXTENSIONS(s->tlsext_ocsp_exts, NULL);
1301                         if (extlen < 0)
1302                                 return NULL;
1303                         }
1304                 else
1305                         extlen = 0;
1306
1307                 if ((long)(limit - ret - 7 - extlen - idlen) < 0) return NULL;
1308                 s2n(TLSEXT_TYPE_status_request, ret);
1309                 if (extlen + idlen > 0xFFF0)
1310                         return NULL;
1311                 s2n(extlen + idlen + 5, ret);
1312                 *(ret++) = TLSEXT_STATUSTYPE_ocsp;
1313                 s2n(idlen, ret);
1314                 for (i = 0; i < sk_OCSP_RESPID_num(s->tlsext_ocsp_ids); i++)
1315                         {
1316                         /* save position of id len */
1317                         unsigned char *q = ret;
1318                         id = sk_OCSP_RESPID_value(s->tlsext_ocsp_ids, i);
1319                         /* skip over id len */
1320                         ret += 2;
1321                         itmp = i2d_OCSP_RESPID(id, &ret);
1322                         /* write id len */
1323                         s2n(itmp, q);
1324                         }
1325                 s2n(extlen, ret);
1326                 if (extlen > 0)
1327                         i2d_X509_EXTENSIONS(s->tlsext_ocsp_exts, &ret);
1328                 }
1329
1330 #ifndef OPENSSL_NO_HEARTBEATS
1331         /* Add Heartbeat extension */
1332         s2n(TLSEXT_TYPE_heartbeat,ret);
1333         s2n(1,ret);
1334         /* Set mode:
1335          * 1: peer may send requests
1336          * 2: peer not allowed to send requests
1337          */
1338         if (s->tlsext_heartbeat & SSL_TLSEXT_HB_DONT_RECV_REQUESTS)
1339                 *(ret++) = SSL_TLSEXT_HB_DONT_SEND_REQUESTS;
1340         else
1341                 *(ret++) = SSL_TLSEXT_HB_ENABLED;
1342 #endif
1343
1344 #ifndef OPENSSL_NO_NEXTPROTONEG
1345         if (s->ctx->next_proto_select_cb && !s->s3->tmp.finish_md_len)
1346                 {
1347                 /* The client advertises an emtpy extension to indicate its
1348                  * support for Next Protocol Negotiation */
1349                 if (limit - ret - 4 < 0)
1350                         return NULL;
1351                 s2n(TLSEXT_TYPE_next_proto_neg,ret);
1352                 s2n(0,ret);
1353                 }
1354 #endif
1355
1356         if(SSL_get_srtp_profiles(s))
1357                 {
1358                 int el;
1359
1360                 ssl_add_clienthello_use_srtp_ext(s, 0, &el, 0);
1361
1362                 if((limit - p - 4 - el) < 0) return NULL;
1363
1364                 s2n(TLSEXT_TYPE_use_srtp,ret);
1365                 s2n(el,ret);
1366
1367                 if(ssl_add_clienthello_use_srtp_ext(s, ret, &el, el))
1368                         {
1369                         SSLerr(SSL_F_SSL_ADD_CLIENTHELLO_TLSEXT, ERR_R_INTERNAL_ERROR);
1370                         return NULL;
1371                         }
1372                 ret += el;
1373                 }
1374
1375         /* Add TLS extension Server_Authz_DataFormats to the ClientHello */
1376         /* 2 bytes for extension type */
1377         /* 2 bytes for extension length */
1378         /* 1 byte for the list length */
1379         /* 1 byte for the list (we only support audit proofs) */
1380         if (s->ctx->tlsext_authz_server_audit_proof_cb != NULL)
1381                 {
1382                 size_t lenmax;
1383                 const unsigned short ext_len = 2;
1384                 const unsigned char list_len = 1;
1385
1386                 if ((lenmax = limit - ret - 6) < 0) return NULL;
1387
1388                 s2n(TLSEXT_TYPE_server_authz, ret);
1389                 /* Extension length: 2 bytes */
1390                 s2n(ext_len, ret);
1391                 *(ret++) = list_len;
1392                 *(ret++) = TLSEXT_AUTHZDATAFORMAT_audit_proof;
1393                 }
1394
1395         if ((extdatalen = ret-p-2) == 0)
1396                 return p;
1397
1398         s2n(extdatalen,p);
1399         return ret;
1400         }
1401
1402 unsigned char *ssl_add_serverhello_tlsext(SSL *s, unsigned char *p, unsigned char *limit)
1403         {
1404         int extdatalen=0;
1405         unsigned char *ret = p;
1406 #ifndef OPENSSL_NO_NEXTPROTONEG
1407         int next_proto_neg_seen;
1408 #endif
1409         unsigned long alg_k = s->s3->tmp.new_cipher->algorithm_mkey;
1410         unsigned long alg_a = s->s3->tmp.new_cipher->algorithm_auth;
1411         int using_ecc = (alg_k & (SSL_kEECDH|SSL_kECDHr|SSL_kECDHe)) || (alg_a & SSL_aECDSA);
1412         using_ecc = using_ecc && (s->session->tlsext_ecpointformatlist != NULL);
1413
1414         /* don't add extensions for SSLv3, unless doing secure renegotiation */
1415         if (s->version == SSL3_VERSION && !s->s3->send_connection_binding)
1416                 return p;
1417
1418         ret+=2;
1419         if (ret>=limit) return NULL; /* this really never occurs, but ... */
1420
1421         if (!s->hit && s->servername_done == 1 && s->session->tlsext_hostname != NULL)
1422                 {
1423                 if ((long)(limit - ret - 4) < 0) return NULL;
1424
1425                 s2n(TLSEXT_TYPE_server_name,ret);
1426                 s2n(0,ret);
1427                 }
1428
1429         if(s->s3->send_connection_binding)
1430         {
1431           int el;
1432
1433           if(!ssl_add_serverhello_renegotiate_ext(s, 0, &el, 0))
1434               {
1435               SSLerr(SSL_F_SSL_ADD_SERVERHELLO_TLSEXT, ERR_R_INTERNAL_ERROR);
1436               return NULL;
1437               }
1438
1439           if((limit - p - 4 - el) < 0) return NULL;
1440
1441           s2n(TLSEXT_TYPE_renegotiate,ret);
1442           s2n(el,ret);
1443
1444           if(!ssl_add_serverhello_renegotiate_ext(s, ret, &el, el))
1445               {
1446               SSLerr(SSL_F_SSL_ADD_SERVERHELLO_TLSEXT, ERR_R_INTERNAL_ERROR);
1447               return NULL;
1448               }
1449
1450           ret += el;
1451         }
1452
1453 #ifndef OPENSSL_NO_EC
1454         if (using_ecc && s->version != DTLS1_VERSION)
1455                 {
1456                 const unsigned char *plist;
1457                 size_t plistlen;
1458                 /* Add TLS extension ECPointFormats to the ServerHello message */
1459                 long lenmax;
1460
1461                 tls1_get_formatlist(s, &plist, &plistlen);
1462
1463                 if ((lenmax = limit - ret - 5) < 0) return NULL;
1464                 if (plistlen > (size_t)lenmax) return NULL;
1465                 if (plistlen > 255)
1466                         {
1467                         SSLerr(SSL_F_SSL_ADD_SERVERHELLO_TLSEXT, ERR_R_INTERNAL_ERROR);
1468                         return NULL;
1469                         }
1470
1471                 s2n(TLSEXT_TYPE_ec_point_formats,ret);
1472                 s2n(plistlen + 1,ret);
1473                 *(ret++) = (unsigned char) plistlen;
1474                 memcpy(ret, plist, plistlen);
1475                 ret+=plistlen;
1476
1477                 }
1478         /* Currently the server should not respond with a SupportedCurves extension */
1479 #endif /* OPENSSL_NO_EC */
1480
1481         if (s->tlsext_ticket_expected
1482                 && !(SSL_get_options(s) & SSL_OP_NO_TICKET))
1483                 {
1484                 if ((long)(limit - ret - 4) < 0) return NULL;
1485                 s2n(TLSEXT_TYPE_session_ticket,ret);
1486                 s2n(0,ret);
1487                 }
1488
1489         if (s->tlsext_status_expected)
1490                 {
1491                 if ((long)(limit - ret - 4) < 0) return NULL;
1492                 s2n(TLSEXT_TYPE_status_request,ret);
1493                 s2n(0,ret);
1494                 }
1495
1496 #ifdef TLSEXT_TYPE_opaque_prf_input
1497         if (s->s3->server_opaque_prf_input != NULL &&
1498             s->version != DTLS1_VERSION)
1499                 {
1500                 size_t sol = s->s3->server_opaque_prf_input_len;
1501
1502                 if ((long)(limit - ret - 6 - sol) < 0)
1503                         return NULL;
1504                 if (sol > 0xFFFD) /* can't happen */
1505                         return NULL;
1506
1507                 s2n(TLSEXT_TYPE_opaque_prf_input, ret);
1508                 s2n(sol + 2, ret);
1509                 s2n(sol, ret);
1510                 memcpy(ret, s->s3->server_opaque_prf_input, sol);
1511                 ret += sol;
1512                 }
1513 #endif
1514
1515         if(s->srtp_profile)
1516                 {
1517                 int el;
1518
1519                 ssl_add_serverhello_use_srtp_ext(s, 0, &el, 0);
1520
1521                 if((limit - p - 4 - el) < 0) return NULL;
1522
1523                 s2n(TLSEXT_TYPE_use_srtp,ret);
1524                 s2n(el,ret);
1525
1526                 if(ssl_add_serverhello_use_srtp_ext(s, ret, &el, el))
1527                         {
1528                         SSLerr(SSL_F_SSL_ADD_SERVERHELLO_TLSEXT, ERR_R_INTERNAL_ERROR);
1529                         return NULL;
1530                         }
1531                 ret+=el;
1532                 }
1533
1534         if (((s->s3->tmp.new_cipher->id & 0xFFFF)==0x80 || (s->s3->tmp.new_cipher->id & 0xFFFF)==0x81)
1535                 && (SSL_get_options(s) & SSL_OP_CRYPTOPRO_TLSEXT_BUG))
1536                 { const unsigned char cryptopro_ext[36] = {
1537                         0xfd, 0xe8, /*65000*/
1538                         0x00, 0x20, /*32 bytes length*/
1539                         0x30, 0x1e, 0x30, 0x08, 0x06, 0x06, 0x2a, 0x85,
1540                         0x03,   0x02, 0x02, 0x09, 0x30, 0x08, 0x06, 0x06,
1541                         0x2a, 0x85, 0x03, 0x02, 0x02, 0x16, 0x30, 0x08,
1542                         0x06, 0x06, 0x2a, 0x85, 0x03, 0x02, 0x02, 0x17};
1543                         if (limit-ret<36) return NULL;
1544                         memcpy(ret,cryptopro_ext,36);
1545                         ret+=36;
1546
1547                 }
1548
1549 #ifndef OPENSSL_NO_HEARTBEATS
1550         /* Add Heartbeat extension if we've received one */
1551         if (s->tlsext_heartbeat & SSL_TLSEXT_HB_ENABLED)
1552                 {
1553                 s2n(TLSEXT_TYPE_heartbeat,ret);
1554                 s2n(1,ret);
1555                 /* Set mode:
1556                  * 1: peer may send requests
1557                  * 2: peer not allowed to send requests
1558                  */
1559                 if (s->tlsext_heartbeat & SSL_TLSEXT_HB_DONT_RECV_REQUESTS)
1560                         *(ret++) = SSL_TLSEXT_HB_DONT_SEND_REQUESTS;
1561                 else
1562                         *(ret++) = SSL_TLSEXT_HB_ENABLED;
1563
1564                 }
1565 #endif
1566
1567 #ifndef OPENSSL_NO_NEXTPROTONEG
1568         next_proto_neg_seen = s->s3->next_proto_neg_seen;
1569         s->s3->next_proto_neg_seen = 0;
1570         if (next_proto_neg_seen && s->ctx->next_protos_advertised_cb)
1571                 {
1572                 const unsigned char *npa;
1573                 unsigned int npalen;
1574                 int r;
1575
1576                 r = s->ctx->next_protos_advertised_cb(s, &npa, &npalen, s->ctx->next_protos_advertised_cb_arg);
1577                 if (r == SSL_TLSEXT_ERR_OK)
1578                         {
1579                         if ((long)(limit - ret - 4 - npalen) < 0) return NULL;
1580                         s2n(TLSEXT_TYPE_next_proto_neg,ret);
1581                         s2n(npalen,ret);
1582                         memcpy(ret, npa, npalen);
1583                         ret += npalen;
1584                         s->s3->next_proto_neg_seen = 1;
1585                         }
1586                 }
1587 #endif
1588
1589         /* If the client supports authz then see whether we have any to offer
1590          * to it. */
1591         if (s->s3->tlsext_authz_client_types_len)
1592                 {
1593                 size_t authz_length;
1594                 /* By now we already know the new cipher, so we can look ahead
1595                  * to see whether the cert we are going to send
1596                  * has any authz data attached to it. */
1597                 const unsigned char* authz = ssl_get_authz_data(s, &authz_length);
1598                 const unsigned char* const orig_authz = authz;
1599                 size_t i;
1600                 unsigned authz_count = 0;
1601
1602                 /* The authz data contains a number of the following structures:
1603                  *      uint8_t authz_type
1604                  *      uint16_t length
1605                  *      uint8_t data[length]
1606                  *
1607                  * First we walk over it to find the number of authz elements. */
1608                 for (i = 0; i < authz_length; i++)
1609                         {
1610                         unsigned short length;
1611                         unsigned char type;
1612
1613                         type = *(authz++);
1614                         if (memchr(s->s3->tlsext_authz_client_types,
1615                                    type,
1616                                    s->s3->tlsext_authz_client_types_len) != NULL)
1617                                 authz_count++;
1618
1619                         n2s(authz, length);
1620                         /* n2s increments authz by 2 */
1621                         i += 2;
1622                         authz += length;
1623                         i += length;
1624                         }
1625
1626                 if (authz_count)
1627                         {
1628                         /* Add TLS extension server_authz to the ServerHello message
1629                          * 2 bytes for extension type
1630                          * 2 bytes for extension length
1631                          * 1 byte for the list length
1632                          * n bytes for the list */
1633                         const unsigned short ext_len = 1 + authz_count;
1634
1635                         if ((long)(limit - ret - 4 - ext_len) < 0) return NULL;
1636                         s2n(TLSEXT_TYPE_server_authz, ret);
1637                         s2n(ext_len, ret);
1638                         *(ret++) = authz_count;
1639                         s->s3->tlsext_authz_promised_to_client = 1;
1640                         }
1641
1642                 authz = orig_authz;
1643                 for (i = 0; i < authz_length; i++)
1644                         {
1645                         unsigned short length;
1646                         unsigned char type;
1647
1648                         authz_count++;
1649                         type = *(authz++);
1650                         if (memchr(s->s3->tlsext_authz_client_types,
1651                                    type,
1652                                    s->s3->tlsext_authz_client_types_len) != NULL)
1653                                 *(ret++) = type;
1654                         n2s(authz, length);
1655                         /* n2s increments authz by 2 */
1656                         i += 2;
1657                         authz += length;
1658                         i += length;
1659                         }
1660                 }
1661
1662         if ((extdatalen = ret-p-2)== 0)
1663                 return p;
1664
1665         s2n(extdatalen,p);
1666         return ret;
1667         }
1668
1669 static int ssl_scan_clienthello_tlsext(SSL *s, unsigned char **p, unsigned char *d, int n, int *al)
1670         {
1671         unsigned short type;
1672         unsigned short size;
1673         unsigned short len;
1674         unsigned char *data = *p;
1675         int renegotiate_seen = 0;
1676         size_t i;
1677
1678         s->servername_done = 0;
1679         s->tlsext_status_type = -1;
1680 #ifndef OPENSSL_NO_NEXTPROTONEG
1681         s->s3->next_proto_neg_seen = 0;
1682 #endif
1683
1684 #ifndef OPENSSL_NO_HEARTBEATS
1685         s->tlsext_heartbeat &= ~(SSL_TLSEXT_HB_ENABLED |
1686                                SSL_TLSEXT_HB_DONT_SEND_REQUESTS);
1687 #endif
1688         /* Clear any signature algorithms extension received */
1689         if (s->cert->peer_sigalgs)
1690                 {
1691                 OPENSSL_free(s->cert->peer_sigalgs);
1692                 s->cert->peer_sigalgs = NULL;
1693                 }
1694         /* Clear any shared sigtnature algorithms */
1695         if (s->cert->shared_sigalgs)
1696                 {
1697                 OPENSSL_free(s->cert->shared_sigalgs);
1698                 s->cert->shared_sigalgs = NULL;
1699                 }
1700         /* Clear certificate digests and validity flags */
1701         for (i = 0; i < SSL_PKEY_NUM; i++)
1702                 {
1703                 s->cert->pkeys[i].digest = NULL;
1704                 s->cert->pkeys[i].valid_flags = 0;
1705                 }
1706
1707         if (data >= (d+n-2))
1708                 goto ri_check;
1709         n2s(data,len);
1710
1711         if (data > (d+n-len))
1712                 goto ri_check;
1713
1714         while (data <= (d+n-4))
1715                 {
1716                 n2s(data,type);
1717                 n2s(data,size);
1718
1719                 if (data+size > (d+n))
1720                         goto ri_check;
1721 #if 0
1722                 fprintf(stderr,"Received extension type %d size %d\n",type,size);
1723 #endif
1724                 if (s->tlsext_debug_cb)
1725                         s->tlsext_debug_cb(s, 0, type, data, size,
1726                                                 s->tlsext_debug_arg);
1727 /* The servername extension is treated as follows:
1728
1729    - Only the hostname type is supported with a maximum length of 255.
