ssl/t1_lib.c

   1 /* ssl/t1_lib.c */
   2 /* Copyright (C) 1995-1998 Eric Young (eay@cryptsoft.com)
   3  * All rights reserved.
   4  *
   5  * This package is an SSL implementation written
   6  * by Eric Young (eay@cryptsoft.com).
   7  * The implementation was written so as to conform with Netscapes SSL.
   8  *
   9  * This library is free for commercial and non-commercial use as long as
  10  * the following conditions are aheared to.  The following conditions
  11  * apply to all code found in this distribution, be it the RC4, RSA,
  12  * lhash, DES, etc., code; not just the SSL code.  The SSL documentation
  13  * included with this distribution is covered by the same copyright terms
  14  * except that the holder is Tim Hudson (tjh@cryptsoft.com).
  15  *
  16  * Copyright remains Eric Young's, and as such any Copyright notices in
  17  * the code are not to be removed.
  18  * If this package is used in a product, Eric Young should be given attribution
  19  * as the author of the parts of the library used.
  20  * This can be in the form of a textual message at program startup or
  21  * in documentation (online or textual) provided with the package.
  22  *
  23  * Redistribution and use in source and binary forms, with or without
  24  * modification, are permitted provided that the following conditions
  25  * are met:
  26  * 1. Redistributions of source code must retain the copyright
  27  *    notice, this list of conditions and the following disclaimer.
  28  * 2. Redistributions in binary form must reproduce the above copyright
  29  *    notice, this list of conditions and the following disclaimer in the
  30  *    documentation and/or other materials provided with the distribution.
  31  * 3. All advertising materials mentioning features or use of this software
  32  *    must display the following acknowledgement:
  33  *    "This product includes cryptographic software written by
  34  *     Eric Young (eay@cryptsoft.com)"
  35  *    The word 'cryptographic' can be left out if the rouines from the library
  36  *    being used are not cryptographic related :-).
  37  * 4. If you include any Windows specific code (or a derivative thereof) from
  38  *    the apps directory (application code) you must include an acknowledgement:
  39  *    "This product includes software written by Tim Hudson (tjh@cryptsoft.com)"
  40  *
  41  * THIS SOFTWARE IS PROVIDED BY ERIC YOUNG ``AS IS'' AND
  42  * ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
  43  * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE
  44  * ARE DISCLAIMED.  IN NO EVENT SHALL THE AUTHOR OR CONTRIBUTORS BE LIABLE
  45  * FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL
  46  * DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS
  47  * OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION)
  48  * HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT
  49  * LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY
  50  * OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF
  51  * SUCH DAMAGE.
  52  *
  53  * The licence and distribution terms for any publically available version or
  54  * derivative of this code cannot be changed.  i.e. this code cannot simply be
  55  * copied and put under another distribution licence
  56  * [including the GNU Public Licence.]
  57  */
  58 /* ====================================================================
  59  * Copyright (c) 1998-2007 The OpenSSL Project.  All rights reserved.
  60  *
  61  * Redistribution and use in source and binary forms, with or without
  62  * modification, are permitted provided that the following conditions
  63  * are met:
  64  *
  65  * 1. Redistributions of source code must retain the above copyright
  66  *    notice, this list of conditions and the following disclaimer.
  67  *
  68  * 2. Redistributions in binary form must reproduce the above copyright
  69  *    notice, this list of conditions and the following disclaimer in
  70  *    the documentation and/or other materials provided with the
  71  *    distribution.
  72  *
  73  * 3. All advertising materials mentioning features or use of this
  74  *    software must display the following acknowledgment:
  75  *    "This product includes software developed by the OpenSSL Project
  76  *    for use in the OpenSSL Toolkit. (http://www.openssl.org/)"
  77  *
  78  * 4. The names "OpenSSL Toolkit" and "OpenSSL Project" must not be used to
  79  *    endorse or promote products derived from this software without
  80  *    prior written permission. For written permission, please contact
  81  *    openssl-core@openssl.org.
  82  *
  83  * 5. Products derived from this software may not be called "OpenSSL"
  84  *    nor may "OpenSSL" appear in their names without prior written
  85  *    permission of the OpenSSL Project.
  86  *
  87  * 6. Redistributions of any form whatsoever must retain the following
  88  *    acknowledgment:
  89  *    "This product includes software developed by the OpenSSL Project
  90  *    for use in the OpenSSL Toolkit (http://www.openssl.org/)"
  91  *
  92  * THIS SOFTWARE IS PROVIDED BY THE OpenSSL PROJECT ``AS IS'' AND ANY
  93  * EXPRESSED OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
  94  * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
  95  * PURPOSE ARE DISCLAIMED.  IN NO EVENT SHALL THE OpenSSL PROJECT OR
  96  * ITS CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL,
  97  * SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT
  98  * NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES;
  99  * LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION)
 100  * HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT,
 101  * STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE)
 102  * ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED
 103  * OF THE POSSIBILITY OF SUCH DAMAGE.
 104  * ====================================================================
 105  *
 106  * This product includes cryptographic software written by Eric Young
 107  * (eay@cryptsoft.com).  This product includes software written by Tim
 108  * Hudson (tjh@cryptsoft.com).
