ssl/t1_lib.c

   1 /* ssl/t1_lib.c */
   2 /* Copyright (C) 1995-1998 Eric Young (eay@cryptsoft.com)
   3  * All rights reserved.
   4  *
   5  * This package is an SSL implementation written
   6  * by Eric Young (eay@cryptsoft.com).
   7  * The implementation was written so as to conform with Netscapes SSL.
   8  *
   9  * This library is free for commercial and non-commercial use as long as
  10  * the following conditions are aheared to.  The following conditions
  11  * apply to all code found in this distribution, be it the RC4, RSA,
  12  * lhash, DES, etc., code; not just the SSL code.  The SSL documentation
  13  * included with this distribution is covered by the same copyright terms
  14  * except that the holder is Tim Hudson (tjh@cryptsoft.com).
  15  *
  16  * Copyright remains Eric Young's, and as such any Copyright notices in
  17  * the code are not to be removed.
  18  * If this package is used in a product, Eric Young should be given attribution
  19  * as the author of the parts of the library used.
  20  * This can be in the form of a textual message at program startup or
  21  * in documentation (online or textual) provided with the package.
  22  *
  23  * Redistribution and use in source and binary forms, with or without
  24  * modification, are permitted provided that the following conditions
  25  * are met:
  26  * 1. Redistributions of source code must retain the copyright
  27  *    notice, this list of conditions and the following disclaimer.
  28  * 2. Redistributions in binary form must reproduce the above copyright
  29  *    notice, this list of conditions and the following disclaimer in the
  30  *    documentation and/or other materials provided with the distribution.
  31  * 3. All advertising materials mentioning features or use of this software
  32  *    must display the following acknowledgement:
  33  *    "This product includes cryptographic software written by
  34  *     Eric Young (eay@cryptsoft.com)"
  35  *    The word 'cryptographic' can be left out if the rouines from the library
  36  *    being used are not cryptographic related :-).
  37  * 4. If you include any Windows specific code (or a derivative thereof) from
  38  *    the apps directory (application code) you must include an acknowledgement:
  39  *    "This product includes software written by Tim Hudson (tjh@cryptsoft.com)"
  40  *
  41  * THIS SOFTWARE IS PROVIDED BY ERIC YOUNG ``AS IS'' AND
  42  * ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
  43  * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE
  44  * ARE DISCLAIMED.  IN NO EVENT SHALL THE AUTHOR OR CONTRIBUTORS BE LIABLE
  45  * FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL
  46  * DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS
  47  * OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION)
  48  * HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT
  49  * LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY
  50  * OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF
  51  * SUCH DAMAGE.
  52  *
  53  * The licence and distribution terms for any publically available version or
  54  * derivative of this code cannot be changed.  i.e. this code cannot simply be
  55  * copied and put under another distribution licence
  56  * [including the GNU Public Licence.]
  57  */
  58 /* ====================================================================
  59  * Copyright (c) 1998-2007 The OpenSSL Project.  All rights reserved.
  60  *
  61  * Redistribution and use in source and binary forms, with or without
  62  * modification, are permitted provided that the following conditions
  63  * are met:
  64  *
  65  * 1. Redistributions of source code must retain the above copyright
  66  *    notice, this list of conditions and the following disclaimer.
  67  *
  68  * 2. Redistributions in binary form must reproduce the above copyright
  69  *    notice, this list of conditions and the following disclaimer in
  70  *    the documentation and/or other materials provided with the
  71  *    distribution.
  72  *
  73  * 3. All advertising materials mentioning features or use of this
  74  *    software must display the following acknowledgment:
  75  *    "This product includes software developed by the OpenSSL Project
  76  *    for use in the OpenSSL Toolkit. (http://www.openssl.org/)"
  77  *
  78  * 4. The names "OpenSSL Toolkit" and "OpenSSL Project" must not be used to
  79  *    endorse or promote products derived from this software without
  80  *    prior written permission. For written permission, please contact
  81  *    openssl-core@openssl.org.
  82  *
  83  * 5. Products derived from this software may not be called "OpenSSL"
  84  *    nor may "OpenSSL" appear in their names without prior written
  85  *    permission of the OpenSSL Project.
  86  *
  87  * 6. Redistributions of any form whatsoever must retain the following
  88  *    acknowledgment:
  89  *    "This product includes software developed by the OpenSSL Project
  90  *    for use in the OpenSSL Toolkit (http://www.openssl.org/)"
  91  *
  92  * THIS SOFTWARE IS PROVIDED BY THE OpenSSL PROJECT ``AS IS'' AND ANY
  93  * EXPRESSED OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
  94  * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
  95  * PURPOSE ARE DISCLAIMED.  IN NO EVENT SHALL THE OpenSSL PROJECT OR
  96  * ITS CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL,
  97  * SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT
  98  * NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES;
  99  * LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION)
 100  * HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT,
 101  * STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE)
 102  * ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED
 103  * OF THE POSSIBILITY OF SUCH DAMAGE.
 104  * ====================================================================
 105  *
 106  * This product includes cryptographic software written by Eric Young
 107  * (eay@cryptsoft.com).  This product includes software written by Tim
 108  * Hudson (tjh@cryptsoft.com).
 109  *
 110  */
 111
 112 #include <stdio.h>
 113 #include <openssl/objects.h>
 114 #include <openssl/evp.h>
 115 #include <openssl/hmac.h>
 116 #include <openssl/ocsp.h>
 117 #include <openssl/rand.h>
 118 #include "ssl_locl.h"
 119
 120 const char tls1_version_str[]="TLSv1" OPENSSL_VERSION_PTEXT;
 121
 122 #ifndef OPENSSL_NO_TLSEXT
 123 static int tls_decrypt_ticket(SSL *s, const unsigned char *tick, int ticklen,
 124                                 const unsigned char *sess_id, int sesslen,
 125                                 SSL_SESSION **psess);
 126 static int ssl_check_clienthello_tlsext_early(SSL *s);
 127 int ssl_check_serverhello_tlsext(SSL *s);
 128 #endif
 129
 130 SSL3_ENC_METHOD TLSv1_enc_data={
 131         tls1_enc,
 132         tls1_mac,
 133         tls1_setup_key_block,
 134         tls1_generate_master_secret,
 135         tls1_change_cipher_state,
 136         tls1_final_finish_mac,
 137         TLS1_FINISH_MAC_LENGTH,
 138         tls1_cert_verify_mac,
 139         TLS_MD_CLIENT_FINISH_CONST,TLS_MD_CLIENT_FINISH_CONST_SIZE,
 140         TLS_MD_SERVER_FINISH_CONST,TLS_MD_SERVER_FINISH_CONST_SIZE,
 141         tls1_alert_code,
 142         tls1_export_keying_material,
 143         };
 144
 145 long tls1_default_timeout(void)
 146         {
 147         /* 2 hours, the 24 hours mentioned in the TLSv1 spec
 148          * is way too long for http, the cache would over fill */
 149         return(60*60*2);
 150         }
 151
 152 int tls1_new(SSL *s)
 153         {
 154         if (!ssl3_new(s)) return(0);
 155         s->method->ssl_clear(s);
 156         return(1);
 157         }
 158
 159 void tls1_free(SSL *s)
 160         {
 161 #ifndef OPENSSL_NO_TLSEXT
 162         if (s->tlsext_session_ticket)
 163                 {
 164                 OPENSSL_free(s->tlsext_session_ticket);
 165                 }
 166 #endif /* OPENSSL_NO_TLSEXT */
 167         ssl3_free(s);
 168         }
 169
 170 void tls1_clear(SSL *s)
 171         {
 172         ssl3_clear(s);
 173         s->version = s->method->version;
 174         }
 175
 176 #ifndef OPENSSL_NO_EC
 177
 178 static int nid_list[] =
 179         {
 180                 NID_sect163k1, /* sect163k1 (1) */
 181                 NID_sect163r1, /* sect163r1 (2) */
 182                 NID_sect163r2, /* sect163r2 (3) */
 183                 NID_sect193r1, /* sect193r1 (4) */
 184                 NID_sect193r2, /* sect193r2 (5) */
 185                 NID_sect233k1, /* sect233k1 (6) */
 186                 NID_sect233r1, /* sect233r1 (7) */
 187                 NID_sect239k1, /* sect239k1 (8) */
 188                 NID_sect283k1, /* sect283k1 (9) */
 189                 NID_sect283r1, /* sect283r1 (10) */
 190                 NID_sect409k1, /* sect409k1 (11) */
 191                 NID_sect409r1, /* sect409r1 (12) */
 192                 NID_sect571k1, /* sect571k1 (13) */
 193                 NID_sect571r1, /* sect571r1 (14) */
 194                 NID_secp160k1, /* secp160k1 (15) */
 195                 NID_secp160r1, /* secp160r1 (16) */
 196                 NID_secp160r2, /* secp160r2 (17) */
 197                 NID_secp192k1, /* secp192k1 (18) */
 198                 NID_X9_62_prime192v1, /* secp192r1 (19) */
 199                 NID_secp224k1, /* secp224k1 (20) */
 200                 NID_secp224r1, /* secp224r1 (21) */
 201                 NID_secp256k1, /* secp256k1 (22) */
 202                 NID_X9_62_prime256v1, /* secp256r1 (23) */
 203                 NID_secp384r1, /* secp384r1 (24) */
 204                 NID_secp521r1  /* secp521r1 (25) */
 205         };
 206
 207
 208 static const unsigned char ecformats_default[] =
 209         {
 210         TLSEXT_ECPOINTFORMAT_uncompressed,
 211         TLSEXT_ECPOINTFORMAT_ansiX962_compressed_prime,
 212         TLSEXT_ECPOINTFORMAT_ansiX962_compressed_char2
 213         };
 214
 215 static const unsigned char eccurves_default[] =
 216         {
 217                 0,14, /* sect571r1 (14) */
 218                 0,13, /* sect571k1 (13) */
 219                 0,25, /* secp521r1 (25) */
 220                 0,11, /* sect409k1 (11) */
 221                 0,12, /* sect409r1 (12) */
 222                 0,24, /* secp384r1 (24) */
 223                 0,9,  /* sect283k1 (9) */
 224                 0,10, /* sect283r1 (10) */
 225                 0,22, /* secp256k1 (22) */
 226                 0,23, /* secp256r1 (23) */
 227                 0,8,  /* sect239k1 (8) */
 228                 0,6,  /* sect233k1 (6) */
 229                 0,7,  /* sect233r1 (7) */
 230                 0,20, /* secp224k1 (20) */
 231                 0,21, /* secp224r1 (21) */
 232                 0,4,  /* sect193r1 (4) */
 233                 0,5,  /* sect193r2 (5) */
 234                 0,18, /* secp192k1 (18) */
 235                 0,19, /* secp192r1 (19) */
 236                 0,1,  /* sect163k1 (1) */
 237                 0,2,  /* sect163r1 (2) */
 238                 0,3,  /* sect163r2 (3) */
 239                 0,15, /* secp160k1 (15) */
 240                 0,16, /* secp160r1 (16) */
 241                 0,17, /* secp160r2 (17) */
 242         };
 243
 244 int tls1_ec_curve_id2nid(int curve_id)
 245         {
 246         /* ECC curves from draft-ietf-tls-ecc-12.txt (Oct. 17, 2005) */
 247         if ((curve_id < 1) || ((unsigned int)curve_id >
 248                                 sizeof(nid_list)/sizeof(nid_list[0])))
 249                 return 0;
 250         return nid_list[curve_id-1];
 251         }
 252
 253 int tls1_ec_nid2curve_id(int nid)
 254         {
 255         /* ECC curves from draft-ietf-tls-ecc-12.txt (Oct. 17, 2005) */
 256         switch (nid)
 257                 {
 258         case NID_sect163k1: /* sect163k1 (1) */
 259                 return 1;
 260         case NID_sect163r1: /* sect163r1 (2) */
 261                 return 2;
 262         case NID_sect163r2: /* sect163r2 (3) */
 263                 return 3;
 264         case NID_sect193r1: /* sect193r1 (4) */
 265                 return 4;
 266         case NID_sect193r2: /* sect193r2 (5) */
 267                 return 5;
 268         case NID_sect233k1: /* sect233k1 (6) */
 269                 return 6;
 270         case NID_sect233r1: /* sect233r1 (7) */
 271                 return 7;
 272         case NID_sect239k1: /* sect239k1 (8) */
 273                 return 8;
 274         case NID_sect283k1: /* sect283k1 (9) */
 275                 return 9;
 276         case NID_sect283r1: /* sect283r1 (10) */
 277                 return 10;
 278         case NID_sect409k1: /* sect409k1 (11) */
 279                 return 11;
 280         case NID_sect409r1: /* sect409r1 (12) */
 281                 return 12;
 282         case NID_sect571k1: /* sect571k1 (13) */
 283                 return 13;
 284         case NID_sect571r1: /* sect571r1 (14) */
 285                 return 14;
 286         case NID_secp160k1: /* secp160k1 (15) */
 287                 return 15;
 288         case NID_secp160r1: /* secp160r1 (16) */
 289                 return 16;
 290         case NID_secp160r2: /* secp160r2 (17) */
 291                 return 17;
 292         case NID_secp192k1: /* secp192k1 (18) */
 293                 return 18;
 294         case NID_X9_62_prime192v1: /* secp192r1 (19) */
 295                 return 19;
 296         case NID_secp224k1: /* secp224k1 (20) */
 297                 return 20;
 298         case NID_secp224r1: /* secp224r1 (21) */
 299                 return 21;
 300         case NID_secp256k1: /* secp256k1 (22) */
 301                 return 22;
 302         case NID_X9_62_prime256v1: /* secp256r1 (23) */
 303                 return 23;
 304         case NID_secp384r1: /* secp384r1 (24) */
 305                 return 24;
 306         case NID_secp521r1:  /* secp521r1 (25) */
 307                 return 25;
 308         default:
 309                 return 0;
 310                 }
 311         }
 312 /* Get curves list, if "sess" is set return client curves otherwise
 313  * preferred list
 314  */
 315 static void tls1_get_curvelist(SSL *s, int sess,
 316                                         const unsigned char **pcurves,
 317                                         size_t *pcurveslen)
 318         {
 319         if (sess)
 320                 {
 321                 *pcurves = s->session->tlsext_ellipticcurvelist;
 322                 *pcurveslen = s->session->tlsext_ellipticcurvelist_length;
 323                 }
 324         else
 325                 {
 326                 *pcurves = s->tlsext_ellipticcurvelist;
 327                 *pcurveslen = s->tlsext_ellipticcurvelist_length;
 328                 }
 329         /* If not set use default: for now static structure */
 330         if (!*pcurves)
 331                 {
 332                 *pcurves = eccurves_default;
 333                 *pcurveslen = sizeof(eccurves_default);
 334                 }
 335         }
 336
 337 /* Return nth shared curve. If nmatch == -1 return number of
 338  * matches.
 339  */
 340
 341 int tls1_shared_curve(SSL *s, int nmatch)
 342         {
 343         const unsigned char *pref, *supp;
 344         size_t preflen, supplen, i, j;
 345         int k;
 346         /* Can't do anything on client side */
 347         if (s->server == 0)
 348                 return -1;
 349         tls1_get_curvelist(s, !!(s->options & SSL_OP_CIPHER_SERVER_PREFERENCE),
 350                                 &supp, &supplen);
 351         tls1_get_curvelist(s, !(s->options & SSL_OP_CIPHER_SERVER_PREFERENCE),
 352                                 &pref, &preflen);
 353         preflen /= 2;
 354         supplen /= 2;
 355         k = 0;
 356         for (i = 0; i < preflen; i++, pref+=2)
 357                 {
 358                 const unsigned char *tsupp = supp;
 359                 for (j = 0; j < supplen; j++, tsupp+=2)
 360                         {
 361                         if (pref[0] == tsupp[0] && pref[1] == tsupp[1])
 362                                 {
 363                                 if (nmatch == k)
 364                                         {
 365                                         int id = (pref[0] << 8) | pref[1];
 366                                         return tls1_ec_curve_id2nid(id);
 367                                         }
 368                                 k++;
 369                                 }
 370                         }
 371                 }
 372         if (nmatch == -1)
 373                 return k;
 374         return 0;
 375         }
 376
 377 int tls1_set_curves(unsigned char **pext, size_t *pextlen,
 378                         int *curves, size_t ncurves)
 379         {
 380         unsigned char *clist, *p;
 381         size_t i;
 382         /* Bitmap of curves included to detect duplicates: only works
 383          * while curve ids < 32
 384          */
 385         unsigned long dup_list = 0;
 386         clist = OPENSSL_malloc(ncurves * 2);
 387         if (!clist)
 388                 return 0;
 389         for (i = 0, p = clist; i < ncurves; i++)
 390                 {
 391                 unsigned long idmask;
 392                 int id;
 393                 id = tls1_ec_nid2curve_id(curves[i]);
 394                 idmask = 1L << id;
 395                 if (!id || (dup_list & idmask))
 396                         {
 397                         OPENSSL_free(clist);
 398                         return 0;
 399                         }
 400                 dup_list |= idmask;
 401                 s2n(id, p);
 402                 }
 403         if (*pext)
 404                 OPENSSL_free(*pext);
 405         *pext = clist;
 406         *pextlen = ncurves * 2;
 407         return 1;
 408         }
 409
 410 #define MAX_CURVELIST   25
 411
 412 typedef struct
 413         {
 414         size_t nidcnt;
 415         int nid_arr[MAX_CURVELIST];
 416         } nid_cb_st;
 417
 418 static int nid_cb(const char *elem, int len, void *arg)
 419         {
 420         nid_cb_st *narg = arg;
 421         size_t i;
 422         int nid;
 423         char etmp[20];
 424         if (narg->nidcnt == MAX_CURVELIST)
 425                 return 0;
 426         if (len > (int)(sizeof(etmp) - 1))
 427                 return 0;
 428         memcpy(etmp, elem, len);
 429         etmp[len] = 0;
 430         nid = EC_curve_nist2nid(etmp);
 431         if (nid == NID_undef)
 432                 nid = OBJ_sn2nid(etmp);
 433         if (nid == NID_undef)
 434                 nid = OBJ_ln2nid(etmp);
 435         if (nid == NID_undef)
 436                 return 0;
 437         for (i = 0; i < narg->nidcnt; i++)
 438                 if (narg->nid_arr[i] == nid)
 439                         return 0;
 440         narg->nid_arr[narg->nidcnt++] = nid;
 441         return 1;
 442         }
 443 /* Set curves based on a colon separate list */
 444 int tls1_set_curves_list(unsigned char **pext, size_t *pextlen,
 445                                 const char *str)
 446         {
 447         nid_cb_st ncb;
 448         ncb.nidcnt = 0;
 449         if (!CONF_parse_list(str, ':', 1, nid_cb, &ncb))
 450                 return 0;
 451         return tls1_set_curves(pext, pextlen, ncb.nid_arr, ncb.nidcnt);
 452         }
 453 /* For an EC key set TLS id and required compression based on parameters */
 454 static int tls1_set_ec_id(unsigned char *curve_id, unsigned char *comp_id,
 455                                 EC_KEY *ec)
 456         {
 457         int is_prime, id;
 458         const EC_GROUP *grp;
 459         const EC_POINT *pt;
 460         const EC_METHOD *meth;
 461         if (!ec)
 462                 return 0;
 463         /* Determine if it is a prime field */
 464         grp = EC_KEY_get0_group(ec);
 465         pt = EC_KEY_get0_public_key(ec);
 466         if (!grp || !pt)
 467                 return 0;
 468         meth = EC_GROUP_method_of(grp);
 469         if (!meth)
 470                 return 0;
 471         if (EC_METHOD_get_field_type(meth) == NID_X9_62_prime_field)
 472                 is_prime = 1;
 473         else
 474                 is_prime = 0;
 475         /* Determine curve ID */
 476         id = EC_GROUP_get_curve_name(grp);
 477         id = tls1_ec_nid2curve_id(id);
 478         /* If we have an ID set it, otherwise set arbitrary explicit curve */
 479         if (id)
 480                 {
 481                 curve_id[0] = 0;
 482                 curve_id[1] = (unsigned char)id;
 483                 }
 484         else
 485                 {
 486                 curve_id[0] = 0xff;
 487                 if (is_prime)
 488                         curve_id[1] = 0x01;
 489                 else
 490                         curve_id[1] = 0x02;
 491                 }
 492         if (comp_id)
 493                 {
 494                 if (EC_KEY_get_conv_form(ec) == POINT_CONVERSION_COMPRESSED)
 495                         {
 496                         if (is_prime)
 497                                 *comp_id = TLSEXT_ECPOINTFORMAT_ansiX962_compressed_prime;
 498                         else
 499                                 *comp_id = TLSEXT_ECPOINTFORMAT_ansiX962_compressed_char2;
 500                         }
 501                 else
 502                         *comp_id = TLSEXT_ECPOINTFORMAT_uncompressed;
 503                 }
 504         return 1;
 505         }
 506 /* Check an EC key is compatible with extensions */
 507 static int tls1_check_ec_key(SSL *s,
 508                         unsigned char *curve_id, unsigned char *comp_id)
 509         {
 510         const unsigned char *p;
 511         size_t plen, i;
 512         int j;
 513         /* If point formats extension present check it, otherwise everything
 514          * is supported (see RFC4492).