1730    - The servername is rejected if too long or if it contains zeros,
1731      in which case an fatal alert is generated.
1732    - The servername field is maintained together with the session cache.
1733    - When a session is resumed, the servername call back invoked in order
1734      to allow the application to position itself to the right context.
1735    - The servername is acknowledged if it is new for a session or when
1736      it is identical to a previously used for the same session.
1737      Applications can control the behaviour.  They can at any time
1738      set a 'desirable' servername for a new SSL object. This can be the
1739      case for example with HTTPS when a Host: header field is received and
1740      a renegotiation is requested. In this case, a possible servername
1741      presented in the new client hello is only acknowledged if it matches
1742      the value of the Host: field.
1743    - Applications must  use SSL_OP_NO_SESSION_RESUMPTION_ON_RENEGOTIATION
1744      if they provide for changing an explicit servername context for the session,
1745      i.e. when the session has been established with a servername extension.
1746    - On session reconnect, the servername extension may be absent.
1747
1748 */
1749
1750                 if (type == TLSEXT_TYPE_server_name)
1751                         {
1752                         unsigned char *sdata;
1753                         int servname_type;
1754                         int dsize;
1755
1756                         if (size < 2)
1757                                 {
1758                                 *al = SSL_AD_DECODE_ERROR;
1759                                 return 0;
1760                                 }
1761                         n2s(data,dsize);
1762                         size -= 2;
1763                         if (dsize > size  )
1764                                 {
1765                                 *al = SSL_AD_DECODE_ERROR;
1766                                 return 0;
1767                                 }
1768
1769                         sdata = data;
1770                         while (dsize > 3)
1771                                 {
1772                                 servname_type = *(sdata++);
1773                                 n2s(sdata,len);
1774                                 dsize -= 3;
1775
1776                                 if (len > dsize)
1777                                         {
1778                                         *al = SSL_AD_DECODE_ERROR;
1779                                         return 0;
1780                                         }
1781                                 if (s->servername_done == 0)
1782                                 switch (servname_type)
1783                                         {
1784                                 case TLSEXT_NAMETYPE_host_name:
1785                                         if (!s->hit)
1786                                                 {
1787                                                 if(s->session->tlsext_hostname)
1788                                                         {
1789                                                         *al = SSL_AD_DECODE_ERROR;
1790                                                         return 0;
1791                                                         }
1792                                                 if (len > TLSEXT_MAXLEN_host_name)
1793                                                         {
1794                                                         *al = TLS1_AD_UNRECOGNIZED_NAME;
1795                                                         return 0;
1796                                                         }
1797                                                 if ((s->session->tlsext_hostname = OPENSSL_malloc(len+1)) == NULL)
1798                                                         {
1799                                                         *al = TLS1_AD_INTERNAL_ERROR;
1800                                                         return 0;
1801                                                         }
1802                                                 memcpy(s->session->tlsext_hostname, sdata, len);
1803                                                 s->session->tlsext_hostname[len]='\0';
1804                                                 if (strlen(s->session->tlsext_hostname) != len) {
1805                                                         OPENSSL_free(s->session->tlsext_hostname);
1806                                                         s->session->tlsext_hostname = NULL;
1807                                                         *al = TLS1_AD_UNRECOGNIZED_NAME;
1808                                                         return 0;
1809                                                 }
1810                                                 s->servername_done = 1;
1811
1812                                                 }
1813                                         else
1814                                                 s->servername_done = s->session->tlsext_hostname
1815                                                         && strlen(s->session->tlsext_hostname) == len
1816                                                         && strncmp(s->session->tlsext_hostname, (char *)sdata, len) == 0;
1817
1818                                         break;
1819
1820                                 default:
1821                                         break;
1822                                         }
1823
1824                                 dsize -= len;
1825                                 }
1826                         if (dsize != 0)
1827                                 {
1828                                 *al = SSL_AD_DECODE_ERROR;
1829                                 return 0;
1830                                 }
1831
1832                         }
1833 #ifndef OPENSSL_NO_SRP
1834                 else if (type == TLSEXT_TYPE_srp)
1835                         {
1836                         if (size <= 0 || ((len = data[0])) != (size -1))
1837                                 {
1838                                 *al = SSL_AD_DECODE_ERROR;
1839                                 return 0;
1840                                 }
1841                         if (s->srp_ctx.login != NULL)
1842                                 {
1843                                 *al = SSL_AD_DECODE_ERROR;
1844                                 return 0;
1845                                 }
1846                         if ((s->srp_ctx.login = OPENSSL_malloc(len+1)) == NULL)
1847                                 return -1;
1848                         memcpy(s->srp_ctx.login, &data[1], len);
1849                         s->srp_ctx.login[len]='\0';
1850
1851                         if (strlen(s->srp_ctx.login) != len)
1852                                 {
1853                                 *al = SSL_AD_DECODE_ERROR;
1854                                 return 0;
1855                                 }
1856                         }
1857 #endif
1858
1859 #ifndef OPENSSL_NO_EC
1860                 else if (type == TLSEXT_TYPE_ec_point_formats &&
1861                      s->version != DTLS1_VERSION)
1862                         {
1863                         unsigned char *sdata = data;
1864                         int ecpointformatlist_length = *(sdata++);
1865
1866                         if (ecpointformatlist_length != size - 1)
1867                                 {
1868                                 *al = TLS1_AD_DECODE_ERROR;
1869                                 return 0;
1870                                 }
1871                         if (!s->hit)
1872                                 {
1873                                 if(s->session->tlsext_ecpointformatlist)
1874                                         {
1875                                         OPENSSL_free(s->session->tlsext_ecpointformatlist);
1876                                         s->session->tlsext_ecpointformatlist = NULL;
1877                                         }
1878                                 s->session->tlsext_ecpointformatlist_length = 0;
1879                                 if ((s->session->tlsext_ecpointformatlist = OPENSSL_malloc(ecpointformatlist_length)) == NULL)
1880                                         {
1881                                         *al = TLS1_AD_INTERNAL_ERROR;
1882                                         return 0;
1883                                         }
1884                                 s->session->tlsext_ecpointformatlist_length = ecpointformatlist_length;
1885                                 memcpy(s->session->tlsext_ecpointformatlist, sdata, ecpointformatlist_length);
1886                                 }
1887 #if 0
1888                         fprintf(stderr,"ssl_parse_clienthello_tlsext s->session->tlsext_ecpointformatlist (length=%i) ", s->session->tlsext_ecpointformatlist_length);
1889                         sdata = s->session->tlsext_ecpointformatlist;
1890                         for (i = 0; i < s->session->tlsext_ecpointformatlist_length; i++)
1891                                 fprintf(stderr,"%i ",*(sdata++));
1892                         fprintf(stderr,"\n");
1893 #endif
1894                         }
1895                 else if (type == TLSEXT_TYPE_elliptic_curves &&
1896                      s->version != DTLS1_VERSION)
1897                         {
1898                         unsigned char *sdata = data;
1899                         int ellipticcurvelist_length = (*(sdata++) << 8);
1900                         ellipticcurvelist_length += (*(sdata++));
1901
1902                         if (ellipticcurvelist_length != size - 2 ||
1903                                 ellipticcurvelist_length < 1)
1904                                 {
1905                                 *al = TLS1_AD_DECODE_ERROR;
1906                                 return 0;
1907                                 }
1908                         if (!s->hit)
1909                                 {
1910                                 if(s->session->tlsext_ellipticcurvelist)
1911                                         {
1912                                         *al = TLS1_AD_DECODE_ERROR;
1913                                         return 0;
1914                                         }
1915                                 s->session->tlsext_ellipticcurvelist_length = 0;
1916                                 if ((s->session->tlsext_ellipticcurvelist = OPENSSL_malloc(ellipticcurvelist_length)) == NULL)
1917                                         {
1918                                         *al = TLS1_AD_INTERNAL_ERROR;
1919                                         return 0;
1920                                         }
1921                                 s->session->tlsext_ellipticcurvelist_length = ellipticcurvelist_length;
1922                                 memcpy(s->session->tlsext_ellipticcurvelist, sdata, ellipticcurvelist_length);
1923                                 }
1924 #if 0
1925                         fprintf(stderr,"ssl_parse_clienthello_tlsext s->session->tlsext_ellipticcurvelist (length=%i) ", s->session->tlsext_ellipticcurvelist_length);
1926                         sdata = s->session->tlsext_ellipticcurvelist;
1927                         for (i = 0; i < s->session->tlsext_ellipticcurvelist_length; i++)
1928                                 fprintf(stderr,"%i ",*(sdata++));
1929                         fprintf(stderr,"\n");
1930 #endif
1931                         }
1932 #endif /* OPENSSL_NO_EC */
1933 #ifdef TLSEXT_TYPE_opaque_prf_input
1934                 else if (type == TLSEXT_TYPE_opaque_prf_input &&
1935                      s->version != DTLS1_VERSION)
1936                         {
1937                         unsigned char *sdata = data;
1938
1939                         if (size < 2)
1940                                 {
1941                                 *al = SSL_AD_DECODE_ERROR;
1942                                 return 0;
1943                                 }
1944                         n2s(sdata, s->s3->client_opaque_prf_input_len);
1945                         if (s->s3->client_opaque_prf_input_len != size - 2)
1946                                 {
1947                                 *al = SSL_AD_DECODE_ERROR;
1948                                 return 0;
1949                                 }
1950
1951                         if (s->s3->client_opaque_prf_input != NULL) /* shouldn't really happen */
1952                                 OPENSSL_free(s->s3->client_opaque_prf_input);
1953                         if (s->s3->client_opaque_prf_input_len == 0)
1954                                 s->s3->client_opaque_prf_input = OPENSSL_malloc(1); /* dummy byte just to get non-NULL */
1955                         else
1956                                 s->s3->client_opaque_prf_input = BUF_memdup(sdata, s->s3->client_opaque_prf_input_len);
1957                         if (s->s3->client_opaque_prf_input == NULL)
1958                                 {
1959                                 *al = TLS1_AD_INTERNAL_ERROR;
1960                                 return 0;
1961                                 }
1962                         }
1963 #endif
1964                 else if (type == TLSEXT_TYPE_session_ticket)
1965                         {
1966                         if (s->tls_session_ticket_ext_cb &&
1967                             !s->tls_session_ticket_ext_cb(s, data, size, s->tls_session_ticket_ext_cb_arg))
1968                                 {
1969                                 *al = TLS1_AD_INTERNAL_ERROR;
1970                                 return 0;
1971                                 }
1972                         }
1973                 else if (type == TLSEXT_TYPE_renegotiate)
1974                         {
1975                         if(!ssl_parse_clienthello_renegotiate_ext(s, data, size, al))
1976                                 return 0;
1977                         renegotiate_seen = 1;
1978                         }
1979                 else if (type == TLSEXT_TYPE_signature_algorithms)
1980                         {
1981                         int dsize;
1982                         if (s->cert->peer_sigalgs || size < 2)
1983                                 {
1984                                 *al = SSL_AD_DECODE_ERROR;
1985                                 return 0;
1986                                 }
1987                         n2s(data,dsize);
1988                         size -= 2;
1989                         if (dsize != size || dsize & 1 || !dsize)
1990                                 {
1991                                 *al = SSL_AD_DECODE_ERROR;
1992                                 return 0;
1993                                 }
1994                         if (!tls1_process_sigalgs(s, data, dsize))
1995                                 {
1996                                 *al = SSL_AD_DECODE_ERROR;
1997                                 return 0;
1998                                 }
1999                         /* If sigalgs received and no shared algorithms fatal
2000                          * error.