 109  *
 110  */
 111
 112 #include <stdio.h>
 113 #include <openssl/objects.h>
 114 #include <openssl/evp.h>
 115 #include <openssl/hmac.h>
 116 #include <openssl/ocsp.h>
 117 #include <openssl/rand.h>
 118 #include "ssl_locl.h"
 119
 120 const char tls1_version_str[]="TLSv1" OPENSSL_VERSION_PTEXT;
 121
 122 #ifndef OPENSSL_NO_TLSEXT
 123 static int tls_decrypt_ticket(SSL *s, const unsigned char *tick, int ticklen,
 124                                 const unsigned char *sess_id, int sesslen,
 125                                 SSL_SESSION **psess);
 126 static int ssl_check_clienthello_tlsext_early(SSL *s);
 127 int ssl_check_serverhello_tlsext(SSL *s);
 128 #endif
 129
 130 SSL3_ENC_METHOD TLSv1_enc_data={
 131         tls1_enc,
 132         tls1_mac,
 133         tls1_setup_key_block,
 134         tls1_generate_master_secret,
 135         tls1_change_cipher_state,
 136         tls1_final_finish_mac,
 137         TLS1_FINISH_MAC_LENGTH,
 138         tls1_cert_verify_mac,
 139         TLS_MD_CLIENT_FINISH_CONST,TLS_MD_CLIENT_FINISH_CONST_SIZE,
 140         TLS_MD_SERVER_FINISH_CONST,TLS_MD_SERVER_FINISH_CONST_SIZE,
 141         tls1_alert_code,
 142         tls1_export_keying_material,
 143         0,
 144         SSL3_HM_HEADER_LENGTH,
 145         ssl3_set_handshake_header,
 146         ssl3_handshake_write
 147         };
 148
 149 SSL3_ENC_METHOD TLSv1_1_enc_data={
 150         tls1_enc,
 151         tls1_mac,
 152         tls1_setup_key_block,
 153         tls1_generate_master_secret,
 154         tls1_change_cipher_state,
 155         tls1_final_finish_mac,
 156         TLS1_FINISH_MAC_LENGTH,
 157         tls1_cert_verify_mac,
 158         TLS_MD_CLIENT_FINISH_CONST,TLS_MD_CLIENT_FINISH_CONST_SIZE,
 159         TLS_MD_SERVER_FINISH_CONST,TLS_MD_SERVER_FINISH_CONST_SIZE,
 160         tls1_alert_code,
 161         tls1_export_keying_material,
 162         SSL_ENC_FLAG_EXPLICIT_IV,
 163         SSL3_HM_HEADER_LENGTH,
 164         ssl3_set_handshake_header,
 165         ssl3_handshake_write
 166         };
 167
 168 SSL3_ENC_METHOD TLSv1_2_enc_data={
 169         tls1_enc,
 170         tls1_mac,
 171         tls1_setup_key_block,
 172         tls1_generate_master_secret,
 173         tls1_change_cipher_state,
 174         tls1_final_finish_mac,
 175         TLS1_FINISH_MAC_LENGTH,
 176         tls1_cert_verify_mac,
 177         TLS_MD_CLIENT_FINISH_CONST,TLS_MD_CLIENT_FINISH_CONST_SIZE,
 178         TLS_MD_SERVER_FINISH_CONST,TLS_MD_SERVER_FINISH_CONST_SIZE,
 179         tls1_alert_code,
 180         tls1_export_keying_material,
 181         SSL_ENC_FLAG_EXPLICIT_IV|SSL_ENC_FLAG_SIGALGS|SSL_ENC_FLAG_SHA256_PRF,
 182         SSL3_HM_HEADER_LENGTH,
 183         ssl3_set_handshake_header,
 184         ssl3_handshake_write
 185         };
 186
 187 long tls1_default_timeout(void)
 188         {
 189         /* 2 hours, the 24 hours mentioned in the TLSv1 spec
 190          * is way too long for http, the cache would over fill */
 191         return(60*60*2);
 192         }
 193
 194 int tls1_new(SSL *s)
 195         {
 196         if (!ssl3_new(s)) return(0);
 197         s->method->ssl_clear(s);
 198         return(1);
 199         }
 200
 201 void tls1_free(SSL *s)
 202         {
 203 #ifndef OPENSSL_NO_TLSEXT
 204         if (s->tlsext_session_ticket)
 205                 {
 206                 OPENSSL_free(s->tlsext_session_ticket);
 207                 }
 208 #endif /* OPENSSL_NO_TLSEXT */
 209         ssl3_free(s);
 210         }
 211
 212 void tls1_clear(SSL *s)
 213         {
 214         ssl3_clear(s);
 215         s->version = s->method->version;
 216         }
 217
 218 #ifndef OPENSSL_NO_EC
 219
 220 static int nid_list[] =
 221         {
 222                 NID_sect163k1, /* sect163k1 (1) */
 223                 NID_sect163r1, /* sect163r1 (2) */
 224                 NID_sect163r2, /* sect163r2 (3) */
 225                 NID_sect193r1, /* sect193r1 (4) */
 226                 NID_sect193r2, /* sect193r2 (5) */
 227                 NID_sect233k1, /* sect233k1 (6) */
 228                 NID_sect233r1, /* sect233r1 (7) */
 229                 NID_sect239k1, /* sect239k1 (8) */
 230                 NID_sect283k1, /* sect283k1 (9) */
 231                 NID_sect283r1, /* sect283r1 (10) */
 232                 NID_sect409k1, /* sect409k1 (11) */
 233                 NID_sect409r1, /* sect409r1 (12) */
 234                 NID_sect571k1, /* sect571k1 (13) */
 235                 NID_sect571r1, /* sect571r1 (14) */
 236                 NID_secp160k1, /* secp160k1 (15) */
 237                 NID_secp160r1, /* secp160r1 (16) */
 238                 NID_secp160r2, /* secp160r2 (17) */
 239                 NID_secp192k1, /* secp192k1 (18) */
 240                 NID_X9_62_prime192v1, /* secp192r1 (19) */
 241                 NID_secp224k1, /* secp224k1 (20) */
 242                 NID_secp224r1, /* secp224r1 (21) */
 243                 NID_secp256k1, /* secp256k1 (22) */
 244                 NID_X9_62_prime256v1, /* secp256r1 (23) */
 245                 NID_secp384r1, /* secp384r1 (24) */
 246                 NID_secp521r1  /* secp521r1 (25) */
 247         };
 248
 249
 250 static const unsigned char ecformats_default[] =
 251         {
 252         TLSEXT_ECPOINTFORMAT_uncompressed,
 253         TLSEXT_ECPOINTFORMAT_ansiX962_compressed_prime,
 254         TLSEXT_ECPOINTFORMAT_ansiX962_compressed_char2
 255         };
 256
 257 static const unsigned char eccurves_default[] =
 258         {
 259                 0,14, /* sect571r1 (14) */
 260                 0,13, /* sect571k1 (13) */
 261                 0,25, /* secp521r1 (25) */
 262                 0,11, /* sect409k1 (11) */
 263                 0,12, /* sect409r1 (12) */
 264                 0,24, /* secp384r1 (24) */
 265                 0,9,  /* sect283k1 (9) */
 266                 0,10, /* sect283r1 (10) */
 267                 0,22, /* secp256k1 (22) */
 268                 0,23, /* secp256r1 (23) */
 269                 0,8,  /* sect239k1 (8) */
 270                 0,6,  /* sect233k1 (6) */
 271                 0,7,  /* sect233r1 (7) */
 272                 0,20, /* secp224k1 (20) */
 273                 0,21, /* secp224r1 (21) */
 274                 0,4,  /* sect193r1 (4) */
 275                 0,5,  /* sect193r2 (5) */
 276                 0,18, /* secp192k1 (18) */
 277                 0,19, /* secp192r1 (19) */
 278                 0,1,  /* sect163k1 (1) */
 279                 0,2,  /* sect163r1 (2) */
 280                 0,3,  /* sect163r2 (3) */
 281                 0,15, /* secp160k1 (15) */
 282                 0,16, /* secp160r1 (16) */
 283                 0,17, /* secp160r2 (17) */
 284         };
 285
 286 static const unsigned char suiteb_curves[] =
 287         {
 288                 0, TLSEXT_curve_P_256,
