ssl/t1_lib.c

   1 /* ssl/t1_lib.c */
   2 /* Copyright (C) 1995-1998 Eric Young (eay@cryptsoft.com)
   3  * All rights reserved.
   4  *
   5  * This package is an SSL implementation written
   6  * by Eric Young (eay@cryptsoft.com).
   7  * The implementation was written so as to conform with Netscapes SSL.
   8  *
   9  * This library is free for commercial and non-commercial use as long as
  10  * the following conditions are aheared to.  The following conditions
  11  * apply to all code found in this distribution, be it the RC4, RSA,
  12  * lhash, DES, etc., code; not just the SSL code.  The SSL documentation
  13  * included with this distribution is covered by the same copyright terms
  14  * except that the holder is Tim Hudson (tjh@cryptsoft.com).
  15  *
  16  * Copyright remains Eric Young's, and as such any Copyright notices in
  17  * the code are not to be removed.
  18  * If this package is used in a product, Eric Young should be given attribution
  19  * as the author of the parts of the library used.
  20  * This can be in the form of a textual message at program startup or
  21  * in documentation (online or textual) provided with the package.
  22  *
  23  * Redistribution and use in source and binary forms, with or without
  24  * modification, are permitted provided that the following conditions
  25  * are met:
  26  * 1. Redistributions of source code must retain the copyright
  27  *    notice, this list of conditions and the following disclaimer.
  28  * 2. Redistributions in binary form must reproduce the above copyright
  29  *    notice, this list of conditions and the following disclaimer in the
  30  *    documentation and/or other materials provided with the distribution.
  31  * 3. All advertising materials mentioning features or use of this software
  32  *    must display the following acknowledgement:
  33  *    "This product includes cryptographic software written by
  34  *     Eric Young (eay@cryptsoft.com)"
  35  *    The word 'cryptographic' can be left out if the rouines from the library
  36  *    being used are not cryptographic related :-).
  37  * 4. If you include any Windows specific code (or a derivative thereof) from
  38  *    the apps directory (application code) you must include an acknowledgement:
  39  *    "This product includes software written by Tim Hudson (tjh@cryptsoft.com)"
  40  *
  41  * THIS SOFTWARE IS PROVIDED BY ERIC YOUNG ``AS IS'' AND
  42  * ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
  43  * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE
  44  * ARE DISCLAIMED.  IN NO EVENT SHALL THE AUTHOR OR CONTRIBUTORS BE LIABLE
  45  * FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL
  46  * DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS
  47  * OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION)
  48  * HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT
  49  * LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY
  50  * OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF
  51  * SUCH DAMAGE.
  52  *
  53  * The licence and distribution terms for any publically available version or
  54  * derivative of this code cannot be changed.  i.e. this code cannot simply be
  55  * copied and put under another distribution licence
  56  * [including the GNU Public Licence.]
  57  */
  58 /* ====================================================================
  59  * Copyright (c) 1998-2007 The OpenSSL Project.  All rights reserved.
  60  *
  61  * Redistribution and use in source and binary forms, with or without
  62  * modification, are permitted provided that the following conditions
  63  * are met:
  64  *
  65  * 1. Redistributions of source code must retain the above copyright
  66  *    notice, this list of conditions and the following disclaimer.
  67  *
  68  * 2. Redistributions in binary form must reproduce the above copyright
  69  *    notice, this list of conditions and the following disclaimer in
  70  *    the documentation and/or other materials provided with the
  71  *    distribution.
  72  *
  73  * 3. All advertising materials mentioning features or use of this
  74  *    software must display the following acknowledgment:
  75  *    "This product includes software developed by the OpenSSL Project
  76  *    for use in the OpenSSL Toolkit. (http://www.openssl.org/)"
  77  *
  78  * 4. The names "OpenSSL Toolkit" and "OpenSSL Project" must not be used to
  79  *    endorse or promote products derived from this software without
  80  *    prior written permission. For written permission, please contact
  81  *    openssl-core@openssl.org.
  82  *
  83  * 5. Products derived from this software may not be called "OpenSSL"
  84  *    nor may "OpenSSL" appear in their names without prior written
  85  *    permission of the OpenSSL Project.
  86  *
  87  * 6. Redistributions of any form whatsoever must retain the following
  88  *    acknowledgment:
  89  *    "This product includes software developed by the OpenSSL Project
  90  *    for use in the OpenSSL Toolkit (http://www.openssl.org/)"
  91  *
  92  * THIS SOFTWARE IS PROVIDED BY THE OpenSSL PROJECT ``AS IS'' AND ANY
  93  * EXPRESSED OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
  94  * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
  95  * PURPOSE ARE DISCLAIMED.  IN NO EVENT SHALL THE OpenSSL PROJECT OR
  96  * ITS CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL,
  97  * SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT
  98  * NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES;
  99  * LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION)
 100  * HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT,
 101  * STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE)
 102  * ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED
 103  * OF THE POSSIBILITY OF SUCH DAMAGE.
 104  * ====================================================================
 105  *
 106  * This product includes cryptographic software written by Eric Young
 107  * (eay@cryptsoft.com).  This product includes software written by Tim
 108  * Hudson (tjh@cryptsoft.com).
 109  *
 110  */
 111
 112 #include <stdio.h>
 113 #include <openssl/objects.h>
 114 #include <openssl/evp.h>
 115 #include <openssl/hmac.h>
 116 #include <openssl/ocsp.h>
 117 #include "ssl_locl.h"
 118
 119 const char tls1_version_str[]="TLSv1" OPENSSL_VERSION_PTEXT;
 120
 121 #ifndef OPENSSL_NO_TLSEXT
 122 static int tls_decrypt_ticket(SSL *s, const unsigned char *tick, int ticklen,
 123                                 const unsigned char *sess_id, int sesslen,
 124                                 SSL_SESSION **psess);
 125 #endif
 126
 127 SSL3_ENC_METHOD TLSv1_enc_data={
 128         tls1_enc,
 129         tls1_mac,
 130         tls1_setup_key_block,
 131         tls1_generate_master_secret,
 132         tls1_change_cipher_state,
 133         tls1_final_finish_mac,
 134         TLS1_FINISH_MAC_LENGTH,
 135         tls1_cert_verify_mac,
 136         TLS_MD_CLIENT_FINISH_CONST,TLS_MD_CLIENT_FINISH_CONST_SIZE,
 137         TLS_MD_SERVER_FINISH_CONST,TLS_MD_SERVER_FINISH_CONST_SIZE,
 138         tls1_alert_code,
 139         };
 140
 141 long tls1_default_timeout(void)
 142         {
 143         /* 2 hours, the 24 hours mentioned in the TLSv1 spec
 144          * is way too long for http, the cache would over fill */
 145         return(60*60*2);
 146         }
 147
 148 int tls1_new(SSL *s)
 149         {
 150         if (!ssl3_new(s)) return(0);
 151         s->method->ssl_clear(s);
 152         return(1);
 153         }
 154
 155 void tls1_free(SSL *s)
 156         {
 157 #ifndef OPENSSL_NO_TLSEXT
 158         if (s->tlsext_session_ticket)
 159                 {
 160                 OPENSSL_free(s->tlsext_session_ticket);
 161                 }
 162 #endif /* OPENSSL_NO_TLSEXT */
 163         ssl3_free(s);
 164         }
 165
 166 void tls1_clear(SSL *s)
 167         {
 168         ssl3_clear(s);
 169         s->version = s->method->version;
 170         }
 171
 172 #ifndef OPENSSL_NO_EC
 173 static int nid_list[] =
 174         {
 175                 NID_sect163k1, /* sect163k1 (1) */
 176                 NID_sect163r1, /* sect163r1 (2) */
 177                 NID_sect163r2, /* sect163r2 (3) */
 178                 NID_sect193r1, /* sect193r1 (4) */
 179                 NID_sect193r2, /* sect193r2 (5) */
 180                 NID_sect233k1, /* sect233k1 (6) */
 181                 NID_sect233r1, /* sect233r1 (7) */
 182                 NID_sect239k1, /* sect239k1 (8) */
 183                 NID_sect283k1, /* sect283k1 (9) */