2001                          */
2002                         if (s->cert->peer_sigalgs && !s->cert->shared_sigalgs)
2003                                 {
2004                                 SSLerr(SSL_F_SSL_SCAN_CLIENTHELLO_TLSEXT,
2005                                         SSL_R_NO_SHARED_SIGATURE_ALGORITHMS);
2006                                 *al = SSL_AD_ILLEGAL_PARAMETER;
2007                                 return 0;
2008                                 }
2009                         }
2010                 else if (type == TLSEXT_TYPE_status_request &&
2011                          s->version != DTLS1_VERSION && s->ctx->tlsext_status_cb)
2012                         {
2013
2014                         if (size < 5)
2015                                 {
2016                                 *al = SSL_AD_DECODE_ERROR;
2017                                 return 0;
2018                                 }
2019
2020                         s->tlsext_status_type = *data++;
2021                         size--;
2022                         if (s->tlsext_status_type == TLSEXT_STATUSTYPE_ocsp)
2023                                 {
2024                                 const unsigned char *sdata;
2025                                 int dsize;
2026                                 /* Read in responder_id_list */
2027                                 n2s(data,dsize);
2028                                 size -= 2;
2029                                 if (dsize > size  )
2030                                         {
2031                                         *al = SSL_AD_DECODE_ERROR;
2032                                         return 0;
2033                                         }
2034                                 while (dsize > 0)
2035                                         {
2036                                         OCSP_RESPID *id;
2037                                         int idsize;
2038                                         if (dsize < 4)
2039                                                 {
2040                                                 *al = SSL_AD_DECODE_ERROR;
2041                                                 return 0;
2042                                                 }
2043                                         n2s(data, idsize);
2044                                         dsize -= 2 + idsize;
2045                                         size -= 2 + idsize;
2046                                         if (dsize < 0)
2047                                                 {
2048                                                 *al = SSL_AD_DECODE_ERROR;
2049                                                 return 0;
2050                                                 }
2051                                         sdata = data;
2052                                         data += idsize;
2053                                         id = d2i_OCSP_RESPID(NULL,
2054                                                                 &sdata, idsize);
2055                                         if (!id)
2056                                                 {
2057                                                 *al = SSL_AD_DECODE_ERROR;
2058                                                 return 0;
2059                                                 }
2060                                         if (data != sdata)
2061                                                 {
2062                                                 OCSP_RESPID_free(id);
2063                                                 *al = SSL_AD_DECODE_ERROR;
2064                                                 return 0;
2065                                                 }
2066                                         if (!s->tlsext_ocsp_ids
2067                                                 && !(s->tlsext_ocsp_ids =
2068                                                 sk_OCSP_RESPID_new_null()))
2069                                                 {
2070                                                 OCSP_RESPID_free(id);
2071                                                 *al = SSL_AD_INTERNAL_ERROR;
2072                                                 return 0;
2073                                                 }
2074                                         if (!sk_OCSP_RESPID_push(
2075                                                         s->tlsext_ocsp_ids, id))
2076                                                 {
2077                                                 OCSP_RESPID_free(id);
2078                                                 *al = SSL_AD_INTERNAL_ERROR;
2079                                                 return 0;
2080                                                 }
2081                                         }
2082
2083                                 /* Read in request_extensions */
2084                                 if (size < 2)
2085                                         {
2086                                         *al = SSL_AD_DECODE_ERROR;
2087                                         return 0;
2088                                         }
2089                                 n2s(data,dsize);
2090                                 size -= 2;
2091                                 if (dsize != size)
2092                                         {
2093                                         *al = SSL_AD_DECODE_ERROR;
2094                                         return 0;
2095                                         }
2096                                 sdata = data;
2097                                 if (dsize > 0)
2098                                         {
2099                                         if (s->tlsext_ocsp_exts)
2100                                                 {
2101                                                 sk_X509_EXTENSION_pop_free(s->tlsext_ocsp_exts,
2102                                                                            X509_EXTENSION_free);
2103                                                 }
2104
2105                                         s->tlsext_ocsp_exts =
2106                                                 d2i_X509_EXTENSIONS(NULL,
2107                                                         &sdata, dsize);
2108                                         if (!s->tlsext_ocsp_exts
2109                                                 || (data + dsize != sdata))
2110                                                 {
2111                                                 *al = SSL_AD_DECODE_ERROR;
2112                                                 return 0;
2113                                                 }
2114                                         }
2115                                 }
2116                                 /* We don't know what to do with any other type
2117                                 * so ignore it.
2118                                 */
2119                                 else
2120                                         s->tlsext_status_type = -1;
2121                         }
2122 #ifndef OPENSSL_NO_HEARTBEATS
2123                 else if (type == TLSEXT_TYPE_heartbeat)
2124                         {
2125                         switch(data[0])
2126                                 {
2127                                 case 0x01:      /* Client allows us to send HB requests */
2128                                                         s->tlsext_heartbeat |= SSL_TLSEXT_HB_ENABLED;
2129                                                         break;
2130                                 case 0x02:      /* Client doesn't accept HB requests */
2131                                                         s->tlsext_heartbeat |= SSL_TLSEXT_HB_ENABLED;
2132                                                         s->tlsext_heartbeat |= SSL_TLSEXT_HB_DONT_SEND_REQUESTS;
2133                                                         break;
2134                                 default:        *al = SSL_AD_ILLEGAL_PARAMETER;
2135                                                         return 0;
2136                                 }
2137                         }
2138 #endif
2139 #ifndef OPENSSL_NO_NEXTPROTONEG
2140                 else if (type == TLSEXT_TYPE_next_proto_neg &&
2141                          s->s3->tmp.finish_md_len == 0)
2142                         {
2143                         /* We shouldn't accept this extension on a
2144                          * renegotiation.
2145                          *
2146                          * s->new_session will be set on renegotiation, but we
2147                          * probably shouldn't rely that it couldn't be set on
2148                          * the initial renegotation too in certain cases (when
2149                          * there's some other reason to disallow resuming an
2150                          * earlier session -- the current code won't be doing
2151                          * anything like that, but this might change).
2152
2153                          * A valid sign that there's been a previous handshake
2154                          * in this connection is if s->s3->tmp.finish_md_len >
2155                          * 0.  (We are talking about a check that will happen
2156                          * in the Hello protocol round, well before a new
2157                          * Finished message could have been computed.) */
2158                         s->s3->next_proto_neg_seen = 1;
2159                         }
2160 #endif
2161
2162                 /* session ticket processed earlier */
2163                 else if (type == TLSEXT_TYPE_use_srtp)
2164                         {
2165                         if(ssl_parse_clienthello_use_srtp_ext(s, data, size,
2166                                                               al))
2167                                 return 0;
2168                         }
2169
2170                 else if (type == TLSEXT_TYPE_server_authz)
2171                         {
2172                         unsigned char *sdata = data;
2173                         unsigned char server_authz_dataformatlist_length;
2174
2175                         if (size == 0)
2176                                 {
2177                                 *al = TLS1_AD_DECODE_ERROR;
2178                                 return 0;
2179                                 }
2180
2181                         server_authz_dataformatlist_length = *(sdata++);
2182
2183                         if (server_authz_dataformatlist_length != size - 1)
2184                                 {
2185                                 *al = TLS1_AD_DECODE_ERROR;
2186                                 return 0;
2187                                 }
2188
2189                         /* Successful session resumption uses the same authz
2190                          * information as the original session so we ignore this
2191                          * in the case of a session resumption. */
2192                         if (!s->hit)
2193                                 {
2194                                 if (s->s3->tlsext_authz_client_types != NULL)
2195                                         OPENSSL_free(s->s3->tlsext_authz_client_types);
2196                                 s->s3->tlsext_authz_client_types =
2197                                         OPENSSL_malloc(server_authz_dataformatlist_length);
2198                                 if (!s->s3->tlsext_authz_client_types)
2199                                         {
2200                                         *al = TLS1_AD_INTERNAL_ERROR;
2201                                         return 0;
2202                                         }
2203
2204                                 s->s3->tlsext_authz_client_types_len =
2205                                         server_authz_dataformatlist_length;
2206                                 memcpy(s->s3->tlsext_authz_client_types,
2207                                        sdata,
2208                                        server_authz_dataformatlist_length);
2209
2210                                 /* Sort the types in order to check for duplicates. */
2211                                 qsort(s->s3->tlsext_authz_client_types,
2212                                       server_authz_dataformatlist_length,
2213                                       1 /* element size */,
2214                                       byte_compare);
2215
2216                                 for (i = 0; i < server_authz_dataformatlist_length; i++)
2217                                         {
2218                                         if (i > 0 &&
2219                                             s->s3->tlsext_authz_client_types[i] ==
2220                                               s->s3->tlsext_authz_client_types[i-1])
2221                                                 {
2222                                                 *al = TLS1_AD_DECODE_ERROR;
2223                                                 return 0;
2224                                                 }
2225                                         }
2226                                 }
2227                         }
2228
2229                 data+=size;
2230                 }
2231
2232         *p = data;
2233
2234         ri_check:
2235
2236         /* Need RI if renegotiating */
2237
2238         if (!renegotiate_seen && s->renegotiate &&
2239                 !(s->options & SSL_OP_ALLOW_UNSAFE_LEGACY_RENEGOTIATION))
2240                 {
2241                 *al = SSL_AD_HANDSHAKE_FAILURE;
2242                 SSLerr(SSL_F_SSL_SCAN_CLIENTHELLO_TLSEXT,
2243                                 SSL_R_UNSAFE_LEGACY_RENEGOTIATION_DISABLED);
2244                 return 0;
2245                 }
2246         /* If no signature algorithms extension set default values */
2247         if (!s->cert->peer_sigalgs)
2248                 ssl_cert_set_default_md(s->cert);
2249
2250         return 1;
2251         }
2252
2253 int ssl_parse_clienthello_tlsext(SSL *s, unsigned char **p, unsigned char *d, int n)
2254         {
2255         int al = -1;
2256         if (ssl_scan_clienthello_tlsext(s, p, d, n, &al) <= 0)
2257                 {
2258                 ssl3_send_alert(s,SSL3_AL_FATAL,al);
2259                 return 0;
2260                 }
2261
2262         if (ssl_check_clienthello_tlsext_early(s) <= 0)
2263                 {
2264                 SSLerr(SSL_F_SSL_PARSE_CLIENTHELLO_TLSEXT,SSL_R_CLIENTHELLO_TLSEXT);
2265                 return 0;
2266                 }
2267         return 1;
2268 }
2269
2270 #ifndef OPENSSL_NO_NEXTPROTONEG
2271 /* ssl_next_proto_validate validates a Next Protocol Negotiation block. No
2272  * elements of zero length are allowed and the set of elements must exactly fill
2273  * the length of the block. */
2274 static char ssl_next_proto_validate(unsigned char *d, unsigned len)
2275         {
2276         unsigned int off = 0;
2277
2278         while (off < len)
2279                 {
2280                 if (d[off] == 0)
2281                         return 0;
2282                 off += d[off];
2283                 off++;
2284                 }
2285
2286         return off == len;
2287         }
2288 #endif
2289
2290 static int ssl_scan_serverhello_tlsext(SSL *s, unsigned char **p, unsigned char *d, int n, int *al)
2291         {
2292         unsigned short length;
2293         unsigned short type;
2294         unsigned short size;
2295         unsigned char *data = *p;
2296         int tlsext_servername = 0;
2297         int renegotiate_seen = 0;
2298
2299 #ifndef OPENSSL_NO_NEXTPROTONEG
2300         s->s3->next_proto_neg_seen = 0;
2301 #endif
2302
2303 #ifndef OPENSSL_NO_HEARTBEATS
2304         s->tlsext_heartbeat &= ~(SSL_TLSEXT_HB_ENABLED |
2305                                SSL_TLSEXT_HB_DONT_SEND_REQUESTS);
2306 #endif
2307
2308         if (data >= (d+n-2))
2309                 goto ri_check;
2310
2311         n2s(data,length);
2312         if (data+length != d+n)
2313                 {
2314                 *al = SSL_AD_DECODE_ERROR;
2315                 return 0;
2316                 }
2317
2318         while(data <= (d+n-4))
2319                 {
2320                 n2s(data,type);
2321                 n2s(data,size);
2322
2323                 if (data+size > (d+n))
2324                         goto ri_check;
2325
2326                 if (s->tlsext_debug_cb)
2327                         s->tlsext_debug_cb(s, 1, type, data, size,
2328                                                 s->tlsext_debug_arg);
2329
2330                 if (type == TLSEXT_TYPE_server_name)
2331                         {
2332                         if (s->tlsext_hostname == NULL || size > 0)
2333                                 {
2334                                 *al = TLS1_AD_UNRECOGNIZED_NAME;
2335                                 return 0;
2336                                 }
2337                         tlsext_servername = 1;
2338                         }
2339
2340 #ifndef OPENSSL_NO_EC
2341                 else if (type == TLSEXT_TYPE_ec_point_formats &&
2342                      s->version != DTLS1_VERSION)
2343                         {
2344                         unsigned char *sdata = data;
2345                         int ecpointformatlist_length = *(sdata++);
2346
2347                         if (ecpointformatlist_length != size - 1 ||
2348                                 ecpointformatlist_length < 1)
2349                                 {
2350                                 *al = TLS1_AD_DECODE_ERROR;
2351                                 return 0;
2352                                 }
2353                         s->session->tlsext_ecpointformatlist_length = 0;
2354                         if (s->session->tlsext_ecpointformatlist != NULL) OPENSSL_free(s->session->tlsext_ecpointformatlist);
2355                         if ((s->session->tlsext_ecpointformatlist = OPENSSL_malloc(ecpointformatlist_length)) == NULL)
2356                                 {
2357                                 *al = TLS1_AD_INTERNAL_ERROR;
2358                                 return 0;
2359                                 }
2360                         s->session->tlsext_ecpointformatlist_length = ecpointformatlist_length;
2361                         memcpy(s->session->tlsext_ecpointformatlist, sdata, ecpointformatlist_length);
2362 #if 0
2363                         fprintf(stderr,"ssl_parse_serverhello_tlsext s->session->tlsext_ecpointformatlist ");
2364                         sdata = s->session->tlsext_ecpointformatlist;
2365                         for (i = 0; i < s->session->tlsext_ecpointformatlist_length; i++)
2366                                 fprintf(stderr,"%i ",*(sdata++));
2367                         fprintf(stderr,"\n");
2368 #endif
2369                         }
2370 #endif /* OPENSSL_NO_EC */
2371
2372                 else if (type == TLSEXT_TYPE_session_ticket)
2373                         {
2374                         if (s->tls_session_ticket_ext_cb &&
2375                             !s->tls_session_ticket_ext_cb(s, data, size, s->tls_session_ticket_ext_cb_arg))
2376                                 {
2377                                 *al = TLS1_AD_INTERNAL_ERROR;
2378                                 return 0;
2379                                 }
2380                         if ((SSL_get_options(s) & SSL_OP_NO_TICKET)
2381                                 || (size > 0))
2382                                 {
2383                                 *al = TLS1_AD_UNSUPPORTED_EXTENSION;
2384                                 return 0;
2385                                 }
2386                         s->tlsext_ticket_expected = 1;
2387                         }
2388 #ifdef TLSEXT_TYPE_opaque_prf_input
2389                 else if (type == TLSEXT_TYPE_opaque_prf_input &&
2390                      s->version != DTLS1_VERSION)
2391                         {
2392                         unsigned char *sdata = data;
2393
2394                         if (size < 2)
2395                                 {
2396                                 *al = SSL_AD_DECODE_ERROR;
2397                                 return 0;
2398                                 }
2399                         n2s(sdata, s->s3->server_opaque_prf_input_len);
2400                         if (s->s3->server_opaque_prf_input_len != size - 2)
2401                                 {
2402                                 *al = SSL_AD_DECODE_ERROR;
2403                                 return 0;
2404                                 }
2405
2406                         if (s->s3->server_opaque_prf_input != NULL) /* shouldn't really happen */
2407                                 OPENSSL_free(s->s3->server_opaque_prf_input);
2408                         if (s->s3->server_opaque_prf_input_len == 0)
2409                                 s->s3->server_opaque_prf_input = OPENSSL_malloc(1); /* dummy byte just to get non-NULL */
2410                         else
2411                                 s->s3->server_opaque_prf_input = BUF_memdup(sdata, s->s3->server_opaque_prf_input_len);
2412
2413                         if (s->s3->server_opaque_prf_input == NULL)
2414                                 {
2415                                 *al = TLS1_AD_INTERNAL_ERROR;
2416                                 return 0;
2417                                 }
2418                         }
2419 #endif
2420                 else if (type == TLSEXT_TYPE_status_request &&
2421                          s->version != DTLS1_VERSION)
2422                         {
2423                         /* MUST be empty and only sent if we've requested
2424                          * a status request message.