 515          */
 516         if (comp_id && s->session->tlsext_ecpointformatlist)
 517                 {
 518                 p = s->session->tlsext_ecpointformatlist;
 519                 plen = s->session->tlsext_ecpointformatlist_length;
 520                 for (i = 0; i < plen; i++, p++)
 521                         {
 522                         if (*comp_id == *p)
 523                                 break;
 524                         }
 525                 if (i == plen)
 526                         return 0;
 527                 }
 528         /* Check curve is consistent with client and server preferences */
 529         for (j = 0; j <= 1; j++)
 530                 {
 531                 tls1_get_curvelist(s, j, &p, &plen);
 532                 for (i = 0; i < plen; i+=2, p+=2)
 533                         {
 534                         if (p[0] == curve_id[0] && p[1] == curve_id[1])
 535                                 break;
 536                         }
 537                 if (i == plen)
 538                         return 0;
 539                 }
 540         return 1;
 541         }
 542
 543 /* Check cert parameters compatible with extensions: currently just checks
 544  * EC certificates have compatible curves and compression.
 545  */
 546 static int tls1_check_cert_param(SSL *s, X509 *x)
 547         {
 548         unsigned char comp_id, curve_id[2];
 549         EVP_PKEY *pkey;
 550         int rv;
 551         pkey = X509_get_pubkey(x);
 552         if (!pkey)
 553                 return 0;
 554         /* If not EC nothing to do */
 555         if (pkey->type != EVP_PKEY_EC)
 556                 {
 557                 EVP_PKEY_free(pkey);
 558                 return 1;
 559                 }
 560         rv = tls1_set_ec_id(curve_id, &comp_id, pkey->pkey.ec);
 561         EVP_PKEY_free(pkey);
 562         if (!rv)
 563                 return 0;
 564         return tls1_check_ec_key(s, curve_id, &comp_id);
 565         }
 566 /* Check EC temporary key is compatible with client extensions */
 567 int tls1_check_ec_tmp_key(SSL *s)
 568         {
 569         unsigned char curve_id[2];
 570         EC_KEY *ec = s->cert->ecdh_tmp;
 571         if (s->cert->ecdh_tmp_auto)
 572                 {
 573                 /* Need a shared curve */
 574                 if (tls1_shared_curve(s, 0))
 575                         return 1;
 576                 else return 0;
 577                 }
 578         if (!ec)
 579                 {
 580                 if (s->cert->ecdh_tmp_cb)
 581                         return 1;
 582                 else
 583                         return 0;
 584                 }
 585         if (!tls1_set_ec_id(curve_id, NULL, ec))
 586                 return 1;
 587         return tls1_check_ec_key(s, curve_id, NULL);
 588         }
 589
 590 #endif /* OPENSSL_NO_EC */
 591
 592 #ifndef OPENSSL_NO_TLSEXT
 593
 594 /* List of supported signature algorithms and hashes. Should make this
 595  * customisable at some point, for now include everything we support.
 596  */
 597
 598 #ifdef OPENSSL_NO_RSA
 599 #define tlsext_sigalg_rsa(md) /* */
 600 #else
 601 #define tlsext_sigalg_rsa(md) md, TLSEXT_signature_rsa,
 602 #endif
 603
 604 #ifdef OPENSSL_NO_DSA
 605 #define tlsext_sigalg_dsa(md) /* */
 606 #else
 607 #define tlsext_sigalg_dsa(md) md, TLSEXT_signature_dsa,
 608 #endif
 609
 610 #ifdef OPENSSL_NO_ECDSA
 611 #define tlsext_sigalg_ecdsa(md) /* */
 612 #else
 613 #define tlsext_sigalg_ecdsa(md) md, TLSEXT_signature_ecdsa,
 614 #endif
 615
 616 #define tlsext_sigalg(md) \
 617                 tlsext_sigalg_rsa(md) \
 618                 tlsext_sigalg_dsa(md) \
 619                 tlsext_sigalg_ecdsa(md)
 620
 621 static unsigned char tls12_sigalgs[] = {
 622 #ifndef OPENSSL_NO_SHA512
 623         tlsext_sigalg(TLSEXT_hash_sha512)
 624         tlsext_sigalg(TLSEXT_hash_sha384)
 625 #endif
 626 #ifndef OPENSSL_NO_SHA256
 627         tlsext_sigalg(TLSEXT_hash_sha256)
 628         tlsext_sigalg(TLSEXT_hash_sha224)
 629 #endif
 630 #ifndef OPENSSL_NO_SHA
 631         tlsext_sigalg(TLSEXT_hash_sha1)
 632 #endif
 633 #ifndef OPENSSL_NO_MD5
 634         tlsext_sigalg_rsa(TLSEXT_hash_md5)
 635 #endif
 636 };
 637
 638 size_t tls12_get_sig_algs(SSL *s, unsigned char *p)
 639         {
 640         const unsigned char *sigs;
 641         size_t sigslen;
 642         /* If server use client authentication sigalgs if not NULL */
 643         if (s->server && s->cert->client_sigalgs)
 644                 {
 645                 sigs = s->cert->client_sigalgs;
 646                 sigslen = s->cert->client_sigalgslen;
 647                 }
 648         else if (s->cert->conf_sigalgs)
 649                 {
 650                 sigs = s->cert->conf_sigalgs;
 651                 sigslen = s->cert->conf_sigalgslen;
 652                 }
 653         else
 654                 {
 655                 sigs = tls12_sigalgs;
 656                 sigslen = sizeof(tls12_sigalgs);
 657 #ifdef OPENSSL_FIPS
 658                 /* If FIPS mode don't include MD5 which is last */
 659                 if (FIPS_mode())
 660                         sigslen -= 2;
 661 #endif
 662                 }
 663
 664         if (p)
 665                 memcpy(p, sigs, sigslen);
 666         return sigslen;
 667         }
 668
 669 /* byte_compare is a compare function for qsort(3) that compares bytes. */
 670 static int byte_compare(const void *in_a, const void *in_b)
 671         {
 672         unsigned char a = *((const unsigned char*) in_a);
 673         unsigned char b = *((const unsigned char*) in_b);
 674
 675         if (a > b)
 676                 return 1;
 677         else if (a < b)
 678                 return -1;
 679         return 0;
 680 }
 681
 682 unsigned char *ssl_add_clienthello_tlsext(SSL *s, unsigned char *p, unsigned char *limit)
 683         {
 684         int extdatalen=0;
 685         unsigned char *ret = p;
 686 #ifndef OPENSSL_NO_EC
 687         /* See if we support any ECC ciphersuites */
 688         int using_ecc = 0;
 689         if (s->version != DTLS1_VERSION && s->version >= TLS1_VERSION)
 690                 {
 691                 int i;
 692                 unsigned long alg_k, alg_a;
 693                 STACK_OF(SSL_CIPHER) *cipher_stack = SSL_get_ciphers(s);
 694
 695                 for (i = 0; i < sk_SSL_CIPHER_num(cipher_stack); i++)
 696                         {
 697                         SSL_CIPHER *c = sk_SSL_CIPHER_value(cipher_stack, i);
 698
 699                         alg_k = c->algorithm_mkey;
 700                         alg_a = c->algorithm_auth;
 701                         if ((alg_k & (SSL_kEECDH|SSL_kECDHr|SSL_kECDHe)
 702                                 || (alg_a & SSL_aECDSA)))
 703                                 {
 704                                 using_ecc = 1;
 705                                 break;
 706                                 }
 707                         }
 708                 }
 709 #endif
 710
 711         /* don't add extensions for SSLv3 unless doing secure renegotiation */
 712         if (s->client_version == SSL3_VERSION
 713                                         && !s->s3->send_connection_binding)
 714                 return p;
 715
 716         ret+=2;
 717
 718         if (ret>=limit) return NULL; /* this really never occurs, but ... */
 719
 720         if (s->tlsext_hostname != NULL)
 721                 {
 722                 /* Add TLS extension servername to the Client Hello message */
 723                 unsigned long size_str;
 724                 long lenmax;
 725
 726                 /* check for enough space.
 727                    4 for the servername type and entension length
 728                    2 for servernamelist length
 729                    1 for the hostname type
 730                    2 for hostname length
 731                    + hostname length
 732                 */
 733
 734                 if ((lenmax = limit - ret - 9) < 0
 735                     || (size_str = strlen(s->tlsext_hostname)) > (unsigned long)lenmax)
 736                         return NULL;
 737
 738                 /* extension type and length */
 739                 s2n(TLSEXT_TYPE_server_name,ret);
 740                 s2n(size_str+5,ret);
 741
 742                 /* length of servername list */
 743                 s2n(size_str+3,ret);
 744
 745                 /* hostname type, length and hostname */
 746                 *(ret++) = (unsigned char) TLSEXT_NAMETYPE_host_name;
 747                 s2n(size_str,ret);
 748                 memcpy(ret, s->tlsext_hostname, size_str);
 749                 ret+=size_str;
 750                 }
 751
 752         /* Add RI if renegotiating */
 753         if (s->renegotiate)
 754           {
 755           int el;
 756
 757           if(!ssl_add_clienthello_renegotiate_ext(s, 0, &el, 0))
 758               {
 759               SSLerr(SSL_F_SSL_ADD_CLIENTHELLO_TLSEXT, ERR_R_INTERNAL_ERROR);
 760               return NULL;
 761               }
 762
 763           if((limit - p - 4 - el) < 0) return NULL;
 764
 765           s2n(TLSEXT_TYPE_renegotiate,ret);
 766           s2n(el,ret);
 767
 768           if(!ssl_add_clienthello_renegotiate_ext(s, ret, &el, el))
 769               {
 770               SSLerr(SSL_F_SSL_ADD_CLIENTHELLO_TLSEXT, ERR_R_INTERNAL_ERROR);
 771               return NULL;
 772               }
 773
 774           ret += el;
 775         }
 776
 777 #ifndef OPENSSL_NO_SRP
 778         /* Add SRP username if there is one */
 779         if (s->srp_ctx.login != NULL)
 780                 { /* Add TLS extension SRP username to the Client Hello message */
 781
 782                 int login_len = strlen(s->srp_ctx.login);
 783                 if (login_len > 255 || login_len == 0)
 784                         {
 785                         SSLerr(SSL_F_SSL_ADD_CLIENTHELLO_TLSEXT, ERR_R_INTERNAL_ERROR);
 786                         return NULL;
 787                         }
 788
 789                 /* check for enough space.
 790                    4 for the srp type type and entension length
 791                    1 for the srp user identity
 792                    + srp user identity length
 793                 */
 794                 if ((limit - ret - 5 - login_len) < 0) return NULL;
 795
 796                 /* fill in the extension */
 797                 s2n(TLSEXT_TYPE_srp,ret);
 798                 s2n(login_len+1,ret);
 799                 (*ret++) = (unsigned char) login_len;
 800                 memcpy(ret, s->srp_ctx.login, login_len);
 801                 ret+=login_len;
 802                 }
 803 #endif
 804
 805 #ifndef OPENSSL_NO_EC
 806         if (using_ecc)
 807                 {
 808                 /* Add TLS extension ECPointFormats to the ClientHello message */
 809                 long lenmax;
 810                 const unsigned char *plist;
 811                 size_t plistlen;
 812                 /* If we have a custom point format list use it otherwise
 813                  * use default */
 814                 plist = s->tlsext_ecpointformatlist;
 815                 if (plist)
 816                         plistlen = s->tlsext_ecpointformatlist_length;
 817                 else
 818                         {
 819                         plist = ecformats_default;
 820                         plistlen = sizeof(ecformats_default);
 821                         }
 822
 823                 if ((lenmax = limit - ret - 5) < 0) return NULL;
 824                 if (plistlen > (size_t)lenmax) return NULL;
 825                 if (plistlen > 255)
 826                         {
 827                         SSLerr(SSL_F_SSL_ADD_CLIENTHELLO_TLSEXT, ERR_R_INTERNAL_ERROR);
 828                         return NULL;
 829                         }
 830
 831                 s2n(TLSEXT_TYPE_ec_point_formats,ret);
 832                 s2n(plistlen + 1,ret);
 833                 *(ret++) = (unsigned char)plistlen ;
 834                 memcpy(ret, plist, plistlen);
 835                 ret+=plistlen;
 836
 837                 /* Add TLS extension EllipticCurves to the ClientHello message */
 838                 plist = s->tlsext_ellipticcurvelist;
 839                 tls1_get_curvelist(s, 0, &plist, &plistlen);
 840
 841                 if ((lenmax = limit - ret - 6) < 0) return NULL;
 842                 if (plistlen > (size_t)lenmax) return NULL;
 843                 if (plistlen > 65532)
 844                         {
 845                         SSLerr(SSL_F_SSL_ADD_CLIENTHELLO_TLSEXT, ERR_R_INTERNAL_ERROR);
 846                         return NULL;
 847                         }
 848
 849                 s2n(TLSEXT_TYPE_elliptic_curves,ret);
 850                 s2n(plistlen + 2, ret);
 851
 852                 /* NB: draft-ietf-tls-ecc-12.txt uses a one-byte prefix for
 853                  * elliptic_curve_list, but the examples use two bytes.
 854                  * http://www1.ietf.org/mail-archive/web/tls/current/msg00538.html
 855                  * resolves this to two bytes.