 184                 NID_sect283r1, /* sect283r1 (10) */
 185                 NID_sect409k1, /* sect409k1 (11) */
 186                 NID_sect409r1, /* sect409r1 (12) */
 187                 NID_sect571k1, /* sect571k1 (13) */
 188                 NID_sect571r1, /* sect571r1 (14) */
 189                 NID_secp160k1, /* secp160k1 (15) */
 190                 NID_secp160r1, /* secp160r1 (16) */
 191                 NID_secp160r2, /* secp160r2 (17) */
 192                 NID_secp192k1, /* secp192k1 (18) */
 193                 NID_X9_62_prime192v1, /* secp192r1 (19) */
 194                 NID_secp224k1, /* secp224k1 (20) */
 195                 NID_secp224r1, /* secp224r1 (21) */
 196                 NID_secp256k1, /* secp256k1 (22) */
 197                 NID_X9_62_prime256v1, /* secp256r1 (23) */
 198                 NID_secp384r1, /* secp384r1 (24) */
 199                 NID_secp521r1  /* secp521r1 (25) */
 200         };
 201
 202 int tls1_ec_curve_id2nid(int curve_id)
 203         {
 204         /* ECC curves from draft-ietf-tls-ecc-12.txt (Oct. 17, 2005) */
 205         if ((curve_id < 1) || ((unsigned int)curve_id >
 206                                 sizeof(nid_list)/sizeof(nid_list[0])))
 207                 return 0;
 208         return nid_list[curve_id-1];
 209         }
 210
 211 int tls1_ec_nid2curve_id(int nid)
 212         {
 213         /* ECC curves from draft-ietf-tls-ecc-12.txt (Oct. 17, 2005) */
 214         switch (nid)
 215                 {
 216         case NID_sect163k1: /* sect163k1 (1) */
 217                 return 1;
 218         case NID_sect163r1: /* sect163r1 (2) */
 219                 return 2;
 220         case NID_sect163r2: /* sect163r2 (3) */
 221                 return 3;
 222         case NID_sect193r1: /* sect193r1 (4) */
 223                 return 4;
 224         case NID_sect193r2: /* sect193r2 (5) */
 225                 return 5;
 226         case NID_sect233k1: /* sect233k1 (6) */
 227                 return 6;
 228         case NID_sect233r1: /* sect233r1 (7) */
 229                 return 7;
 230         case NID_sect239k1: /* sect239k1 (8) */
 231                 return 8;
 232         case NID_sect283k1: /* sect283k1 (9) */
 233                 return 9;
 234         case NID_sect283r1: /* sect283r1 (10) */
 235                 return 10;
 236         case NID_sect409k1: /* sect409k1 (11) */
 237                 return 11;
 238         case NID_sect409r1: /* sect409r1 (12) */
 239                 return 12;
 240         case NID_sect571k1: /* sect571k1 (13) */
 241                 return 13;
 242         case NID_sect571r1: /* sect571r1 (14) */
 243                 return 14;
 244         case NID_secp160k1: /* secp160k1 (15) */
 245                 return 15;
 246         case NID_secp160r1: /* secp160r1 (16) */
 247                 return 16;
 248         case NID_secp160r2: /* secp160r2 (17) */
 249                 return 17;
 250         case NID_secp192k1: /* secp192k1 (18) */
 251                 return 18;
 252         case NID_X9_62_prime192v1: /* secp192r1 (19) */
 253                 return 19;
 254         case NID_secp224k1: /* secp224k1 (20) */
 255                 return 20;
 256         case NID_secp224r1: /* secp224r1 (21) */
 257                 return 21;
 258         case NID_secp256k1: /* secp256k1 (22) */
 259                 return 22;
 260         case NID_X9_62_prime256v1: /* secp256r1 (23) */
 261                 return 23;
 262         case NID_secp384r1: /* secp384r1 (24) */
 263                 return 24;
 264         case NID_secp521r1:  /* secp521r1 (25) */
 265                 return 25;
 266         default:
 267                 return 0;
 268                 }
 269         }
 270 #endif /* OPENSSL_NO_EC */
 271
 272 #ifndef OPENSSL_NO_TLSEXT
 273 unsigned char *ssl_add_clienthello_tlsext(SSL *s, unsigned char *p, unsigned char *limit)
 274         {
 275         int extdatalen=0;
 276         unsigned char *ret = p;
 277
 278         /* don't add extensions for SSLv3 unless doing secure renegotiation */
 279         if (s->client_version == SSL3_VERSION
 280                                         && !s->s3->send_connection_binding)
 281                 return p;
 282
 283         ret+=2;
 284
 285         if (ret>=limit) return NULL; /* this really never occurs, but ... */
 286
 287         if (s->tlsext_hostname != NULL)
 288                 {
 289                 /* Add TLS extension servername to the Client Hello message */
 290                 unsigned long size_str;
 291                 long lenmax;
 292
 293                 /* check for enough space.
 294                    4 for the servername type and entension length
 295                    2 for servernamelist length
 296                    1 for the hostname type
 297                    2 for hostname length
 298                    + hostname length
 299                 */
 300
 301                 if ((lenmax = limit - ret - 9) < 0
 302                     || (size_str = strlen(s->tlsext_hostname)) > (unsigned long)lenmax)
 303                         return NULL;
 304
 305                 /* extension type and length */
 306                 s2n(TLSEXT_TYPE_server_name,ret);
 307                 s2n(size_str+5,ret);
 308
 309                 /* length of servername list */
 310                 s2n(size_str+3,ret);
 311
 312                 /* hostname type, length and hostname */
 313                 *(ret++) = (unsigned char) TLSEXT_NAMETYPE_host_name;
 314                 s2n(size_str,ret);
 315                 memcpy(ret, s->tlsext_hostname, size_str);
 316                 ret+=size_str;
 317                 }
 318
 319         /* Add the renegotiation option: TODOEKR switch */
 320         {
 321           int el;
 322
 323           if(!ssl_add_clienthello_renegotiate_ext(s, 0, &el, 0))
 324               {
 325               SSLerr(SSL_F_SSL_ADD_CLIENTHELLO_TLSEXT, ERR_R_INTERNAL_ERROR);
 326               return NULL;
 327               }
 328
 329           if((limit - p - 4 - el) < 0) return NULL;
 330
 331           s2n(TLSEXT_TYPE_renegotiate,ret);
 332           s2n(el,ret);
 333
 334           if(!ssl_add_clienthello_renegotiate_ext(s, ret, &el, el))
 335               {
 336               SSLerr(SSL_F_SSL_ADD_CLIENTHELLO_TLSEXT, ERR_R_INTERNAL_ERROR);
 337               return NULL;
 338               }
 339
 340           ret += el;
 341         }
 342
 343 #ifndef OPENSSL_NO_EC
 344         if (s->tlsext_ecpointformatlist != NULL &&
 345             s->version != DTLS1_VERSION)
 346                 {
 347                 /* Add TLS extension ECPointFormats to the ClientHello message */
 348                 long lenmax;
 349
 350                 if ((lenmax = limit - ret - 5) < 0) return NULL;
 351                 if (s->tlsext_ecpointformatlist_length > (unsigned long)lenmax) return NULL;
 352                 if (s->tlsext_ecpointformatlist_length > 255)
 353                         {
 354                         SSLerr(SSL_F_SSL_ADD_CLIENTHELLO_TLSEXT, ERR_R_INTERNAL_ERROR);
 355                         return NULL;
 356                         }
 357
 358                 s2n(TLSEXT_TYPE_ec_point_formats,ret);
 359                 s2n(s->tlsext_ecpointformatlist_length + 1,ret);
 360                 *(ret++) = (unsigned char) s->tlsext_ecpointformatlist_length;
 361                 memcpy(ret, s->tlsext_ecpointformatlist, s->tlsext_ecpointformatlist_length);
 362                 ret+=s->tlsext_ecpointformatlist_length;
 363                 }
 364         if (s->tlsext_ellipticcurvelist != NULL &&
 365             s->version != DTLS1_VERSION)
 366                 {
 367                 /* Add TLS extension EllipticCurves to the ClientHello message */
 368                 long lenmax;
 369
 370                 if ((lenmax = limit - ret - 6) < 0) return NULL;
 371                 if (s->tlsext_ellipticcurvelist_length > (unsigned long)lenmax) return NULL;
 372                 if (s->tlsext_ellipticcurvelist_length > 65532)
 373                         {
 374                         SSLerr(SSL_F_SSL_ADD_CLIENTHELLO_TLSEXT, ERR_R_INTERNAL_ERROR);
 375                         return NULL;
 376                         }
 377
 378                 s2n(TLSEXT_TYPE_elliptic_curves,ret);
 379                 s2n(s->tlsext_ellipticcurvelist_length + 2, ret);
 380
 381                 /* NB: draft-ietf-tls-ecc-12.txt uses a one-byte prefix for
 382                  * elliptic_curve_list, but the examples use two bytes.
 383                  * http://www1.ietf.org/mail-archive/web/tls/current/msg00538.html
 384                  * resolves this to two bytes.