2425                          */
2426                         if ((s->tlsext_status_type == -1) || (size > 0))
2427                                 {
2428                                 *al = TLS1_AD_UNSUPPORTED_EXTENSION;
2429                                 return 0;
2430                                 }
2431                         /* Set flag to expect CertificateStatus message */
2432                         s->tlsext_status_expected = 1;
2433                         }
2434 #ifndef OPENSSL_NO_NEXTPROTONEG
2435                 else if (type == TLSEXT_TYPE_next_proto_neg &&
2436                          s->s3->tmp.finish_md_len == 0)
2437                         {
2438                         unsigned char *selected;
2439                         unsigned char selected_len;
2440
2441                         /* We must have requested it. */
2442                         if ((s->ctx->next_proto_select_cb == NULL))
2443                                 {
2444                                 *al = TLS1_AD_UNSUPPORTED_EXTENSION;
2445                                 return 0;
2446                                 }
2447                         /* The data must be valid */
2448                         if (!ssl_next_proto_validate(data, size))
2449                                 {
2450                                 *al = TLS1_AD_DECODE_ERROR;
2451                                 return 0;
2452                                 }
2453                         if (s->ctx->next_proto_select_cb(s, &selected, &selected_len, data, size, s->ctx->next_proto_select_cb_arg) != SSL_TLSEXT_ERR_OK)
2454                                 {
2455                                 *al = TLS1_AD_INTERNAL_ERROR;
2456                                 return 0;
2457                                 }
2458                         s->next_proto_negotiated = OPENSSL_malloc(selected_len);
2459                         if (!s->next_proto_negotiated)
2460                                 {
2461                                 *al = TLS1_AD_INTERNAL_ERROR;
2462                                 return 0;
2463                                 }
2464                         memcpy(s->next_proto_negotiated, selected, selected_len);
2465                         s->next_proto_negotiated_len = selected_len;
2466                         s->s3->next_proto_neg_seen = 1;
2467                         }
2468 #endif
2469                 else if (type == TLSEXT_TYPE_renegotiate)
2470                         {
2471                         if(!ssl_parse_serverhello_renegotiate_ext(s, data, size, al))
2472                                 return 0;
2473                         renegotiate_seen = 1;
2474                         }
2475 #ifndef OPENSSL_NO_HEARTBEATS
2476                 else if (type == TLSEXT_TYPE_heartbeat)
2477                         {
2478                         switch(data[0])
2479                                 {
2480                                 case 0x01:      /* Server allows us to send HB requests */
2481                                                         s->tlsext_heartbeat |= SSL_TLSEXT_HB_ENABLED;
2482                                                         break;
2483                                 case 0x02:      /* Server doesn't accept HB requests */
2484                                                         s->tlsext_heartbeat |= SSL_TLSEXT_HB_ENABLED;
2485                                                         s->tlsext_heartbeat |= SSL_TLSEXT_HB_DONT_SEND_REQUESTS;
2486                                                         break;
2487                                 default:        *al = SSL_AD_ILLEGAL_PARAMETER;
2488                                                         return 0;
2489                                 }
2490                         }
2491 #endif
2492                 else if (type == TLSEXT_TYPE_use_srtp)
2493                         {
2494                         if(ssl_parse_serverhello_use_srtp_ext(s, data, size,
2495                                                               al))
2496                                 return 0;
2497                         }
2498
2499                 else if (type == TLSEXT_TYPE_server_authz)
2500                         {
2501                         /* We only support audit proofs. It's an error to send
2502                          * an authz hello extension if the client
2503                          * didn't request a proof. */
2504                         unsigned char *sdata = data;
2505                         unsigned char server_authz_dataformatlist_length;
2506
2507                         if (!s->ctx->tlsext_authz_server_audit_proof_cb)
2508                                 {
2509                                 *al = TLS1_AD_UNSUPPORTED_EXTENSION;
2510                                 return 0;
2511                                 }
2512
2513                         if (!size)
2514                                 {
2515                                 *al = TLS1_AD_DECODE_ERROR;
2516                                 return 0;
2517                                 }
2518
2519                         server_authz_dataformatlist_length = *(sdata++);
2520                         if (server_authz_dataformatlist_length != size - 1)
2521                                 {
2522                                 *al = TLS1_AD_DECODE_ERROR;
2523                                 return 0;
2524                                 }
2525
2526                         /* We only support audit proofs, so a legal ServerHello
2527                          * authz list contains exactly one entry. */
2528                         if (server_authz_dataformatlist_length != 1 ||
2529                                 sdata[0] != TLSEXT_AUTHZDATAFORMAT_audit_proof)
2530                                 {
2531                                 *al = TLS1_AD_UNSUPPORTED_EXTENSION;
2532                                 return 0;
2533                                 }
2534
2535                         s->s3->tlsext_authz_server_promised = 1;
2536                         }
2537
2538                 data += size;
2539                 }
2540
2541         if (data != d+n)
2542                 {
2543                 *al = SSL_AD_DECODE_ERROR;
2544                 return 0;
2545                 }
2546
2547         if (!s->hit && tlsext_servername == 1)
2548                 {
2549                 if (s->tlsext_hostname)
2550                         {
2551                         if (s->session->tlsext_hostname == NULL)
2552                                 {
2553                                 s->session->tlsext_hostname = BUF_strdup(s->tlsext_hostname);
2554                                 if (!s->session->tlsext_hostname)
2555                                         {
2556                                         *al = SSL_AD_UNRECOGNIZED_NAME;
2557                                         return 0;
2558                                         }
2559                                 }
2560                         else
2561                                 {
2562                                 *al = SSL_AD_DECODE_ERROR;
2563                                 return 0;
2564                                 }
2565                         }
2566                 }
2567
2568         *p = data;
2569
2570         ri_check:
2571
2572         /* Determine if we need to see RI. Strictly speaking if we want to
2573          * avoid an attack we should *always* see RI even on initial server
2574          * hello because the client doesn't see any renegotiation during an
2575          * attack. However this would mean we could not connect to any server
2576          * which doesn't support RI so for the immediate future tolerate RI
2577          * absence on initial connect only.
2578          */
2579         if (!renegotiate_seen
2580                 && !(s->options & SSL_OP_LEGACY_SERVER_CONNECT)
2581                 && !(s->options & SSL_OP_ALLOW_UNSAFE_LEGACY_RENEGOTIATION))
2582                 {
2583                 *al = SSL_AD_HANDSHAKE_FAILURE;
2584                 SSLerr(SSL_F_SSL_SCAN_SERVERHELLO_TLSEXT,
2585                                 SSL_R_UNSAFE_LEGACY_RENEGOTIATION_DISABLED);
2586                 return 0;
2587                 }
2588
2589         return 1;
2590         }
2591
2592
2593 int ssl_prepare_clienthello_tlsext(SSL *s)
2594         {
2595
2596 #ifdef TLSEXT_TYPE_opaque_prf_input
2597         {
2598                 int r = 1;
2599
2600                 if (s->ctx->tlsext_opaque_prf_input_callback != 0)
2601                         {
2602                         r = s->ctx->tlsext_opaque_prf_input_callback(s, NULL, 0, s->ctx->tlsext_opaque_prf_input_callback_arg);
2603                         if (!r)
2604                                 return -1;
2605                         }
2606
2607                 if (s->tlsext_opaque_prf_input != NULL)
2608                         {
2609                         if (s->s3->client_opaque_prf_input != NULL) /* shouldn't really happen */
2610                                 OPENSSL_free(s->s3->client_opaque_prf_input);
2611
2612                         if (s->tlsext_opaque_prf_input_len == 0)
2613                                 s->s3->client_opaque_prf_input = OPENSSL_malloc(1); /* dummy byte just to get non-NULL */
2614                         else
2615                                 s->s3->client_opaque_prf_input = BUF_memdup(s->tlsext_opaque_prf_input, s->tlsext_opaque_prf_input_len);
2616                         if (s->s3->client_opaque_prf_input == NULL)
2617                                 {
2618                                 SSLerr(SSL_F_SSL_PREPARE_CLIENTHELLO_TLSEXT,ERR_R_MALLOC_FAILURE);
2619                                 return -1;
2620                                 }
2621                         s->s3->client_opaque_prf_input_len = s->tlsext_opaque_prf_input_len;
2622                         }
2623
2624                 if (r == 2)
2625                         /* at callback's request, insist on receiving an appropriate server opaque PRF input */
2626                         s->s3->server_opaque_prf_input_len = s->tlsext_opaque_prf_input_len;
2627         }
2628 #endif
2629
2630         return 1;
2631         }
2632
2633 int ssl_prepare_serverhello_tlsext(SSL *s)
2634         {
2635         return 1;
2636         }
2637
2638 static int ssl_check_clienthello_tlsext_early(SSL *s)
2639         {
2640         int ret=SSL_TLSEXT_ERR_NOACK;
2641         int al = SSL_AD_UNRECOGNIZED_NAME;
2642
2643 #ifndef OPENSSL_NO_EC
2644         /* The handling of the ECPointFormats extension is done elsewhere, namely in
2645          * ssl3_choose_cipher in s3_lib.c.
2646          */
2647         /* The handling of the EllipticCurves extension is done elsewhere, namely in
2648          * ssl3_choose_cipher in s3_lib.c.
2649          */
2650 #endif
2651
2652         if (s->ctx != NULL && s->ctx->tlsext_servername_callback != 0)
2653                 ret = s->ctx->tlsext_servername_callback(s, &al, s->ctx->tlsext_servername_arg);
2654         else if (s->initial_ctx != NULL && s->initial_ctx->tlsext_servername_callback != 0)
2655                 ret = s->initial_ctx->tlsext_servername_callback(s, &al, s->initial_ctx->tlsext_servername_arg);
2656
2657 #ifdef TLSEXT_TYPE_opaque_prf_input
2658         {
2659                 /* This sort of belongs into ssl_prepare_serverhello_tlsext(),
2660                  * but we might be sending an alert in response to the client hello,
2661                  * so this has to happen here in
2662                  * ssl_check_clienthello_tlsext_early(). */
2663
2664                 int r = 1;
2665
2666                 if (s->ctx->tlsext_opaque_prf_input_callback != 0)
2667                         {
2668                         r = s->ctx->tlsext_opaque_prf_input_callback(s, NULL, 0, s->ctx->tlsext_opaque_prf_input_callback_arg);
2669                         if (!r)
2670                                 {
2671                                 ret = SSL_TLSEXT_ERR_ALERT_FATAL;
2672                                 al = SSL_AD_INTERNAL_ERROR;
2673                                 goto err;
2674                                 }
2675                         }
2676
2677                 if (s->s3->server_opaque_prf_input != NULL) /* shouldn't really happen */
2678                         OPENSSL_free(s->s3->server_opaque_prf_input);
2679                 s->s3->server_opaque_prf_input = NULL;
2680
2681                 if (s->tlsext_opaque_prf_input != NULL)
2682                         {
2683                         if (s->s3->client_opaque_prf_input != NULL &&
2684                                 s->s3->client_opaque_prf_input_len == s->tlsext_opaque_prf_input_len)
2685                                 {
2686                                 /* can only use this extension if we have a server opaque PRF input
2687                                  * of the same length as the client opaque PRF input! */
2688
2689                                 if (s->tlsext_opaque_prf_input_len == 0)
2690                                         s->s3->server_opaque_prf_input = OPENSSL_malloc(1); /* dummy byte just to get non-NULL */
2691                                 else
2692                                         s->s3->server_opaque_prf_input = BUF_memdup(s->tlsext_opaque_prf_input, s->tlsext_opaque_prf_input_len);
2693                                 if (s->s3->server_opaque_prf_input == NULL)
2694                                         {
2695                                         ret = SSL_TLSEXT_ERR_ALERT_FATAL;
2696                                         al = SSL_AD_INTERNAL_ERROR;
2697                                         goto err;
2698                                         }
2699                                 s->s3->server_opaque_prf_input_len = s->tlsext_opaque_prf_input_len;
2700                                 }
2701                         }
2702
2703                 if (r == 2 && s->s3->server_opaque_prf_input == NULL)
2704                         {
2705                         /* The callback wants to enforce use of the extension,
2706                          * but we can't do that with the client opaque PRF input;
2707                          * abort the handshake.