 856                  */
 857                 s2n(plistlen, ret);
 858                 memcpy(ret, plist, plistlen);
 859                 ret+=plistlen;
 860                 }
 861 #endif /* OPENSSL_NO_EC */
 862
 863         if (!(SSL_get_options(s) & SSL_OP_NO_TICKET))
 864                 {
 865                 int ticklen;
 866                 if (!s->new_session && s->session && s->session->tlsext_tick)
 867                         ticklen = s->session->tlsext_ticklen;
 868                 else if (s->session && s->tlsext_session_ticket &&
 869                          s->tlsext_session_ticket->data)
 870                         {
 871                         ticklen = s->tlsext_session_ticket->length;
 872                         s->session->tlsext_tick = OPENSSL_malloc(ticklen);
 873                         if (!s->session->tlsext_tick)
 874                                 return NULL;
 875                         memcpy(s->session->tlsext_tick,
 876                                s->tlsext_session_ticket->data,
 877                                ticklen);
 878                         s->session->tlsext_ticklen = ticklen;
 879                         }
 880                 else
 881                         ticklen = 0;
 882                 if (ticklen == 0 && s->tlsext_session_ticket &&
 883                     s->tlsext_session_ticket->data == NULL)
 884                         goto skip_ext;
 885                 /* Check for enough room 2 for extension type, 2 for len
 886                  * rest for ticket
 887                  */
 888                 if ((long)(limit - ret - 4 - ticklen) < 0) return NULL;
 889                 s2n(TLSEXT_TYPE_session_ticket,ret);
 890                 s2n(ticklen,ret);
 891                 if (ticklen)
 892                         {
 893                         memcpy(ret, s->session->tlsext_tick, ticklen);
 894                         ret += ticklen;
 895                         }
 896                 }
 897                 skip_ext:
 898
 899         if (TLS1_get_client_version(s) >= TLS1_2_VERSION)
 900                 {
 901                 size_t salglen;
 902                 salglen = tls12_get_sig_algs(s, NULL);
 903                 if ((size_t)(limit - ret) < salglen + 6)
 904                         return NULL;
 905                 s2n(TLSEXT_TYPE_signature_algorithms,ret);
 906                 s2n(salglen + 2, ret);
 907                 s2n(salglen, ret);
 908                 tls12_get_sig_algs(s, ret);
 909                 ret += salglen;
 910                 }
 911
 912 #ifdef TLSEXT_TYPE_opaque_prf_input
 913         if (s->s3->client_opaque_prf_input != NULL &&
 914             s->version != DTLS1_VERSION)
 915                 {
 916                 size_t col = s->s3->client_opaque_prf_input_len;
 917
 918                 if ((long)(limit - ret - 6 - col < 0))
 919                         return NULL;
 920                 if (col > 0xFFFD) /* can't happen */
 921                         return NULL;
 922
 923                 s2n(TLSEXT_TYPE_opaque_prf_input, ret);
 924                 s2n(col + 2, ret);
 925                 s2n(col, ret);
 926                 memcpy(ret, s->s3->client_opaque_prf_input, col);
 927                 ret += col;
 928                 }
 929 #endif
 930
 931         if (s->tlsext_status_type == TLSEXT_STATUSTYPE_ocsp &&
 932             s->version != DTLS1_VERSION)
 933                 {
 934                 int i;
 935                 long extlen, idlen, itmp;
 936                 OCSP_RESPID *id;
 937
 938                 idlen = 0;
 939                 for (i = 0; i < sk_OCSP_RESPID_num(s->tlsext_ocsp_ids); i++)
 940                         {
 941                         id = sk_OCSP_RESPID_value(s->tlsext_ocsp_ids, i);
 942                         itmp = i2d_OCSP_RESPID(id, NULL);
 943                         if (itmp <= 0)
 944                                 return NULL;
 945                         idlen += itmp + 2;
 946                         }
 947
 948                 if (s->tlsext_ocsp_exts)
 949                         {
 950                         extlen = i2d_X509_EXTENSIONS(s->tlsext_ocsp_exts, NULL);
 951                         if (extlen < 0)
 952                                 return NULL;
 953                         }
 954                 else
 955                         extlen = 0;
 956
 957                 if ((long)(limit - ret - 7 - extlen - idlen) < 0) return NULL;
 958                 s2n(TLSEXT_TYPE_status_request, ret);
 959                 if (extlen + idlen > 0xFFF0)
 960                         return NULL;
 961                 s2n(extlen + idlen + 5, ret);
 962                 *(ret++) = TLSEXT_STATUSTYPE_ocsp;
 963                 s2n(idlen, ret);
 964                 for (i = 0; i < sk_OCSP_RESPID_num(s->tlsext_ocsp_ids); i++)
 965                         {
 966                         /* save position of id len */
 967                         unsigned char *q = ret;
 968                         id = sk_OCSP_RESPID_value(s->tlsext_ocsp_ids, i);
 969                         /* skip over id len */
 970                         ret += 2;
 971                         itmp = i2d_OCSP_RESPID(id, &ret);
 972                         /* write id len */
 973                         s2n(itmp, q);
 974                         }
 975                 s2n(extlen, ret);
 976                 if (extlen > 0)
 977                         i2d_X509_EXTENSIONS(s->tlsext_ocsp_exts, &ret);
 978                 }
 979
 980 #ifndef OPENSSL_NO_HEARTBEATS
 981         /* Add Heartbeat extension */
 982         s2n(TLSEXT_TYPE_heartbeat,ret);
 983         s2n(1,ret);
 984         /* Set mode:
 985          * 1: peer may send requests
 986          * 2: peer not allowed to send requests
 987          */
 988         if (s->tlsext_heartbeat & SSL_TLSEXT_HB_DONT_RECV_REQUESTS)
 989                 *(ret++) = SSL_TLSEXT_HB_DONT_SEND_REQUESTS;
 990         else
 991                 *(ret++) = SSL_TLSEXT_HB_ENABLED;
 992 #endif
 993
 994 #ifndef OPENSSL_NO_NEXTPROTONEG
 995         if (s->ctx->next_proto_select_cb && !s->s3->tmp.finish_md_len)
 996                 {
 997                 /* The client advertises an emtpy extension to indicate its
 998                  * support for Next Protocol Negotiation */
 999                 if (limit - ret - 4 < 0)
1000                         return NULL;
1001                 s2n(TLSEXT_TYPE_next_proto_neg,ret);
1002                 s2n(0,ret);
1003                 }
1004 #endif
1005
1006         if(SSL_get_srtp_profiles(s))
1007                 {
1008                 int el;
1009
1010                 ssl_add_clienthello_use_srtp_ext(s, 0, &el, 0);
1011
1012                 if((limit - p - 4 - el) < 0) return NULL;
1013
1014                 s2n(TLSEXT_TYPE_use_srtp,ret);
1015                 s2n(el,ret);
1016
1017                 if(ssl_add_clienthello_use_srtp_ext(s, ret, &el, el))
1018                         {
1019                         SSLerr(SSL_F_SSL_ADD_CLIENTHELLO_TLSEXT, ERR_R_INTERNAL_ERROR);
1020                         return NULL;
1021                         }
1022                 ret += el;
1023                 }
1024
1025         /* Add TLS extension Server_Authz_DataFormats to the ClientHello */
1026         /* 2 bytes for extension type */
1027         /* 2 bytes for extension length */
1028         /* 1 byte for the list length */
1029         /* 1 byte for the list (we only support audit proofs) */
1030         if (s->ctx->tlsext_authz_server_audit_proof_cb != NULL)
1031                 {
1032                 size_t lenmax;
1033                 const unsigned short ext_len = 2;
1034                 const unsigned char list_len = 1;
1035
1036                 if ((lenmax = limit - ret - 6) < 0) return NULL;
1037
1038                 s2n(TLSEXT_TYPE_server_authz, ret);
1039                 /* Extension length: 2 bytes */
1040                 s2n(ext_len, ret);
1041                 *(ret++) = list_len;
1042                 *(ret++) = TLSEXT_AUTHZDATAFORMAT_audit_proof;
1043                 }
1044
1045         if ((extdatalen = ret-p-2) == 0)
1046                 return p;
1047
1048         s2n(extdatalen,p);
1049         return ret;
1050         }
1051
1052 unsigned char *ssl_add_serverhello_tlsext(SSL *s, unsigned char *p, unsigned char *limit)
1053         {
1054         int extdatalen=0;
1055         unsigned char *ret = p;
1056 #ifndef OPENSSL_NO_NEXTPROTONEG
1057         int next_proto_neg_seen;
1058 #endif
1059
1060         /* don't add extensions for SSLv3, unless doing secure renegotiation */
1061         if (s->version == SSL3_VERSION && !s->s3->send_connection_binding)
1062                 return p;
1063
1064         ret+=2;
1065         if (ret>=limit) return NULL; /* this really never occurs, but ... */
1066
1067         if (!s->hit && s->servername_done == 1 && s->session->tlsext_hostname != NULL)
1068                 {
1069                 if ((long)(limit - ret - 4) < 0) return NULL;
1070
1071                 s2n(TLSEXT_TYPE_server_name,ret);
1072                 s2n(0,ret);
1073                 }
1074
1075         if(s->s3->send_connection_binding)
1076         {
1077           int el;
1078
1079           if(!ssl_add_serverhello_renegotiate_ext(s, 0, &el, 0))
1080               {
1081               SSLerr(SSL_F_SSL_ADD_SERVERHELLO_TLSEXT, ERR_R_INTERNAL_ERROR);
1082               return NULL;
1083               }
1084
1085           if((limit - p - 4 - el) < 0) return NULL;
1086
1087           s2n(TLSEXT_TYPE_renegotiate,ret);
1088           s2n(el,ret);
1089
1090           if(!ssl_add_serverhello_renegotiate_ext(s, ret, &el, el))
1091               {
1092               SSLerr(SSL_F_SSL_ADD_SERVERHELLO_TLSEXT, ERR_R_INTERNAL_ERROR);
1093               return NULL;
1094               }
1095
1096           ret += el;
1097         }
1098
1099 #ifndef OPENSSL_NO_EC
1100         if (s->tlsext_ecpointformatlist != NULL &&
1101             s->version != DTLS1_VERSION)
1102                 {
1103                 /* Add TLS extension ECPointFormats to the ServerHello message */
1104                 long lenmax;
1105
1106                 if ((lenmax = limit - ret - 5) < 0) return NULL;
1107                 if (s->tlsext_ecpointformatlist_length > (unsigned long)lenmax) return NULL;
1108                 if (s->tlsext_ecpointformatlist_length > 255)
1109                         {
1110                         SSLerr(SSL_F_SSL_ADD_SERVERHELLO_TLSEXT, ERR_R_INTERNAL_ERROR);
1111                         return NULL;
1112                         }
1113
1114                 s2n(TLSEXT_TYPE_ec_point_formats,ret);
1115                 s2n(s->tlsext_ecpointformatlist_length + 1,ret);
1116                 *(ret++) = (unsigned char) s->tlsext_ecpointformatlist_length;
1117                 memcpy(ret, s->tlsext_ecpointformatlist, s->tlsext_ecpointformatlist_length);
1118                 ret+=s->tlsext_ecpointformatlist_length;
1119
1120                 }
1121         /* Currently the server should not respond with a SupportedCurves extension */
1122 #endif /* OPENSSL_NO_EC */
1123
1124         if (s->tlsext_ticket_expected
1125                 && !(SSL_get_options(s) & SSL_OP_NO_TICKET))
1126                 {
1127                 if ((long)(limit - ret - 4) < 0) return NULL;
1128                 s2n(TLSEXT_TYPE_session_ticket,ret);
1129                 s2n(0,ret);
1130                 }
1131
1132         if (s->tlsext_status_expected)
1133                 {
1134                 if ((long)(limit - ret - 4) < 0) return NULL;
1135                 s2n(TLSEXT_TYPE_status_request,ret);
1136                 s2n(0,ret);
1137                 }
1138
1139 #ifdef TLSEXT_TYPE_opaque_prf_input
1140         if (s->s3->server_opaque_prf_input != NULL &&
1141             s->version != DTLS1_VERSION)
1142                 {
1143                 size_t sol = s->s3->server_opaque_prf_input_len;
1144
1145                 if ((long)(limit - ret - 6 - sol) < 0)
1146                         return NULL;
1147                 if (sol > 0xFFFD) /* can't happen */
1148                         return NULL;
1149
1150                 s2n(TLSEXT_TYPE_opaque_prf_input, ret);
1151                 s2n(sol + 2, ret);
1152                 s2n(sol, ret);
1153                 memcpy(ret, s->s3->server_opaque_prf_input, sol);
1154                 ret += sol;
1155                 }
1156 #endif
1157
1158         if(s->srtp_profile)
1159                 {
1160                 int el;
1161
1162                 ssl_add_serverhello_use_srtp_ext(s, 0, &el, 0);
1163
1164                 if((limit - p - 4 - el) < 0) return NULL;
1165
1166                 s2n(TLSEXT_TYPE_use_srtp,ret);
1167                 s2n(el,ret);
1168
1169                 if(ssl_add_serverhello_use_srtp_ext(s, ret, &el, el))
1170                         {
1171                         SSLerr(SSL_F_SSL_ADD_SERVERHELLO_TLSEXT, ERR_R_INTERNAL_ERROR);
1172                         return NULL;
1173                         }
1174                 ret+=el;
1175                 }
1176
1177         if (((s->s3->tmp.new_cipher->id & 0xFFFF)==0x80 || (s->s3->tmp.new_cipher->id & 0xFFFF)==0x81)
1178                 && (SSL_get_options(s) & SSL_OP_CRYPTOPRO_TLSEXT_BUG))
1179                 { const unsigned char cryptopro_ext[36] = {
1180                         0xfd, 0xe8, /*65000*/
1181                         0x00, 0x20, /*32 bytes length*/
1182                         0x30, 0x1e, 0x30, 0x08, 0x06, 0x06, 0x2a, 0x85,
1183                         0x03,   0x02, 0x02, 0x09, 0x30, 0x08, 0x06, 0x06,
1184                         0x2a, 0x85, 0x03, 0x02, 0x02, 0x16, 0x30, 0x08,
1185                         0x06, 0x06, 0x2a, 0x85, 0x03, 0x02, 0x02, 0x17};
1186                         if (limit-ret<36) return NULL;
1187                         memcpy(ret,cryptopro_ext,36);
1188                         ret+=36;
1189
1190                 }
1191
1192 #ifndef OPENSSL_NO_HEARTBEATS
1193         /* Add Heartbeat extension if we've received one */
1194         if (s->tlsext_heartbeat & SSL_TLSEXT_HB_ENABLED)
1195                 {
1196                 s2n(TLSEXT_TYPE_heartbeat,ret);
1197                 s2n(1,ret);
1198                 /* Set mode:
1199                  * 1: peer may send requests
1200                  * 2: peer not allowed to send requests
1201                  */
1202                 if (s->tlsext_heartbeat & SSL_TLSEXT_HB_DONT_RECV_REQUESTS)
1203                         *(ret++) = SSL_TLSEXT_HB_DONT_SEND_REQUESTS;
1204                 else
1205                         *(ret++) = SSL_TLSEXT_HB_ENABLED;
1206
1207                 }
1208 #endif
1209
1210 #ifndef OPENSSL_NO_NEXTPROTONEG
1211         next_proto_neg_seen = s->s3->next_proto_neg_seen;
1212         s->s3->next_proto_neg_seen = 0;
1213         if (next_proto_neg_seen && s->ctx->next_protos_advertised_cb)
1214                 {
1215                 const unsigned char *npa;
1216                 unsigned int npalen;
1217                 int r;
1218
1219                 r = s->ctx->next_protos_advertised_cb(s, &npa, &npalen, s->ctx->next_protos_advertised_cb_arg);
1220                 if (r == SSL_TLSEXT_ERR_OK)
1221                         {
1222                         if ((long)(limit - ret - 4 - npalen) < 0) return NULL;
1223                         s2n(TLSEXT_TYPE_next_proto_neg,ret);
1224                         s2n(npalen,ret);
1225                         memcpy(ret, npa, npalen);
1226                         ret += npalen;
1227                         s->s3->next_proto_neg_seen = 1;
1228                         }
1229                 }
1230 #endif
1231
1232         /* If the client supports authz then see whether we have any to offer
1233          * to it. */
1234         if (s->s3->tlsext_authz_client_types_len)
1235                 {
1236                 size_t authz_length;
1237                 /* By now we already know the new cipher, so we can look ahead
1238                  * to see whether the cert we are going to send
1239                  * has any authz data attached to it. */
1240                 const unsigned char* authz = ssl_get_authz_data(s, &authz_length);
1241                 const unsigned char* const orig_authz = authz;
1242                 size_t i;
1243                 unsigned authz_count = 0;
1244
1245                 /* The authz data contains a number of the following structures:
1246                  *      uint8_t authz_type
1247                  *      uint16_t length
1248                  *      uint8_t data[length]
1249                  *
1250                  * First we walk over it to find the number of authz elements. */
1251                 for (i = 0; i < authz_length; i++)
1252                         {
1253                         unsigned short length;
1254                         unsigned char type;
1255
1256                         type = *(authz++);
1257                         if (memchr(s->s3->tlsext_authz_client_types,
1258                                    type,
1259                                    s->s3->tlsext_authz_client_types_len) != NULL)
1260                                 authz_count++;
1261
1262                         n2s(authz, length);
1263                         /* n2s increments authz by 2 */
1264                         i += 2;
1265                         authz += length;
1266                         i += length;
1267                         }
1268
1269                 if (authz_count)
1270                         {
1271                         /* Add TLS extension server_authz to the ServerHello message
1272                          * 2 bytes for extension type
1273                          * 2 bytes for extension length
1274                          * 1 byte for the list length
1275                          * n bytes for the list */
1276                         const unsigned short ext_len = 1 + authz_count;
1277
1278                         if ((long)(limit - ret - 4 - ext_len) < 0) return NULL;
1279                         s2n(TLSEXT_TYPE_server_authz, ret);
1280                         s2n(ext_len, ret);
1281                         *(ret++) = authz_count;
1282                         s->s3->tlsext_authz_promised_to_client = 1;
1283                         }
1284
1285                 authz = orig_authz;
1286                 for (i = 0; i < authz_length; i++)
1287                         {
1288                         unsigned short length;
1289                         unsigned char type;
1290
1291                         authz_count++;
1292                         type = *(authz++);
1293                         if (memchr(s->s3->tlsext_authz_client_types,
1294                                    type,
1295                                    s->s3->tlsext_authz_client_types_len) != NULL)
1296                                 *(ret++) = type;
1297                         n2s(authz, length);
1298                         /* n2s increments authz by 2 */
1299                         i += 2;
1300                         authz += length;
1301                         i += length;
1302                         }
1303                 }
1304
1305         if ((extdatalen = ret-p-2)== 0)
1306                 return p;
1307
1308         s2n(extdatalen,p);
1309         return ret;
1310         }
1311
1312 static int ssl_scan_clienthello_tlsext(SSL *s, unsigned char **p, unsigned char *d, int n, int *al)
1313         {
1314         unsigned short type;
1315         unsigned short size;
1316         unsigned short len;
1317         unsigned char *data = *p;
1318         int renegotiate_seen = 0;
1319
1320         s->servername_done = 0;
1321         s->tlsext_status_type = -1;
1322 #ifndef OPENSSL_NO_NEXTPROTONEG
1323         s->s3->next_proto_neg_seen = 0;
1324 #endif
1325
1326 #ifndef OPENSSL_NO_HEARTBEATS
1327         s->tlsext_heartbeat &= ~(SSL_TLSEXT_HB_ENABLED |
1328                                SSL_TLSEXT_HB_DONT_SEND_REQUESTS);
1329 #endif
1330         /* Clear any signature algorithms extension received */
1331         if (s->cert->peer_sigalgs)
1332                 {
1333                 OPENSSL_free(s->cert->peer_sigalgs);
1334                 s->cert->peer_sigalgs = NULL;
1335                 }
1336         /* Clear any shared sigtnature algorithms */
1337         if (s->cert->shared_sigalgs)
1338                 {
1339                 OPENSSL_free(s->cert->shared_sigalgs);
1340                 s->cert->shared_sigalgs = NULL;
1341                 }
1342
1343         if (data >= (d+n-2))
1344                 goto ri_check;
1345         n2s(data,len);
1346
1347         if (data > (d+n-len))
1348                 goto ri_check;
1349
1350         while (data <= (d+n-4))
1351                 {
1352                 n2s(data,type);
1353                 n2s(data,size);
1354
1355                 if (data+size > (d+n))
1356                         goto ri_check;
1357 #if 0
1358                 fprintf(stderr,"Received extension type %d size %d\n",type,size);
1359 #endif
1360                 if (s->tlsext_debug_cb)
1361                         s->tlsext_debug_cb(s, 0, type, data, size,
1362                                                 s->tlsext_debug_arg);
1363 /* The servername extension is treated as follows:
1364
1365    - Only the hostname type is supported with a maximum length of 255.