 385                  */
 386                 s2n(s->tlsext_ellipticcurvelist_length, ret);
 387                 memcpy(ret, s->tlsext_ellipticcurvelist, s->tlsext_ellipticcurvelist_length);
 388                 ret+=s->tlsext_ellipticcurvelist_length;
 389                 }
 390 #endif /* OPENSSL_NO_EC */
 391
 392         if (!(SSL_get_options(s) & SSL_OP_NO_TICKET))
 393                 {
 394                 int ticklen;
 395                 if (!s->new_session && s->session && s->session->tlsext_tick)
 396                         ticklen = s->session->tlsext_ticklen;
 397                 else if (s->session && s->tlsext_session_ticket &&
 398                          s->tlsext_session_ticket->data)
 399                         {
 400                         ticklen = s->tlsext_session_ticket->length;
 401                         s->session->tlsext_tick = OPENSSL_malloc(ticklen);
 402                         if (!s->session->tlsext_tick)
 403                                 return NULL;
 404                         memcpy(s->session->tlsext_tick,
 405                                s->tlsext_session_ticket->data,
 406                                ticklen);
 407                         s->session->tlsext_ticklen = ticklen;
 408                         }
 409                 else
 410                         ticklen = 0;
 411                 if (ticklen == 0 && s->tlsext_session_ticket &&
 412                     s->tlsext_session_ticket->data == NULL)
 413                         goto skip_ext;
 414                 /* Check for enough room 2 for extension type, 2 for len
 415                  * rest for ticket
 416                  */
 417                 if ((long)(limit - ret - 4 - ticklen) < 0) return NULL;
 418                 s2n(TLSEXT_TYPE_session_ticket,ret);
 419                 s2n(ticklen,ret);
 420                 if (ticklen)
 421                         {
 422                         memcpy(ret, s->session->tlsext_tick, ticklen);
 423                         ret += ticklen;
 424                         }
 425                 }
 426                 skip_ext:
 427
 428 #ifdef TLSEXT_TYPE_opaque_prf_input
 429         if (s->s3->client_opaque_prf_input != NULL &&
 430             s->version != DTLS1_VERSION)
 431                 {
 432                 size_t col = s->s3->client_opaque_prf_input_len;
 433
 434                 if ((long)(limit - ret - 6 - col < 0))
 435                         return NULL;
 436                 if (col > 0xFFFD) /* can't happen */
 437                         return NULL;
 438
 439                 s2n(TLSEXT_TYPE_opaque_prf_input, ret);
 440                 s2n(col + 2, ret);
 441                 s2n(col, ret);
 442                 memcpy(ret, s->s3->client_opaque_prf_input, col);
 443                 ret += col;
 444                 }
 445 #endif
 446
 447         if (s->tlsext_status_type == TLSEXT_STATUSTYPE_ocsp &&
 448             s->version != DTLS1_VERSION)
 449                 {
 450                 int i;
 451                 long extlen, idlen, itmp;
 452                 OCSP_RESPID *id;
 453
 454                 idlen = 0;
 455                 for (i = 0; i < sk_OCSP_RESPID_num(s->tlsext_ocsp_ids); i++)
 456                         {
 457                         id = sk_OCSP_RESPID_value(s->tlsext_ocsp_ids, i);
 458                         itmp = i2d_OCSP_RESPID(id, NULL);
 459                         if (itmp <= 0)
 460                                 return NULL;
 461                         idlen += itmp + 2;
 462                         }
 463
 464                 if (s->tlsext_ocsp_exts)
 465                         {
 466                         extlen = i2d_X509_EXTENSIONS(s->tlsext_ocsp_exts, NULL);
 467                         if (extlen < 0)
 468                                 return NULL;
 469                         }
 470                 else
 471                         extlen = 0;
 472
 473                 if ((long)(limit - ret - 7 - extlen - idlen) < 0) return NULL;
 474                 s2n(TLSEXT_TYPE_status_request, ret);
 475                 if (extlen + idlen > 0xFFF0)
 476                         return NULL;
 477                 s2n(extlen + idlen + 5, ret);
 478                 *(ret++) = TLSEXT_STATUSTYPE_ocsp;
 479                 s2n(idlen, ret);
 480                 for (i = 0; i < sk_OCSP_RESPID_num(s->tlsext_ocsp_ids); i++)
 481                         {
 482                         /* save position of id len */
 483                         unsigned char *q = ret;
 484                         id = sk_OCSP_RESPID_value(s->tlsext_ocsp_ids, i);
 485                         /* skip over id len */
 486                         ret += 2;
 487                         itmp = i2d_OCSP_RESPID(id, &ret);
 488                         /* write id len */
 489                         s2n(itmp, q);
 490                         }
 491                 s2n(extlen, ret);
 492                 if (extlen > 0)
 493                         i2d_X509_EXTENSIONS(s->tlsext_ocsp_exts, &ret);
 494                 }
 495
 496         if ((extdatalen = ret-p-2)== 0)
 497                 return p;
 498
 499         s2n(extdatalen,p);
 500         return ret;
 501         }
 502
 503 unsigned char *ssl_add_serverhello_tlsext(SSL *s, unsigned char *p, unsigned char *limit)
 504         {
 505         int extdatalen=0;
 506         unsigned char *ret = p;
 507
 508         /* don't add extensions for SSLv3, unless doing secure renegotiation */
 509         if (s->version == SSL3_VERSION && !s->s3->send_connection_binding)
 510                 return p;
 511
 512         ret+=2;
 513         if (ret>=limit) return NULL; /* this really never occurs, but ... */
 514
 515         if (!s->hit && s->servername_done == 1 && s->session->tlsext_hostname != NULL)
 516                 {
 517                 if ((long)(limit - ret - 4) < 0) return NULL;
 518
 519                 s2n(TLSEXT_TYPE_server_name,ret);
 520                 s2n(0,ret);
 521                 }
 522
 523         if(s->s3->send_connection_binding)
 524         {
 525           int el;
 526
 527           if(!ssl_add_serverhello_renegotiate_ext(s, 0, &el, 0))
 528               {
 529               SSLerr(SSL_F_SSL_ADD_SERVERHELLO_TLSEXT, ERR_R_INTERNAL_ERROR);
 530               return NULL;
 531               }
 532
 533           if((limit - p - 4 - el) < 0) return NULL;
 534
 535           s2n(TLSEXT_TYPE_renegotiate,ret);
 536           s2n(el,ret);
 537
 538           if(!ssl_add_serverhello_renegotiate_ext(s, ret, &el, el))
 539               {
 540               SSLerr(SSL_F_SSL_ADD_SERVERHELLO_TLSEXT, ERR_R_INTERNAL_ERROR);
 541               return NULL;
 542               }
 543
 544           ret += el;
 545         }
 546
 547 #ifndef OPENSSL_NO_EC
 548         if (s->tlsext_ecpointformatlist != NULL &&
 549             s->version != DTLS1_VERSION)
 550                 {
 551                 /* Add TLS extension ECPointFormats to the ServerHello message */
 552                 long lenmax;
 553
 554                 if ((lenmax = limit - ret - 5) < 0) return NULL;
 555                 if (s->tlsext_ecpointformatlist_length > (unsigned long)lenmax) return NULL;
 556                 if (s->tlsext_ecpointformatlist_length > 255)
 557                         {
 558                         SSLerr(SSL_F_SSL_ADD_SERVERHELLO_TLSEXT, ERR_R_INTERNAL_ERROR);
 559                         return NULL;
 560                         }
 561
 562                 s2n(TLSEXT_TYPE_ec_point_formats,ret);
 563                 s2n(s->tlsext_ecpointformatlist_length + 1,ret);
 564                 *(ret++) = (unsigned char) s->tlsext_ecpointformatlist_length;
 565                 memcpy(ret, s->tlsext_ecpointformatlist, s->tlsext_ecpointformatlist_length);
 566                 ret+=s->tlsext_ecpointformatlist_length;
 567
 568                 }
 569         /* Currently the server should not respond with a SupportedCurves extension */
 570 #endif /* OPENSSL_NO_EC */
 571
 572         if (s->tlsext_ticket_expected
 573                 && !(SSL_get_options(s) & SSL_OP_NO_TICKET))
 574                 {
 575                 if ((long)(limit - ret - 4) < 0) return NULL;
 576                 s2n(TLSEXT_TYPE_session_ticket,ret);
 577                 s2n(0,ret);
 578                 }
 579
 580         if (s->tlsext_status_expected)
 581                 {
 582                 if ((long)(limit - ret - 4) < 0) return NULL;
 583                 s2n(TLSEXT_TYPE_status_request,ret);
 584                 s2n(0,ret);
 585                 }
 586
 587 #ifdef TLSEXT_TYPE_opaque_prf_input
 588         if (s->s3->server_opaque_prf_input != NULL &&
 589             s->version != DTLS1_VERSION)
 590                 {
 591                 size_t sol = s->s3->server_opaque_prf_input_len;
 592
 593                 if ((long)(limit - ret - 6 - sol) < 0)
 594                         return NULL;
 595                 if (sol > 0xFFFD) /* can't happen */
 596                         return NULL;
 597
 598                 s2n(TLSEXT_TYPE_opaque_prf_input, ret);
 599                 s2n(sol + 2, ret);
 600                 s2n(sol, ret);
 601                 memcpy(ret, s->s3->server_opaque_prf_input, sol);
 602                 ret += sol;
 603                 }
 604 #endif
 605         if (((s->s3->tmp.new_cipher->id & 0xFFFF)==0x80 || (s->s3->tmp.new_cipher->id & 0xFFFF)==0x81)
 606                 && (SSL_get_options(s) & SSL_OP_CRYPTOPRO_TLSEXT_BUG))
 607                 { const unsigned char cryptopro_ext[36] = {
 608                         0xfd, 0xe8, /*65000*/
 609                         0x00, 0x20, /*32 bytes length*/
 610                         0x30, 0x1e, 0x30, 0x08, 0x06, 0x06, 0x2a, 0x85,
 611                         0x03,   0x02, 0x02, 0x09, 0x30, 0x08, 0x06, 0x06,
 612                         0x2a, 0x85, 0x03, 0x02, 0x02, 0x16, 0x30, 0x08,
 613                         0x06, 0x06, 0x2a, 0x85, 0x03, 0x02, 0x02, 0x17};
 614                         if (limit-ret<36) return NULL;
 615                         memcpy(ret,cryptopro_ext,36);
 616                         ret+=36;
 617
 618                 }
 619
 620         if ((extdatalen = ret-p-2)== 0)
 621                 return p;
 622
 623         s2n(extdatalen,p);
 624         return ret;
 625         }
 626
 627 int ssl_parse_clienthello_tlsext(SSL *s, unsigned char **p, unsigned char *d, int n, int *al)
 628         {
 629         unsigned short type;
 630         unsigned short size;
 631         unsigned short len;
 632         unsigned char *data = *p;
 633         int renegotiate_seen = 0;
 634
 635         s->servername_done = 0;
 636         s->tlsext_status_type = -1;
 637
 638         if (data >= (d+n-2))
 639                 {
 640                 if (s->new_session
 641                         && !(s->ctx->options & SSL_OP_ALLOW_UNSAFE_LEGACY_RENEGOTIATION))
 642                         {
 643                         /* We should always see one extension: the renegotiate extension */
 644                         *al = SSL_AD_ILLEGAL_PARAMETER; /* is this the right alert? */
 645                         SSLerr(SSL_F_SSL_PARSE_CLIENTHELLO_TLSEXT, SSL_R_UNSAFE_LEGACY_RENEGOTIATION_DISABLED);
 646                         return 0;
 647                         }
 648                 return 1;
 649                 }
 650         n2s(data,len);
 651
 652         if (data > (d+n-len))
 653                 return 1;
 654
 655         while (data <= (d+n-4))
 656                 {
 657                 n2s(data,type);
 658                 n2s(data,size);
 659
 660                 if (data+size > (d+n))
 661                         return 1;
 662 #if 0
 663                 fprintf(stderr,"Received extension type %d size %d\n",type,size);
 664 #endif
 665                 if (s->tlsext_debug_cb)
 666                         s->tlsext_debug_cb(s, 0, type, data, size,
 667                                                 s->tlsext_debug_arg);
 668 /* The servername extension is treated as follows:
 669
 670    - Only the hostname type is supported with a maximum length of 255.