2708                          */
2709                         ret = SSL_TLSEXT_ERR_ALERT_FATAL;
2710                         al = SSL_AD_HANDSHAKE_FAILURE;
2711                         }
2712         }
2713
2714  err:
2715 #endif
2716         switch (ret)
2717                 {
2718                 case SSL_TLSEXT_ERR_ALERT_FATAL:
2719                         ssl3_send_alert(s,SSL3_AL_FATAL,al);
2720                         return -1;
2721
2722                 case SSL_TLSEXT_ERR_ALERT_WARNING:
2723                         ssl3_send_alert(s,SSL3_AL_WARNING,al);
2724                         return 1;
2725
2726                 case SSL_TLSEXT_ERR_NOACK:
2727                         s->servername_done=0;
2728                         default:
2729                 return 1;
2730                 }
2731         }
2732
2733 int ssl_check_clienthello_tlsext_late(SSL *s)
2734         {
2735         int ret = SSL_TLSEXT_ERR_OK;
2736         int al;
2737
2738         /* If status request then ask callback what to do.
2739          * Note: this must be called after servername callbacks in case
2740          * the certificate has changed, and must be called after the cipher
2741          * has been chosen because this may influence which certificate is sent
2742          */
2743         if ((s->tlsext_status_type != -1) && s->ctx && s->ctx->tlsext_status_cb)
2744                 {
2745                 int r;
2746                 CERT_PKEY *certpkey;
2747                 certpkey = ssl_get_server_send_pkey(s);
2748                 /* If no certificate can't return certificate status */
2749                 if (certpkey == NULL)
2750                         {
2751                         s->tlsext_status_expected = 0;
2752                         return 1;
2753                         }
2754                 /* Set current certificate to one we will use so
2755                  * SSL_get_certificate et al can pick it up.
2756                  */
2757                 s->cert->key = certpkey;
2758                 r = s->ctx->tlsext_status_cb(s, s->ctx->tlsext_status_arg);
2759                 switch (r)
2760                         {
2761                         /* We don't want to send a status request response */
2762                         case SSL_TLSEXT_ERR_NOACK:
2763                                 s->tlsext_status_expected = 0;
2764                                 break;
2765                         /* status request response should be sent */
2766                         case SSL_TLSEXT_ERR_OK:
2767                                 if (s->tlsext_ocsp_resp)
2768                                         s->tlsext_status_expected = 1;
2769                                 else
2770                                         s->tlsext_status_expected = 0;
2771                                 break;
2772                         /* something bad happened */
2773                         case SSL_TLSEXT_ERR_ALERT_FATAL:
2774                                 ret = SSL_TLSEXT_ERR_ALERT_FATAL;
2775                                 al = SSL_AD_INTERNAL_ERROR;
2776                                 goto err;
2777                         }
2778                 }
2779         else
2780                 s->tlsext_status_expected = 0;
2781
2782  err:
2783         switch (ret)
2784                 {
2785                 case SSL_TLSEXT_ERR_ALERT_FATAL:
2786                         ssl3_send_alert(s, SSL3_AL_FATAL,al);
2787                         return -1;
2788
2789                 case SSL_TLSEXT_ERR_ALERT_WARNING:
2790                         ssl3_send_alert(s, SSL3_AL_WARNING,al);
2791                         return 1;
2792
2793                 default:
2794                         return 1;
2795                 }
2796         }
2797
2798 int ssl_check_serverhello_tlsext(SSL *s)
2799         {
2800         int ret=SSL_TLSEXT_ERR_NOACK;
2801         int al = SSL_AD_UNRECOGNIZED_NAME;
2802
2803 #ifndef OPENSSL_NO_EC
2804         /* If we are client and using an elliptic curve cryptography cipher
2805          * suite, then if server returns an EC point formats lists extension
2806          * it must contain uncompressed.
2807          */
2808         unsigned long alg_k = s->s3->tmp.new_cipher->algorithm_mkey;
2809         unsigned long alg_a = s->s3->tmp.new_cipher->algorithm_auth;
2810         if ((s->tlsext_ecpointformatlist != NULL) && (s->tlsext_ecpointformatlist_length > 0) &&
2811             (s->session->tlsext_ecpointformatlist != NULL) && (s->session->tlsext_ecpointformatlist_length > 0) &&
2812             ((alg_k & (SSL_kEECDH|SSL_kECDHr|SSL_kECDHe)) || (alg_a & SSL_aECDSA)))
2813                 {
2814                 /* we are using an ECC cipher */
2815                 size_t i;
2816                 unsigned char *list;
2817                 int found_uncompressed = 0;
2818                 list = s->session->tlsext_ecpointformatlist;
2819                 for (i = 0; i < s->session->tlsext_ecpointformatlist_length; i++)
2820                         {
2821                         if (*(list++) == TLSEXT_ECPOINTFORMAT_uncompressed)
2822                                 {
2823                                 found_uncompressed = 1;
2824                                 break;
2825                                 }
2826                         }
2827                 if (!found_uncompressed)
2828                         {
2829                         SSLerr(SSL_F_SSL_CHECK_SERVERHELLO_TLSEXT,SSL_R_TLS_INVALID_ECPOINTFORMAT_LIST);
2830                         return -1;
2831                         }
2832                 }
2833         ret = SSL_TLSEXT_ERR_OK;
2834 #endif /* OPENSSL_NO_EC */
2835
2836         if (s->ctx != NULL && s->ctx->tlsext_servername_callback != 0)
2837                 ret = s->ctx->tlsext_servername_callback(s, &al, s->ctx->tlsext_servername_arg);
2838         else if (s->initial_ctx != NULL && s->initial_ctx->tlsext_servername_callback != 0)
2839                 ret = s->initial_ctx->tlsext_servername_callback(s, &al, s->initial_ctx->tlsext_servername_arg);
2840
2841 #ifdef TLSEXT_TYPE_opaque_prf_input
2842         if (s->s3->server_opaque_prf_input_len > 0)
2843                 {
2844                 /* This case may indicate that we, as a client, want to insist on using opaque PRF inputs.
2845                  * So first verify that we really have a value from the server too. */
2846
2847                 if (s->s3->server_opaque_prf_input == NULL)
2848                         {
2849                         ret = SSL_TLSEXT_ERR_ALERT_FATAL;
2850                         al = SSL_AD_HANDSHAKE_FAILURE;
2851                         }
2852
2853                 /* Anytime the server *has* sent an opaque PRF input, we need to check
2854                  * that we have a client opaque PRF input of the same size. */
2855                 if (s->s3->client_opaque_prf_input == NULL ||
2856                     s->s3->client_opaque_prf_input_len != s->s3->server_opaque_prf_input_len)
2857                         {
2858                         ret = SSL_TLSEXT_ERR_ALERT_FATAL;
2859                         al = SSL_AD_ILLEGAL_PARAMETER;
2860                         }
2861                 }
2862 #endif
2863
2864         /* If we've requested certificate status and we wont get one
2865          * tell the callback
2866          */
2867         if ((s->tlsext_status_type != -1) && !(s->tlsext_status_expected)
2868                         && s->ctx && s->ctx->tlsext_status_cb)
2869                 {
2870                 int r;
2871                 /* Set resp to NULL, resplen to -1 so callback knows
2872                  * there is no response.
2873                  */
2874                 if (s->tlsext_ocsp_resp)
2875                         {
2876                         OPENSSL_free(s->tlsext_ocsp_resp);
2877                         s->tlsext_ocsp_resp = NULL;
2878                         }
2879                 s->tlsext_ocsp_resplen = -1;
2880                 r = s->ctx->tlsext_status_cb(s, s->ctx->tlsext_status_arg);
2881                 if (r == 0)
2882                         {
2883                         al = SSL_AD_BAD_CERTIFICATE_STATUS_RESPONSE;
2884                         ret = SSL_TLSEXT_ERR_ALERT_FATAL;
2885                         }
2886                 if (r < 0)
2887                         {
2888                         al = SSL_AD_INTERNAL_ERROR;
2889                         ret = SSL_TLSEXT_ERR_ALERT_FATAL;
2890                         }
2891                 }
2892
2893         switch (ret)
2894                 {
2895                 case SSL_TLSEXT_ERR_ALERT_FATAL:
2896                         ssl3_send_alert(s,SSL3_AL_FATAL,al);
2897                         return -1;
2898
2899                 case SSL_TLSEXT_ERR_ALERT_WARNING:
2900                         ssl3_send_alert(s,SSL3_AL_WARNING,al);
2901                         return 1;
2902
2903                 case SSL_TLSEXT_ERR_NOACK:
2904                         s->servername_done=0;
2905                         default:
2906                 return 1;
2907                 }
2908         }
2909
2910 int ssl_parse_serverhello_tlsext(SSL *s, unsigned char **p, unsigned char *d, int n)
2911         {
2912         int al = -1;
2913         if (s->version < SSL3_VERSION)
2914                 return 1;
2915         if (ssl_scan_serverhello_tlsext(s, p, d, n, &al) <= 0)
2916                 {
2917                 ssl3_send_alert(s,SSL3_AL_FATAL,al);
2918                 return 0;
2919                 }
2920
2921         if (ssl_check_serverhello_tlsext(s) <= 0)
2922                 {
2923                 SSLerr(SSL_F_SSL_PARSE_SERVERHELLO_TLSEXT,SSL_R_SERVERHELLO_TLSEXT);
2924                 return 0;
2925                 }
2926         return 1;
2927 }
2928
2929 /* Since the server cache lookup is done early on in the processing of the
2930  * ClientHello, and other operations depend on the result, we need to handle
2931  * any TLS session ticket extension at the same time.
2932  *
2933  *   session_id: points at the session ID in the ClientHello. This code will
2934  *       read past the end of this in order to parse out the session ticket
2935  *       extension, if any.
2936  *   len: the length of the session ID.
2937  *   limit: a pointer to the first byte after the ClientHello.
2938  *   ret: (output) on return, if a ticket was decrypted, then this is set to
2939  *       point to the resulting session.
2940  *
2941  * If s->tls_session_secret_cb is set then we are expecting a pre-shared key
2942  * ciphersuite, in which case we have no use for session tickets and one will
2943  * never be decrypted, nor will s->tlsext_ticket_expected be set to 1.
2944  *
2945  * Returns:
2946  *   -1: fatal error, either from parsing or decrypting the ticket.
2947  *    0: no ticket was found (or was ignored, based on settings).
2948  *    1: a zero length extension was found, indicating that the client supports
2949  *       session tickets but doesn't currently have one to offer.
2950  *    2: either s->tls_session_secret_cb was set, or a ticket was offered but
2951  *       couldn't be decrypted because of a non-fatal error.
2952  *    3: a ticket was successfully decrypted and *ret was set.
2953  *
2954  * Side effects:
2955  *   Sets s->tlsext_ticket_expected to 1 if the server will have to issue
2956  *   a new session ticket to the client because the client indicated support
2957  *   (and s->tls_session_secret_cb is NULL) but the client either doesn't have
2958  *   a session ticket or we couldn't use the one it gave us, or if
2959  *   s->ctx->tlsext_ticket_key_cb asked to renew the client's ticket.
2960  *   Otherwise, s->tlsext_ticket_expected is set to 0.
2961  */
2962 int tls1_process_ticket(SSL *s, unsigned char *session_id, int len,
2963                         const unsigned char *limit, SSL_SESSION **ret)
2964         {
2965         /* Point after session ID in client hello */
2966         const unsigned char *p = session_id + len;
2967         unsigned short i;
2968
2969         *ret = NULL;
2970         s->tlsext_ticket_expected = 0;
2971
2972         /* If tickets disabled behave as if no ticket present
2973          * to permit stateful resumption.
2974          */
2975         if (SSL_get_options(s) & SSL_OP_NO_TICKET)
2976                 return 0;
2977         if ((s->version <= SSL3_VERSION) || !limit)
2978                 return 0;
2979         if (p >= limit)
2980                 return -1;
2981         /* Skip past DTLS cookie */
2982         if (s->version == DTLS1_VERSION || s->version == DTLS1_BAD_VER)
2983                 {
2984                 i = *(p++);
2985                 p+= i;
2986                 if (p >= limit)
2987                         return -1;
2988                 }
2989         /* Skip past cipher list */
2990         n2s(p, i);
2991         p+= i;
2992         if (p >= limit)
2993                 return -1;
2994         /* Skip past compression algorithm list */
2995         i = *(p++);
2996         p += i;
2997         if (p > limit)
2998                 return -1;
2999         /* Now at start of extensions */
3000         if ((p + 2) >= limit)
3001                 return 0;
3002         n2s(p, i);
3003         while ((p + 4) <= limit)
3004                 {
3005                 unsigned short type, size;
3006                 n2s(p, type);
3007                 n2s(p, size);
3008                 if (p + size > limit)
3009                         return 0;
3010                 if (type == TLSEXT_TYPE_session_ticket)
3011                         {
3012                         int r;
3013                         if (size == 0)
3014                                 {
3015                                 /* The client will accept a ticket but doesn't
3016                                  * currently have one. */
3017                                 s->tlsext_ticket_expected = 1;
3018                                 return 1;
3019                                 }
3020                         if (s->tls_session_secret_cb)
3021                                 {
3022                                 /* Indicate that the ticket couldn't be
3023                                  * decrypted rather than generating the session
3024                                  * from ticket now, trigger abbreviated
3025                                  * handshake based on external mechanism to
3026                                  * calculate the master secret later. */
3027                                 return 2;
3028                                 }
3029                         r = tls_decrypt_ticket(s, p, size, session_id, len, ret);
3030                         switch (r)
3031                                 {
3032                                 case 2: /* ticket couldn't be decrypted */
3033                                         s->tlsext_ticket_expected = 1;
3034                                         return 2;
3035                                 case 3: /* ticket was decrypted */
3036                                         return r;
3037                                 case 4: /* ticket decrypted but need to renew */
3038                                         s->tlsext_ticket_expected = 1;
3039                                         return 3;
3040                                 default: /* fatal error */
3041                                         return -1;
3042                                 }
3043                         }
3044                 p += size;
3045                 }
3046         return 0;
3047         }
3048
3049 /* tls_decrypt_ticket attempts to decrypt a session ticket.