1366    - The servername is rejected if too long or if it contains zeros,
1367      in which case an fatal alert is generated.
1368    - The servername field is maintained together with the session cache.
1369    - When a session is resumed, the servername call back invoked in order
1370      to allow the application to position itself to the right context.
1371    - The servername is acknowledged if it is new for a session or when
1372      it is identical to a previously used for the same session.
1373      Applications can control the behaviour.  They can at any time
1374      set a 'desirable' servername for a new SSL object. This can be the
1375      case for example with HTTPS when a Host: header field is received and
1376      a renegotiation is requested. In this case, a possible servername
1377      presented in the new client hello is only acknowledged if it matches
1378      the value of the Host: field.
1379    - Applications must  use SSL_OP_NO_SESSION_RESUMPTION_ON_RENEGOTIATION
1380      if they provide for changing an explicit servername context for the session,
1381      i.e. when the session has been established with a servername extension.
1382    - On session reconnect, the servername extension may be absent.
1383
1384 */
1385
1386                 if (type == TLSEXT_TYPE_server_name)
1387                         {
1388                         unsigned char *sdata;
1389                         int servname_type;
1390                         int dsize;
1391
1392                         if (size < 2)
1393                                 {
1394                                 *al = SSL_AD_DECODE_ERROR;
1395                                 return 0;
1396                                 }
1397                         n2s(data,dsize);
1398                         size -= 2;
1399                         if (dsize > size  )
1400                                 {
1401                                 *al = SSL_AD_DECODE_ERROR;
1402                                 return 0;
1403                                 }
1404
1405                         sdata = data;
1406                         while (dsize > 3)
1407                                 {
1408                                 servname_type = *(sdata++);
1409                                 n2s(sdata,len);
1410                                 dsize -= 3;
1411
1412                                 if (len > dsize)
1413                                         {
1414                                         *al = SSL_AD_DECODE_ERROR;
1415                                         return 0;
1416                                         }
1417                                 if (s->servername_done == 0)
1418                                 switch (servname_type)
1419                                         {
1420                                 case TLSEXT_NAMETYPE_host_name:
1421                                         if (!s->hit)
1422                                                 {
1423                                                 if(s->session->tlsext_hostname)
1424                                                         {
1425                                                         *al = SSL_AD_DECODE_ERROR;
1426                                                         return 0;
1427                                                         }
1428                                                 if (len > TLSEXT_MAXLEN_host_name)
1429                                                         {
1430                                                         *al = TLS1_AD_UNRECOGNIZED_NAME;
1431                                                         return 0;
1432                                                         }
1433                                                 if ((s->session->tlsext_hostname = OPENSSL_malloc(len+1)) == NULL)
1434                                                         {
1435                                                         *al = TLS1_AD_INTERNAL_ERROR;
1436                                                         return 0;
1437                                                         }
1438                                                 memcpy(s->session->tlsext_hostname, sdata, len);
1439                                                 s->session->tlsext_hostname[len]='\0';
1440                                                 if (strlen(s->session->tlsext_hostname) != len) {
1441                                                         OPENSSL_free(s->session->tlsext_hostname);
1442                                                         s->session->tlsext_hostname = NULL;
1443                                                         *al = TLS1_AD_UNRECOGNIZED_NAME;
1444                                                         return 0;
1445                                                 }
1446                                                 s->servername_done = 1;
1447
1448                                                 }
1449                                         else
1450                                                 s->servername_done = s->session->tlsext_hostname
1451                                                         && strlen(s->session->tlsext_hostname) == len
1452                                                         && strncmp(s->session->tlsext_hostname, (char *)sdata, len) == 0;
1453
1454                                         break;
1455
1456                                 default:
1457                                         break;
1458                                         }
1459
1460                                 dsize -= len;
1461                                 }
1462                         if (dsize != 0)
1463                                 {
1464                                 *al = SSL_AD_DECODE_ERROR;
1465                                 return 0;
1466                                 }
1467
1468                         }
1469 #ifndef OPENSSL_NO_SRP
1470                 else if (type == TLSEXT_TYPE_srp)
1471                         {
1472                         if (size <= 0 || ((len = data[0])) != (size -1))
1473                                 {
1474                                 *al = SSL_AD_DECODE_ERROR;
1475                                 return 0;
1476                                 }
1477                         if (s->srp_ctx.login != NULL)
1478                                 {
1479                                 *al = SSL_AD_DECODE_ERROR;
1480                                 return 0;
1481                                 }
1482                         if ((s->srp_ctx.login = OPENSSL_malloc(len+1)) == NULL)
1483                                 return -1;
1484                         memcpy(s->srp_ctx.login, &data[1], len);
1485                         s->srp_ctx.login[len]='\0';
1486
1487                         if (strlen(s->srp_ctx.login) != len)
1488                                 {
1489                                 *al = SSL_AD_DECODE_ERROR;
1490                                 return 0;
1491                                 }
1492                         }
1493 #endif
1494
1495 #ifndef OPENSSL_NO_EC
1496                 else if (type == TLSEXT_TYPE_ec_point_formats &&
1497                      s->version != DTLS1_VERSION)
1498                         {
1499                         unsigned char *sdata = data;
1500                         int ecpointformatlist_length = *(sdata++);
1501
1502                         if (ecpointformatlist_length != size - 1)
1503                                 {
1504                                 *al = TLS1_AD_DECODE_ERROR;
1505                                 return 0;
1506                                 }
1507                         if (!s->hit)
1508                                 {
1509                                 if(s->session->tlsext_ecpointformatlist)
1510                                         {
1511                                         OPENSSL_free(s->session->tlsext_ecpointformatlist);
1512                                         s->session->tlsext_ecpointformatlist = NULL;
1513                                         }
1514                                 s->session->tlsext_ecpointformatlist_length = 0;
1515                                 if ((s->session->tlsext_ecpointformatlist = OPENSSL_malloc(ecpointformatlist_length)) == NULL)
1516                                         {
1517                                         *al = TLS1_AD_INTERNAL_ERROR;
1518                                         return 0;
1519                                         }
1520                                 s->session->tlsext_ecpointformatlist_length = ecpointformatlist_length;
1521                                 memcpy(s->session->tlsext_ecpointformatlist, sdata, ecpointformatlist_length);
1522                                 }
1523 #if 0
1524                         fprintf(stderr,"ssl_parse_clienthello_tlsext s->session->tlsext_ecpointformatlist (length=%i) ", s->session->tlsext_ecpointformatlist_length);
1525                         sdata = s->session->tlsext_ecpointformatlist;
1526                         for (i = 0; i < s->session->tlsext_ecpointformatlist_length; i++)
1527                                 fprintf(stderr,"%i ",*(sdata++));
1528                         fprintf(stderr,"\n");
1529 #endif
1530                         }
1531                 else if (type == TLSEXT_TYPE_elliptic_curves &&
1532                      s->version != DTLS1_VERSION)
1533                         {
1534                         unsigned char *sdata = data;
1535                         int ellipticcurvelist_length = (*(sdata++) << 8);
1536                         ellipticcurvelist_length += (*(sdata++));
1537
1538                         if (ellipticcurvelist_length != size - 2 ||
1539                                 ellipticcurvelist_length < 1)
1540                                 {
1541                                 *al = TLS1_AD_DECODE_ERROR;
1542                                 return 0;
1543                                 }
1544                         if (!s->hit)
1545                                 {
1546                                 if(s->session->tlsext_ellipticcurvelist)
1547                                         {
1548                                         *al = TLS1_AD_DECODE_ERROR;
1549                                         return 0;
1550                                         }
1551                                 s->session->tlsext_ellipticcurvelist_length = 0;
1552                                 if ((s->session->tlsext_ellipticcurvelist = OPENSSL_malloc(ellipticcurvelist_length)) == NULL)
1553                                         {
1554                                         *al = TLS1_AD_INTERNAL_ERROR;
1555                                         return 0;
1556                                         }
1557                                 s->session->tlsext_ellipticcurvelist_length = ellipticcurvelist_length;
1558                                 memcpy(s->session->tlsext_ellipticcurvelist, sdata, ellipticcurvelist_length);
1559                                 }
1560 #if 0
1561                         fprintf(stderr,"ssl_parse_clienthello_tlsext s->session->tlsext_ellipticcurvelist (length=%i) ", s->session->tlsext_ellipticcurvelist_length);
1562                         sdata = s->session->tlsext_ellipticcurvelist;
1563                         for (i = 0; i < s->session->tlsext_ellipticcurvelist_length; i++)
1564                                 fprintf(stderr,"%i ",*(sdata++));
1565                         fprintf(stderr,"\n");
1566 #endif
1567                         }
1568 #endif /* OPENSSL_NO_EC */
1569 #ifdef TLSEXT_TYPE_opaque_prf_input
1570                 else if (type == TLSEXT_TYPE_opaque_prf_input &&
1571                      s->version != DTLS1_VERSION)
1572                         {
1573                         unsigned char *sdata = data;
1574
1575                         if (size < 2)
1576                                 {
1577                                 *al = SSL_AD_DECODE_ERROR;
1578                                 return 0;
1579                                 }
1580                         n2s(sdata, s->s3->client_opaque_prf_input_len);
1581                         if (s->s3->client_opaque_prf_input_len != size - 2)
1582                                 {
1583                                 *al = SSL_AD_DECODE_ERROR;
1584                                 return 0;
1585                                 }
1586
1587                         if (s->s3->client_opaque_prf_input != NULL) /* shouldn't really happen */
1588                                 OPENSSL_free(s->s3->client_opaque_prf_input);
1589                         if (s->s3->client_opaque_prf_input_len == 0)
1590                                 s->s3->client_opaque_prf_input = OPENSSL_malloc(1); /* dummy byte just to get non-NULL */
1591                         else
1592                                 s->s3->client_opaque_prf_input = BUF_memdup(sdata, s->s3->client_opaque_prf_input_len);
1593                         if (s->s3->client_opaque_prf_input == NULL)
1594                                 {
1595                                 *al = TLS1_AD_INTERNAL_ERROR;
1596                                 return 0;
1597                                 }
1598                         }
1599 #endif
1600                 else if (type == TLSEXT_TYPE_session_ticket)
1601                         {
1602                         if (s->tls_session_ticket_ext_cb &&
1603                             !s->tls_session_ticket_ext_cb(s, data, size, s->tls_session_ticket_ext_cb_arg))
1604                                 {
1605                                 *al = TLS1_AD_INTERNAL_ERROR;
1606                                 return 0;
1607                                 }
1608                         }
1609                 else if (type == TLSEXT_TYPE_renegotiate)
1610                         {
1611                         if(!ssl_parse_clienthello_renegotiate_ext(s, data, size, al))
1612                                 return 0;
1613                         renegotiate_seen = 1;
1614                         }
1615                 else if (type == TLSEXT_TYPE_signature_algorithms)
1616                         {
1617                         int dsize;
1618                         if (s->cert->peer_sigalgs || size < 2)
1619                                 {
1620                                 *al = SSL_AD_DECODE_ERROR;
1621                                 return 0;
1622                                 }
1623                         n2s(data,dsize);
1624                         size -= 2;
1625                         if (dsize != size || dsize & 1 || !dsize)
1626                                 {
1627                                 *al = SSL_AD_DECODE_ERROR;
1628                                 return 0;
1629                                 }
1630                         if (!tls1_process_sigalgs(s, data, dsize))
1631                                 {
1632                                 *al = SSL_AD_DECODE_ERROR;
1633                                 return 0;
1634                                 }
1635                         /* If sigalgs received and no shared algorithms fatal
1636                          * error.
1637                          */
1638                         if (s->cert->peer_sigalgs && !s->cert->shared_sigalgs)
1639                                 {
1640                                 SSLerr(SSL_F_SSL_SCAN_CLIENTHELLO_TLSEXT,
1641                                         SSL_R_NO_SHARED_SIGATURE_ALGORITHMS);
1642                                 *al = SSL_AD_ILLEGAL_PARAMETER;
1643                                 return 0;
1644                                 }
1645                         }
1646                 else if (type == TLSEXT_TYPE_status_request &&
1647                          s->version != DTLS1_VERSION && s->ctx->tlsext_status_cb)
1648                         {
1649
1650                         if (size < 5)
1651                                 {
1652                                 *al = SSL_AD_DECODE_ERROR;
1653                                 return 0;
1654                                 }
1655
1656                         s->tlsext_status_type = *data++;
1657                         size--;
1658                         if (s->tlsext_status_type == TLSEXT_STATUSTYPE_ocsp)
1659                                 {
1660                                 const unsigned char *sdata;
1661                                 int dsize;
1662                                 /* Read in responder_id_list */
1663                                 n2s(data,dsize);
1664                                 size -= 2;
1665                                 if (dsize > size  )
1666                                         {
1667                                         *al = SSL_AD_DECODE_ERROR;
1668                                         return 0;
1669                                         }
1670                                 while (dsize > 0)
1671                                         {
1672                                         OCSP_RESPID *id;
1673                                         int idsize;
1674                                         if (dsize < 4)
1675                                                 {
1676                                                 *al = SSL_AD_DECODE_ERROR;
1677                                                 return 0;
1678                                                 }
1679                                         n2s(data, idsize);
1680                                         dsize -= 2 + idsize;
1681                                         size -= 2 + idsize;
1682                                         if (dsize < 0)
1683                                                 {
1684                                                 *al = SSL_AD_DECODE_ERROR;
1685                                                 return 0;
1686                                                 }
1687                                         sdata = data;
1688                                         data += idsize;
1689                                         id = d2i_OCSP_RESPID(NULL,
1690                                                                 &sdata, idsize);
1691                                         if (!id)
1692                                                 {
1693                                                 *al = SSL_AD_DECODE_ERROR;
1694                                                 return 0;
1695                                                 }
1696                                         if (data != sdata)
1697                                                 {
1698                                                 OCSP_RESPID_free(id);
1699                                                 *al = SSL_AD_DECODE_ERROR;
1700                                                 return 0;
1701                                                 }
1702                                         if (!s->tlsext_ocsp_ids
1703                                                 && !(s->tlsext_ocsp_ids =
1704                                                 sk_OCSP_RESPID_new_null()))
1705                                                 {
1706                                                 OCSP_RESPID_free(id);
1707                                                 *al = SSL_AD_INTERNAL_ERROR;
1708                                                 return 0;
1709                                                 }
1710                                         if (!sk_OCSP_RESPID_push(
1711                                                         s->tlsext_ocsp_ids, id))
1712                                                 {
1713                                                 OCSP_RESPID_free(id);
1714                                                 *al = SSL_AD_INTERNAL_ERROR;
1715                                                 return 0;
1716                                                 }
1717                                         }
1718
1719                                 /* Read in request_extensions */
1720                                 if (size < 2)
1721                                         {
1722                                         *al = SSL_AD_DECODE_ERROR;
1723                                         return 0;
1724                                         }
1725                                 n2s(data,dsize);
1726                                 size -= 2;
1727                                 if (dsize != size)
1728                                         {
1729                                         *al = SSL_AD_DECODE_ERROR;
1730                                         return 0;
1731                                         }
1732                                 sdata = data;
1733                                 if (dsize > 0)
1734                                         {
1735                                         if (s->tlsext_ocsp_exts)
1736                                                 {
1737                                                 sk_X509_EXTENSION_pop_free(s->tlsext_ocsp_exts,
1738                                                                            X509_EXTENSION_free);
1739                                                 }
1740
1741                                         s->tlsext_ocsp_exts =
1742                                                 d2i_X509_EXTENSIONS(NULL,
1743                                                         &sdata, dsize);
1744                                         if (!s->tlsext_ocsp_exts
1745                                                 || (data + dsize != sdata))
1746                                                 {
1747                                                 *al = SSL_AD_DECODE_ERROR;
1748                                                 return 0;
1749                                                 }
1750                                         }
1751                                 }
1752                                 /* We don't know what to do with any other type
1753                                 * so ignore it.
1754                                 */
1755                                 else
1756                                         s->tlsext_status_type = -1;
1757                         }
1758 #ifndef OPENSSL_NO_HEARTBEATS
1759                 else if (type == TLSEXT_TYPE_heartbeat)
1760                         {
1761                         switch(data[0])
1762                                 {
1763                                 case 0x01:      /* Client allows us to send HB requests */
1764                                                         s->tlsext_heartbeat |= SSL_TLSEXT_HB_ENABLED;
1765                                                         break;
1766                                 case 0x02:      /* Client doesn't accept HB requests */
1767                                                         s->tlsext_heartbeat |= SSL_TLSEXT_HB_ENABLED;
1768                                                         s->tlsext_heartbeat |= SSL_TLSEXT_HB_DONT_SEND_REQUESTS;
1769                                                         break;
1770                                 default:        *al = SSL_AD_ILLEGAL_PARAMETER;
1771                                                         return 0;
1772                                 }
1773                         }
1774 #endif
1775 #ifndef OPENSSL_NO_NEXTPROTONEG
1776                 else if (type == TLSEXT_TYPE_next_proto_neg &&
1777                          s->s3->tmp.finish_md_len == 0)
1778                         {
1779                         /* We shouldn't accept this extension on a
1780                          * renegotiation.
1781                          *
1782                          * s->new_session will be set on renegotiation, but we
1783                          * probably shouldn't rely that it couldn't be set on
1784                          * the initial renegotation too in certain cases (when
1785                          * there's some other reason to disallow resuming an
1786                          * earlier session -- the current code won't be doing
1787                          * anything like that, but this might change).