 671    - The servername is rejected if too long or if it contains zeros,
 672      in which case an fatal alert is generated.
 673    - The servername field is maintained together with the session cache.
 674    - When a session is resumed, the servername call back invoked in order
 675      to allow the application to position itself to the right context.
 676    - The servername is acknowledged if it is new for a session or when
 677      it is identical to a previously used for the same session.
 678      Applications can control the behaviour.  They can at any time
 679      set a 'desirable' servername for a new SSL object. This can be the
 680      case for example with HTTPS when a Host: header field is received and
 681      a renegotiation is requested. In this case, a possible servername
 682      presented in the new client hello is only acknowledged if it matches
 683      the value of the Host: field.
 684    - Applications must  use SSL_OP_NO_SESSION_RESUMPTION_ON_RENEGOTIATION
 685      if they provide for changing an explicit servername context for the session,
 686      i.e. when the session has been established with a servername extension.
 687    - On session reconnect, the servername extension may be absent.
 688
 689 */
 690
 691                 if (type == TLSEXT_TYPE_server_name)
 692                         {
 693                         unsigned char *sdata;
 694                         int servname_type;
 695                         int dsize;
 696
 697                         if (size < 2)
 698                                 {
 699                                 *al = SSL_AD_DECODE_ERROR;
 700                                 return 0;
 701                                 }
 702                         n2s(data,dsize);
 703                         size -= 2;
 704                         if (dsize > size  )
 705                                 {
 706                                 *al = SSL_AD_DECODE_ERROR;
 707                                 return 0;
 708                                 }
 709
 710                         sdata = data;
 711                         while (dsize > 3)
 712                                 {
 713                                 servname_type = *(sdata++);
 714                                 n2s(sdata,len);
 715                                 dsize -= 3;
 716
 717                                 if (len > dsize)
 718                                         {
 719                                         *al = SSL_AD_DECODE_ERROR;
 720                                         return 0;
 721                                         }
 722                                 if (s->servername_done == 0)
 723                                 switch (servname_type)
 724                                         {
 725                                 case TLSEXT_NAMETYPE_host_name:
 726                                         if (s->session->tlsext_hostname == NULL)
 727                                                 {
 728                                                 if (len > TLSEXT_MAXLEN_host_name ||
 729                                                         ((s->session->tlsext_hostname = OPENSSL_malloc(len+1)) == NULL))
 730                                                         {
 731                                                         *al = TLS1_AD_UNRECOGNIZED_NAME;
 732                                                         return 0;
 733                                                         }
 734                                                 memcpy(s->session->tlsext_hostname, sdata, len);
 735                                                 s->session->tlsext_hostname[len]='\0';
 736                                                 if (strlen(s->session->tlsext_hostname) != len) {
 737                                                         OPENSSL_free(s->session->tlsext_hostname);
 738                                                         s->session->tlsext_hostname = NULL;
 739                                                         *al = TLS1_AD_UNRECOGNIZED_NAME;
 740                                                         return 0;
 741                                                 }
 742                                                 s->servername_done = 1;
 743
 744                                                 }
 745                                         else
 746                                                 s->servername_done = strlen(s->session->tlsext_hostname) == len
 747                                                         && strncmp(s->session->tlsext_hostname, (char *)sdata, len) == 0;
 748
 749                                         break;
 750
 751                                 default:
 752                                         break;
 753                                         }
 754
 755                                 dsize -= len;
 756                                 }
 757                         if (dsize != 0)
 758                                 {
 759                                 *al = SSL_AD_DECODE_ERROR;
 760                                 return 0;
 761                                 }
 762
 763                         }
 764
 765 #ifndef OPENSSL_NO_EC
 766                 else if (type == TLSEXT_TYPE_ec_point_formats &&
 767                      s->version != DTLS1_VERSION)
 768                         {
 769                         unsigned char *sdata = data;
 770                         int ecpointformatlist_length = *(sdata++);
 771
 772                         if (ecpointformatlist_length != size - 1)
 773                                 {
 774                                 *al = TLS1_AD_DECODE_ERROR;
 775                                 return 0;
 776                                 }
 777                         s->session->tlsext_ecpointformatlist_length = 0;
 778                         if (s->session->tlsext_ecpointformatlist != NULL) OPENSSL_free(s->session->tlsext_ecpointformatlist);
 779                         if ((s->session->tlsext_ecpointformatlist = OPENSSL_malloc(ecpointformatlist_length)) == NULL)
 780                                 {
 781                                 *al = TLS1_AD_INTERNAL_ERROR;
 782                                 return 0;
 783                                 }
 784                         s->session->tlsext_ecpointformatlist_length = ecpointformatlist_length;
 785                         memcpy(s->session->tlsext_ecpointformatlist, sdata, ecpointformatlist_length);
 786 #if 0
 787                         fprintf(stderr,"ssl_parse_clienthello_tlsext s->session->tlsext_ecpointformatlist (length=%i) ", s->session->tlsext_ecpointformatlist_length);
 788                         sdata = s->session->tlsext_ecpointformatlist;
 789                         for (i = 0; i < s->session->tlsext_ecpointformatlist_length; i++)
 790                                 fprintf(stderr,"%i ",*(sdata++));
 791                         fprintf(stderr,"\n");
 792 #endif
 793                         }
 794                 else if (type == TLSEXT_TYPE_elliptic_curves &&
 795                      s->version != DTLS1_VERSION)
 796                         {
 797                         unsigned char *sdata = data;
 798                         int ellipticcurvelist_length = (*(sdata++) << 8);
 799                         ellipticcurvelist_length += (*(sdata++));
 800
 801                         if (ellipticcurvelist_length != size - 2)
 802                                 {
 803                                 *al = TLS1_AD_DECODE_ERROR;
 804                                 return 0;
 805                                 }
 806                         s->session->tlsext_ellipticcurvelist_length = 0;
 807                         if (s->session->tlsext_ellipticcurvelist != NULL) OPENSSL_free(s->session->tlsext_ellipticcurvelist);
 808                         if ((s->session->tlsext_ellipticcurvelist = OPENSSL_malloc(ellipticcurvelist_length)) == NULL)
 809                                 {
 810                                 *al = TLS1_AD_INTERNAL_ERROR;
 811                                 return 0;
 812                                 }
 813                         s->session->tlsext_ellipticcurvelist_length = ellipticcurvelist_length;
 814                         memcpy(s->session->tlsext_ellipticcurvelist, sdata, ellipticcurvelist_length);
 815 #if 0
 816                         fprintf(stderr,"ssl_parse_clienthello_tlsext s->session->tlsext_ellipticcurvelist (length=%i) ", s->session->tlsext_ellipticcurvelist_length);
 817                         sdata = s->session->tlsext_ellipticcurvelist;
 818                         for (i = 0; i < s->session->tlsext_ellipticcurvelist_length; i++)
 819                                 fprintf(stderr,"%i ",*(sdata++));
 820                         fprintf(stderr,"\n");
 821 #endif
 822                         }
 823 #endif /* OPENSSL_NO_EC */
 824 #ifdef TLSEXT_TYPE_opaque_prf_input
 825                 else if (type == TLSEXT_TYPE_opaque_prf_input &&
 826                      s->version != DTLS1_VERSION)
 827                         {
 828                         unsigned char *sdata = data;
 829
 830                         if (size < 2)
 831                                 {
 832                                 *al = SSL_AD_DECODE_ERROR;
 833                                 return 0;
 834                                 }
 835                         n2s(sdata, s->s3->client_opaque_prf_input_len);
 836                         if (s->s3->client_opaque_prf_input_len != size - 2)
 837                                 {
 838                                 *al = SSL_AD_DECODE_ERROR;
 839                                 return 0;
 840                                 }
 841
 842                         if (s->s3->client_opaque_prf_input != NULL) /* shouldn't really happen */
 843                                 OPENSSL_free(s->s3->client_opaque_prf_input);
 844                         if (s->s3->client_opaque_prf_input_len == 0)
 845                                 s->s3->client_opaque_prf_input = OPENSSL_malloc(1); /* dummy byte just to get non-NULL */
 846                         else
 847                                 s->s3->client_opaque_prf_input = BUF_memdup(sdata, s->s3->client_opaque_prf_input_len);
 848                         if (s->s3->client_opaque_prf_input == NULL)
 849                                 {
 850                                 *al = TLS1_AD_INTERNAL_ERROR;
 851                                 return 0;
 852                                 }
 853                         }
 854 #endif
 855                 else if (type == TLSEXT_TYPE_session_ticket)
 856                         {
 857                         if (s->tls_session_ticket_ext_cb &&
 858                             !s->tls_session_ticket_ext_cb(s, data, size, s->tls_session_ticket_ext_cb_arg))
 859                                 {
 860                                 *al = TLS1_AD_INTERNAL_ERROR;
 861                                 return 0;
 862                                 }
 863                         }
 864                 else if (type == TLSEXT_TYPE_renegotiate)
 865                         {
 866                         if(!ssl_parse_clienthello_renegotiate_ext(s, data, size, al))
 867                                 return 0;
 868                         renegotiate_seen = 1;
 869                         }
 870                 else if (type == TLSEXT_TYPE_status_request &&
 871                          s->version != DTLS1_VERSION && s->ctx->tlsext_status_cb)
 872                         {
 873
 874                         if (size < 5)
 875                                 {
 876                                 *al = SSL_AD_DECODE_ERROR;
 877                                 return 0;
 878                                 }
 879
 880                         s->tlsext_status_type = *data++;
 881                         size--;
 882                         if (s->tlsext_status_type == TLSEXT_STATUSTYPE_ocsp)
 883                                 {
 884                                 const unsigned char *sdata;
 885                                 int dsize;
 886                                 /* Read in responder_id_list */
 887                                 n2s(data,dsize);