 289                 0, TLSEXT_curve_P_384
 290         };
 291
 292 int tls1_ec_curve_id2nid(int curve_id)
 293         {
 294         /* ECC curves from draft-ietf-tls-ecc-12.txt (Oct. 17, 2005) */
 295         if ((curve_id < 1) || ((unsigned int)curve_id >
 296                                 sizeof(nid_list)/sizeof(nid_list[0])))
 297                 return 0;
 298         return nid_list[curve_id-1];
 299         }
 300
 301 int tls1_ec_nid2curve_id(int nid)
 302         {
 303         /* ECC curves from draft-ietf-tls-ecc-12.txt (Oct. 17, 2005) */
 304         switch (nid)
 305                 {
 306         case NID_sect163k1: /* sect163k1 (1) */
 307                 return 1;
 308         case NID_sect163r1: /* sect163r1 (2) */
 309                 return 2;
 310         case NID_sect163r2: /* sect163r2 (3) */
 311                 return 3;
 312         case NID_sect193r1: /* sect193r1 (4) */
 313                 return 4;
 314         case NID_sect193r2: /* sect193r2 (5) */
 315                 return 5;
 316         case NID_sect233k1: /* sect233k1 (6) */
 317                 return 6;
 318         case NID_sect233r1: /* sect233r1 (7) */
 319                 return 7;
 320         case NID_sect239k1: /* sect239k1 (8) */
 321                 return 8;
 322         case NID_sect283k1: /* sect283k1 (9) */
 323                 return 9;
 324         case NID_sect283r1: /* sect283r1 (10) */
 325                 return 10;
 326         case NID_sect409k1: /* sect409k1 (11) */
 327                 return 11;
 328         case NID_sect409r1: /* sect409r1 (12) */
 329                 return 12;
 330         case NID_sect571k1: /* sect571k1 (13) */
 331                 return 13;
 332         case NID_sect571r1: /* sect571r1 (14) */
 333                 return 14;
 334         case NID_secp160k1: /* secp160k1 (15) */
 335                 return 15;
 336         case NID_secp160r1: /* secp160r1 (16) */
 337                 return 16;
 338         case NID_secp160r2: /* secp160r2 (17) */
 339                 return 17;
 340         case NID_secp192k1: /* secp192k1 (18) */
 341                 return 18;
 342         case NID_X9_62_prime192v1: /* secp192r1 (19) */
 343                 return 19;
 344         case NID_secp224k1: /* secp224k1 (20) */
 345                 return 20;
 346         case NID_secp224r1: /* secp224r1 (21) */
 347                 return 21;
 348         case NID_secp256k1: /* secp256k1 (22) */
 349                 return 22;
 350         case NID_X9_62_prime256v1: /* secp256r1 (23) */
 351                 return 23;
 352         case NID_secp384r1: /* secp384r1 (24) */
 353                 return 24;
 354         case NID_secp521r1:  /* secp521r1 (25) */
 355                 return 25;
 356         default:
 357                 return 0;
 358                 }
 359         }
 360 /* Get curves list, if "sess" is set return client curves otherwise
 361  * preferred list
 362  */
 363 static void tls1_get_curvelist(SSL *s, int sess,
 364                                         const unsigned char **pcurves,
 365                                         size_t *pcurveslen)
 366         {
 367         if (sess)
 368                 {
 369                 *pcurves = s->session->tlsext_ellipticcurvelist;
 370                 *pcurveslen = s->session->tlsext_ellipticcurvelist_length;
 371                 return;
 372                 }
 373         /* For Suite B mode only include P-256, P-384 */
 374         switch (tls1_suiteb(s))
 375                 {
 376         case SSL_CERT_FLAG_SUITEB_128_LOS:
 377                 *pcurves = suiteb_curves;
 378                 *pcurveslen = sizeof(suiteb_curves);
 379                 break;
 380
 381         case SSL_CERT_FLAG_SUITEB_128_LOS_ONLY:
 382                 *pcurves = suiteb_curves;
 383                 *pcurveslen = 2;
 384                 break;
 385
 386         case SSL_CERT_FLAG_SUITEB_192_LOS:
 387                 *pcurves = suiteb_curves + 2;
 388                 *pcurveslen = 2;
 389                 break;
 390         default:
 391                 *pcurves = s->tlsext_ellipticcurvelist;
 392                 *pcurveslen = s->tlsext_ellipticcurvelist_length;
 393                 }
 394         if (!*pcurves)
 395                 {
 396                 *pcurves = eccurves_default;
 397                 *pcurveslen = sizeof(eccurves_default);
 398                 }
 399         }
 400 /* Check a curve is one of our preferences */
 401 int tls1_check_curve(SSL *s, const unsigned char *p, size_t len)
 402         {
 403         const unsigned char *curves;
 404         size_t curveslen, i;
 405         unsigned int suiteb_flags = tls1_suiteb(s);
 406         if (len != 3 || p[0] != NAMED_CURVE_TYPE)
 407                 return 0;
 408         /* Check curve matches Suite B preferences */
 409         if (suiteb_flags)
 410                 {
 411                 unsigned long cid = s->s3->tmp.new_cipher->id;
 412                 if (p[1])
 413                         return 0;
 414                 if (cid == TLS1_CK_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256)
 415                         {
 416                         if (p[2] != TLSEXT_curve_P_256)
 417                                 return 0;
 418                         }
 419                 else if (cid == TLS1_CK_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384)
 420                         {
 421                         if (p[2] != TLSEXT_curve_P_384)
 422                                 return 0;
 423                         }
 424                 else    /* Should never happen */
 425                         return 0;
 426                 }
 427         tls1_get_curvelist(s, 0, &curves, &curveslen);
 428         for (i = 0; i < curveslen; i += 2, curves += 2)
 429                 {
 430                 if (p[1] == curves[0] && p[2] == curves[1])
 431                         return 1;
 432                 }
 433         return 0;
 434         }
 435
 436 /* Return nth shared curve. If nmatch == -1 return number of
 437  * matches. For nmatch == -2 return the NID of the curve to use for
 438  * an EC tmp key.
 439  */
 440
 441 int tls1_shared_curve(SSL *s, int nmatch)
 442         {
 443         const unsigned char *pref, *supp;
 444         size_t preflen, supplen, i, j;
 445         int k;
 446         /* Can't do anything on client side */
 447         if (s->server == 0)
 448                 return -1;
 449         if (nmatch == -2)
 450                 {
 451                 if (tls1_suiteb(s))
 452                         {
 453                         /* For Suite B ciphersuite determines curve: we
 454                          * already know these are acceptable due to previous
 455                          * checks.