1788
1789                          * A valid sign that there's been a previous handshake
1790                          * in this connection is if s->s3->tmp.finish_md_len >
1791                          * 0.  (We are talking about a check that will happen
1792                          * in the Hello protocol round, well before a new
1793                          * Finished message could have been computed.) */
1794                         s->s3->next_proto_neg_seen = 1;
1795                         }
1796 #endif
1797
1798                 /* session ticket processed earlier */
1799                 else if (type == TLSEXT_TYPE_use_srtp)
1800                         {
1801                         if(ssl_parse_clienthello_use_srtp_ext(s, data, size,
1802                                                               al))
1803                                 return 0;
1804                         }
1805
1806                 else if (type == TLSEXT_TYPE_server_authz)
1807                         {
1808                         unsigned char *sdata = data;
1809                         unsigned char server_authz_dataformatlist_length;
1810
1811                         if (size == 0)
1812                                 {
1813                                 *al = TLS1_AD_DECODE_ERROR;
1814                                 return 0;
1815                                 }
1816
1817                         server_authz_dataformatlist_length = *(sdata++);
1818
1819                         if (server_authz_dataformatlist_length != size - 1)
1820                                 {
1821                                 *al = TLS1_AD_DECODE_ERROR;
1822                                 return 0;
1823                                 }
1824
1825                         /* Successful session resumption uses the same authz
1826                          * information as the original session so we ignore this
1827                          * in the case of a session resumption. */
1828                         if (!s->hit)
1829                                 {
1830                                 size_t i;
1831                                 if (s->s3->tlsext_authz_client_types != NULL)
1832                                         OPENSSL_free(s->s3->tlsext_authz_client_types);
1833                                 s->s3->tlsext_authz_client_types =
1834                                         OPENSSL_malloc(server_authz_dataformatlist_length);
1835                                 if (!s->s3->tlsext_authz_client_types)
1836                                         {
1837                                         *al = TLS1_AD_INTERNAL_ERROR;
1838                                         return 0;
1839                                         }
1840
1841                                 s->s3->tlsext_authz_client_types_len =
1842                                         server_authz_dataformatlist_length;
1843                                 memcpy(s->s3->tlsext_authz_client_types,
1844                                        sdata,
1845                                        server_authz_dataformatlist_length);
1846
1847                                 /* Sort the types in order to check for duplicates. */
1848                                 qsort(s->s3->tlsext_authz_client_types,
1849                                       server_authz_dataformatlist_length,
1850                                       1 /* element size */,
1851                                       byte_compare);
1852
1853                                 for (i = 0; i < server_authz_dataformatlist_length; i++)
1854                                         {
1855                                         if (i > 0 &&
1856                                             s->s3->tlsext_authz_client_types[i] ==
1857                                               s->s3->tlsext_authz_client_types[i-1])
1858                                                 {
1859                                                 *al = TLS1_AD_DECODE_ERROR;
1860                                                 return 0;
1861                                                 }
1862                                         }
1863                                 }
1864                         }
1865
1866                 data+=size;
1867                 }
1868
1869         *p = data;
1870
1871         ri_check:
1872
1873         /* Need RI if renegotiating */
1874
1875         if (!renegotiate_seen && s->renegotiate &&
1876                 !(s->options & SSL_OP_ALLOW_UNSAFE_LEGACY_RENEGOTIATION))
1877                 {
1878                 *al = SSL_AD_HANDSHAKE_FAILURE;
1879                 SSLerr(SSL_F_SSL_SCAN_CLIENTHELLO_TLSEXT,
1880                                 SSL_R_UNSAFE_LEGACY_RENEGOTIATION_DISABLED);
1881                 return 0;
1882                 }
1883         /* If no signature algorithms extension set default values */
1884         if (!s->cert->peer_sigalgs)
1885                 ssl_cert_set_default_md(s->cert);
1886
1887         return 1;
1888         }
1889
1890 int ssl_parse_clienthello_tlsext(SSL *s, unsigned char **p, unsigned char *d, int n)
1891         {
1892         int al = -1;
1893         if (ssl_scan_clienthello_tlsext(s, p, d, n, &al) <= 0)
1894                 {
1895                 ssl3_send_alert(s,SSL3_AL_FATAL,al);
1896                 return 0;
1897                 }
1898
1899         if (ssl_check_clienthello_tlsext_early(s) <= 0)
1900                 {
1901                 SSLerr(SSL_F_SSL_PARSE_CLIENTHELLO_TLSEXT,SSL_R_CLIENTHELLO_TLSEXT);
1902                 return 0;
1903                 }
1904         return 1;
1905 }
1906
1907 #ifndef OPENSSL_NO_NEXTPROTONEG
1908 /* ssl_next_proto_validate validates a Next Protocol Negotiation block. No
1909  * elements of zero length are allowed and the set of elements must exactly fill
1910  * the length of the block. */
1911 static char ssl_next_proto_validate(unsigned char *d, unsigned len)
1912         {
1913         unsigned int off = 0;
1914
1915         while (off < len)
1916                 {
1917                 if (d[off] == 0)
1918                         return 0;
1919                 off += d[off];
1920                 off++;
1921                 }
1922
1923         return off == len;
1924         }
1925 #endif
1926
1927 static int ssl_scan_serverhello_tlsext(SSL *s, unsigned char **p, unsigned char *d, int n, int *al)
1928         {
1929         unsigned short length;
1930         unsigned short type;
1931         unsigned short size;
1932         unsigned char *data = *p;
1933         int tlsext_servername = 0;
1934         int renegotiate_seen = 0;
1935
1936 #ifndef OPENSSL_NO_NEXTPROTONEG
1937         s->s3->next_proto_neg_seen = 0;
1938 #endif
1939
1940 #ifndef OPENSSL_NO_HEARTBEATS
1941         s->tlsext_heartbeat &= ~(SSL_TLSEXT_HB_ENABLED |
1942                                SSL_TLSEXT_HB_DONT_SEND_REQUESTS);
1943 #endif
1944
1945         if (data >= (d+n-2))
1946                 goto ri_check;
1947
1948         n2s(data,length);
1949         if (data+length != d+n)
1950                 {
1951                 *al = SSL_AD_DECODE_ERROR;
1952                 return 0;
1953                 }
1954
1955         while(data <= (d+n-4))
1956                 {
1957                 n2s(data,type);
1958                 n2s(data,size);
1959
1960                 if (data+size > (d+n))
1961                         goto ri_check;
1962
1963                 if (s->tlsext_debug_cb)
1964                         s->tlsext_debug_cb(s, 1, type, data, size,
1965                                                 s->tlsext_debug_arg);
1966
1967                 if (type == TLSEXT_TYPE_server_name)
1968                         {
1969                         if (s->tlsext_hostname == NULL || size > 0)
1970                                 {
1971                                 *al = TLS1_AD_UNRECOGNIZED_NAME;
1972                                 return 0;
1973                                 }
1974                         tlsext_servername = 1;
1975                         }
1976
1977 #ifndef OPENSSL_NO_EC
1978                 else if (type == TLSEXT_TYPE_ec_point_formats &&
1979                      s->version != DTLS1_VERSION)
1980                         {
1981                         unsigned char *sdata = data;
1982                         int ecpointformatlist_length = *(sdata++);
1983
1984                         if (ecpointformatlist_length != size - 1 ||
1985                                 ecpointformatlist_length < 1)
1986                                 {
1987                                 *al = TLS1_AD_DECODE_ERROR;
1988                                 return 0;
1989                                 }
1990                         s->session->tlsext_ecpointformatlist_length = 0;
1991                         if (s->session->tlsext_ecpointformatlist != NULL) OPENSSL_free(s->session->tlsext_ecpointformatlist);
1992                         if ((s->session->tlsext_ecpointformatlist = OPENSSL_malloc(ecpointformatlist_length)) == NULL)
1993                                 {
1994                                 *al = TLS1_AD_INTERNAL_ERROR;
1995                                 return 0;
1996                                 }
1997                         s->session->tlsext_ecpointformatlist_length = ecpointformatlist_length;
1998                         memcpy(s->session->tlsext_ecpointformatlist, sdata, ecpointformatlist_length);
1999 #if 0
2000                         fprintf(stderr,"ssl_parse_serverhello_tlsext s->session->tlsext_ecpointformatlist ");
2001                         sdata = s->session->tlsext_ecpointformatlist;
2002                         for (i = 0; i < s->session->tlsext_ecpointformatlist_length; i++)
2003                                 fprintf(stderr,"%i ",*(sdata++));
2004                         fprintf(stderr,"\n");
2005 #endif
2006                         }
2007 #endif /* OPENSSL_NO_EC */
2008
2009                 else if (type == TLSEXT_TYPE_session_ticket)
2010                         {
2011                         if (s->tls_session_ticket_ext_cb &&
2012                             !s->tls_session_ticket_ext_cb(s, data, size, s->tls_session_ticket_ext_cb_arg))
2013                                 {
2014                                 *al = TLS1_AD_INTERNAL_ERROR;
2015                                 return 0;
2016                                 }
2017                         if ((SSL_get_options(s) & SSL_OP_NO_TICKET)
2018                                 || (size > 0))
2019                                 {
2020                                 *al = TLS1_AD_UNSUPPORTED_EXTENSION;
2021                                 return 0;
2022                                 }
2023                         s->tlsext_ticket_expected = 1;
2024                         }
2025 #ifdef TLSEXT_TYPE_opaque_prf_input
2026                 else if (type == TLSEXT_TYPE_opaque_prf_input &&
2027                      s->version != DTLS1_VERSION)
2028                         {
2029                         unsigned char *sdata = data;
2030
2031                         if (size < 2)
2032                                 {
2033                                 *al = SSL_AD_DECODE_ERROR;
2034                                 return 0;
2035                                 }
2036                         n2s(sdata, s->s3->server_opaque_prf_input_len);
2037                         if (s->s3->server_opaque_prf_input_len != size - 2)
2038                                 {
2039                                 *al = SSL_AD_DECODE_ERROR;
2040                                 return 0;
2041                                 }
2042
2043                         if (s->s3->server_opaque_prf_input != NULL) /* shouldn't really happen */
2044                                 OPENSSL_free(s->s3->server_opaque_prf_input);
2045                         if (s->s3->server_opaque_prf_input_len == 0)
2046                                 s->s3->server_opaque_prf_input = OPENSSL_malloc(1); /* dummy byte just to get non-NULL */
2047                         else
2048                                 s->s3->server_opaque_prf_input = BUF_memdup(sdata, s->s3->server_opaque_prf_input_len);
2049
2050                         if (s->s3->server_opaque_prf_input == NULL)
2051                                 {
2052                                 *al = TLS1_AD_INTERNAL_ERROR;
2053                                 return 0;
2054                                 }
2055                         }
2056 #endif
2057                 else if (type == TLSEXT_TYPE_status_request &&
2058                          s->version != DTLS1_VERSION)
2059                         {
2060                         /* MUST be empty and only sent if we've requested
2061                          * a status request message.
2062                          */
2063                         if ((s->tlsext_status_type == -1) || (size > 0))
2064                                 {
2065                                 *al = TLS1_AD_UNSUPPORTED_EXTENSION;
2066                                 return 0;
2067                                 }
2068                         /* Set flag to expect CertificateStatus message */
2069                         s->tlsext_status_expected = 1;
2070                         }
2071 #ifndef OPENSSL_NO_NEXTPROTONEG
2072                 else if (type == TLSEXT_TYPE_next_proto_neg &&
2073                          s->s3->tmp.finish_md_len == 0)
2074                         {
2075                         unsigned char *selected;
2076                         unsigned char selected_len;
2077
2078                         /* We must have requested it. */
2079                         if ((s->ctx->next_proto_select_cb == NULL))
2080                                 {
2081                                 *al = TLS1_AD_UNSUPPORTED_EXTENSION;
2082                                 return 0;
2083                                 }
2084                         /* The data must be valid */
2085                         if (!ssl_next_proto_validate(data, size))
2086                                 {
2087                                 *al = TLS1_AD_DECODE_ERROR;
2088                                 return 0;
2089                                 }
2090                         if (s->ctx->next_proto_select_cb(s, &selected, &selected_len, data, size, s->ctx->next_proto_select_cb_arg) != SSL_TLSEXT_ERR_OK)
2091                                 {
2092                                 *al = TLS1_AD_INTERNAL_ERROR;
2093                                 return 0;
2094                                 }
2095                         s->next_proto_negotiated = OPENSSL_malloc(selected_len);
2096                         if (!s->next_proto_negotiated)
2097                                 {
2098                                 *al = TLS1_AD_INTERNAL_ERROR;
2099                                 return 0;
2100                                 }
2101                         memcpy(s->next_proto_negotiated, selected, selected_len);
2102                         s->next_proto_negotiated_len = selected_len;
2103                         s->s3->next_proto_neg_seen = 1;
2104                         }
2105 #endif
2106                 else if (type == TLSEXT_TYPE_renegotiate)
2107                         {
2108                         if(!ssl_parse_serverhello_renegotiate_ext(s, data, size, al))
2109                                 return 0;
2110                         renegotiate_seen = 1;
2111                         }
2112 #ifndef OPENSSL_NO_HEARTBEATS
2113                 else if (type == TLSEXT_TYPE_heartbeat)
2114                         {
2115                         switch(data[0])
2116                                 {
2117                                 case 0x01:      /* Server allows us to send HB requests */
2118                                                         s->tlsext_heartbeat |= SSL_TLSEXT_HB_ENABLED;
2119                                                         break;
2120                                 case 0x02:      /* Server doesn't accept HB requests */
2121                                                         s->tlsext_heartbeat |= SSL_TLSEXT_HB_ENABLED;
2122                                                         s->tlsext_heartbeat |= SSL_TLSEXT_HB_DONT_SEND_REQUESTS;
2123                                                         break;
2124                                 default:        *al = SSL_AD_ILLEGAL_PARAMETER;
2125                                                         return 0;
2126                                 }
2127                         }
2128 #endif
2129                 else if (type == TLSEXT_TYPE_use_srtp)
2130                         {
2131                         if(ssl_parse_serverhello_use_srtp_ext(s, data, size,
2132                                                               al))
2133                                 return 0;
2134                         }
2135
2136                 else if (type == TLSEXT_TYPE_server_authz)
2137                         {
2138                         /* We only support audit proofs. It's an error to send
2139                          * an authz hello extension if the client
2140                          * didn't request a proof. */
2141                         unsigned char *sdata = data;
2142                         unsigned char server_authz_dataformatlist_length;
2143
2144                         if (!s->ctx->tlsext_authz_server_audit_proof_cb)
2145                                 {
2146                                 *al = TLS1_AD_UNSUPPORTED_EXTENSION;
2147                                 return 0;
2148                                 }
2149
2150                         if (!size)
2151                                 {
2152                                 *al = TLS1_AD_DECODE_ERROR;
2153                                 return 0;
2154                                 }
2155
2156                         server_authz_dataformatlist_length = *(sdata++);
2157                         if (server_authz_dataformatlist_length != size - 1)
2158                                 {
2159                                 *al = TLS1_AD_DECODE_ERROR;
2160                                 return 0;
2161                                 }
2162
2163                         /* We only support audit proofs, so a legal ServerHello
2164                          * authz list contains exactly one entry. */
2165                         if (server_authz_dataformatlist_length != 1 ||
2166                                 sdata[0] != TLSEXT_AUTHZDATAFORMAT_audit_proof)
2167                                 {
2168                                 *al = TLS1_AD_UNSUPPORTED_EXTENSION;
2169                                 return 0;
2170                                 }
2171
2172                         s->s3->tlsext_authz_server_promised = 1;
2173                         }
2174
2175                 data += size;
2176                 }
2177
2178         if (data != d+n)
2179                 {
2180                 *al = SSL_AD_DECODE_ERROR;
2181                 return 0;
2182                 }
2183
2184         if (!s->hit && tlsext_servername == 1)
2185                 {
2186                 if (s->tlsext_hostname)
2187                         {
2188                         if (s->session->tlsext_hostname == NULL)
2189                                 {
2190                                 s->session->tlsext_hostname = BUF_strdup(s->tlsext_hostname);
2191                                 if (!s->session->tlsext_hostname)
2192                                         {
2193                                         *al = SSL_AD_UNRECOGNIZED_NAME;
2194                                         return 0;
2195                                         }
2196                                 }
2197                         else
2198                                 {
2199                                 *al = SSL_AD_DECODE_ERROR;
2200                                 return 0;
2201                                 }
2202                         }
2203                 }
2204
2205         *p = data;
2206
2207         ri_check:
2208
2209         /* Determine if we need to see RI. Strictly speaking if we want to
2210          * avoid an attack we should *always* see RI even on initial server
2211          * hello because the client doesn't see any renegotiation during an
2212          * attack. However this would mean we could not connect to any server
2213          * which doesn't support RI so for the immediate future tolerate RI
2214          * absence on initial connect only.
2215          */
2216         if (!renegotiate_seen
2217                 && !(s->options & SSL_OP_LEGACY_SERVER_CONNECT)
2218                 && !(s->options & SSL_OP_ALLOW_UNSAFE_LEGACY_RENEGOTIATION))
2219                 {
2220                 *al = SSL_AD_HANDSHAKE_FAILURE;
2221                 SSLerr(SSL_F_SSL_SCAN_SERVERHELLO_TLSEXT,
2222                                 SSL_R_UNSAFE_LEGACY_RENEGOTIATION_DISABLED);
2223                 return 0;
2224                 }
2225
2226         return 1;
2227         }
2228
2229
2230 int ssl_prepare_clienthello_tlsext(SSL *s)
2231         {
2232
2233 #ifdef TLSEXT_TYPE_opaque_prf_input
2234         {
2235                 int r = 1;
2236
2237                 if (s->ctx->tlsext_opaque_prf_input_callback != 0)
2238                         {
2239                         r = s->ctx->tlsext_opaque_prf_input_callback(s, NULL, 0, s->ctx->tlsext_opaque_prf_input_callback_arg);
2240                         if (!r)
2241                                 return -1;
2242                         }
2243
2244                 if (s->tlsext_opaque_prf_input != NULL)
2245                         {
2246                         if (s->s3->client_opaque_prf_input != NULL) /* shouldn't really happen */
2247                                 OPENSSL_free(s->s3->client_opaque_prf_input);
2248
2249                         if (s->tlsext_opaque_prf_input_len == 0)
2250                                 s->s3->client_opaque_prf_input = OPENSSL_malloc(1); /* dummy byte just to get non-NULL */
2251                         else
2252                                 s->s3->client_opaque_prf_input = BUF_memdup(s->tlsext_opaque_prf_input, s->tlsext_opaque_prf_input_len);
2253                         if (s->s3->client_opaque_prf_input == NULL)
2254                                 {
2255                                 SSLerr(SSL_F_SSL_PREPARE_CLIENTHELLO_TLSEXT,ERR_R_MALLOC_FAILURE);
2256                                 return -1;
2257                                 }
2258                         s->s3->client_opaque_prf_input_len = s->tlsext_opaque_prf_input_len;
2259                         }
2260
2261                 if (r == 2)
2262                         /* at callback's request, insist on receiving an appropriate server opaque PRF input */
2263                         s->s3->server_opaque_prf_input_len = s->tlsext_opaque_prf_input_len;
2264         }
2265 #endif
2266
2267         return 1;
2268         }
2269
2270 int ssl_prepare_serverhello_tlsext(SSL *s)
2271         {
2272 #ifndef OPENSSL_NO_EC
2273         /* If we are server and using an ECC cipher suite, send the point formats we support
2274          * if the client sent us an ECPointsFormat extension.  Note that the server is not
2275          * supposed to send an EllipticCurves extension.