 888                                 size -= 2;
 889                                 if (dsize > size  )
 890                                         {
 891                                         *al = SSL_AD_DECODE_ERROR;
 892                                         return 0;
 893                                         }
 894                                 while (dsize > 0)
 895                                         {
 896                                         OCSP_RESPID *id;
 897                                         int idsize;
 898                                         if (dsize < 4)
 899                                                 {
 900                                                 *al = SSL_AD_DECODE_ERROR;
 901                                                 return 0;
 902                                                 }
 903                                         n2s(data, idsize);
 904                                         dsize -= 2 + idsize;
 905                                         if (dsize < 0)
 906                                                 {
 907                                                 *al = SSL_AD_DECODE_ERROR;
 908                                                 return 0;
 909                                                 }
 910                                         sdata = data;
 911                                         data += idsize;
 912                                         id = d2i_OCSP_RESPID(NULL,
 913                                                                 &sdata, idsize);
 914                                         if (!id)
 915                                                 {
 916                                                 *al = SSL_AD_DECODE_ERROR;
 917                                                 return 0;
 918                                                 }
 919                                         if (data != sdata)
 920                                                 {
 921                                                 OCSP_RESPID_free(id);
 922                                                 *al = SSL_AD_DECODE_ERROR;
 923                                                 return 0;
 924                                                 }
 925                                         if (!s->tlsext_ocsp_ids
 926                                                 && !(s->tlsext_ocsp_ids =
 927                                                 sk_OCSP_RESPID_new_null()))
 928                                                 {
 929                                                 OCSP_RESPID_free(id);
 930                                                 *al = SSL_AD_INTERNAL_ERROR;
 931                                                 return 0;
 932                                                 }
 933                                         if (!sk_OCSP_RESPID_push(
 934                                                         s->tlsext_ocsp_ids, id))
 935                                                 {
 936                                                 OCSP_RESPID_free(id);
 937                                                 *al = SSL_AD_INTERNAL_ERROR;
 938                                                 return 0;
 939                                                 }
 940                                         }
 941
 942                                 /* Read in request_extensions */
 943                                 n2s(data,dsize);
 944                                 size -= 2;
 945                                 if (dsize > size)
 946                                         {
 947                                         *al = SSL_AD_DECODE_ERROR;
 948                                         return 0;
 949                                         }
 950                                 sdata = data;
 951                                 if (dsize > 0)
 952                                         {
 953                                         s->tlsext_ocsp_exts =
 954                                                 d2i_X509_EXTENSIONS(NULL,
 955                                                         &sdata, dsize);
 956                                         if (!s->tlsext_ocsp_exts
 957                                                 || (data + dsize != sdata))
 958                                                 {
 959                                                 *al = SSL_AD_DECODE_ERROR;
 960                                                 return 0;
 961                                                 }
 962                                         }
 963                                 }
 964                                 /* We don't know what to do with any other type
 965                                 * so ignore it.
 966                                 */
 967                                 else
 968                                         s->tlsext_status_type = -1;
 969                         }
 970
 971                 /* session ticket processed earlier */
 972                 data+=size;
 973                 }
 974
 975         if (s->new_session && !renegotiate_seen
 976                 && !(s->ctx->options & SSL_OP_ALLOW_UNSAFE_LEGACY_RENEGOTIATION))
 977                 {
 978                 SSLerr(SSL_F_SSL_PARSE_CLIENTHELLO_TLSEXT, SSL_R_UNSAFE_LEGACY_RENEGOTIATION_DISABLED);
 979                 *al = SSL_AD_ILLEGAL_PARAMETER; /* is this the right alert? */
 980                 return 0;
 981                 }
 982
 983
 984         *p = data;
 985         return 1;
 986         }
 987
 988 int ssl_parse_serverhello_tlsext(SSL *s, unsigned char **p, unsigned char *d, int n, int *al)
 989         {
 990         unsigned short type;
 991         unsigned short size;
 992         unsigned short len;
 993         unsigned char *data = *p;
 994         int tlsext_servername = 0;
 995         int renegotiate_seen = 0;
 996
 997         if (data >= (d+n-2))
 998                 {
 999                 /* Because the client does not see any renegotiation during an
1000                    attack, we must enforce this on all server hellos, even the
1001                    first */
1002                 if (!(s->ctx->options & SSL_OP_ALLOW_UNSAFE_LEGACY_RENEGOTIATION))
1003                         {
1004                         /* We should always see one extension: the renegotiate extension */
1005                         *al = SSL_AD_ILLEGAL_PARAMETER; /* is this the right alert? */
1006                         SSLerr(SSL_F_SSL_PARSE_SERVERHELLO_TLSEXT, SSL_R_UNSAFE_LEGACY_RENEGOTIATION_DISABLED);
1007                         return 0;
1008                         }
1009                 return 1;
1010                 }
1011
1012         n2s(data,len);
1013
1014         while(data <= (d+n-4))
1015                 {
1016                 n2s(data,type);
1017                 n2s(data,size);
1018
1019                 if (data+size > (d+n))
1020                         return 1;
1021
1022                 if (s->tlsext_debug_cb)
1023                         s->tlsext_debug_cb(s, 1, type, data, size,
1024                                                 s->tlsext_debug_arg);
1025
1026                 if (type == TLSEXT_TYPE_server_name)
1027                         {
1028                         if (s->tlsext_hostname == NULL || size > 0)
1029                                 {
1030                                 *al = TLS1_AD_UNRECOGNIZED_NAME;
1031                                 return 0;
1032                                 }
1033                         tlsext_servername = 1;
1034                         }
1035
1036 #ifndef OPENSSL_NO_EC
1037                 else if (type == TLSEXT_TYPE_ec_point_formats &&
1038                      s->version != DTLS1_VERSION)
1039                         {
1040                         unsigned char *sdata = data;
1041                         int ecpointformatlist_length = *(sdata++);
1042
1043                         if (ecpointformatlist_length != size - 1)
1044                                 {
1045                                 *al = TLS1_AD_DECODE_ERROR;
1046                                 return 0;
1047                                 }
1048                         s->session->tlsext_ecpointformatlist_length = 0;
1049                         if (s->session->tlsext_ecpointformatlist != NULL) OPENSSL_free(s->session->tlsext_ecpointformatlist);
1050                         if ((s->session->tlsext_ecpointformatlist = OPENSSL_malloc(ecpointformatlist_length)) == NULL)
1051                                 {
1052                                 *al = TLS1_AD_INTERNAL_ERROR;
1053                                 return 0;
1054                                 }
1055                         s->session->tlsext_ecpointformatlist_length = ecpointformatlist_length;
1056                         memcpy(s->session->tlsext_ecpointformatlist, sdata, ecpointformatlist_length);
1057 #if 0
1058                         fprintf(stderr,"ssl_parse_serverhello_tlsext s->session->tlsext_ecpointformatlist ");
1059                         sdata = s->session->tlsext_ecpointformatlist;
1060                         for (i = 0; i < s->session->tlsext_ecpointformatlist_length; i++)
1061                                 fprintf(stderr,"%i ",*(sdata++));
1062                         fprintf(stderr,"\n");
1063 #endif
1064                         }
1065 #endif /* OPENSSL_NO_EC */
1066
1067                 else if (type == TLSEXT_TYPE_session_ticket)
1068                         {
1069                         if (s->tls_session_ticket_ext_cb &&
1070                             !s->tls_session_ticket_ext_cb(s, data, size, s->tls_session_ticket_ext_cb_arg))
1071                                 {
1072                                 *al = TLS1_AD_INTERNAL_ERROR;
1073                                 return 0;
1074                                 }
1075                         if ((SSL_get_options(s) & SSL_OP_NO_TICKET)
1076                                 || (size > 0))
1077                                 {
1078                                 *al = TLS1_AD_UNSUPPORTED_EXTENSION;
1079                                 return 0;
1080                                 }
1081                         s->tlsext_ticket_expected = 1;
1082                         }
1083 #ifdef TLSEXT_TYPE_opaque_prf_input
1084                 else if (type == TLSEXT_TYPE_opaque_prf_input &&
1085                      s->version != DTLS1_VERSION)
1086                         {
1087                         unsigned char *sdata = data;
1088
1089                         if (size < 2)
1090                                 {
1091                                 *al = SSL_AD_DECODE_ERROR;
1092                                 return 0;
1093                                 }
1094                         n2s(sdata, s->s3->server_opaque_prf_input_len);
1095                         if (s->s3->server_opaque_prf_input_len != size - 2)
1096                                 {
1097                                 *al = SSL_AD_DECODE_ERROR;
1098                                 return 0;
1099                                 }
1100
1101                         if (s->s3->server_opaque_prf_input != NULL) /* shouldn't really happen */
1102                                 OPENSSL_free(s->s3->server_opaque_prf_input);
1103                         if (s->s3->server_opaque_prf_input_len == 0)
1104                                 s->s3->server_opaque_prf_input = OPENSSL_malloc(1); /* dummy byte just to get non-NULL */
1105                         else
1106                                 s->s3->server_opaque_prf_input = BUF_memdup(sdata, s->s3->server_opaque_prf_input_len);
1107
1108                         if (s->s3->server_opaque_prf_input == NULL)
1109                                 {
1110                                 *al = TLS1_AD_INTERNAL_ERROR;
1111                                 return 0;
1112                                 }
1113                         }
1114 #endif
1115                 else if (type == TLSEXT_TYPE_status_request &&
1116                          s->version != DTLS1_VERSION)
1117                         {
1118                         /* MUST be empty and only sent if we've requested
1119                          * a status request message.