 456                          */
 457                         unsigned long cid = s->s3->tmp.new_cipher->id;
 458                         if (cid == TLS1_CK_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256)
 459                                 return NID_X9_62_prime256v1; /* P-256 */
 460                         if (cid == TLS1_CK_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384)
 461                                 return NID_secp384r1; /* P-384 */
 462                         /* Should never happen */
 463                         return NID_undef;
 464                         }
 465                 /* If not Suite B just return first preference shared curve */
 466                 nmatch = 0;
 467                 }
 468         tls1_get_curvelist(s, !!(s->options & SSL_OP_CIPHER_SERVER_PREFERENCE),
 469                                 &supp, &supplen);
 470         tls1_get_curvelist(s, !(s->options & SSL_OP_CIPHER_SERVER_PREFERENCE),
 471                                 &pref, &preflen);
 472         preflen /= 2;
 473         supplen /= 2;
 474         k = 0;
 475         for (i = 0; i < preflen; i++, pref+=2)
 476                 {
 477                 const unsigned char *tsupp = supp;
 478                 for (j = 0; j < supplen; j++, tsupp+=2)
 479                         {
 480                         if (pref[0] == tsupp[0] && pref[1] == tsupp[1])
 481                                 {
 482                                 if (nmatch == k)
 483                                         {
 484                                         int id = (pref[0] << 8) | pref[1];
 485                                         return tls1_ec_curve_id2nid(id);
 486                                         }
 487                                 k++;
 488                                 }
 489                         }
 490                 }
 491         if (nmatch == -1)
 492                 return k;
 493         return 0;
 494         }
 495
 496 int tls1_set_curves(unsigned char **pext, size_t *pextlen,
 497                         int *curves, size_t ncurves)
 498         {
 499         unsigned char *clist, *p;
 500         size_t i;
 501         /* Bitmap of curves included to detect duplicates: only works
 502          * while curve ids < 32
 503          */
 504         unsigned long dup_list = 0;
 505         clist = OPENSSL_malloc(ncurves * 2);
 506         if (!clist)
 507                 return 0;
 508         for (i = 0, p = clist; i < ncurves; i++)
 509                 {
 510                 unsigned long idmask;
 511                 int id;
 512                 id = tls1_ec_nid2curve_id(curves[i]);
 513                 idmask = 1L << id;
 514                 if (!id || (dup_list & idmask))
 515                         {
 516                         OPENSSL_free(clist);
 517                         return 0;
 518                         }
 519                 dup_list |= idmask;
 520                 s2n(id, p);
 521                 }
 522         if (*pext)
 523                 OPENSSL_free(*pext);
 524         *pext = clist;
 525         *pextlen = ncurves * 2;
 526         return 1;
 527         }
 528
 529 #define MAX_CURVELIST   25
 530
 531 typedef struct
 532         {
 533         size_t nidcnt;
 534         int nid_arr[MAX_CURVELIST];
 535         } nid_cb_st;
 536
 537 static int nid_cb(const char *elem, int len, void *arg)
 538         {
 539         nid_cb_st *narg = arg;
 540         size_t i;
 541         int nid;
 542         char etmp[20];
 543         if (narg->nidcnt == MAX_CURVELIST)
 544                 return 0;
 545         if (len > (int)(sizeof(etmp) - 1))
 546                 return 0;
 547         memcpy(etmp, elem, len);
 548         etmp[len] = 0;
 549         nid = EC_curve_nist2nid(etmp);
 550         if (nid == NID_undef)
 551                 nid = OBJ_sn2nid(etmp);
 552         if (nid == NID_undef)
 553                 nid = OBJ_ln2nid(etmp);
 554         if (nid == NID_undef)
 555                 return 0;
 556         for (i = 0; i < narg->nidcnt; i++)
 557                 if (narg->nid_arr[i] == nid)
 558                         return 0;
 559         narg->nid_arr[narg->nidcnt++] = nid;
 560         return 1;
 561         }
 562 /* Set curves based on a colon separate list */
 563 int tls1_set_curves_list(unsigned char **pext, size_t *pextlen,
 564                                 const char *str)
 565         {
 566         nid_cb_st ncb;
 567         ncb.nidcnt = 0;
 568         if (!CONF_parse_list(str, ':', 1, nid_cb, &ncb))
 569                 return 0;
 570         if (pext == NULL)
 571                 return 1;
 572         return tls1_set_curves(pext, pextlen, ncb.nid_arr, ncb.nidcnt);
 573         }
 574 /* For an EC key set TLS id and required compression based on parameters */
 575 static int tls1_set_ec_id(unsigned char *curve_id, unsigned char *comp_id,
 576                                 EC_KEY *ec)
 577         {
 578         int is_prime, id;
 579         const EC_GROUP *grp;
 580         const EC_POINT *pt;
 581         const EC_METHOD *meth;
 582         if (!ec)
 583                 return 0;
 584         /* Determine if it is a prime field */
 585         grp = EC_KEY_get0_group(ec);
 586         pt = EC_KEY_get0_public_key(ec);
 587         if (!grp || !pt)
 588                 return 0;
 589         meth = EC_GROUP_method_of(grp);
 590         if (!meth)
 591                 return 0;
 592         if (EC_METHOD_get_field_type(meth) == NID_X9_62_prime_field)
 593                 is_prime = 1;
 594         else
 595                 is_prime = 0;
 596         /* Determine curve ID */
 597         id = EC_GROUP_get_curve_name(grp);
 598         id = tls1_ec_nid2curve_id(id);
 599         /* If we have an ID set it, otherwise set arbitrary explicit curve */
 600         if (id)
 601                 {
 602                 curve_id[0] = 0;
 603                 curve_id[1] = (unsigned char)id;
 604                 }
 605         else
 606                 {
 607                 curve_id[0] = 0xff;
 608                 if (is_prime)
 609                         curve_id[1] = 0x01;
 610                 else
 611                         curve_id[1] = 0x02;
 612                 }
 613         if (comp_id)
 614                 {
 615                 if (EC_KEY_get_conv_form(ec) == POINT_CONVERSION_COMPRESSED)
 616                         {
 617                         if (is_prime)
 618                                 *comp_id = TLSEXT_ECPOINTFORMAT_ansiX962_compressed_prime;
 619                         else
 620                                 *comp_id = TLSEXT_ECPOINTFORMAT_ansiX962_compressed_char2;
 621                         }
 622                 else
 623                         *comp_id = TLSEXT_ECPOINTFORMAT_uncompressed;
 624                 }
 625         return 1;
 626         }
 627 /* Check an EC key is compatible with extensions */
 628 static int tls1_check_ec_key(SSL *s,
 629                         unsigned char *curve_id, unsigned char *comp_id)
 630         {
 631         const unsigned char *p;
 632         size_t plen, i;
 633         int j;
 634         /* If point formats extension present check it, otherwise everything
 635          * is supported (see RFC4492).