3050  *
3051  *   etick: points to the body of the session ticket extension.
3052  *   eticklen: the length of the session tickets extenion.
3053  *   sess_id: points at the session ID.
3054  *   sesslen: the length of the session ID.
3055  *   psess: (output) on return, if a ticket was decrypted, then this is set to
3056  *       point to the resulting session.
3057  *
3058  * Returns:
3059  *   -1: fatal error, either from parsing or decrypting the ticket.
3060  *    2: the ticket couldn't be decrypted.
3061  *    3: a ticket was successfully decrypted and *psess was set.
3062  *    4: same as 3, but the ticket needs to be renewed.
3063  */
3064 static int tls_decrypt_ticket(SSL *s, const unsigned char *etick, int eticklen,
3065                                 const unsigned char *sess_id, int sesslen,
3066                                 SSL_SESSION **psess)
3067         {
3068         SSL_SESSION *sess;
3069         unsigned char *sdec;
3070         const unsigned char *p;
3071         int slen, mlen, renew_ticket = 0;
3072         unsigned char tick_hmac[EVP_MAX_MD_SIZE];
3073         HMAC_CTX hctx;
3074         EVP_CIPHER_CTX ctx;
3075         SSL_CTX *tctx = s->initial_ctx;
3076         /* Need at least keyname + iv + some encrypted data */
3077         if (eticklen < 48)
3078                 return 2;
3079         /* Initialize session ticket encryption and HMAC contexts */
3080         HMAC_CTX_init(&hctx);
3081         EVP_CIPHER_CTX_init(&ctx);
3082         if (tctx->tlsext_ticket_key_cb)
3083                 {
3084                 unsigned char *nctick = (unsigned char *)etick;
3085                 int rv = tctx->tlsext_ticket_key_cb(s, nctick, nctick + 16,
3086                                                         &ctx, &hctx, 0);
3087                 if (rv < 0)
3088                         return -1;
3089                 if (rv == 0)
3090                         return 2;
3091                 if (rv == 2)
3092                         renew_ticket = 1;
3093                 }
3094         else
3095                 {
3096                 /* Check key name matches */
3097                 if (memcmp(etick, tctx->tlsext_tick_key_name, 16))
3098                         return 2;
3099                 HMAC_Init_ex(&hctx, tctx->tlsext_tick_hmac_key, 16,
3100                                         tlsext_tick_md(), NULL);
3101                 EVP_DecryptInit_ex(&ctx, EVP_aes_128_cbc(), NULL,
3102                                 tctx->tlsext_tick_aes_key, etick + 16);
3103                 }
3104         /* Attempt to process session ticket, first conduct sanity and
3105          * integrity checks on ticket.
3106          */
3107         mlen = HMAC_size(&hctx);
3108         if (mlen < 0)
3109                 {
3110                 EVP_CIPHER_CTX_cleanup(&ctx);
3111                 return -1;
3112                 }
3113         eticklen -= mlen;
3114         /* Check HMAC of encrypted ticket */
3115         HMAC_Update(&hctx, etick, eticklen);
3116         HMAC_Final(&hctx, tick_hmac, NULL);
3117         HMAC_CTX_cleanup(&hctx);
3118         if (memcmp(tick_hmac, etick + eticklen, mlen))
3119                 return 2;
3120         /* Attempt to decrypt session data */
3121         /* Move p after IV to start of encrypted ticket, update length */
3122         p = etick + 16 + EVP_CIPHER_CTX_iv_length(&ctx);
3123         eticklen -= 16 + EVP_CIPHER_CTX_iv_length(&ctx);
3124         sdec = OPENSSL_malloc(eticklen);
3125         if (!sdec)
3126                 {
3127                 EVP_CIPHER_CTX_cleanup(&ctx);
3128                 return -1;
3129                 }
3130         EVP_DecryptUpdate(&ctx, sdec, &slen, p, eticklen);
3131         if (EVP_DecryptFinal(&ctx, sdec + slen, &mlen) <= 0)
3132                 return 2;
3133         slen += mlen;
3134         EVP_CIPHER_CTX_cleanup(&ctx);
3135         p = sdec;
3136
3137         sess = d2i_SSL_SESSION(NULL, &p, slen);
3138         OPENSSL_free(sdec);
3139         if (sess)
3140                 {
3141                 /* The session ID, if non-empty, is used by some clients to
3142                  * detect that the ticket has been accepted. So we copy it to
3143                  * the session structure. If it is empty set length to zero
3144                  * as required by standard.
3145                  */
3146                 if (sesslen)
3147                         memcpy(sess->session_id, sess_id, sesslen);
3148                 sess->session_id_length = sesslen;
3149                 *psess = sess;
3150                 if (renew_ticket)
3151                         return 4;
3152                 else
3153                         return 3;
3154                 }
3155         ERR_clear_error();
3156         /* For session parse failure, indicate that we need to send a new
3157          * ticket. */
3158         return 2;
3159         }
3160
3161 /* Tables to translate from NIDs to TLS v1.2 ids */
3162
3163 typedef struct
3164         {
3165         int nid;
3166         int id;
3167         } tls12_lookup;
3168
3169 static tls12_lookup tls12_md[] = {
3170         {NID_md5, TLSEXT_hash_md5},
3171         {NID_sha1, TLSEXT_hash_sha1},
3172         {NID_sha224, TLSEXT_hash_sha224},
3173         {NID_sha256, TLSEXT_hash_sha256},
3174         {NID_sha384, TLSEXT_hash_sha384},
3175         {NID_sha512, TLSEXT_hash_sha512}
3176 };
3177
3178 static tls12_lookup tls12_sig[] = {
3179         {EVP_PKEY_RSA, TLSEXT_signature_rsa},
3180         {EVP_PKEY_DSA, TLSEXT_signature_dsa},
3181         {EVP_PKEY_EC, TLSEXT_signature_ecdsa}
3182 };
3183
3184 static int tls12_find_id(int nid, tls12_lookup *table, size_t tlen)
3185         {
3186         size_t i;
3187         for (i = 0; i < tlen; i++)
3188                 {
3189                 if (table[i].nid == nid)
3190                         return table[i].id;
3191                 }
3192         return -1;
3193         }
3194
3195 static int tls12_find_nid(int id, tls12_lookup *table, size_t tlen)
3196         {
3197         size_t i;
3198         for (i = 0; i < tlen; i++)
3199                 {
3200                 if ((table[i].id) == id)
3201                         return table[i].nid;
3202                 }
3203         return NID_undef;
3204         }
3205
3206 int tls12_get_sigandhash(unsigned char *p, const EVP_PKEY *pk, const EVP_MD *md)
3207         {
3208         int sig_id, md_id;
3209         if (!md)
3210                 return 0;
3211         md_id = tls12_find_id(EVP_MD_type(md), tls12_md,
3212                                 sizeof(tls12_md)/sizeof(tls12_lookup));
3213         if (md_id == -1)
3214                 return 0;
3215         sig_id = tls12_get_sigid(pk);
3216         if (sig_id == -1)
3217                 return 0;
3218         p[0] = (unsigned char)md_id;
3219         p[1] = (unsigned char)sig_id;
3220         return 1;
3221         }
3222
3223 int tls12_get_sigid(const EVP_PKEY *pk)
3224         {
3225         return tls12_find_id(pk->type, tls12_sig,
3226                                 sizeof(tls12_sig)/sizeof(tls12_lookup));
3227         }
3228
3229 const EVP_MD *tls12_get_hash(unsigned char hash_alg)
3230         {
3231         switch(hash_alg)
3232                 {
3233 #ifndef OPENSSL_NO_MD5
3234                 case TLSEXT_hash_md5:
3235 #ifdef OPENSSL_FIPS
3236                 if (FIPS_mode())
3237                         return NULL;
3238 #endif
3239                 return EVP_md5();
3240 #endif
3241 #ifndef OPENSSL_NO_SHA
3242                 case TLSEXT_hash_sha1:
3243                 return EVP_sha1();
3244 #endif
3245 #ifndef OPENSSL_NO_SHA256
3246                 case TLSEXT_hash_sha224:
3247                 return EVP_sha224();
3248
3249                 case TLSEXT_hash_sha256:
3250                 return EVP_sha256();
3251 #endif
3252 #ifndef OPENSSL_NO_SHA512
3253                 case TLSEXT_hash_sha384:
3254                 return EVP_sha384();
3255
3256                 case TLSEXT_hash_sha512:
3257                 return EVP_sha512();
3258 #endif
3259                 default:
3260                 return NULL;
3261
3262                 }
3263         }
3264
3265 static int tls12_get_pkey_idx(unsigned char sig_alg)
3266         {
3267         switch(sig_alg)
3268                 {
3269 #ifndef OPENSSL_NO_RSA
3270         case TLSEXT_signature_rsa:
3271                 return SSL_PKEY_RSA_SIGN;
3272 #endif
3273 #ifndef OPENSSL_NO_DSA
3274         case TLSEXT_signature_dsa:
3275                 return SSL_PKEY_DSA_SIGN;
3276 #endif
3277 #ifndef OPENSSL_NO_ECDSA
3278         case TLSEXT_signature_ecdsa:
3279                 return SSL_PKEY_ECC;
3280 #endif
3281                 }
3282         return -1;
3283         }
3284
3285 /* Convert TLS 1.2 signature algorithm extension values into NIDs */
3286 static void tls1_lookup_sigalg(int *phash_nid, int *psign_nid,
3287                         int *psignhash_nid, const unsigned char *data)
3288         {
3289         int sign_nid = 0, hash_nid = 0;
3290         if (!phash_nid && !psign_nid && !psignhash_nid)
3291                 return;
3292         if (phash_nid || psignhash_nid)
3293                 {
3294                 hash_nid = tls12_find_nid(data[0], tls12_md,
3295                                         sizeof(tls12_md)/sizeof(tls12_lookup));
3296                 if (phash_nid)
3297                         *phash_nid = hash_nid;
3298                 }
3299         if (psign_nid || psignhash_nid)
3300                 {
3301                 sign_nid = tls12_find_nid(data[1], tls12_sig,
3302                                         sizeof(tls12_sig)/sizeof(tls12_lookup));
3303                 if (psign_nid)
3304                         *psign_nid = sign_nid;
3305                 }
3306         if (psignhash_nid)
3307                 {
3308                 if (sign_nid && hash_nid)
3309                         OBJ_find_sigid_by_algs(psignhash_nid,
3310                                                         hash_nid, sign_nid);
3311                 else
3312                         *psignhash_nid = NID_undef;
3313                 }
3314         }
3315 /* Given preference and allowed sigalgs set shared sigalgs */
3316 static int tls12_do_shared_sigalgs(TLS_SIGALGS *shsig,
3317                                 const unsigned char *pref, size_t preflen,
3318                                 const unsigned char *allow, size_t allowlen)
3319         {
3320         const unsigned char *ptmp, *atmp;
3321         size_t i, j, nmatch = 0;
3322         for (i = 0, ptmp = pref; i < preflen; i+=2, ptmp+=2)
3323                 {
3324                 /* Skip disabled hashes or signature algorithms */
3325                 if (tls12_get_hash(ptmp[0]) == NULL)
3326                         continue;
3327                 if (tls12_get_pkey_idx(ptmp[1]) == -1)
3328                         continue;
3329                 for (j = 0, atmp = allow; j < allowlen; j+=2, atmp+=2)
3330                         {
3331                         if (ptmp[0] == atmp[0] && ptmp[1] == atmp[1])
3332                                 {
3333                                 nmatch++;
3334                                 if (shsig)
3335                                         {
3336                                         shsig->rhash = ptmp[0];
3337                                         shsig->rsign = ptmp[1];
3338                                         tls1_lookup_sigalg(&shsig->hash_nid,
3339                                                 &shsig->sign_nid,
3340                                                 &shsig->signandhash_nid,
3341                                                 ptmp);
3342                                         shsig++;
3343                                         }
3344                                 break;
3345                                 }
3346                         }
3347                 }
3348         return nmatch;
3349         }
3350
3351 /* Set shared signature algorithms for SSL structures */
3352 static int tls1_set_shared_sigalgs(SSL *s)
3353         {
3354         const unsigned char *pref, *allow, *conf;
3355         size_t preflen, allowlen, conflen;
3356         size_t nmatch;
3357         TLS_SIGALGS *salgs = NULL;
3358         CERT *c = s->cert;
3359         unsigned int is_suiteb = tls1_suiteb(s);
3360         /* If client use client signature algorithms if not NULL */
3361         if (!s->server && c->client_sigalgs && !is_suiteb)
3362                 {
3363                 conf = c->client_sigalgs;
3364                 conflen = c->client_sigalgslen;
3365                 }
3366         else if (c->conf_sigalgs && !is_suiteb)
3367                 {
3368                 conf = c->conf_sigalgs;
3369                 conflen = c->conf_sigalgslen;
3370                 }
3371         else
3372                 conflen = tls12_get_psigalgs(s, &conf);
3373         if(s->options & SSL_OP_CIPHER_SERVER_PREFERENCE || is_suiteb)
3374                 {
3375                 pref = conf;
3376                 preflen = conflen;
3377                 allow = c->peer_sigalgs;
3378                 allowlen = c->peer_sigalgslen;
3379                 }
3380         else
3381                 {
3382                 allow = conf;
3383                 allowlen = conflen;
3384                 pref = c->peer_sigalgs;
3385                 preflen = c->peer_sigalgslen;
3386                 }
3387         nmatch = tls12_do_shared_sigalgs(NULL, pref, preflen, allow, allowlen);
3388         if (!nmatch)
3389                 return 1;
3390         salgs = OPENSSL_malloc(nmatch * sizeof(TLS_SIGALGS));
3391         if (!salgs)
3392                 return 0;
3393         nmatch = tls12_do_shared_sigalgs(salgs, pref, preflen, allow, allowlen);
3394         c->shared_sigalgs = salgs;
3395         c->shared_sigalgslen = nmatch;
3396         return 1;
3397         }
3398
3399
3400 /* Set preferred digest for each key type */
3401
3402 int tls1_process_sigalgs(SSL *s, const unsigned char *data, int dsize)
3403         {
3404         int idx;
3405         size_t i;
3406         const EVP_MD *md;
3407         CERT *c = s->cert;
3408         TLS_SIGALGS *sigptr;
3409         /* Extension ignored for TLS versions below 1.2 */
3410         if (TLS1_get_version(s) < TLS1_2_VERSION)
3411                 return 1;
3412         /* Should never happen */
3413         if (!c)
3414                 return 0;
3415
3416         c->peer_sigalgs = OPENSSL_malloc(dsize);
3417         if (!c->peer_sigalgs)
3418                 return 0;
3419         c->peer_sigalgslen = dsize;
3420         memcpy(c->peer_sigalgs, data, dsize);
3421
3422         tls1_set_shared_sigalgs(s);
3423
3424         for (i = 0, sigptr = c->shared_sigalgs;
3425                         i < c->shared_sigalgslen; i++, sigptr++)
3426                 {
3427                 idx = tls12_get_pkey_idx(sigptr->rsign);
3428                 if (idx > 0 && c->pkeys[idx].digest == NULL)
3429                         {
3430                         md = tls12_get_hash(sigptr->rhash);
3431                         c->pkeys[idx].digest = md;
3432                         c->pkeys[idx].valid_flags = CERT_PKEY_EXPLICIT_SIGN;
3433                         if (idx == SSL_PKEY_RSA_SIGN)
3434                                 {
3435                                 c->pkeys[SSL_PKEY_RSA_ENC].valid_flags = CERT_PKEY_EXPLICIT_SIGN;
3436                                 c->pkeys[SSL_PKEY_RSA_ENC].digest = md;
3437                                 }
3438                         }
3439
3440                 }
3441         /* In strict mode leave unset digests as NULL to indicate we can't
3442          * use the certificate for signing.