2276          */
2277
2278         unsigned long alg_k = s->s3->tmp.new_cipher->algorithm_mkey;
2279         unsigned long alg_a = s->s3->tmp.new_cipher->algorithm_auth;
2280         int using_ecc = (alg_k & (SSL_kEECDH|SSL_kECDHr|SSL_kECDHe)) || (alg_a & SSL_aECDSA);
2281         using_ecc = using_ecc && (s->session->tlsext_ecpointformatlist != NULL);
2282
2283         if (using_ecc)
2284                 {
2285                 if (s->tlsext_ecpointformatlist != NULL) OPENSSL_free(s->tlsext_ecpointformatlist);
2286                 if ((s->tlsext_ecpointformatlist = OPENSSL_malloc(3)) == NULL)
2287                         {
2288                         SSLerr(SSL_F_SSL_PREPARE_SERVERHELLO_TLSEXT,ERR_R_MALLOC_FAILURE);
2289                         return -1;
2290                         }
2291                 s->tlsext_ecpointformatlist_length = 3;
2292                 s->tlsext_ecpointformatlist[0] = TLSEXT_ECPOINTFORMAT_uncompressed;
2293                 s->tlsext_ecpointformatlist[1] = TLSEXT_ECPOINTFORMAT_ansiX962_compressed_prime;
2294                 s->tlsext_ecpointformatlist[2] = TLSEXT_ECPOINTFORMAT_ansiX962_compressed_char2;
2295                 }
2296 #endif /* OPENSSL_NO_EC */
2297
2298         return 1;
2299         }
2300
2301 static int ssl_check_clienthello_tlsext_early(SSL *s)
2302         {
2303         int ret=SSL_TLSEXT_ERR_NOACK;
2304         int al = SSL_AD_UNRECOGNIZED_NAME;
2305
2306 #ifndef OPENSSL_NO_EC
2307         /* The handling of the ECPointFormats extension is done elsewhere, namely in
2308          * ssl3_choose_cipher in s3_lib.c.
2309          */
2310         /* The handling of the EllipticCurves extension is done elsewhere, namely in
2311          * ssl3_choose_cipher in s3_lib.c.
2312          */
2313 #endif
2314
2315         if (s->ctx != NULL && s->ctx->tlsext_servername_callback != 0)
2316                 ret = s->ctx->tlsext_servername_callback(s, &al, s->ctx->tlsext_servername_arg);
2317         else if (s->initial_ctx != NULL && s->initial_ctx->tlsext_servername_callback != 0)
2318                 ret = s->initial_ctx->tlsext_servername_callback(s, &al, s->initial_ctx->tlsext_servername_arg);
2319
2320 #ifdef TLSEXT_TYPE_opaque_prf_input
2321         {
2322                 /* This sort of belongs into ssl_prepare_serverhello_tlsext(),
2323                  * but we might be sending an alert in response to the client hello,
2324                  * so this has to happen here in
2325                  * ssl_check_clienthello_tlsext_early(). */
2326
2327                 int r = 1;
2328
2329                 if (s->ctx->tlsext_opaque_prf_input_callback != 0)
2330                         {
2331                         r = s->ctx->tlsext_opaque_prf_input_callback(s, NULL, 0, s->ctx->tlsext_opaque_prf_input_callback_arg);
2332                         if (!r)
2333                                 {
2334                                 ret = SSL_TLSEXT_ERR_ALERT_FATAL;
2335                                 al = SSL_AD_INTERNAL_ERROR;
2336                                 goto err;
2337                                 }
2338                         }
2339
2340                 if (s->s3->server_opaque_prf_input != NULL) /* shouldn't really happen */
2341                         OPENSSL_free(s->s3->server_opaque_prf_input);
2342                 s->s3->server_opaque_prf_input = NULL;
2343
2344                 if (s->tlsext_opaque_prf_input != NULL)
2345                         {
2346                         if (s->s3->client_opaque_prf_input != NULL &&
2347                                 s->s3->client_opaque_prf_input_len == s->tlsext_opaque_prf_input_len)
2348                                 {
2349                                 /* can only use this extension if we have a server opaque PRF input
2350                                  * of the same length as the client opaque PRF input! */
2351
2352                                 if (s->tlsext_opaque_prf_input_len == 0)
2353                                         s->s3->server_opaque_prf_input = OPENSSL_malloc(1); /* dummy byte just to get non-NULL */
2354                                 else
2355                                         s->s3->server_opaque_prf_input = BUF_memdup(s->tlsext_opaque_prf_input, s->tlsext_opaque_prf_input_len);
2356                                 if (s->s3->server_opaque_prf_input == NULL)
2357                                         {
2358                                         ret = SSL_TLSEXT_ERR_ALERT_FATAL;
2359                                         al = SSL_AD_INTERNAL_ERROR;
2360                                         goto err;
2361                                         }
2362                                 s->s3->server_opaque_prf_input_len = s->tlsext_opaque_prf_input_len;
2363                                 }
2364                         }
2365
2366                 if (r == 2 && s->s3->server_opaque_prf_input == NULL)
2367                         {
2368                         /* The callback wants to enforce use of the extension,
2369                          * but we can't do that with the client opaque PRF input;
2370                          * abort the handshake.
2371                          */
2372                         ret = SSL_TLSEXT_ERR_ALERT_FATAL;
2373                         al = SSL_AD_HANDSHAKE_FAILURE;
2374                         }
2375         }
2376
2377  err:
2378 #endif
2379         switch (ret)
2380                 {
2381                 case SSL_TLSEXT_ERR_ALERT_FATAL:
2382                         ssl3_send_alert(s,SSL3_AL_FATAL,al);
2383                         return -1;
2384
2385                 case SSL_TLSEXT_ERR_ALERT_WARNING:
2386                         ssl3_send_alert(s,SSL3_AL_WARNING,al);
2387                         return 1;
2388
2389                 case SSL_TLSEXT_ERR_NOACK:
2390                         s->servername_done=0;
2391                         default:
2392                 return 1;
2393                 }
2394         }
2395
2396 int ssl_check_clienthello_tlsext_late(SSL *s)
2397         {
2398         int ret = SSL_TLSEXT_ERR_OK;
2399         int al;
2400
2401         /* If status request then ask callback what to do.
2402          * Note: this must be called after servername callbacks in case
2403          * the certificate has changed, and must be called after the cipher
2404          * has been chosen because this may influence which certificate is sent
2405          */
2406         if ((s->tlsext_status_type != -1) && s->ctx && s->ctx->tlsext_status_cb)
2407                 {
2408                 int r;
2409                 CERT_PKEY *certpkey;
2410                 certpkey = ssl_get_server_send_pkey(s);
2411                 /* If no certificate can't return certificate status */
2412                 if (certpkey == NULL)
2413                         {
2414                         s->tlsext_status_expected = 0;
2415                         return 1;
2416                         }
2417                 /* Set current certificate to one we will use so
2418                  * SSL_get_certificate et al can pick it up.
2419                  */
2420                 s->cert->key = certpkey;
2421                 r = s->ctx->tlsext_status_cb(s, s->ctx->tlsext_status_arg);
2422                 switch (r)
2423                         {
2424                         /* We don't want to send a status request response */
2425                         case SSL_TLSEXT_ERR_NOACK:
2426                                 s->tlsext_status_expected = 0;
2427                                 break;
2428                         /* status request response should be sent */
2429                         case SSL_TLSEXT_ERR_OK:
2430                                 if (s->tlsext_ocsp_resp)
2431                                         s->tlsext_status_expected = 1;
2432                                 else
2433                                         s->tlsext_status_expected = 0;
2434                                 break;
2435                         /* something bad happened */
2436                         case SSL_TLSEXT_ERR_ALERT_FATAL:
2437                                 ret = SSL_TLSEXT_ERR_ALERT_FATAL;
2438                                 al = SSL_AD_INTERNAL_ERROR;
2439                                 goto err;
2440                         }
2441                 }
2442         else
2443                 s->tlsext_status_expected = 0;
2444
2445  err:
2446         switch (ret)
2447                 {
2448                 case SSL_TLSEXT_ERR_ALERT_FATAL:
2449                         ssl3_send_alert(s, SSL3_AL_FATAL,al);
2450                         return -1;
2451
2452                 case SSL_TLSEXT_ERR_ALERT_WARNING:
2453                         ssl3_send_alert(s, SSL3_AL_WARNING,al);
2454                         return 1;
2455
2456                 default:
2457                         return 1;
2458                 }
2459         }
2460
2461 int ssl_check_serverhello_tlsext(SSL *s)
2462         {
2463         int ret=SSL_TLSEXT_ERR_NOACK;
2464         int al = SSL_AD_UNRECOGNIZED_NAME;
2465
2466 #ifndef OPENSSL_NO_EC
2467         /* If we are client and using an elliptic curve cryptography cipher
2468          * suite, then if server returns an EC point formats lists extension
2469          * it must contain uncompressed.
2470          */
2471         unsigned long alg_k = s->s3->tmp.new_cipher->algorithm_mkey;
2472         unsigned long alg_a = s->s3->tmp.new_cipher->algorithm_auth;
2473         if ((s->tlsext_ecpointformatlist != NULL) && (s->tlsext_ecpointformatlist_length > 0) &&
2474             (s->session->tlsext_ecpointformatlist != NULL) && (s->session->tlsext_ecpointformatlist_length > 0) &&
2475             ((alg_k & (SSL_kEECDH|SSL_kECDHr|SSL_kECDHe)) || (alg_a & SSL_aECDSA)))
2476                 {
2477                 /* we are using an ECC cipher */
2478                 size_t i;
2479                 unsigned char *list;
2480                 int found_uncompressed = 0;
2481                 list = s->session->tlsext_ecpointformatlist;
2482                 for (i = 0; i < s->session->tlsext_ecpointformatlist_length; i++)
2483                         {
2484                         if (*(list++) == TLSEXT_ECPOINTFORMAT_uncompressed)
2485                                 {
2486                                 found_uncompressed = 1;
2487                                 break;
2488                                 }
2489                         }
2490                 if (!found_uncompressed)
2491                         {
2492                         SSLerr(SSL_F_SSL_CHECK_SERVERHELLO_TLSEXT,SSL_R_TLS_INVALID_ECPOINTFORMAT_LIST);
2493                         return -1;
2494                         }
2495                 }
2496         ret = SSL_TLSEXT_ERR_OK;
2497 #endif /* OPENSSL_NO_EC */
2498
2499         if (s->ctx != NULL && s->ctx->tlsext_servername_callback != 0)
2500                 ret = s->ctx->tlsext_servername_callback(s, &al, s->ctx->tlsext_servername_arg);
2501         else if (s->initial_ctx != NULL && s->initial_ctx->tlsext_servername_callback != 0)
2502                 ret = s->initial_ctx->tlsext_servername_callback(s, &al, s->initial_ctx->tlsext_servername_arg);
2503
2504 #ifdef TLSEXT_TYPE_opaque_prf_input
2505         if (s->s3->server_opaque_prf_input_len > 0)
2506                 {
2507                 /* This case may indicate that we, as a client, want to insist on using opaque PRF inputs.
2508                  * So first verify that we really have a value from the server too. */
2509
2510                 if (s->s3->server_opaque_prf_input == NULL)
2511                         {
2512                         ret = SSL_TLSEXT_ERR_ALERT_FATAL;
2513                         al = SSL_AD_HANDSHAKE_FAILURE;
2514                         }
2515
2516                 /* Anytime the server *has* sent an opaque PRF input, we need to check
2517                  * that we have a client opaque PRF input of the same size. */
2518                 if (s->s3->client_opaque_prf_input == NULL ||
2519                     s->s3->client_opaque_prf_input_len != s->s3->server_opaque_prf_input_len)
2520                         {
2521                         ret = SSL_TLSEXT_ERR_ALERT_FATAL;
2522                         al = SSL_AD_ILLEGAL_PARAMETER;
2523                         }
2524                 }
2525 #endif
2526
2527         /* If we've requested certificate status and we wont get one
2528          * tell the callback
2529          */
2530         if ((s->tlsext_status_type != -1) && !(s->tlsext_status_expected)
2531                         && s->ctx && s->ctx->tlsext_status_cb)
2532                 {
2533                 int r;
2534                 /* Set resp to NULL, resplen to -1 so callback knows
2535                  * there is no response.
2536                  */
2537                 if (s->tlsext_ocsp_resp)
2538                         {
2539                         OPENSSL_free(s->tlsext_ocsp_resp);
2540                         s->tlsext_ocsp_resp = NULL;
2541                         }
2542                 s->tlsext_ocsp_resplen = -1;
2543                 r = s->ctx->tlsext_status_cb(s, s->ctx->tlsext_status_arg);
2544                 if (r == 0)
2545                         {
2546                         al = SSL_AD_BAD_CERTIFICATE_STATUS_RESPONSE;
2547                         ret = SSL_TLSEXT_ERR_ALERT_FATAL;
2548                         }
2549                 if (r < 0)
2550                         {
2551                         al = SSL_AD_INTERNAL_ERROR;
2552                         ret = SSL_TLSEXT_ERR_ALERT_FATAL;
2553                         }
2554                 }
2555
2556         switch (ret)
2557                 {
2558                 case SSL_TLSEXT_ERR_ALERT_FATAL:
2559                         ssl3_send_alert(s,SSL3_AL_FATAL,al);
2560                         return -1;
2561
2562                 case SSL_TLSEXT_ERR_ALERT_WARNING:
2563                         ssl3_send_alert(s,SSL3_AL_WARNING,al);
2564                         return 1;
2565
2566                 case SSL_TLSEXT_ERR_NOACK:
2567                         s->servername_done=0;
2568                         default:
2569                 return 1;
2570                 }
2571         }
2572
2573 int ssl_parse_serverhello_tlsext(SSL *s, unsigned char **p, unsigned char *d, int n)
2574         {
2575         int al = -1;
2576         if (s->version < SSL3_VERSION)
2577                 return 1;
2578         if (ssl_scan_serverhello_tlsext(s, p, d, n, &al) <= 0)
2579                 {
2580                 ssl3_send_alert(s,SSL3_AL_FATAL,al);
2581                 return 0;
2582                 }
2583
2584         if (ssl_check_serverhello_tlsext(s) <= 0)
2585                 {
2586                 SSLerr(SSL_F_SSL_PARSE_SERVERHELLO_TLSEXT,SSL_R_SERVERHELLO_TLSEXT);
2587                 return 0;
2588                 }
2589         return 1;
2590 }
2591
2592 /* Since the server cache lookup is done early on in the processing of the
2593  * ClientHello, and other operations depend on the result, we need to handle
2594  * any TLS session ticket extension at the same time.
2595  *
2596  *   session_id: points at the session ID in the ClientHello. This code will
2597  *       read past the end of this in order to parse out the session ticket
2598  *       extension, if any.
2599  *   len: the length of the session ID.
2600  *   limit: a pointer to the first byte after the ClientHello.
2601  *   ret: (output) on return, if a ticket was decrypted, then this is set to
2602  *       point to the resulting session.
2603  *
2604  * If s->tls_session_secret_cb is set then we are expecting a pre-shared key
2605  * ciphersuite, in which case we have no use for session tickets and one will
2606  * never be decrypted, nor will s->tlsext_ticket_expected be set to 1.
2607  *
2608  * Returns:
2609  *   -1: fatal error, either from parsing or decrypting the ticket.
2610  *    0: no ticket was found (or was ignored, based on settings).
2611  *    1: a zero length extension was found, indicating that the client supports
2612  *       session tickets but doesn't currently have one to offer.
2613  *    2: either s->tls_session_secret_cb was set, or a ticket was offered but
2614  *       couldn't be decrypted because of a non-fatal error.
2615  *    3: a ticket was successfully decrypted and *ret was set.
2616  *
2617  * Side effects:
2618  *   Sets s->tlsext_ticket_expected to 1 if the server will have to issue
2619  *   a new session ticket to the client because the client indicated support
2620  *   (and s->tls_session_secret_cb is NULL) but the client either doesn't have
2621  *   a session ticket or we couldn't use the one it gave us, or if
2622  *   s->ctx->tlsext_ticket_key_cb asked to renew the client's ticket.
2623  *   Otherwise, s->tlsext_ticket_expected is set to 0.
2624  */
2625 int tls1_process_ticket(SSL *s, unsigned char *session_id, int len,
2626                         const unsigned char *limit, SSL_SESSION **ret)
2627         {
2628         /* Point after session ID in client hello */
2629         const unsigned char *p = session_id + len;
2630         unsigned short i;
2631
2632         *ret = NULL;
2633         s->tlsext_ticket_expected = 0;
2634
2635         /* If tickets disabled behave as if no ticket present
2636          * to permit stateful resumption.