 636          */
 637         if (comp_id && s->session->tlsext_ecpointformatlist)
 638                 {
 639                 p = s->session->tlsext_ecpointformatlist;
 640                 plen = s->session->tlsext_ecpointformatlist_length;
 641                 for (i = 0; i < plen; i++, p++)
 642                         {
 643                         if (*comp_id == *p)
 644                                 break;
 645                         }
 646                 if (i == plen)
 647                         return 0;
 648                 }
 649         if (!curve_id)
 650                 return 1;
 651         /* Check curve is consistent with client and server preferences */
 652         for (j = 0; j <= 1; j++)
 653                 {
 654                 tls1_get_curvelist(s, j, &p, &plen);
 655                 for (i = 0; i < plen; i+=2, p+=2)
 656                         {
 657                         if (p[0] == curve_id[0] && p[1] == curve_id[1])
 658                                 break;
 659                         }
 660                 if (i == plen)
 661                         return 0;
 662                 /* For clients can only check sent curve list */
 663                 if (!s->server)
 664                         return 1;
 665                 }
 666         return 1;
 667         }
 668
 669 static void tls1_get_formatlist(SSL *s, const unsigned char **pformats,
 670                                         size_t *pformatslen)
 671         {
 672         /* If we have a custom point format list use it otherwise
 673          * use default */
 674         if (s->tlsext_ecpointformatlist)
 675                 {
 676                 *pformats = s->tlsext_ecpointformatlist;
 677                 *pformatslen = s->tlsext_ecpointformatlist_length;
 678                 }
 679         else
 680                 {
 681                 *pformats = ecformats_default;
 682                 /* For Suite B we don't support char2 fields */
 683                 if (tls1_suiteb(s))
 684                         *pformatslen = sizeof(ecformats_default) - 1;
 685                 else
 686                         *pformatslen = sizeof(ecformats_default);
 687                 }
 688         }
 689
 690 /* Check cert parameters compatible with extensions: currently just checks
 691  * EC certificates have compatible curves and compression.
 692  */
 693 static int tls1_check_cert_param(SSL *s, X509 *x, int set_ee_md)
 694         {
 695         unsigned char comp_id, curve_id[2];
 696         EVP_PKEY *pkey;
 697         int rv;
 698         pkey = X509_get_pubkey(x);
 699         if (!pkey)
 700                 return 0;
 701         /* If not EC nothing to do */
 702         if (pkey->type != EVP_PKEY_EC)
 703                 {
 704                 EVP_PKEY_free(pkey);
 705                 return 1;
 706                 }
 707         rv = tls1_set_ec_id(curve_id, &comp_id, pkey->pkey.ec);
 708         EVP_PKEY_free(pkey);
 709         if (!rv)
 710                 return 0;
 711         /* Can't check curve_id for client certs as we don't have a
 712          * supported curves extension.
 713          */
 714         rv = tls1_check_ec_key(s, s->server ? curve_id : NULL, &comp_id);
 715         if (!rv)
 716                 return 0;
 717         /* Special case for suite B. We *MUST* sign using SHA256+P-256 or
 718          * SHA384+P-384, adjust digest if necessary.
 719          */
 720         if (set_ee_md && tls1_suiteb(s))
 721                 {
 722                 int check_md;
 723                 size_t i;
 724                 CERT *c = s->cert;
 725                 if (curve_id[0])
 726                         return 0;
 727                 /* Check to see we have necessary signing algorithm */
 728                 if (curve_id[1] == TLSEXT_curve_P_256)
 729                         check_md = NID_ecdsa_with_SHA256;
 730                 else if (curve_id[1] == TLSEXT_curve_P_384)
 731                         check_md = NID_ecdsa_with_SHA384;
 732                 else
 733                         return 0; /* Should never happen */
 734                 for (i = 0; i < c->shared_sigalgslen; i++)
 735                         if (check_md == c->shared_sigalgs[i].signandhash_nid)
 736                                 break;
 737                 if (i == c->shared_sigalgslen)
 738                         return 0;
 739                 if (set_ee_md == 2)
 740                         {
 741                         if (check_md == NID_ecdsa_with_SHA256)
 742                                 c->pkeys[SSL_PKEY_ECC].digest = EVP_sha256();
 743                         else
 744                                 c->pkeys[SSL_PKEY_ECC].digest = EVP_sha384();
 745                         }
 746                 }
 747         return rv;
 748         }
 749 /* Check EC temporary key is compatible with client extensions */
 750 int tls1_check_ec_tmp_key(SSL *s, unsigned long cid)
 751         {
 752         unsigned char curve_id[2];
 753         EC_KEY *ec = s->cert->ecdh_tmp;
 754 #ifdef OPENSSL_SSL_DEBUG_BROKEN_PROTOCOL
 755         /* Allow any curve: not just those peer supports */
 756         if (s->cert->cert_flags & SSL_CERT_FLAG_BROKEN_PROTOCOL)
 757                 return 1;
 758 #endif
 759         /* If Suite B, AES128 MUST use P-256 and AES256 MUST use P-384,
 760          * no other curves permitted.
 761          */
 762         if (tls1_suiteb(s))
 763                 {
 764                 /* Curve to check determined by ciphersuite */
 765                 if (cid == TLS1_CK_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256)
 766                         curve_id[1] = TLSEXT_curve_P_256;
 767                 else if (cid == TLS1_CK_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384)
 768                         curve_id[1] = TLSEXT_curve_P_384;
 769                 else
 770                         return 0;
 771                 curve_id[0] = 0;
 772                 /* Check this curve is acceptable */
 773                 if (!tls1_check_ec_key(s, curve_id, NULL))
 774                         return 0;
 775                 /* If auto or setting curve from callback assume OK */
 776                 if (s->cert->ecdh_tmp_auto || s->cert->ecdh_tmp_cb)
 777                         return 1;
 778                 /* Otherwise check curve is acceptable */
 779                 else
 780                         {
 781                         unsigned char curve_tmp[2];
 782                         if (!ec)
 783                                 return 0;
 784                         if (!tls1_set_ec_id(curve_tmp, NULL, ec))
 785                                 return 0;
 786                         if (!curve_tmp[0] || curve_tmp[1] == curve_id[1])
 787                                 return 1;
 788                         return 0;
 789                         }
 790
 791                 }
 792         if (s->cert->ecdh_tmp_auto)
 793                 {
 794                 /* Need a shared curve */
 795                 if (tls1_shared_curve(s, 0))
 796                         return 1;
 797                 else return 0;
 798                 }
 799         if (!ec)
 800                 {
 801                 if (s->cert->ecdh_tmp_cb)
 802                         return 1;
 803                 else
 804                         return 0;
 805                 }
 806         if (!tls1_set_ec_id(curve_id, NULL, ec))
 807                 return 0;
 808 /* Set this to allow use of invalid curves for testing */
 809 #if 0
 810         return 1;
 811 #else
 812         return tls1_check_ec_key(s, curve_id, NULL);
 813 #endif
 814         }
 815
 816 #else
 817
 818 static int tls1_check_cert_param(SSL *s, X509 *x, int set_ee_md)
 819         {
 820         return 1;
 821         }
 822
 823 #endif /* OPENSSL_NO_EC */
 824
 825 #ifndef OPENSSL_NO_TLSEXT
 826
 827 /* List of supported signature algorithms and hashes. Should make this
 828  * customisable at some point, for now include everything we support.