3443          */
3444         if (!(s->cert->cert_flags & SSL_CERT_FLAGS_CHECK_TLS_STRICT))
3445                 {
3446                 /* Set any remaining keys to default values. NOTE: if alg is
3447                  * not supported it stays as NULL.
3448                  */
3449 #ifndef OPENSSL_NO_DSA
3450                 if (!c->pkeys[SSL_PKEY_DSA_SIGN].digest)
3451                         c->pkeys[SSL_PKEY_DSA_SIGN].digest = EVP_sha1();
3452 #endif
3453 #ifndef OPENSSL_NO_RSA
3454                 if (!c->pkeys[SSL_PKEY_RSA_SIGN].digest)
3455                         {
3456                         c->pkeys[SSL_PKEY_RSA_SIGN].digest = EVP_sha1();
3457                         c->pkeys[SSL_PKEY_RSA_ENC].digest = EVP_sha1();
3458                         }
3459 #endif
3460 #ifndef OPENSSL_NO_ECDSA
3461                 if (!c->pkeys[SSL_PKEY_ECC].digest)
3462                         c->pkeys[SSL_PKEY_ECC].digest = EVP_sha1();
3463 #endif
3464                 }
3465         return 1;
3466         }
3467
3468
3469 int SSL_get_sigalgs(SSL *s, int idx,
3470                         int *psign, int *phash, int *psignhash,
3471                         unsigned char *rsig, unsigned char *rhash)
3472         {
3473         const unsigned char *psig = s->cert->peer_sigalgs;
3474         if (psig == NULL)
3475                 return 0;
3476         if (idx >= 0)
3477                 {
3478                 idx <<= 1;
3479                 if (idx >= (int)s->cert->peer_sigalgslen)
3480                         return 0;
3481                 psig += idx;
3482                 if (rhash)
3483                         *rhash = psig[0];
3484                 if (rsig)
3485                         *rsig = psig[1];
3486                 tls1_lookup_sigalg(phash, psign, psignhash, psig);
3487                 }
3488         return s->cert->peer_sigalgslen / 2;
3489         }
3490
3491 int SSL_get_shared_sigalgs(SSL *s, int idx,
3492                         int *psign, int *phash, int *psignhash,
3493                         unsigned char *rsig, unsigned char *rhash)
3494         {
3495         TLS_SIGALGS *shsigalgs = s->cert->shared_sigalgs;
3496         if (!shsigalgs || idx >= (int)s->cert->shared_sigalgslen)
3497                 return 0;
3498         shsigalgs += idx;
3499         if (phash)
3500                 *phash = shsigalgs->hash_nid;
3501         if (psign)
3502                 *psign = shsigalgs->sign_nid;
3503         if (psignhash)
3504                 *psignhash = shsigalgs->signandhash_nid;
3505         if (rsig)
3506                 *rsig = shsigalgs->rsign;
3507         if (rhash)
3508                 *rhash = shsigalgs->rhash;
3509         return s->cert->shared_sigalgslen;
3510         }
3511
3512
3513 #ifndef OPENSSL_NO_HEARTBEATS
3514 int
3515 tls1_process_heartbeat(SSL *s)
3516         {
3517         unsigned char *p = &s->s3->rrec.data[0], *pl;
3518         unsigned short hbtype;
3519         unsigned int payload;
3520         unsigned int padding = 16; /* Use minimum padding */
3521
3522         /* Read type and payload length first */
3523         hbtype = *p++;
3524         n2s(p, payload);
3525         pl = p;
3526
3527         if (s->msg_callback)
3528                 s->msg_callback(0, s->version, TLS1_RT_HEARTBEAT,
3529                         &s->s3->rrec.data[0], s->s3->rrec.length,
3530                         s, s->msg_callback_arg);
3531
3532         if (hbtype == TLS1_HB_REQUEST)
3533                 {
3534                 unsigned char *buffer, *bp;
3535                 int r;
3536
3537                 /* Allocate memory for the response, size is 1 bytes
3538                  * message type, plus 2 bytes payload length, plus
3539                  * payload, plus padding
3540                  */
3541                 buffer = OPENSSL_malloc(1 + 2 + payload + padding);
3542                 bp = buffer;
3543
3544                 /* Enter response type, length and copy payload */
3545                 *bp++ = TLS1_HB_RESPONSE;
3546                 s2n(payload, bp);
3547                 memcpy(bp, pl, payload);
3548                 bp += payload;
3549                 /* Random padding */
3550                 RAND_pseudo_bytes(bp, padding);
3551
3552                 r = ssl3_write_bytes(s, TLS1_RT_HEARTBEAT, buffer, 3 + payload + padding);
3553
3554                 if (r >= 0 && s->msg_callback)
3555                         s->msg_callback(1, s->version, TLS1_RT_HEARTBEAT,
3556                                 buffer, 3 + payload + padding,
3557                                 s, s->msg_callback_arg);
3558
3559                 OPENSSL_free(buffer);
3560
3561                 if (r < 0)
3562                         return r;
3563                 }
3564         else if (hbtype == TLS1_HB_RESPONSE)
3565                 {
3566                 unsigned int seq;
3567
3568                 /* We only send sequence numbers (2 bytes unsigned int),
3569                  * and 16 random bytes, so we just try to read the
3570                  * sequence number */
3571                 n2s(pl, seq);
3572
3573                 if (payload == 18 && seq == s->tlsext_hb_seq)
3574                         {
3575                         s->tlsext_hb_seq++;
3576                         s->tlsext_hb_pending = 0;
3577                         }
3578                 }
3579
3580         return 0;
3581         }
3582
3583 int
3584 tls1_heartbeat(SSL *s)
3585         {
3586         unsigned char *buf, *p;
3587         int ret;
3588         unsigned int payload = 18; /* Sequence number + random bytes */
3589         unsigned int padding = 16; /* Use minimum padding */
3590
3591         /* Only send if peer supports and accepts HB requests... */
3592         if (!(s->tlsext_heartbeat & SSL_TLSEXT_HB_ENABLED) ||
3593             s->tlsext_heartbeat & SSL_TLSEXT_HB_DONT_SEND_REQUESTS)
3594                 {
3595                 SSLerr(SSL_F_TLS1_HEARTBEAT,SSL_R_TLS_HEARTBEAT_PEER_DOESNT_ACCEPT);
3596                 return -1;
3597                 }
3598
3599         /* ...and there is none in flight yet... */
3600         if (s->tlsext_hb_pending)
3601                 {
3602                 SSLerr(SSL_F_TLS1_HEARTBEAT,SSL_R_TLS_HEARTBEAT_PENDING);
3603                 return -1;
3604                 }
3605
3606         /* ...and no handshake in progress. */
3607         if (SSL_in_init(s) || s->in_handshake)
3608                 {
3609                 SSLerr(SSL_F_TLS1_HEARTBEAT,SSL_R_UNEXPECTED_MESSAGE);
3610                 return -1;
3611                 }
3612
3613         /* Check if padding is too long, payload and padding
3614          * must not exceed 2^14 - 3 = 16381 bytes in total.
3615          */
3616         OPENSSL_assert(payload + padding <= 16381);
3617
3618         /* Create HeartBeat message, we just use a sequence number
3619          * as payload to distuingish different messages and add
3620          * some random stuff.
3621          *  - Message Type, 1 byte
3622          *  - Payload Length, 2 bytes (unsigned int)
3623          *  - Payload, the sequence number (2 bytes uint)
3624          *  - Payload, random bytes (16 bytes uint)
3625          *  - Padding
3626          */
3627         buf = OPENSSL_malloc(1 + 2 + payload + padding);
3628         p = buf;
3629         /* Message Type */
3630         *p++ = TLS1_HB_REQUEST;
3631         /* Payload length (18 bytes here) */
3632         s2n(payload, p);
3633         /* Sequence number */
3634         s2n(s->tlsext_hb_seq, p);
3635         /* 16 random bytes */
3636         RAND_pseudo_bytes(p, 16);
3637         p += 16;
3638         /* Random padding */
3639         RAND_pseudo_bytes(p, padding);
3640
3641         ret = ssl3_write_bytes(s, TLS1_RT_HEARTBEAT, buf, 3 + payload + padding);
3642         if (ret >= 0)
3643                 {
3644                 if (s->msg_callback)
3645                         s->msg_callback(1, s->version, TLS1_RT_HEARTBEAT,
3646                                 buf, 3 + payload + padding,
3647                                 s, s->msg_callback_arg);
3648
3649                 s->tlsext_hb_pending = 1;
3650                 }
3651
3652         OPENSSL_free(buf);
3653
3654         return ret;
3655         }
3656 #endif
3657
3658 #define MAX_SIGALGLEN   (TLSEXT_hash_num * TLSEXT_signature_num * 2)
3659
3660 typedef struct
3661         {
3662         size_t sigalgcnt;
3663         int sigalgs[MAX_SIGALGLEN];
3664         } sig_cb_st;
3665
3666 static int sig_cb(const char *elem, int len, void *arg)
3667         {
3668         sig_cb_st *sarg = arg;
3669         size_t i;
3670         char etmp[20], *p;
3671         int sig_alg, hash_alg;
3672         if (sarg->sigalgcnt == MAX_SIGALGLEN)
3673                 return 0;
3674         if (len > (int)(sizeof(etmp) - 1))
3675                 return 0;
3676         memcpy(etmp, elem, len);
3677         etmp[len] = 0;
3678         p = strchr(etmp, '+');
3679         if (!p)
3680                 return 0;
3681         *p = 0;
3682         p++;
3683         if (!*p)
3684                 return 0;
3685
3686         if (!strcmp(etmp, "RSA"))
3687                 sig_alg = EVP_PKEY_RSA;
3688         else if (!strcmp(etmp, "DSA"))
3689                 sig_alg = EVP_PKEY_DSA;
3690         else if (!strcmp(etmp, "ECDSA"))
3691                 sig_alg = EVP_PKEY_EC;
3692         else return 0;
3693
3694         hash_alg = OBJ_sn2nid(p);
3695         if (hash_alg == NID_undef)
3696                 hash_alg = OBJ_ln2nid(p);
3697         if (hash_alg == NID_undef)
3698                 return 0;
3699
3700         for (i = 0; i < sarg->sigalgcnt; i+=2)
3701                 {
3702                 if (sarg->sigalgs[i] == sig_alg
3703                         && sarg->sigalgs[i + 1] == hash_alg)
3704                         return 0;
3705                 }
3706         sarg->sigalgs[sarg->sigalgcnt++] = hash_alg;
3707         sarg->sigalgs[sarg->sigalgcnt++] = sig_alg;
3708         return 1;
3709         }
3710
3711 /* Set suppored signature algorithms based on a colon separated list
3712  * of the form sig+hash e.g. RSA+SHA512:DSA+SHA512 */
3713 int tls1_set_sigalgs_list(CERT *c, const char *str, int client)
3714         {
3715         sig_cb_st sig;
3716         sig.sigalgcnt = 0;
3717         if (!CONF_parse_list(str, ':', 1, sig_cb, &sig))
3718                 return 0;
3719         return tls1_set_sigalgs(c, sig.sigalgs, sig.sigalgcnt, client);
3720         }
3721
3722 int tls1_set_sigalgs(CERT *c, const int *psig_nids, size_t salglen, int client)
3723         {
3724         unsigned char *sigalgs, *sptr;
3725         int rhash, rsign;
3726         size_t i;
3727         if (salglen & 1)
3728                 return 0;
3729         sigalgs = OPENSSL_malloc(salglen);
3730         if (sigalgs == NULL)
3731                 return 0;
3732         for (i = 0, sptr = sigalgs; i < salglen; i+=2)
3733                 {
3734                 rhash = tls12_find_id(*psig_nids++, tls12_md,
3735                                         sizeof(tls12_md)/sizeof(tls12_lookup));
3736                 rsign = tls12_find_id(*psig_nids++, tls12_sig,
3737                                 sizeof(tls12_sig)/sizeof(tls12_lookup));
3738
3739                 if (rhash == -1 || rsign == -1)
3740                         goto err;
3741                 *sptr++ = rhash;
3742                 *sptr++ = rsign;
3743                 }
3744
3745         if (client)
3746                 {
3747                 if (c->client_sigalgs)
3748                         OPENSSL_free(c->client_sigalgs);
3749                 c->client_sigalgs = sigalgs;
3750                 c->client_sigalgslen = salglen;
3751                 }
3752         else
3753                 {
3754                 if (c->conf_sigalgs)
3755                         OPENSSL_free(c->conf_sigalgs);
3756                 c->conf_sigalgs = sigalgs;
3757                 c->conf_sigalgslen = salglen;
3758                 }
3759
3760         return 1;
3761
3762         err:
3763         OPENSSL_free(sigalgs);
3764         return 0;
3765         }
3766
3767 static int tls1_check_sig_alg(CERT *c, X509 *x, int default_nid)
3768         {
3769         int sig_nid;
3770         size_t i;
3771         if (default_nid == -1)
3772                 return 1;
3773         sig_nid = X509_get_signature_nid(x);
3774         if (default_nid)
3775                 return sig_nid == default_nid ? 1 : 0;
3776         for (i = 0; i < c->shared_sigalgslen; i++)
3777                 if (sig_nid == c->shared_sigalgs[i].signandhash_nid)
3778                         return 1;
3779         return 0;
3780         }
3781 /* Check to see if a certificate issuer name matches list of CA names */
3782 static int ssl_check_ca_name(STACK_OF(X509_NAME) *names, X509 *x)
3783         {
3784         X509_NAME *nm;
3785         int i;
3786         nm = X509_get_issuer_name(x);
3787         for (i = 0; i < sk_X509_NAME_num(names); i++)
3788                 {
3789                 if(!X509_NAME_cmp(nm, sk_X509_NAME_value(names, i)))
3790                         return 1;
3791                 }
3792         return 0;
3793         }
3794
3795 /* Check certificate chain is consistent with TLS extensions and is
3796  * usable by server. This servers two purposes: it allows users to
3797  * check chains before passing them to the server and it allows the
3798  * server to check chains before attempting to use them.