2637          */
2638         if (SSL_get_options(s) & SSL_OP_NO_TICKET)
2639                 return 0;
2640         if ((s->version <= SSL3_VERSION) || !limit)
2641                 return 0;
2642         if (p >= limit)
2643                 return -1;
2644         /* Skip past DTLS cookie */
2645         if (s->version == DTLS1_VERSION || s->version == DTLS1_BAD_VER)
2646                 {
2647                 i = *(p++);
2648                 p+= i;
2649                 if (p >= limit)
2650                         return -1;
2651                 }
2652         /* Skip past cipher list */
2653         n2s(p, i);
2654         p+= i;
2655         if (p >= limit)
2656                 return -1;
2657         /* Skip past compression algorithm list */
2658         i = *(p++);
2659         p += i;
2660         if (p > limit)
2661                 return -1;
2662         /* Now at start of extensions */
2663         if ((p + 2) >= limit)
2664                 return 0;
2665         n2s(p, i);
2666         while ((p + 4) <= limit)
2667                 {
2668                 unsigned short type, size;
2669                 n2s(p, type);
2670                 n2s(p, size);
2671                 if (p + size > limit)
2672                         return 0;
2673                 if (type == TLSEXT_TYPE_session_ticket)
2674                         {
2675                         int r;
2676                         if (size == 0)
2677                                 {
2678                                 /* The client will accept a ticket but doesn't
2679                                  * currently have one. */
2680                                 s->tlsext_ticket_expected = 1;
2681                                 return 1;
2682                                 }
2683                         if (s->tls_session_secret_cb)
2684                                 {
2685                                 /* Indicate that the ticket couldn't be
2686                                  * decrypted rather than generating the session
2687                                  * from ticket now, trigger abbreviated
2688                                  * handshake based on external mechanism to
2689                                  * calculate the master secret later. */
2690                                 return 2;
2691                                 }
2692                         r = tls_decrypt_ticket(s, p, size, session_id, len, ret);
2693                         switch (r)
2694                                 {
2695                                 case 2: /* ticket couldn't be decrypted */
2696                                         s->tlsext_ticket_expected = 1;
2697                                         return 2;
2698                                 case 3: /* ticket was decrypted */
2699                                         return r;
2700                                 case 4: /* ticket decrypted but need to renew */
2701                                         s->tlsext_ticket_expected = 1;
2702                                         return 3;
2703                                 default: /* fatal error */
2704                                         return -1;
2705                                 }
2706                         }
2707                 p += size;
2708                 }
2709         return 0;
2710         }
2711
2712 /* tls_decrypt_ticket attempts to decrypt a session ticket.
2713  *
2714  *   etick: points to the body of the session ticket extension.
2715  *   eticklen: the length of the session tickets extenion.
2716  *   sess_id: points at the session ID.
2717  *   sesslen: the length of the session ID.
2718  *   psess: (output) on return, if a ticket was decrypted, then this is set to
2719  *       point to the resulting session.
2720  *
2721  * Returns:
2722  *   -1: fatal error, either from parsing or decrypting the ticket.
2723  *    2: the ticket couldn't be decrypted.
2724  *    3: a ticket was successfully decrypted and *psess was set.
2725  *    4: same as 3, but the ticket needs to be renewed.
2726  */
2727 static int tls_decrypt_ticket(SSL *s, const unsigned char *etick, int eticklen,
2728                                 const unsigned char *sess_id, int sesslen,
2729                                 SSL_SESSION **psess)
2730         {
2731         SSL_SESSION *sess;
2732         unsigned char *sdec;
2733         const unsigned char *p;
2734         int slen, mlen, renew_ticket = 0;
2735         unsigned char tick_hmac[EVP_MAX_MD_SIZE];
2736         HMAC_CTX hctx;
2737         EVP_CIPHER_CTX ctx;
2738         SSL_CTX *tctx = s->initial_ctx;
2739         /* Need at least keyname + iv + some encrypted data */
2740         if (eticklen < 48)
2741                 return 2;
2742         /* Initialize session ticket encryption and HMAC contexts */
2743         HMAC_CTX_init(&hctx);
2744         EVP_CIPHER_CTX_init(&ctx);
2745         if (tctx->tlsext_ticket_key_cb)
2746                 {
2747                 unsigned char *nctick = (unsigned char *)etick;
2748                 int rv = tctx->tlsext_ticket_key_cb(s, nctick, nctick + 16,
2749                                                         &ctx, &hctx, 0);
2750                 if (rv < 0)
2751                         return -1;
2752                 if (rv == 0)
2753                         return 2;
2754                 if (rv == 2)
2755                         renew_ticket = 1;
2756                 }
2757         else
2758                 {
2759                 /* Check key name matches */
2760                 if (memcmp(etick, tctx->tlsext_tick_key_name, 16))
2761                         return 2;
2762                 HMAC_Init_ex(&hctx, tctx->tlsext_tick_hmac_key, 16,
2763                                         tlsext_tick_md(), NULL);
2764                 EVP_DecryptInit_ex(&ctx, EVP_aes_128_cbc(), NULL,
2765                                 tctx->tlsext_tick_aes_key, etick + 16);
2766                 }
2767         /* Attempt to process session ticket, first conduct sanity and
2768          * integrity checks on ticket.
2769          */
2770         mlen = HMAC_size(&hctx);
2771         if (mlen < 0)
2772                 {
2773                 EVP_CIPHER_CTX_cleanup(&ctx);
2774                 return -1;
2775                 }
2776         eticklen -= mlen;
2777         /* Check HMAC of encrypted ticket */
2778         HMAC_Update(&hctx, etick, eticklen);
2779         HMAC_Final(&hctx, tick_hmac, NULL);
2780         HMAC_CTX_cleanup(&hctx);
2781         if (memcmp(tick_hmac, etick + eticklen, mlen))
2782                 return 2;
2783         /* Attempt to decrypt session data */
2784         /* Move p after IV to start of encrypted ticket, update length */
2785         p = etick + 16 + EVP_CIPHER_CTX_iv_length(&ctx);
2786         eticklen -= 16 + EVP_CIPHER_CTX_iv_length(&ctx);
2787         sdec = OPENSSL_malloc(eticklen);
2788         if (!sdec)
2789                 {
2790                 EVP_CIPHER_CTX_cleanup(&ctx);
2791                 return -1;
2792                 }
2793         EVP_DecryptUpdate(&ctx, sdec, &slen, p, eticklen);
2794         if (EVP_DecryptFinal(&ctx, sdec + slen, &mlen) <= 0)
2795                 return 2;
2796         slen += mlen;
2797         EVP_CIPHER_CTX_cleanup(&ctx);
2798         p = sdec;
2799
2800         sess = d2i_SSL_SESSION(NULL, &p, slen);
2801         OPENSSL_free(sdec);
2802         if (sess)
2803                 {
2804                 /* The session ID, if non-empty, is used by some clients to
2805                  * detect that the ticket has been accepted. So we copy it to
2806                  * the session structure. If it is empty set length to zero
2807                  * as required by standard.
2808                  */
2809                 if (sesslen)
2810                         memcpy(sess->session_id, sess_id, sesslen);
2811                 sess->session_id_length = sesslen;
2812                 *psess = sess;
2813                 if (renew_ticket)
2814                         return 4;
2815                 else
2816                         return 3;
2817                 }
2818         ERR_clear_error();
2819         /* For session parse failure, indicate that we need to send a new
2820          * ticket. */
2821         return 2;
2822         }
2823
2824 /* Tables to translate from NIDs to TLS v1.2 ids */
2825
2826 typedef struct
2827         {
2828         int nid;
2829         int id;
2830         } tls12_lookup;
2831
2832 static tls12_lookup tls12_md[] = {
2833         {NID_md5, TLSEXT_hash_md5},
2834         {NID_sha1, TLSEXT_hash_sha1},
2835         {NID_sha224, TLSEXT_hash_sha224},
2836         {NID_sha256, TLSEXT_hash_sha256},
2837         {NID_sha384, TLSEXT_hash_sha384},
2838         {NID_sha512, TLSEXT_hash_sha512}
2839 };
2840
2841 static tls12_lookup tls12_sig[] = {
2842         {EVP_PKEY_RSA, TLSEXT_signature_rsa},
2843         {EVP_PKEY_DSA, TLSEXT_signature_dsa},
2844         {EVP_PKEY_EC, TLSEXT_signature_ecdsa}
2845 };
2846
2847 static int tls12_find_id(int nid, tls12_lookup *table, size_t tlen)
2848         {
2849         size_t i;
2850         for (i = 0; i < tlen; i++)
2851                 {
2852                 if (table[i].nid == nid)
2853                         return table[i].id;
2854                 }
2855         return -1;
2856         }
2857
2858 static int tls12_find_nid(int id, tls12_lookup *table, size_t tlen)
2859         {
2860         size_t i;
2861         for (i = 0; i < tlen; i++)
2862                 {
2863                 if ((table[i].id) == id)
2864                         return table[i].nid;
2865                 }
2866         return NID_undef;
2867         }
2868
2869 int tls12_get_sigandhash(unsigned char *p, const EVP_PKEY *pk, const EVP_MD *md)
2870         {
2871         int sig_id, md_id;
2872         if (!md)
2873                 return 0;
2874         md_id = tls12_find_id(EVP_MD_type(md), tls12_md,
2875                                 sizeof(tls12_md)/sizeof(tls12_lookup));
2876         if (md_id == -1)
2877                 return 0;
2878         sig_id = tls12_get_sigid(pk);
2879         if (sig_id == -1)
2880                 return 0;
2881         p[0] = (unsigned char)md_id;
2882         p[1] = (unsigned char)sig_id;
2883         return 1;
2884         }
2885
2886 int tls12_get_sigid(const EVP_PKEY *pk)
2887         {
2888         return tls12_find_id(pk->type, tls12_sig,
2889                                 sizeof(tls12_sig)/sizeof(tls12_lookup));
2890         }
2891
2892 const EVP_MD *tls12_get_hash(unsigned char hash_alg)
2893         {
2894         switch(hash_alg)
2895                 {
2896 #ifndef OPENSSL_NO_MD5
2897                 case TLSEXT_hash_md5:
2898 #ifdef OPENSSL_FIPS
2899                 if (FIPS_mode())
2900                         return NULL;
2901 #endif
2902                 return EVP_md5();
2903 #endif
2904 #ifndef OPENSSL_NO_SHA
2905                 case TLSEXT_hash_sha1:
2906                 return EVP_sha1();
2907 #endif
2908 #ifndef OPENSSL_NO_SHA256
2909                 case TLSEXT_hash_sha224:
2910                 return EVP_sha224();
2911
2912                 case TLSEXT_hash_sha256:
2913                 return EVP_sha256();
2914 #endif
2915 #ifndef OPENSSL_NO_SHA512
2916                 case TLSEXT_hash_sha384:
2917                 return EVP_sha384();
2918
2919                 case TLSEXT_hash_sha512:
2920                 return EVP_sha512();
2921 #endif
2922                 default:
2923                 return NULL;
2924
2925                 }
2926         }
2927
2928 static int tls12_get_pkey_idx(unsigned char sig_alg)
2929         {
2930         switch(sig_alg)
2931                 {
2932 #ifndef OPENSSL_NO_RSA
2933         case TLSEXT_signature_rsa:
2934                 return SSL_PKEY_RSA_SIGN;
2935 #endif
2936 #ifndef OPENSSL_NO_DSA
2937         case TLSEXT_signature_dsa:
2938                 return SSL_PKEY_DSA_SIGN;
2939 #endif
2940 #ifndef OPENSSL_NO_ECDSA
2941         case TLSEXT_signature_ecdsa:
2942                 return SSL_PKEY_ECC;
2943 #endif
2944                 }
2945         return -1;
2946         }
2947
2948 /* Convert TLS 1.2 signature algorithm extension values into NIDs */
2949 static void tls1_lookup_sigalg(int *phash_nid, int *psign_nid,
2950                         int *psignhash_nid, const unsigned char *data)
2951         {
2952         int sign_nid, hash_nid;
2953         if (!phash_nid && !psign_nid && !psignhash_nid)
2954                 return;
2955         if (phash_nid || psignhash_nid)
2956                 {
2957                 hash_nid = tls12_find_nid(data[0], tls12_md,
2958                                         sizeof(tls12_md)/sizeof(tls12_lookup));
2959                 if (phash_nid)
2960                         *phash_nid = hash_nid;
2961                 }
2962         if (psign_nid || psignhash_nid)
2963                 {
2964                 sign_nid = tls12_find_nid(data[1], tls12_sig,
2965                                         sizeof(tls12_sig)/sizeof(tls12_lookup));
2966                 if (psign_nid)
2967                         *psign_nid = sign_nid;
2968                 }
2969         if (psignhash_nid)
2970                 {
2971                 if (sign_nid && hash_nid)
2972                         OBJ_find_sigid_by_algs(psignhash_nid,
2973                                                         hash_nid, sign_nid);
2974                 else
2975                         *psignhash_nid = NID_undef;
2976                 }
2977         }
2978 /* Given preference and allowed sigalgs set shared sigalgs */
2979 static int tls12_do_shared_sigalgs(TLS_SIGALGS *shsig,
2980                                 const unsigned char *pref, size_t preflen,
2981                                 const unsigned char *allow, size_t allowlen)
2982         {
2983         const unsigned char *ptmp, *atmp;
2984         size_t i, j, nmatch = 0;
2985         for (i = 0, ptmp = pref; i < preflen; i+=2, ptmp+=2)
2986                 {
2987                 /* Skip disabled hashes or signature algorithms */
2988                 if (tls12_get_hash(ptmp[0]) == NULL)
2989                         continue;
2990                 if (tls12_get_pkey_idx(ptmp[1]) == -1)
2991                         continue;
2992                 for (j = 0, atmp = allow; j < allowlen; j+=2, atmp+=2)
2993                         {
2994                         if (ptmp[0] == atmp[0] && ptmp[1] == atmp[1])
2995                                 {
2996                                 nmatch++;
2997                                 if (shsig)
2998                                         {
2999                                         shsig->rhash = ptmp[0];
3000                                         shsig->rsign = ptmp[1];
3001                                         tls1_lookup_sigalg(&shsig->hash_nid,
3002                                                 &shsig->sign_nid,
3003                                                 &shsig->signandhash_nid,
3004                                                 ptmp);
3005                                         shsig++;
3006                                         }
3007                                 break;
3008                                 }
3009                         }
3010                 }
3011         return nmatch;
3012         }
3013
3014 /* Set shared signature algorithms for SSL structures */
3015 static int tls1_set_shared_sigalgs(SSL *s)
3016         {
3017         const unsigned char *pref, *allow, *conf;
3018         size_t preflen, allowlen, conflen;
3019         size_t nmatch;
3020         TLS_SIGALGS *salgs = NULL;
3021         CERT *c = s->cert;
3022         /* If client use client signature algorithms if not NULL */
3023         if (!s->server && c->client_sigalgs)
3024                 {
3025                 conf = c->client_sigalgs;
3026                 conflen = c->client_sigalgslen;
3027                 }
3028         else if (c->conf_sigalgs)
3029                 {
3030                 conf = c->conf_sigalgs;
3031                 conflen = c->conf_sigalgslen;
3032                 }
3033         else
3034                 {
3035                 conf = tls12_sigalgs;
3036                 conflen = sizeof(tls12_sigalgs);
3037 #ifdef OPENSSL_FIPS
3038                 if (FIPS_mode())
3039                         conflen -= 2;
3040 #endif
3041                 }
3042         if(s->options & SSL_OP_CIPHER_SERVER_PREFERENCE)
3043                 {
3044                 pref = conf;
3045                 preflen = conflen;
3046                 allow = c->peer_sigalgs;
3047                 allowlen = c->peer_sigalgslen;
3048                 }
3049         else
3050                 {
3051                 allow = conf;
3052                 allowlen = conflen;
3053                 pref = c->peer_sigalgs;
3054                 preflen = c->peer_sigalgslen;
3055                 }
3056         nmatch = tls12_do_shared_sigalgs(NULL, pref, preflen, allow, allowlen);
3057         if (!nmatch)
3058                 return 1;
3059         salgs = OPENSSL_malloc(nmatch * sizeof(TLS_SIGALGS));
3060         if (!salgs)
3061                 return 0;
3062         nmatch = tls12_do_shared_sigalgs(salgs, pref, preflen, allow, allowlen);
3063         c->shared_sigalgs = salgs;
3064         c->shared_sigalgslen = nmatch;
3065         return 1;
3066         }
3067
3068
3069 /* Set preferred digest for each key type */
3070
3071 int tls1_process_sigalgs(SSL *s, const unsigned char *data, int dsize)
3072         {
3073         int idx;
3074         size_t i;
3075         const EVP_MD *md;
3076         CERT *c = s->cert;
3077         TLS_SIGALGS *sigptr;
3078         /* Extension ignored for TLS versions below 1.2 */
3079         if (TLS1_get_version(s) < TLS1_2_VERSION)
3080                 return 1;
3081         /* Should never happen */
3082         if (!c)
3083                 return 0;
3084
3085         c->pkeys[SSL_PKEY_DSA_SIGN].digest = NULL;
3086         c->pkeys[SSL_PKEY_RSA_SIGN].digest = NULL;
3087         c->pkeys[SSL_PKEY_RSA_ENC].digest = NULL;
3088         c->pkeys[SSL_PKEY_ECC].digest = NULL;
3089
3090         c->peer_sigalgs = OPENSSL_malloc(dsize);
3091         if (!c->peer_sigalgs)
3092                 return 0;
3093         c->peer_sigalgslen = dsize;
3094         memcpy(c->peer_sigalgs, data, dsize);
3095
3096         tls1_set_shared_sigalgs(s);
3097
3098         for (i = 0, sigptr = c->shared_sigalgs;
3099                         i < c->shared_sigalgslen; i++, sigptr++)
3100                 {
3101                 idx = tls12_get_pkey_idx(sigptr->rsign);
3102                 if (idx > 0 && c->pkeys[idx].digest == NULL)
3103                         {
3104                         md = tls12_get_hash(sigptr->rhash);
3105                         c->pkeys[idx].digest = md;
3106                         if (idx == SSL_PKEY_RSA_SIGN)
3107                                 c->pkeys[SSL_PKEY_RSA_ENC].digest = md;
3108                         }
3109
3110                 }
3111         /* In strict mode leave unset digests as NULL to indicate we can't
3112          * use the certificate for signing.
3113          */
3114         if (!(s->cert->cert_flags & SSL_CERT_FLAG_TLS_STRICT))
3115                 {
3116                 /* Set any remaining keys to default values. NOTE: if alg is
3117                  * not supported it stays as NULL.