 829  */
 830
 831 #ifdef OPENSSL_NO_RSA
 832 #define tlsext_sigalg_rsa(md) /* */
 833 #else
 834 #define tlsext_sigalg_rsa(md) md, TLSEXT_signature_rsa,
 835 #endif
 836
 837 #ifdef OPENSSL_NO_DSA
 838 #define tlsext_sigalg_dsa(md) /* */
 839 #else
 840 #define tlsext_sigalg_dsa(md) md, TLSEXT_signature_dsa,
 841 #endif
 842
 843 #ifdef OPENSSL_NO_ECDSA
 844 #define tlsext_sigalg_ecdsa(md) /* */
 845 #else
 846 #define tlsext_sigalg_ecdsa(md) md, TLSEXT_signature_ecdsa,
 847 #endif
 848
 849 #define tlsext_sigalg(md) \
 850                 tlsext_sigalg_rsa(md) \
 851                 tlsext_sigalg_dsa(md) \
 852                 tlsext_sigalg_ecdsa(md)
 853
 854 static unsigned char tls12_sigalgs[] = {
 855 #ifndef OPENSSL_NO_SHA512
 856         tlsext_sigalg(TLSEXT_hash_sha512)
 857         tlsext_sigalg(TLSEXT_hash_sha384)
 858 #endif
 859 #ifndef OPENSSL_NO_SHA256
 860         tlsext_sigalg(TLSEXT_hash_sha256)
 861         tlsext_sigalg(TLSEXT_hash_sha224)
 862 #endif
 863 #ifndef OPENSSL_NO_SHA
 864         tlsext_sigalg(TLSEXT_hash_sha1)
 865 #endif
 866 #ifndef OPENSSL_NO_MD5
 867         tlsext_sigalg_rsa(TLSEXT_hash_md5)
 868 #endif
 869 };
 870 #ifndef OPENSSL_NO_ECDSA
 871 static unsigned char suiteb_sigalgs[] = {
 872         tlsext_sigalg_ecdsa(TLSEXT_hash_sha256)
 873         tlsext_sigalg_ecdsa(TLSEXT_hash_sha384)
 874 };
 875 #endif
 876 size_t tls12_get_psigalgs(SSL *s, const unsigned char **psigs)
 877         {
 878         /* If Suite B mode use Suite B sigalgs only, ignore any other
 879          * preferences.
 880          */
 881 #ifndef OPENSSL_NO_EC
 882         switch (tls1_suiteb(s))
 883                 {
 884         case SSL_CERT_FLAG_SUITEB_128_LOS:
 885                 *psigs = suiteb_sigalgs;
 886                 return sizeof(suiteb_sigalgs);
 887
 888         case SSL_CERT_FLAG_SUITEB_128_LOS_ONLY:
 889                 *psigs = suiteb_sigalgs;
 890                 return 2;
 891
 892         case SSL_CERT_FLAG_SUITEB_192_LOS:
 893                 *psigs = suiteb_sigalgs + 2;
 894                 return 2;
 895                 }
 896 #endif
 897         /* If server use client authentication sigalgs if not NULL */
 898         if (s->server && s->cert->client_sigalgs)
 899                 {
 900                 *psigs = s->cert->client_sigalgs;
 901                 return s->cert->client_sigalgslen;
 902                 }
 903         else if (s->cert->conf_sigalgs)
 904                 {
 905                 *psigs = s->cert->conf_sigalgs;
 906                 return s->cert->conf_sigalgslen;
 907                 }
 908         else
 909                 {
 910                 *psigs = tls12_sigalgs;
 911 #ifdef OPENSSL_FIPS
 912                 /* If FIPS mode don't include MD5 which is last */
 913                 if (FIPS_mode())
 914                         return sizeof(tls12_sigalgs) - 2;
 915                 else
 916 #endif
 917                         return sizeof(tls12_sigalgs);
 918                 }
 919         }
 920 /* Check signature algorithm is consistent with sent supported signature
 921  * algorithms and if so return relevant digest.
 922  */
 923 int tls12_check_peer_sigalg(const EVP_MD **pmd, SSL *s,
 924                                 const unsigned char *sig, EVP_PKEY *pkey)
 925         {
 926         const unsigned char *sent_sigs;
 927         size_t sent_sigslen, i;
 928         int sigalg = tls12_get_sigid(pkey);
 929         /* Should never happen */
 930         if (sigalg == -1)
 931                 return -1;
 932         /* Check key type is consistent with signature */
 933         if (sigalg != (int)sig[1])
 934                 {
 935                 SSLerr(SSL_F_TLS12_CHECK_PEER_SIGALG,SSL_R_WRONG_SIGNATURE_TYPE);
 936                 return 0;
 937                 }
 938 #ifndef OPENSSL_NO_EC
 939         if (pkey->type == EVP_PKEY_EC)
 940                 {
 941                 unsigned char curve_id[2], comp_id;
 942                 /* Check compression and curve matches extensions */
 943                 if (!tls1_set_ec_id(curve_id, &comp_id, pkey->pkey.ec))
 944                         return 0;
 945                 if (!s->server && !tls1_check_ec_key(s, curve_id, &comp_id))
 946                         {
 947                         SSLerr(SSL_F_TLS12_CHECK_PEER_SIGALG,SSL_R_WRONG_CURVE);
 948                         return 0;
 949                         }
 950                 /* If Suite B only P-384+SHA384 or P-256+SHA-256 allowed */
 951                 if (tls1_suiteb(s))
 952                         {
 953                         if (curve_id[0])
 954                                 return 0;
 955                         if (curve_id[1] == TLSEXT_curve_P_256)
 956                                 {
 957                                 if (sig[0] != TLSEXT_hash_sha256)
 958                                         {
 959                                         SSLerr(SSL_F_TLS12_CHECK_PEER_SIGALG,
 960                                                 SSL_R_ILLEGAL_SUITEB_DIGEST);
 961                                         return 0;
 962                                         }
 963                                 }
 964                         else if (curve_id[1] == TLSEXT_curve_P_384)
 965                                 {
 966                                 if (sig[0] != TLSEXT_hash_sha384)
 967                                         {
 968                                         SSLerr(SSL_F_TLS12_CHECK_PEER_SIGALG,
 969                                                 SSL_R_ILLEGAL_SUITEB_DIGEST);
 970                                         return 0;
 971                                         }
 972                                 }
 973                         else
 974                                 return 0;
 975                         }
 976                 }
 977         else if (tls1_suiteb(s))
 978                 return 0;
 979 #endif
 980
 981         /* Check signature matches a type we sent */
 982         sent_sigslen = tls12_get_psigalgs(s, &sent_sigs);
 983         for (i = 0; i < sent_sigslen; i+=2, sent_sigs+=2)
 984                 {
 985                 if (sig[0] == sent_sigs[0] && sig[1] == sent_sigs[1])
 986                         break;
 987                 }
 988         /* Allow fallback to SHA1 if not strict mode */
 989         if (i == sent_sigslen && (sig[0] != TLSEXT_hash_sha1 || s->cert->cert_flags & SSL_CERT_FLAGS_CHECK_TLS_STRICT))
 990                 {
 991                 SSLerr(SSL_F_TLS12_CHECK_PEER_SIGALG,SSL_R_WRONG_SIGNATURE_TYPE);
 992                 return 0;
 993                 }
 994         *pmd = tls12_get_hash(sig[0]);
 995         if (*pmd == NULL)
 996                 {
 997                 SSLerr(SSL_F_TLS12_CHECK_PEER_SIGALG,SSL_R_UNKNOWN_DIGEST);
 998                 return 0;
 999                 }
1000         /* Store the digest used so applications can retrieve it if they
1001          * wish.