1120                          */
1121                         if ((s->tlsext_status_type == -1) || (size > 0))
1122                                 {
1123                                 *al = TLS1_AD_UNSUPPORTED_EXTENSION;
1124                                 return 0;
1125                                 }
1126                         /* Set flag to expect CertificateStatus message */
1127                         s->tlsext_status_expected = 1;
1128                         }
1129                 else if (type == TLSEXT_TYPE_renegotiate)
1130                         {
1131                         if(!ssl_parse_serverhello_renegotiate_ext(s, data, size, al))
1132                                 return 0;
1133                         renegotiate_seen = 1;
1134                         }
1135                 data+=size;
1136                 }
1137
1138         if (data != d+n)
1139                 {
1140                 *al = SSL_AD_DECODE_ERROR;
1141                 return 0;
1142                 }
1143
1144         if (!renegotiate_seen
1145                 && !(s->ctx->options & SSL_OP_ALLOW_UNSAFE_LEGACY_RENEGOTIATION))
1146                 {
1147                 *al = SSL_AD_ILLEGAL_PARAMETER; /* is this the right alert? */
1148                 SSLerr(SSL_F_SSL_PARSE_SERVERHELLO_TLSEXT, SSL_R_UNSAFE_LEGACY_RENEGOTIATION_DISABLED);
1149                 return 0;
1150                 }
1151
1152         if (!s->hit && tlsext_servername == 1)
1153                 {
1154                 if (s->tlsext_hostname)
1155                         {
1156                         if (s->session->tlsext_hostname == NULL)
1157                                 {
1158                                 s->session->tlsext_hostname = BUF_strdup(s->tlsext_hostname);
1159                                 if (!s->session->tlsext_hostname)
1160                                         {
1161                                         *al = SSL_AD_UNRECOGNIZED_NAME;
1162                                         return 0;
1163                                         }
1164                                 }
1165                         else
1166                                 {
1167                                 *al = SSL_AD_DECODE_ERROR;
1168                                 return 0;
1169                                 }
1170                         }
1171                 }
1172
1173         *p = data;
1174         return 1;
1175         }
1176
1177
1178 int ssl_prepare_clienthello_tlsext(SSL *s)
1179         {
1180 #ifndef OPENSSL_NO_EC
1181         /* If we are client and using an elliptic curve cryptography cipher suite, send the point formats
1182          * and elliptic curves we support.
1183          */
1184         int using_ecc = 0;
1185         int i;
1186         unsigned char *j;
1187         unsigned long alg_k, alg_a;
1188         STACK_OF(SSL_CIPHER) *cipher_stack = SSL_get_ciphers(s);
1189
1190         for (i = 0; i < sk_SSL_CIPHER_num(cipher_stack); i++)
1191                 {
1192                 SSL_CIPHER *c = sk_SSL_CIPHER_value(cipher_stack, i);
1193
1194                 alg_k = c->algorithm_mkey;
1195                 alg_a = c->algorithm_auth;
1196                 if ((alg_k & (SSL_kEECDH|SSL_kECDHr|SSL_kECDHe) || (alg_a & SSL_aECDSA)))
1197                         {
1198                         using_ecc = 1;
1199                         break;
1200                         }
1201                 }
1202         using_ecc = using_ecc && (s->version == TLS1_VERSION);
1203         if (using_ecc)
1204                 {
1205                 if (s->tlsext_ecpointformatlist != NULL) OPENSSL_free(s->tlsext_ecpointformatlist);
1206                 if ((s->tlsext_ecpointformatlist = OPENSSL_malloc(3)) == NULL)
1207                         {
1208                         SSLerr(SSL_F_SSL_PREPARE_CLIENTHELLO_TLSEXT,ERR_R_MALLOC_FAILURE);
1209                         return -1;
1210                         }
1211                 s->tlsext_ecpointformatlist_length = 3;
1212                 s->tlsext_ecpointformatlist[0] = TLSEXT_ECPOINTFORMAT_uncompressed;
1213                 s->tlsext_ecpointformatlist[1] = TLSEXT_ECPOINTFORMAT_ansiX962_compressed_prime;
1214                 s->tlsext_ecpointformatlist[2] = TLSEXT_ECPOINTFORMAT_ansiX962_compressed_char2;
1215
1216                 /* we support all named elliptic curves in draft-ietf-tls-ecc-12 */
1217                 if (s->tlsext_ellipticcurvelist != NULL) OPENSSL_free(s->tlsext_ellipticcurvelist);
1218                 s->tlsext_ellipticcurvelist_length = sizeof(nid_list)/sizeof(nid_list[0]) * 2;
1219                 if ((s->tlsext_ellipticcurvelist = OPENSSL_malloc(s->tlsext_ellipticcurvelist_length)) == NULL)
1220                         {
1221                         s->tlsext_ellipticcurvelist_length = 0;
1222                         SSLerr(SSL_F_SSL_PREPARE_CLIENTHELLO_TLSEXT,ERR_R_MALLOC_FAILURE);
1223                         return -1;
1224                         }
1225                 for (i = 1, j = s->tlsext_ellipticcurvelist; (unsigned int)i <=
1226                                 sizeof(nid_list)/sizeof(nid_list[0]); i++)
1227                         s2n(i,j);
1228                 }
1229 #endif /* OPENSSL_NO_EC */
1230
1231 #ifdef TLSEXT_TYPE_opaque_prf_input
1232         {
1233                 int r = 1;
1234
1235                 if (s->ctx->tlsext_opaque_prf_input_callback != 0)
1236                         {
1237                         r = s->ctx->tlsext_opaque_prf_input_callback(s, NULL, 0, s->ctx->tlsext_opaque_prf_input_callback_arg);
1238                         if (!r)
1239                                 return -1;
1240                         }
1241
1242                 if (s->tlsext_opaque_prf_input != NULL)
1243                         {
1244                         if (s->s3->client_opaque_prf_input != NULL) /* shouldn't really happen */
1245                                 OPENSSL_free(s->s3->client_opaque_prf_input);
1246
1247                         if (s->tlsext_opaque_prf_input_len == 0)
1248                                 s->s3->client_opaque_prf_input = OPENSSL_malloc(1); /* dummy byte just to get non-NULL */
1249                         else
1250                                 s->s3->client_opaque_prf_input = BUF_memdup(s->tlsext_opaque_prf_input, s->tlsext_opaque_prf_input_len);
1251                         if (s->s3->client_opaque_prf_input == NULL)
1252                                 {
1253                                 SSLerr(SSL_F_SSL_PREPARE_CLIENTHELLO_TLSEXT,ERR_R_MALLOC_FAILURE);
1254                                 return -1;
1255                                 }
1256                         s->s3->client_opaque_prf_input_len = s->tlsext_opaque_prf_input_len;
1257                         }
1258
1259                 if (r == 2)
1260                         /* at callback's request, insist on receiving an appropriate server opaque PRF input */
1261                         s->s3->server_opaque_prf_input_len = s->tlsext_opaque_prf_input_len;
1262         }
1263 #endif
1264
1265         return 1;
1266         }
1267
1268 int ssl_prepare_serverhello_tlsext(SSL *s)
1269         {
1270 #ifndef OPENSSL_NO_EC
1271         /* If we are server and using an ECC cipher suite, send the point formats we support
1272          * if the client sent us an ECPointsFormat extension.  Note that the server is not
1273          * supposed to send an EllipticCurves extension.