3118                  */
3119 #ifndef OPENSSL_NO_DSA
3120                 if (!c->pkeys[SSL_PKEY_DSA_SIGN].digest)
3121                         c->pkeys[SSL_PKEY_DSA_SIGN].digest = EVP_sha1();
3122 #endif
3123 #ifndef OPENSSL_NO_RSA
3124                 if (!c->pkeys[SSL_PKEY_RSA_SIGN].digest)
3125                         {
3126                         c->pkeys[SSL_PKEY_RSA_SIGN].digest = EVP_sha1();
3127                         c->pkeys[SSL_PKEY_RSA_ENC].digest = EVP_sha1();
3128                         }
3129 #endif
3130 #ifndef OPENSSL_NO_ECDSA
3131                 if (!c->pkeys[SSL_PKEY_ECC].digest)
3132                         c->pkeys[SSL_PKEY_ECC].digest = EVP_sha1();
3133 #endif
3134                 }
3135         return 1;
3136         }
3137
3138
3139 int SSL_get_sigalgs(SSL *s, int idx,
3140                         int *psign, int *phash, int *psignhash,
3141                         unsigned char *rsig, unsigned char *rhash)
3142         {
3143         const unsigned char *psig = s->cert->peer_sigalgs;
3144         if (psig == NULL)
3145                 return 0;
3146         if (idx >= 0)
3147                 {
3148                 idx <<= 1;
3149                 if (idx >= (int)s->cert->peer_sigalgslen)
3150                         return 0;
3151                 psig += idx;
3152                 if (rhash)
3153                         *rhash = psig[0];
3154                 if (rsig)
3155                         *rsig = psig[1];
3156                 tls1_lookup_sigalg(phash, psign, psignhash, psig);
3157                 }
3158         return s->cert->peer_sigalgslen / 2;
3159         }
3160
3161 int SSL_get_shared_sigalgs(SSL *s, int idx,
3162                         int *psign, int *phash, int *psignhash,
3163                         unsigned char *rsig, unsigned char *rhash)
3164         {
3165         TLS_SIGALGS *shsigalgs = s->cert->shared_sigalgs;
3166         if (!shsigalgs || idx >= (int)s->cert->shared_sigalgslen)
3167                 return 0;
3168         shsigalgs += idx;
3169         if (phash)
3170                 *phash = shsigalgs->hash_nid;
3171         if (psign)
3172                 *psign = shsigalgs->sign_nid;
3173         if (psignhash)
3174                 *psignhash = shsigalgs->signandhash_nid;
3175         if (rsig)
3176                 *rsig = shsigalgs->rsign;
3177         if (rhash)
3178                 *rhash = shsigalgs->rhash;
3179         return s->cert->shared_sigalgslen;
3180         }
3181
3182
3183 #ifndef OPENSSL_NO_HEARTBEATS
3184 int
3185 tls1_process_heartbeat(SSL *s)
3186         {
3187         unsigned char *p = &s->s3->rrec.data[0], *pl;
3188         unsigned short hbtype;
3189         unsigned int payload;
3190         unsigned int padding = 16; /* Use minimum padding */
3191
3192         /* Read type and payload length first */
3193         hbtype = *p++;
3194         n2s(p, payload);
3195         pl = p;
3196
3197         if (s->msg_callback)
3198                 s->msg_callback(0, s->version, TLS1_RT_HEARTBEAT,
3199                         &s->s3->rrec.data[0], s->s3->rrec.length,
3200                         s, s->msg_callback_arg);
3201
3202         if (hbtype == TLS1_HB_REQUEST)
3203                 {
3204                 unsigned char *buffer, *bp;
3205                 int r;
3206
3207                 /* Allocate memory for the response, size is 1 bytes
3208                  * message type, plus 2 bytes payload length, plus
3209                  * payload, plus padding
3210                  */
3211                 buffer = OPENSSL_malloc(1 + 2 + payload + padding);
3212                 bp = buffer;
3213
3214                 /* Enter response type, length and copy payload */
3215                 *bp++ = TLS1_HB_RESPONSE;
3216                 s2n(payload, bp);
3217                 memcpy(bp, pl, payload);
3218                 bp += payload;
3219                 /* Random padding */
3220                 RAND_pseudo_bytes(bp, padding);
3221
3222                 r = ssl3_write_bytes(s, TLS1_RT_HEARTBEAT, buffer, 3 + payload + padding);
3223
3224                 if (r >= 0 && s->msg_callback)
3225                         s->msg_callback(1, s->version, TLS1_RT_HEARTBEAT,
3226                                 buffer, 3 + payload + padding,
3227                                 s, s->msg_callback_arg);
3228
3229                 OPENSSL_free(buffer);
3230
3231                 if (r < 0)
3232                         return r;
3233                 }
3234         else if (hbtype == TLS1_HB_RESPONSE)
3235                 {
3236                 unsigned int seq;
3237
3238                 /* We only send sequence numbers (2 bytes unsigned int),
3239                  * and 16 random bytes, so we just try to read the
3240                  * sequence number */
3241                 n2s(pl, seq);
3242
3243                 if (payload == 18 && seq == s->tlsext_hb_seq)
3244                         {
3245                         s->tlsext_hb_seq++;
3246                         s->tlsext_hb_pending = 0;
3247                         }
3248                 }
3249
3250         return 0;
3251         }
3252
3253 int
3254 tls1_heartbeat(SSL *s)
3255         {
3256         unsigned char *buf, *p;
3257         int ret;
3258         unsigned int payload = 18; /* Sequence number + random bytes */
3259         unsigned int padding = 16; /* Use minimum padding */
3260
3261         /* Only send if peer supports and accepts HB requests... */
3262         if (!(s->tlsext_heartbeat & SSL_TLSEXT_HB_ENABLED) ||
3263             s->tlsext_heartbeat & SSL_TLSEXT_HB_DONT_SEND_REQUESTS)
3264                 {
3265                 SSLerr(SSL_F_TLS1_HEARTBEAT,SSL_R_TLS_HEARTBEAT_PEER_DOESNT_ACCEPT);
3266                 return -1;
3267                 }
3268
3269         /* ...and there is none in flight yet... */
3270         if (s->tlsext_hb_pending)
3271                 {
3272                 SSLerr(SSL_F_TLS1_HEARTBEAT,SSL_R_TLS_HEARTBEAT_PENDING);
3273                 return -1;
3274                 }
3275
3276         /* ...and no handshake in progress. */
3277         if (SSL_in_init(s) || s->in_handshake)
3278                 {
3279                 SSLerr(SSL_F_TLS1_HEARTBEAT,SSL_R_UNEXPECTED_MESSAGE);
3280                 return -1;
3281                 }
3282
3283         /* Check if padding is too long, payload and padding
3284          * must not exceed 2^14 - 3 = 16381 bytes in total.
3285          */
3286         OPENSSL_assert(payload + padding <= 16381);
3287
3288         /* Create HeartBeat message, we just use a sequence number
3289          * as payload to distuingish different messages and add
3290          * some random stuff.
3291          *  - Message Type, 1 byte
3292          *  - Payload Length, 2 bytes (unsigned int)
3293          *  - Payload, the sequence number (2 bytes uint)
3294          *  - Payload, random bytes (16 bytes uint)
3295          *  - Padding
3296          */
3297         buf = OPENSSL_malloc(1 + 2 + payload + padding);
3298         p = buf;
3299         /* Message Type */
3300         *p++ = TLS1_HB_REQUEST;
3301         /* Payload length (18 bytes here) */
3302         s2n(payload, p);
3303         /* Sequence number */
3304         s2n(s->tlsext_hb_seq, p);
3305         /* 16 random bytes */
3306         RAND_pseudo_bytes(p, 16);
3307         p += 16;
3308         /* Random padding */
3309         RAND_pseudo_bytes(p, padding);
3310
3311         ret = ssl3_write_bytes(s, TLS1_RT_HEARTBEAT, buf, 3 + payload + padding);
3312         if (ret >= 0)
3313                 {
3314                 if (s->msg_callback)
3315                         s->msg_callback(1, s->version, TLS1_RT_HEARTBEAT,
3316                                 buf, 3 + payload + padding,
3317                                 s, s->msg_callback_arg);
3318
3319                 s->tlsext_hb_pending = 1;
3320                 }
3321
3322         OPENSSL_free(buf);
3323
3324         return ret;
3325         }
3326 #endif
3327
3328 #define MAX_SIGALGLEN   (TLSEXT_hash_num * TLSEXT_signature_num * 2)
3329
3330 typedef struct
3331         {
3332         size_t sigalgcnt;
3333         int sigalgs[MAX_SIGALGLEN];
3334         } sig_cb_st;
3335
3336 static int sig_cb(const char *elem, int len, void *arg)
3337         {
3338         sig_cb_st *sarg = arg;
3339         size_t i;
3340         char etmp[20], *p;
3341         int sig_alg, hash_alg;
3342         if (sarg->sigalgcnt == MAX_SIGALGLEN)
3343                 return 0;
3344         if (len > (int)(sizeof(etmp) - 1))
3345                 return 0;
3346         memcpy(etmp, elem, len);
3347         etmp[len] = 0;
3348         p = strchr(etmp, '+');
3349         if (!p)
3350                 return 0;
3351         *p = 0;
3352         p++;
3353         if (!*p)
3354                 return 0;
3355
3356         if (!strcmp(etmp, "RSA"))
3357                 sig_alg = EVP_PKEY_RSA;
3358         else if (!strcmp(etmp, "DSA"))
3359                 sig_alg = EVP_PKEY_DSA;
3360         else if (!strcmp(etmp, "ECDSA"))
3361                 sig_alg = EVP_PKEY_EC;
3362         else return 0;
3363
3364         hash_alg = OBJ_sn2nid(p);
3365         if (hash_alg == NID_undef)
3366                 hash_alg = OBJ_ln2nid(p);
3367         if (hash_alg == NID_undef)
3368                 return 0;
3369
3370         for (i = 0; i < sarg->sigalgcnt; i+=2)
3371                 {
3372                 if (sarg->sigalgs[i] == sig_alg
3373                         && sarg->sigalgs[i + 1] == hash_alg)
3374                         return 0;
3375                 }
3376         sarg->sigalgs[sarg->sigalgcnt++] = hash_alg;
3377         sarg->sigalgs[sarg->sigalgcnt++] = sig_alg;
3378         return 1;
3379         }
3380
3381 /* Set suppored signature algorithms based on a colon separated list
3382  * of the form sig+hash e.g. RSA+SHA512:DSA+SHA512 */
3383 int tls1_set_sigalgs_list(CERT *c, const char *str, int client)
3384         {
3385         sig_cb_st sig;
3386         sig.sigalgcnt = 0;
3387         if (!CONF_parse_list(str, ':', 1, sig_cb, &sig))
3388                 return 0;
3389         return tls1_set_sigalgs(c, sig.sigalgs, sig.sigalgcnt, client);
3390         }
3391
3392 int tls1_set_sigalgs(CERT *c, const int *psig_nids, size_t salglen, int client)
3393         {
3394         unsigned char *sigalgs, *sptr;
3395         int rhash, rsign;
3396         size_t i;
3397         if (salglen & 1)
3398                 return 0;
3399         sigalgs = OPENSSL_malloc(salglen);
3400         if (sigalgs == NULL)
3401                 return 0;
3402         for (i = 0, sptr = sigalgs; i < salglen; i+=2)
3403                 {
3404                 rhash = tls12_find_id(*psig_nids++, tls12_md,
3405                                         sizeof(tls12_md)/sizeof(tls12_lookup));
3406                 rsign = tls12_find_id(*psig_nids++, tls12_sig,
3407                                 sizeof(tls12_sig)/sizeof(tls12_lookup));
3408
3409                 if (rhash == -1 || rsign == -1)
3410                         goto err;
3411                 *sptr++ = rhash;
3412                 *sptr++ = rsign;
3413                 }
3414
3415         if (client)
3416                 {
3417                 if (c->client_sigalgs)
3418                         OPENSSL_free(c->client_sigalgs);
3419                 c->client_sigalgs = sigalgs;
3420                 c->client_sigalgslen = salglen;
3421                 }
3422         else
3423                 {
3424                 if (c->conf_sigalgs)
3425                         OPENSSL_free(c->conf_sigalgs);
3426                 c->conf_sigalgs = sigalgs;
3427                 c->conf_sigalgslen = salglen;
3428                 }
3429
3430         return 1;
3431
3432         err:
3433         OPENSSL_free(sigalgs);
3434         return 0;
3435         }
3436
3437 static int tls1_check_sig_alg(CERT *c, X509 *x, int default_nid)
3438         {
3439         int sig_nid;
3440         size_t i;
3441         if (default_nid == -1)
3442                 return 1;
3443         sig_nid = X509_get_signature_nid(x);
3444         if (default_nid)
3445                 return sig_nid == default_nid ? 1 : 0;
3446         for (i = 0; i < c->shared_sigalgslen; i++)
3447                 if (sig_nid == c->shared_sigalgs[i].signandhash_nid)
3448                         return 1;
3449         return 0;
3450         }
3451
3452 /* Check certificate chain is consistent with TLS extensions and is
3453  * usable by server.
3454  */
3455 int tls1_check_chain(SSL *s, X509 *x, EVP_PKEY *pk, STACK_OF(X509) *chain,
3456                                                                         int idx)
3457         {
3458         int i;
3459         int rv = CERT_PKEY_INVALID;
3460         CERT_PKEY *cpk = NULL;
3461         CERT *c = s->cert;
3462         if (idx != -1)
3463                 {
3464                 cpk = c->pkeys + idx;
3465                 x = cpk->x509;
3466                 pk = cpk->privatekey;
3467                 chain = cpk->chain;
3468                 /* If no cert or key, forget it */
3469                 if (!x || !pk)
3470                         goto end;
3471                 }
3472         else
3473                 {
3474                 idx = ssl_cert_type(x, pk);
3475                 if (idx == -1)
3476                         goto end;
3477                 }
3478
3479         /* Check all signature algorithms are consistent with
3480          * signature algorithms extension if TLS 1.2 or later
3481          * and strict mode.
3482          */
3483         if (TLS1_get_version(s) >= TLS1_2_VERSION
3484                 && c->cert_flags & SSL_CERT_FLAG_TLS_STRICT)
3485                 {
3486                 int default_nid;
3487                 unsigned char rsign = 0;
3488                 if (c->peer_sigalgs)
3489                         default_nid = 0;
3490                 /* If no sigalgs extension use defaults from RFC5246 */
3491                 else
3492                         {
3493                         switch(idx)
3494                                 {
3495                         case SSL_PKEY_RSA_ENC:
3496                         case SSL_PKEY_RSA_SIGN:
3497                         case SSL_PKEY_DH_RSA:
3498                                 rsign = TLSEXT_signature_rsa;
3499                                 default_nid = NID_sha1WithRSAEncryption;
3500                                 break;
3501
3502                         case SSL_PKEY_DSA_SIGN:
3503                         case SSL_PKEY_DH_DSA:
3504                                 rsign = TLSEXT_signature_dsa;
3505                                 default_nid = NID_dsaWithSHA1;
3506                                 break;
3507
3508                         case SSL_PKEY_ECC:
3509                                 rsign = TLSEXT_signature_ecdsa;
3510                                 default_nid = NID_ecdsa_with_SHA1;
3511                                 break;
3512
3513                         default:
3514                                 default_nid = -1;
3515                                 break;
3516                                 }
3517                         }
3518                 /* If peer sent no signature algorithms extension and we
3519                  * have set preferred signature algorithms check we support
3520                  * sha1.
3521                  */
3522                 if (s->server && default_nid > 0 && c->conf_sigalgs)
3523                         {
3524                         size_t j;
3525                         const unsigned char *p = c->conf_sigalgs;
3526                         for (j = 0; j < c->conf_sigalgslen; j += 2, p += 2)
3527                                 {
3528                                 if (p[0] == TLSEXT_hash_sha1 && p[1] == rsign)
3529                                         break;
3530                                 }
3531                         if (j == c->conf_sigalgslen)
3532                                 goto end;
3533                         }
3534                 /* Check signature algorithm of each cert in chain */
3535                 if (!tls1_check_sig_alg(c, x, default_nid))
3536                         goto end;
3537                 for (i = 0; i < sk_X509_num(chain); i++)
3538                         {
3539                         if (!tls1_check_sig_alg(c, sk_X509_value(chain, i),
3540                                                         default_nid))
3541                                 goto end;
3542                         }
3543                 }
3544
3545         /* Check cert parameters are consistent */
3546         if (!tls1_check_cert_param(s, x))
3547                 goto end;
3548         /* In strict mode check rest of chain too */
3549         if (c->cert_flags & SSL_CERT_FLAG_TLS_STRICT)
3550                 {
3551                 for (i = 0; i < sk_X509_num(chain); i++)
3552                         {
3553                         if (!tls1_check_cert_param(s, sk_X509_value(chain, i)))
3554                                 goto end;
3555                         }
3556                 }
3557         rv = CERT_PKEY_VALID;
3558
3559         end:
3560         if (cpk)
3561                 {
3562                 if (rv && cpk->digest)
3563                         rv |= CERT_PKEY_SIGN;
3564                 cpk->valid_flags = rv;
3565                 }
3566         return rv;
3567         }
3568
3569 /* Set validity of certificates in an SSL structure */
3570 void tls1_set_cert_validity(SSL *s)
3571         {
3572         tls1_check_chain(s, NULL, NULL, NULL, SSL_PKEY_RSA_ENC);
3573         tls1_check_chain(s, NULL, NULL, NULL, SSL_PKEY_RSA_SIGN);
3574         tls1_check_chain(s, NULL, NULL, NULL, SSL_PKEY_DSA_SIGN);
3575         tls1_check_chain(s, NULL, NULL, NULL, SSL_PKEY_DH_RSA);
3576         tls1_check_chain(s, NULL, NULL, NULL, SSL_PKEY_DH_DSA);
3577         tls1_check_chain(s, NULL, NULL, NULL, SSL_PKEY_ECC);
3578         }
3579 /* User level utiity function to check a chain is suitable */
3580 int SSL_check_chain(SSL *s, X509 *x, EVP_PKEY *pk, STACK_OF(X509) *chain)
3581         {
3582         return tls1_check_chain(s, x, pk, chain, -1);
3583         }
3584
3585 #endif