1002          */
1003         if (s->session && s->session->sess_cert)
1004                 s->session->sess_cert->peer_key->digest = *pmd;
1005         return 1;
1006         }
1007 /* Get a mask of disabled algorithms: an algorithm is disabled
1008  * if it isn't supported or doesn't appear in supported signature
1009  * algorithms. Unlike ssl_cipher_get_disabled this applies to a specific
1010  * session and not global settings.
1011  *
1012  */
1013 void ssl_set_client_disabled(SSL *s)
1014         {
1015         CERT *c = s->cert;
1016         const unsigned char *sigalgs;
1017         size_t i, sigalgslen;
1018         int have_rsa = 0, have_dsa = 0, have_ecdsa = 0;
1019         c->mask_a = 0;
1020         c->mask_k = 0;
1021         /* If less than TLS 1.2 don't allow TLS 1.2 only ciphers */
1022         if (TLS1_get_client_version(s) < TLS1_2_VERSION)
1023                 c->mask_ssl = SSL_TLSV1_2;
1024         else
1025                 c->mask_ssl = 0;
1026         /* Now go through all signature algorithms seeing if we support
1027          * any for RSA, DSA, ECDSA. Do this for all versions not just
1028          * TLS 1.2.
1029          */
1030         sigalgslen = tls12_get_psigalgs(s, &sigalgs);
1031         for (i = 0; i < sigalgslen; i += 2, sigalgs += 2)
1032                 {
1033                 switch(sigalgs[1])
1034                         {
1035 #ifndef OPENSSL_NO_RSA
1036                 case TLSEXT_signature_rsa:
1037                         have_rsa = 1;
1038                         break;
1039 #endif
1040 #ifndef OPENSSL_NO_DSA
1041                 case TLSEXT_signature_dsa:
1042                         have_dsa = 1;
1043                         break;
1044 #endif
1045 #ifndef OPENSSL_NO_ECDSA
1046                 case TLSEXT_signature_ecdsa:
1047                         have_ecdsa = 1;
1048                         break;
1049 #endif
1050                         }
1051                 }
1052         /* Disable auth and static DH if we don't include any appropriate
1053          * signature algorithms.
1054          */
1055         if (!have_rsa)
1056                 {
1057                 c->mask_a |= SSL_aRSA;
1058                 c->mask_k |= SSL_kDHr|SSL_kECDHr;
1059                 }
1060         if (!have_dsa)
1061                 {
1062                 c->mask_a |= SSL_aDSS;
1063                 c->mask_k |= SSL_kDHd;
1064                 }
1065         if (!have_ecdsa)
1066                 {
1067                 c->mask_a |= SSL_aECDSA;
1068                 c->mask_k |= SSL_kECDHe;
1069                 }
1070 #ifndef OPENSSL_NO_KRB5
1071         if (!kssl_tgt_is_available(s->kssl_ctx))
1072                 {
1073                 c->mask_a |= SSL_aKRB5;
1074                 c->mask_k |= SSL_kKRB5;
1075                 }
1076 #endif
1077 #ifndef OPENSSL_NO_PSK
1078         /* with PSK there must be client callback set */
1079         if (!s->psk_client_callback)
1080                 {
1081                 c->mask_a |= SSL_aPSK;
1082                 c->mask_k |= SSL_kPSK;
1083                 }
1084 #endif /* OPENSSL_NO_PSK */
1085         c->valid = 1;
1086         }
1087
1088 /* byte_compare is a compare function for qsort(3) that compares bytes. */
1089 static int byte_compare(const void *in_a, const void *in_b)
1090         {
1091         unsigned char a = *((const unsigned char*) in_a);
1092         unsigned char b = *((const unsigned char*) in_b);
1093
1094         if (a > b)
1095                 return 1;
1096         else if (a < b)
1097                 return -1;
1098         return 0;
1099 }
1100
1101 unsigned char *ssl_add_clienthello_tlsext(SSL *s, unsigned char *p, unsigned char *limit)
1102         {
1103         int extdatalen=0;
1104         unsigned char *ret = p;
1105 #ifndef OPENSSL_NO_EC
1106         /* See if we support any ECC ciphersuites */
1107         int using_ecc = 0;
1108         if (s->version != DTLS1_VERSION && s->version >= TLS1_VERSION)
1109                 {
1110                 int i;
1111                 unsigned long alg_k, alg_a;
1112                 STACK_OF(SSL_CIPHER) *cipher_stack = SSL_get_ciphers(s);
1113
1114                 for (i = 0; i < sk_SSL_CIPHER_num(cipher_stack); i++)
1115                         {
1116                         SSL_CIPHER *c = sk_SSL_CIPHER_value(cipher_stack, i);
1117
1118                         alg_k = c->algorithm_mkey;
1119                         alg_a = c->algorithm_auth;
1120                         if ((alg_k & (SSL_kEECDH|SSL_kECDHr|SSL_kECDHe)
1121                                 || (alg_a & SSL_aECDSA)))
1122                                 {
1123                                 using_ecc = 1;
1124                                 break;
1125                                 }
1126                         }
1127                 }
1128 #endif
1129
1130         /* don't add extensions for SSLv3 unless doing secure renegotiation */
1131         if (s->client_version == SSL3_VERSION
1132                                         && !s->s3->send_connection_binding)
1133                 return p;
1134
1135         ret+=2;
1136
1137         if (ret>=limit) return NULL; /* this really never occurs, but ... */
1138
1139         if (s->tlsext_hostname != NULL)
1140                 {
1141                 /* Add TLS extension servername to the Client Hello message */
1142                 unsigned long size_str;
1143                 long lenmax;
1144
1145                 /* check for enough space.