3799  */
3800
3801 /* Flags which need to be set for a certificate when stict mode not set */
3802
3803 #define CERT_PKEY_VALID_FLAGS \
3804         (CERT_PKEY_EE_SIGNATURE|CERT_PKEY_EE_PARAM)
3805 /* Strict mode flags */
3806 #define CERT_PKEY_STRICT_FLAGS \
3807          (CERT_PKEY_VALID_FLAGS|CERT_PKEY_CA_SIGNATURE|CERT_PKEY_CA_PARAM \
3808          | CERT_PKEY_ISSUER_NAME|CERT_PKEY_CERT_TYPE)
3809
3810 int tls1_check_chain(SSL *s, X509 *x, EVP_PKEY *pk, STACK_OF(X509) *chain,
3811                                                                         int idx)
3812         {
3813         int i;
3814         int rv = 0;
3815         int check_flags = 0, strict_mode;
3816         CERT_PKEY *cpk = NULL;
3817         CERT *c = s->cert;
3818         unsigned int suiteb_flags = tls1_suiteb(s);
3819         /* idx == -1 means checking server chains */
3820         if (idx != -1)
3821                 {
3822                 /* idx == -2 means checking client certificate chains */
3823                 if (idx == -2)
3824                         {
3825                         cpk = c->key;
3826                         idx = cpk - c->pkeys;
3827                         }
3828                 else
3829                         cpk = c->pkeys + idx;
3830                 x = cpk->x509;
3831                 pk = cpk->privatekey;
3832                 chain = cpk->chain;
3833                 strict_mode = c->cert_flags & SSL_CERT_FLAGS_CHECK_TLS_STRICT;
3834                 /* If no cert or key, forget it */
3835                 if (!x || !pk)
3836                         goto end;
3837                 }
3838         else
3839                 {
3840                 if (!x || !pk)
3841                         goto end;
3842                 idx = ssl_cert_type(x, pk);
3843                 if (idx == -1)
3844                         goto end;
3845                 cpk = c->pkeys + idx;
3846                 if (c->cert_flags & SSL_CERT_FLAGS_CHECK_TLS_STRICT)
3847                         check_flags = CERT_PKEY_STRICT_FLAGS;
3848                 else
3849                         check_flags = CERT_PKEY_VALID_FLAGS;
3850                 strict_mode = 1;
3851                 }
3852
3853         if (suiteb_flags)
3854                 {
3855                 int ok;
3856                 if (check_flags)
3857                         check_flags |= CERT_PKEY_SUITEB;
3858                 ok = X509_chain_check_suiteb(NULL, x, chain, suiteb_flags);
3859                 if (ok != X509_V_OK)
3860                         {
3861                         if (check_flags)
3862                                 rv |= CERT_PKEY_SUITEB;
3863                         else
3864                                 goto end;
3865                         }
3866                 }
3867
3868         /* Check all signature algorithms are consistent with
3869          * signature algorithms extension if TLS 1.2 or later
3870          * and strict mode.
3871          */
3872         if (TLS1_get_version(s) >= TLS1_2_VERSION && strict_mode)
3873                 {
3874                 int default_nid;
3875                 unsigned char rsign = 0;
3876                 if (c->peer_sigalgs)
3877                         default_nid = 0;
3878                 /* If no sigalgs extension use defaults from RFC5246 */
3879                 else
3880                         {
3881                         switch(idx)
3882                                 {
3883                         case SSL_PKEY_RSA_ENC:
3884                         case SSL_PKEY_RSA_SIGN:
3885                         case SSL_PKEY_DH_RSA:
3886                                 rsign = TLSEXT_signature_rsa;
3887                                 default_nid = NID_sha1WithRSAEncryption;
3888                                 break;
3889
3890                         case SSL_PKEY_DSA_SIGN:
3891                         case SSL_PKEY_DH_DSA:
3892                                 rsign = TLSEXT_signature_dsa;
3893                                 default_nid = NID_dsaWithSHA1;
3894                                 break;
3895
3896                         case SSL_PKEY_ECC:
3897                                 rsign = TLSEXT_signature_ecdsa;
3898                                 default_nid = NID_ecdsa_with_SHA1;
3899                                 break;
3900
3901                         default:
3902                                 default_nid = -1;
3903                                 break;
3904                                 }
3905                         }
3906                 /* If peer sent no signature algorithms extension and we
3907                  * have set preferred signature algorithms check we support
3908                  * sha1.
3909                  */
3910                 if (default_nid > 0 && c->conf_sigalgs)
3911                         {
3912                         size_t j;
3913                         const unsigned char *p = c->conf_sigalgs;
3914                         for (j = 0; j < c->conf_sigalgslen; j += 2, p += 2)
3915                                 {
3916                                 if (p[0] == TLSEXT_hash_sha1 && p[1] == rsign)
3917                                         break;
3918                                 }
3919                         if (j == c->conf_sigalgslen)
3920                                 {
3921                                 if (check_flags)
3922                                         goto skip_sigs;
3923                                 else
3924                                         goto end;
3925                                 }
3926                         }
3927                 /* Check signature algorithm of each cert in chain */
3928                 if (!tls1_check_sig_alg(c, x, default_nid))
3929                         {
3930                         if (!check_flags) goto end;
3931                         }
3932                 else
3933                         rv |= CERT_PKEY_EE_SIGNATURE;
3934                 rv |= CERT_PKEY_CA_SIGNATURE;
3935                 for (i = 0; i < sk_X509_num(chain); i++)
3936                         {
3937                         if (!tls1_check_sig_alg(c, sk_X509_value(chain, i),
3938                                                         default_nid))
3939                                 {
3940                                 if (check_flags)
3941                                         {
3942                                         rv &= ~CERT_PKEY_CA_SIGNATURE;
3943                                         break;
3944                                         }
3945                                 else
3946                                         goto end;
3947                                 }
3948                         }
3949                 }
3950         /* Else not TLS 1.2, so mark EE and CA signing algorithms OK */
3951         else if(check_flags)
3952                 rv |= CERT_PKEY_EE_SIGNATURE|CERT_PKEY_CA_SIGNATURE;
3953         skip_sigs:
3954         /* Check cert parameters are consistent */
3955         if (tls1_check_cert_param(s, x, check_flags ? 1 : 2))
3956                 rv |= CERT_PKEY_EE_PARAM;
3957         else if (!check_flags)
3958                 goto end;
3959         if (!s->server)
3960                 rv |= CERT_PKEY_CA_PARAM;
3961         /* In strict mode check rest of chain too */
3962         else if (strict_mode)
3963                 {
3964                 rv |= CERT_PKEY_CA_PARAM;
3965                 for (i = 0; i < sk_X509_num(chain); i++)
3966                         {
3967                         X509 *ca = sk_X509_value(chain, i);
3968                         if (!tls1_check_cert_param(s, ca, 0))
3969                                 {
3970                                 if (check_flags)
3971                                         {
3972                                         rv &= ~CERT_PKEY_CA_PARAM;
3973                                         break;
3974                                         }
3975                                 else
3976                                         goto end;
3977                                 }
3978                         }
3979                 }
3980         if (!s->server && strict_mode)
3981                 {
3982                 STACK_OF(X509_NAME) *ca_dn;
3983                 int check_type = 0;
3984                 switch (pk->type)
3985                         {
3986                 case EVP_PKEY_RSA:
3987                         check_type = TLS_CT_RSA_SIGN;
3988                         break;
3989                 case EVP_PKEY_DSA:
3990                         check_type = TLS_CT_DSS_SIGN;
3991                         break;
3992                 case EVP_PKEY_EC:
3993                         check_type = TLS_CT_ECDSA_SIGN;
3994                         break;
3995                 case EVP_PKEY_DH:
3996                 case EVP_PKEY_DHX:
3997                                 {
3998                                 int cert_type = X509_certificate_type(x, pk);
3999                                 if (cert_type & EVP_PKS_RSA)
4000                                         check_type = TLS_CT_RSA_FIXED_DH;
4001                                 if (cert_type & EVP_PKS_DSA)
4002                                         check_type = TLS_CT_DSS_FIXED_DH;
4003                                 }
4004                         }
4005                 if (check_type)
4006                         {
4007                         const unsigned char *ctypes;
4008                         int ctypelen;
4009                         if (c->ctypes)
4010                                 {
4011                                 ctypes = c->ctypes;
4012                                 ctypelen = (int)c->ctype_num;
4013                                 }
4014                         else
4015                                 {
4016                                 ctypes = (unsigned char *)s->s3->tmp.ctype;
4017                                 ctypelen = s->s3->tmp.ctype_num;
4018                                 }
4019                         for (i = 0; i < ctypelen; i++)
4020                                 {
4021                                 if (ctypes[i] == check_type)
4022                                         {
4023                                         rv |= CERT_PKEY_CERT_TYPE;
4024                                         break;
4025                                         }
4026                                 }
4027                         if (!(rv & CERT_PKEY_CERT_TYPE) && !check_flags)
4028                                 goto end;
4029                         }
4030                 else
4031                         rv |= CERT_PKEY_CERT_TYPE;
4032
4033
4034                 ca_dn = s->s3->tmp.ca_names;
4035
4036                 if (!sk_X509_NAME_num(ca_dn))
4037                         rv |= CERT_PKEY_ISSUER_NAME;
4038
4039                 if (!(rv & CERT_PKEY_ISSUER_NAME))
4040                         {
4041                         if (ssl_check_ca_name(ca_dn, x))
4042                                 rv |= CERT_PKEY_ISSUER_NAME;
4043                         }
4044                 if (!(rv & CERT_PKEY_ISSUER_NAME))
4045                         {
4046                         for (i = 0; i < sk_X509_num(chain); i++)
4047                                 {
4048                                 X509 *xtmp = sk_X509_value(chain, i);
4049                                 if (ssl_check_ca_name(ca_dn, xtmp))
4050                                         {
4051                                         rv |= CERT_PKEY_ISSUER_NAME;
4052                                         break;
4053                                         }
4054                                 }
4055                         }
4056                 if (!check_flags && !(rv & CERT_PKEY_ISSUER_NAME))
4057                         goto end;
4058                 }
4059         else
4060                 rv |= CERT_PKEY_ISSUER_NAME|CERT_PKEY_CERT_TYPE;
4061
4062         if (!check_flags || (rv & check_flags) == check_flags)
4063                 rv |= CERT_PKEY_VALID;
4064
4065         end:
4066
4067         if (TLS1_get_version(s) >= TLS1_2_VERSION)
4068                 {
4069                 if (cpk->valid_flags & CERT_PKEY_EXPLICIT_SIGN)
4070                         rv |= CERT_PKEY_EXPLICIT_SIGN|CERT_PKEY_SIGN;
4071                 else if (cpk->digest)
4072                         rv |= CERT_PKEY_SIGN;
4073                 }
4074         else
4075                 rv |= CERT_PKEY_SIGN|CERT_PKEY_EXPLICIT_SIGN;
4076
4077         /* When checking a CERT_PKEY structure all flags are irrelevant
4078          * if the chain is invalid.
4079          */
4080         if (!check_flags)
4081                 {
4082                 if (rv & CERT_PKEY_VALID)
4083                         cpk->valid_flags = rv;
4084                 else
4085                         {
4086                         /* Preserve explicit sign flag, clear rest */
4087                         cpk->valid_flags &= CERT_PKEY_EXPLICIT_SIGN;
4088                         return 0;
4089                         }
4090                 }
4091         return rv;
4092         }
4093
4094 /* Set validity of certificates in an SSL structure */
4095 void tls1_set_cert_validity(SSL *s)
4096         {
4097         tls1_check_chain(s, NULL, NULL, NULL, SSL_PKEY_RSA_ENC);
4098         tls1_check_chain(s, NULL, NULL, NULL, SSL_PKEY_RSA_SIGN);
4099         tls1_check_chain(s, NULL, NULL, NULL, SSL_PKEY_DSA_SIGN);
4100         tls1_check_chain(s, NULL, NULL, NULL, SSL_PKEY_DH_RSA);
4101         tls1_check_chain(s, NULL, NULL, NULL, SSL_PKEY_DH_DSA);
4102         tls1_check_chain(s, NULL, NULL, NULL, SSL_PKEY_ECC);
4103         }
4104 /* User level utiity function to check a chain is suitable */
4105 int SSL_check_chain(SSL *s, X509 *x, EVP_PKEY *pk, STACK_OF(X509) *chain)
4106         {
4107         return tls1_check_chain(s, x, pk, chain, -1);
4108         }
4109
4110 #endif