1274          */
1275
1276         unsigned long alg_k = s->s3->tmp.new_cipher->algorithm_mkey;
1277         unsigned long alg_a = s->s3->tmp.new_cipher->algorithm_auth;
1278         int using_ecc = (alg_k & (SSL_kEECDH|SSL_kECDHr|SSL_kECDHe)) || (alg_a & SSL_aECDSA);
1279         using_ecc = using_ecc && (s->session->tlsext_ecpointformatlist != NULL);
1280
1281         if (using_ecc)
1282                 {
1283                 if (s->tlsext_ecpointformatlist != NULL) OPENSSL_free(s->tlsext_ecpointformatlist);
1284                 if ((s->tlsext_ecpointformatlist = OPENSSL_malloc(3)) == NULL)
1285                         {
1286                         SSLerr(SSL_F_SSL_PREPARE_SERVERHELLO_TLSEXT,ERR_R_MALLOC_FAILURE);
1287                         return -1;
1288                         }
1289                 s->tlsext_ecpointformatlist_length = 3;
1290                 s->tlsext_ecpointformatlist[0] = TLSEXT_ECPOINTFORMAT_uncompressed;
1291                 s->tlsext_ecpointformatlist[1] = TLSEXT_ECPOINTFORMAT_ansiX962_compressed_prime;
1292                 s->tlsext_ecpointformatlist[2] = TLSEXT_ECPOINTFORMAT_ansiX962_compressed_char2;
1293                 }
1294 #endif /* OPENSSL_NO_EC */
1295
1296         return 1;
1297         }
1298
1299 int ssl_check_clienthello_tlsext(SSL *s)
1300         {
1301         int ret=SSL_TLSEXT_ERR_NOACK;
1302         int al = SSL_AD_UNRECOGNIZED_NAME;
1303
1304 #ifndef OPENSSL_NO_EC
1305         /* The handling of the ECPointFormats extension is done elsewhere, namely in
1306          * ssl3_choose_cipher in s3_lib.c.
1307          */
1308         /* The handling of the EllipticCurves extension is done elsewhere, namely in
1309          * ssl3_choose_cipher in s3_lib.c.
1310          */
1311 #endif
1312
1313         if (s->ctx != NULL && s->ctx->tlsext_servername_callback != 0)
1314                 ret = s->ctx->tlsext_servername_callback(s, &al, s->ctx->tlsext_servername_arg);
1315         else if (s->initial_ctx != NULL && s->initial_ctx->tlsext_servername_callback != 0)
1316                 ret = s->initial_ctx->tlsext_servername_callback(s, &al, s->initial_ctx->tlsext_servername_arg);
1317
1318         /* If status request then ask callback what to do.
1319          * Note: this must be called after servername callbacks in case
1320          * the certificate has changed.
1321          */
1322         if ((s->tlsext_status_type != -1) && s->ctx && s->ctx->tlsext_status_cb)
1323                 {
1324                 int r;
1325                 r = s->ctx->tlsext_status_cb(s, s->ctx->tlsext_status_arg);
1326                 switch (r)
1327                         {
1328                         /* We don't want to send a status request response */
1329                         case SSL_TLSEXT_ERR_NOACK:
1330                                 s->tlsext_status_expected = 0;
1331                                 break;
1332                         /* status request response should be sent */
1333                         case SSL_TLSEXT_ERR_OK:
1334                                 if (s->tlsext_ocsp_resp)
1335                                         s->tlsext_status_expected = 1;
1336                                 else
1337                                         s->tlsext_status_expected = 0;
1338                                 break;
1339                         /* something bad happened */
1340                         case SSL_TLSEXT_ERR_ALERT_FATAL:
1341                                 ret = SSL_TLSEXT_ERR_ALERT_FATAL;
1342                                 al = SSL_AD_INTERNAL_ERROR;
1343                                 goto err;
1344                         }
1345                 }
1346         else
1347                 s->tlsext_status_expected = 0;
1348
1349 #ifdef TLSEXT_TYPE_opaque_prf_input
1350         {
1351                 /* This sort of belongs into ssl_prepare_serverhello_tlsext(),
1352                  * but we might be sending an alert in response to the client hello,
1353                  * so this has to happen here in ssl_check_clienthello_tlsext(). */
1354
1355                 int r = 1;
1356
1357                 if (s->ctx->tlsext_opaque_prf_input_callback != 0)
1358                         {
1359                         r = s->ctx->tlsext_opaque_prf_input_callback(s, NULL, 0, s->ctx->tlsext_opaque_prf_input_callback_arg);
1360                         if (!r)
1361                                 {
1362                                 ret = SSL_TLSEXT_ERR_ALERT_FATAL;
1363                                 al = SSL_AD_INTERNAL_ERROR;
1364                                 goto err;
1365                                 }
1366                         }
1367
1368                 if (s->s3->server_opaque_prf_input != NULL) /* shouldn't really happen */
1369                         OPENSSL_free(s->s3->server_opaque_prf_input);
1370                 s->s3->server_opaque_prf_input = NULL;
1371
1372                 if (s->tlsext_opaque_prf_input != NULL)
1373                         {
1374                         if (s->s3->client_opaque_prf_input != NULL &&
1375                                 s->s3->client_opaque_prf_input_len == s->tlsext_opaque_prf_input_len)
1376                                 {
1377                                 /* can only use this extension if we have a server opaque PRF input
1378                                  * of the same length as the client opaque PRF input! */
1379
1380                                 if (s->tlsext_opaque_prf_input_len == 0)
1381                                         s->s3->server_opaque_prf_input = OPENSSL_malloc(1); /* dummy byte just to get non-NULL */
1382                                 else
1383                                         s->s3->server_opaque_prf_input = BUF_memdup(s->tlsext_opaque_prf_input, s->tlsext_opaque_prf_input_len);
1384                                 if (s->s3->server_opaque_prf_input == NULL)
1385                                         {
1386                                         ret = SSL_TLSEXT_ERR_ALERT_FATAL;
1387                                         al = SSL_AD_INTERNAL_ERROR;
1388                                         goto err;
1389                                         }
1390                                 s->s3->server_opaque_prf_input_len = s->tlsext_opaque_prf_input_len;
1391                                 }
1392                         }
1393
1394                 if (r == 2 && s->s3->server_opaque_prf_input == NULL)
1395                         {
1396                         /* The callback wants to enforce use of the extension,
1397                          * but we can't do that with the client opaque PRF input;
1398                          * abort the handshake.
1399                          */
1400                         ret = SSL_TLSEXT_ERR_ALERT_FATAL;
1401                         al = SSL_AD_HANDSHAKE_FAILURE;
1402                         }
1403         }
1404
1405 #endif
1406  err:
1407         switch (ret)
1408                 {
1409                 case SSL_TLSEXT_ERR_ALERT_FATAL:
1410                         ssl3_send_alert(s,SSL3_AL_FATAL,al);
1411                         return -1;
1412
1413                 case SSL_TLSEXT_ERR_ALERT_WARNING:
1414                         ssl3_send_alert(s,SSL3_AL_WARNING,al);
1415                         return 1;
1416
1417                 case SSL_TLSEXT_ERR_NOACK:
1418                         s->servername_done=0;
1419                         default:
1420                 return 1;
1421                 }
1422         }
1423
1424 int ssl_check_serverhello_tlsext(SSL *s)
1425         {
1426         int ret=SSL_TLSEXT_ERR_NOACK;
1427         int al = SSL_AD_UNRECOGNIZED_NAME;
1428
1429 #ifndef OPENSSL_NO_EC
1430         /* If we are client and using an elliptic curve cryptography cipher suite, then server
1431          * must return a an EC point formats lists containing uncompressed.
1432          */
1433         unsigned long alg_k = s->s3->tmp.new_cipher->algorithm_mkey;
1434         unsigned long alg_a = s->s3->tmp.new_cipher->algorithm_auth;
1435         if ((s->tlsext_ecpointformatlist != NULL) && (s->tlsext_ecpointformatlist_length > 0) &&
1436             ((alg_k & (SSL_kEECDH|SSL_kECDHr|SSL_kECDHe)) || (alg_a & SSL_aECDSA)))
1437                 {
1438                 /* we are using an ECC cipher */
1439                 size_t i;
1440                 unsigned char *list;
1441                 int found_uncompressed = 0;
1442                 if ((s->session->tlsext_ecpointformatlist == NULL) || (s->session->tlsext_ecpointformatlist_length == 0))
1443                         {
1444                         SSLerr(SSL_F_SSL_CHECK_SERVERHELLO_TLSEXT,SSL_R_TLS_INVALID_ECPOINTFORMAT_LIST);
1445                         return -1;
1446                         }
1447                 list = s->session->tlsext_ecpointformatlist;
1448                 for (i = 0; i < s->session->tlsext_ecpointformatlist_length; i++)
1449                         {
1450                         if (*(list++) == TLSEXT_ECPOINTFORMAT_uncompressed)
1451                                 {
1452                                 found_uncompressed = 1;
1453                                 break;
1454                                 }
1455                         }
1456                 if (!found_uncompressed)
1457                         {
1458                         SSLerr(SSL_F_SSL_CHECK_SERVERHELLO_TLSEXT,SSL_R_TLS_INVALID_ECPOINTFORMAT_LIST);
1459                         return -1;
1460                         }
1461                 }
1462         ret = SSL_TLSEXT_ERR_OK;
1463 #endif /* OPENSSL_NO_EC */
1464
1465         if (s->ctx != NULL && s->ctx->tlsext_servername_callback != 0)
1466                 ret = s->ctx->tlsext_servername_callback(s, &al, s->ctx->tlsext_servername_arg);
1467         else if (s->initial_ctx != NULL && s->initial_ctx->tlsext_servername_callback != 0)
1468                 ret = s->initial_ctx->tlsext_servername_callback(s, &al, s->initial_ctx->tlsext_servername_arg);
1469
1470 #ifdef TLSEXT_TYPE_opaque_prf_input
1471         if (s->s3->server_opaque_prf_input_len > 0)
1472                 {
1473                 /* This case may indicate that we, as a client, want to insist on using opaque PRF inputs.
1474                  * So first verify that we really have a value from the server too. */
1475
1476                 if (s->s3->server_opaque_prf_input == NULL)
1477                         {
1478                         ret = SSL_TLSEXT_ERR_ALERT_FATAL;
1479                         al = SSL_AD_HANDSHAKE_FAILURE;
1480                         }
1481
1482                 /* Anytime the server *has* sent an opaque PRF input, we need to check
1483                  * that we have a client opaque PRF input of the same size. */
1484                 if (s->s3->client_opaque_prf_input == NULL ||
1485                     s->s3->client_opaque_prf_input_len != s->s3->server_opaque_prf_input_len)
1486                         {
1487                         ret = SSL_TLSEXT_ERR_ALERT_FATAL;
1488                         al = SSL_AD_ILLEGAL_PARAMETER;
1489                         }
1490                 }
1491 #endif
1492
1493         /* If we've requested certificate status and we wont get one
1494          * tell the callback
1495          */
1496         if ((s->tlsext_status_type != -1) && !(s->tlsext_status_expected)
1497                         && s->ctx && s->ctx->tlsext_status_cb)
1498                 {
1499                 int r;
1500                 /* Set resp to NULL, resplen to -1 so callback knows
1501                  * there is no response.
1502                  */
1503                 if (s->tlsext_ocsp_resp)
1504                         {
1505                         OPENSSL_free(s->tlsext_ocsp_resp);
1506                         s->tlsext_ocsp_resp = NULL;
1507                         }
1508                 s->tlsext_ocsp_resplen = -1;
1509                 r = s->ctx->tlsext_status_cb(s, s->ctx->tlsext_status_arg);
1510                 if (r == 0)
1511                         {
1512                         al = SSL_AD_BAD_CERTIFICATE_STATUS_RESPONSE;
1513                         ret = SSL_TLSEXT_ERR_ALERT_FATAL;
1514                         }
1515                 if (r < 0)
1516                         {
1517                         al = SSL_AD_INTERNAL_ERROR;
1518                         ret = SSL_TLSEXT_ERR_ALERT_FATAL;
1519                         }
1520                 }
1521
1522         switch (ret)
1523                 {
1524                 case SSL_TLSEXT_ERR_ALERT_FATAL:
1525                         ssl3_send_alert(s,SSL3_AL_FATAL,al);
1526                         return -1;
1527
1528                 case SSL_TLSEXT_ERR_ALERT_WARNING:
1529                         ssl3_send_alert(s,SSL3_AL_WARNING,al);
1530                         return 1;
1531
1532                 case SSL_TLSEXT_ERR_NOACK:
1533                         s->servername_done=0;
1534                         default:
1535                 return 1;
1536                 }
1537         }
1538
1539 /* Since the server cache lookup is done early on in the processing of client
1540  * hello and other operations depend on the result we need to handle any TLS
1541  * session ticket extension at the same time.
1542  */
1543
1544 int tls1_process_ticket(SSL *s, unsigned char *session_id, int len,
1545                                 const unsigned char *limit, SSL_SESSION **ret)
1546         {
1547         /* Point after session ID in client hello */
1548         const unsigned char *p = session_id + len;
1549         unsigned short i;
1550
1551         /* If tickets disabled behave as if no ticket present
1552          * to permit stateful resumption.
1553          */
1554         if (SSL_get_options(s) & SSL_OP_NO_TICKET)
1555                 return 1;
1556
1557         if ((s->version <= SSL3_VERSION) || !limit)
1558                 return 1;
1559         if (p >= limit)
1560                 return -1;
1561         /* Skip past DTLS cookie */
1562         if (s->version == DTLS1_VERSION || s->version == DTLS1_BAD_VER)
1563                 {
1564                 i = *(p++);
1565                 p+= i;
1566                 if (p >= limit)
1567                         return -1;
1568                 }
1569         /* Skip past cipher list */
1570         n2s(p, i);
1571         p+= i;
1572         if (p >= limit)
1573                 return -1;
1574         /* Skip past compression algorithm list */
1575         i = *(p++);
1576         p += i;
1577         if (p > limit)
1578                 return -1;
1579         /* Now at start of extensions */
1580         if ((p + 2) >= limit)
1581                 return 1;
1582         n2s(p, i);
1583         while ((p + 4) <= limit)
1584                 {
1585                 unsigned short type, size;
1586                 n2s(p, type);
1587                 n2s(p, size);
1588                 if (p + size > limit)
1589                         return 1;
1590                 if (type == TLSEXT_TYPE_session_ticket)
1591                         {
1592                         /* If tickets disabled indicate cache miss which will
1593                          * trigger a full handshake
1594                          */
1595                         if (SSL_get_options(s) & SSL_OP_NO_TICKET)
1596                                 return 1;
1597                         /* If zero length note client will accept a ticket
1598                          * and indicate cache miss to trigger full handshake
1599                          */
1600                         if (size == 0)
1601                                 {
1602                                 s->tlsext_ticket_expected = 1;
1603                                 return 0;       /* Cache miss */
1604                                 }
1605                         if (s->tls_session_secret_cb)
1606                                 {
1607                                 /* Indicate cache miss here and instead of
1608                                  * generating the session from ticket now,
1609                                  * trigger abbreviated handshake based on
1610                                  * external mechanism to calculate the master
1611                                  * secret later. */
1612                                 return 0;
1613                                 }
1614                         return tls_decrypt_ticket(s, p, size, session_id, len,
1615                                                                         ret);
1616                         }
1617                 p += size;
1618                 }
1619         return 1;
1620         }
1621
1622 static int tls_decrypt_ticket(SSL *s, const unsigned char *etick, int eticklen,
1623                                 const unsigned char *sess_id, int sesslen,
1624                                 SSL_SESSION **psess)
1625         {
1626         SSL_SESSION *sess;
1627         unsigned char *sdec;
1628         const unsigned char *p;
1629         int slen, mlen, renew_ticket = 0;
1630         unsigned char tick_hmac[EVP_MAX_MD_SIZE];
1631         HMAC_CTX hctx;
1632         EVP_CIPHER_CTX ctx;
1633         SSL_CTX *tctx = s->initial_ctx;
1634         /* Need at least keyname + iv + some encrypted data */
1635         if (eticklen < 48)
1636                 goto tickerr;
1637         /* Initialize session ticket encryption and HMAC contexts */
1638         HMAC_CTX_init(&hctx);
1639         EVP_CIPHER_CTX_init(&ctx);
1640         if (tctx->tlsext_ticket_key_cb)
1641                 {
1642                 unsigned char *nctick = (unsigned char *)etick;
1643                 int rv = tctx->tlsext_ticket_key_cb(s, nctick, nctick + 16,
1644                                                         &ctx, &hctx, 0);
1645                 if (rv < 0)
1646                         return -1;
1647                 if (rv == 0)
1648                         goto tickerr;
1649                 if (rv == 2)
1650                         renew_ticket = 1;
1651                 }
1652         else
1653                 {
1654                 /* Check key name matches */
1655                 if (memcmp(etick, tctx->tlsext_tick_key_name, 16))
1656                         goto tickerr;
1657                 HMAC_Init_ex(&hctx, tctx->tlsext_tick_hmac_key, 16,
1658                                         tlsext_tick_md(), NULL);
1659                 EVP_DecryptInit_ex(&ctx, EVP_aes_128_cbc(), NULL,
1660                                 tctx->tlsext_tick_aes_key, etick + 16);
1661                 }
1662         /* Attempt to process session ticket, first conduct sanity and
1663          * integrity checks on ticket.
1664          */
1665         mlen = HMAC_size(&hctx);
1666         if (mlen < 0)
1667                 {
1668                 EVP_CIPHER_CTX_cleanup(&ctx);
1669                 return -1;
1670                 }
1671         eticklen -= mlen;
1672         /* Check HMAC of encrypted ticket */
1673         HMAC_Update(&hctx, etick, eticklen);
1674         HMAC_Final(&hctx, tick_hmac, NULL);
1675         HMAC_CTX_cleanup(&hctx);
1676         if (memcmp(tick_hmac, etick + eticklen, mlen))
1677                 goto tickerr;
1678         /* Attempt to decrypt session data */
1679         /* Move p after IV to start of encrypted ticket, update length */
1680         p = etick + 16 + EVP_CIPHER_CTX_iv_length(&ctx);
1681         eticklen -= 16 + EVP_CIPHER_CTX_iv_length(&ctx);
1682         sdec = OPENSSL_malloc(eticklen);
1683         if (!sdec)
1684                 {
1685                 EVP_CIPHER_CTX_cleanup(&ctx);
1686                 return -1;
1687                 }
1688         EVP_DecryptUpdate(&ctx, sdec, &slen, p, eticklen);
1689         if (EVP_DecryptFinal(&ctx, sdec + slen, &mlen) <= 0)
1690                 goto tickerr;
1691         slen += mlen;
1692         EVP_CIPHER_CTX_cleanup(&ctx);
1693         p = sdec;
1694
1695         sess = d2i_SSL_SESSION(NULL, &p, slen);
1696         OPENSSL_free(sdec);
1697         if (sess)
1698                 {
1699                 /* The session ID if non-empty is used by some clients to
1700                  * detect that the ticket has been accepted. So we copy it to
1701                  * the session structure. If it is empty set length to zero
1702                  * as required by standard.
1703                  */
1704                 if (sesslen)
1705                         memcpy(sess->session_id, sess_id, sesslen);
1706                 sess->session_id_length = sesslen;
1707                 *psess = sess;
1708                 s->tlsext_ticket_expected = renew_ticket;
1709                 return 1;
1710                 }
1711         /* If session decrypt failure indicate a cache miss and set state to
1712          * send a new ticket
1713          */
1714         tickerr:
1715         s->tlsext_ticket_expected = 1;
1716         return 0;
1717         }
1718
1719 #endif