1146                    4 for the servername type and entension length
1147                    2 for servernamelist length
1148                    1 for the hostname type
1149                    2 for hostname length
1150                    + hostname length
1151                 */
1152
1153                 if ((lenmax = limit - ret - 9) < 0
1154                     || (size_str = strlen(s->tlsext_hostname)) > (unsigned long)lenmax)
1155                         return NULL;
1156
1157                 /* extension type and length */
1158                 s2n(TLSEXT_TYPE_server_name,ret);
1159                 s2n(size_str+5,ret);
1160
1161                 /* length of servername list */
1162                 s2n(size_str+3,ret);
1163
1164                 /* hostname type, length and hostname */
1165                 *(ret++) = (unsigned char) TLSEXT_NAMETYPE_host_name;
1166                 s2n(size_str,ret);
1167                 memcpy(ret, s->tlsext_hostname, size_str);
1168                 ret+=size_str;
1169                 }
1170
1171         /* Add RI if renegotiating */
1172         if (s->renegotiate)
1173           {
1174           int el;
1175
1176           if(!ssl_add_clienthello_renegotiate_ext(s, 0, &el, 0))
1177               {
1178               SSLerr(SSL_F_SSL_ADD_CLIENTHELLO_TLSEXT, ERR_R_INTERNAL_ERROR);
1179               return NULL;
1180               }
1181
1182           if((limit - p - 4 - el) < 0) return NULL;
1183
1184           s2n(TLSEXT_TYPE_renegotiate,ret);
1185           s2n(el,ret);
1186
1187           if(!ssl_add_clienthello_renegotiate_ext(s, ret, &el, el))
1188               {
1189               SSLerr(SSL_F_SSL_ADD_CLIENTHELLO_TLSEXT, ERR_R_INTERNAL_ERROR);
1190               return NULL;
1191               }
1192
1193           ret += el;
1194         }
1195
1196 #ifndef OPENSSL_NO_SRP
1197         /* Add SRP username if there is one */
1198         if (s->srp_ctx.login != NULL)
1199                 { /* Add TLS extension SRP username to the Client Hello message */
1200
1201                 int login_len = strlen(s->srp_ctx.login);
1202                 if (login_len > 255 || login_len == 0)
1203                         {
1204                         SSLerr(SSL_F_SSL_ADD_CLIENTHELLO_TLSEXT, ERR_R_INTERNAL_ERROR);
1205                         return NULL;
1206                         }
1207
1208                 /* check for enough space.
1209                    4 for the srp type type and entension length
1210                    1 for the srp user identity
1211                    + srp user identity length
1212                 */
1213                 if ((limit - ret - 5 - login_len) < 0) return NULL;
1214
1215                 /* fill in the extension */
1216                 s2n(TLSEXT_TYPE_srp,ret);
1217                 s2n(login_len+1,ret);
1218                 (*ret++) = (unsigned char) login_len;
1219                 memcpy(ret, s->srp_ctx.login, login_len);
1220                 ret+=login_len;
1221                 }
1222 #endif
1223
1224 #ifndef OPENSSL_NO_EC
1225         if (using_ecc)
1226                 {
1227                 /* Add TLS extension ECPointFormats to the ClientHello message */
1228                 long lenmax;
1229                 const unsigned char *plist;
1230                 size_t plistlen;
1231
1232                 tls1_get_formatlist(s, &plist, &plistlen);
1233
1234                 if ((lenmax = limit - ret - 5) < 0) return NULL;
1235                 if (plistlen > (size_t)lenmax) return NULL;
1236                 if (plistlen > 255)
1237                         {
1238                         SSLerr(SSL_F_SSL_ADD_CLIENTHELLO_TLSEXT, ERR_R_INTERNAL_ERROR);
1239                         return NULL;
1240                         }
1241
1242                 s2n(TLSEXT_TYPE_ec_point_formats,ret);
1243                 s2n(plistlen + 1,ret);
1244                 *(ret++) = (unsigned char)plistlen ;
1245                 memcpy(ret, plist, plistlen);
1246                 ret+=plistlen;
1247
1248                 /* Add TLS extension EllipticCurves to the ClientHello message */
1249                 plist = s->tlsext_ellipticcurvelist;
1250                 tls1_get_curvelist(s, 0, &plist, &plistlen);
1251
1252                 if ((lenmax = limit - ret - 6) < 0) return NULL;
1253                 if (plistlen > (size_t)lenmax) return NULL;
1254                 if (plistlen > 65532)
1255                         {
1256                         SSLerr(SSL_F_SSL_ADD_CLIENTHELLO_TLSEXT, ERR_R_INTERNAL_ERROR);
1257                         return NULL;
1258                         }
1259
1260                 s2n(TLSEXT_TYPE_elliptic_curves,ret);
1261                 s2n(plistlen + 2, ret);
1262
1263                 /* NB: draft-ietf-tls-ecc-12.txt uses a one-byte prefix for
1264                  * elliptic_curve_list, but the examples use two bytes.
1265                  * http://www1.ietf.org/mail-archive/web/tls/current/msg00538.html
1266                  * resolves this to two bytes.
1267                  */
1268                 s2n(plistlen, ret);
1269                 memcpy(ret, plist, plistlen);
1270                 ret+=plistlen;
1271                 }
1272 #endif /* OPENSSL_NO_EC */
1273
1274         if (!(SSL_get_options(s) & SSL_OP_NO_TICKET))
1275                 {
1276                 int ticklen;
1277                 if (!s->new_session && s->session && s->session->tlsext_tick)
1278                         ticklen = s->session->tlsext_ticklen;
1279                 else if (s->session && s->tlsext_session_ticket &&
1280                          s->tlsext_session_ticket->data)
1281                         {
1282                         ticklen = s->tlsext_session_ticket->length;
1283                         s->session->tlsext_tick = OPENSSL_malloc(ticklen);
1284                         if (!s->session->tlsext_tick)
1285                                 return NULL;
1286                         memcpy(s->session->tlsext_tick,
1287                                s->tlsext_session_ticket->data,
1288                                ticklen);
1289                         s->session->tlsext_ticklen = ticklen;
1290                         }
1291                 else
1292                         ticklen = 0;
1293                 if (ticklen == 0 && s->tlsext_session_ticket &&
1294                     s->tlsext_session_ticket->data == NULL)
1295                         goto skip_ext;
1296                 /* Check for enough room 2 for extension type, 2 for len
1297                  * rest for ticket
1298                  */
1299                 if ((long)(limit - ret - 4 - ticklen) < 0) return NULL;
1300                 s2n(TLSEXT_TYPE_session_ticket,ret);
1301                 s2n(ticklen,ret);
1302                 if (ticklen)
1303                         {
1304                         memcpy(ret, s->session->tlsext_tick, ticklen);
1305                         ret += ticklen;
1306                         }
1307                 }
1308                 skip_ext:
1309
1310         if (SSL_USE_SIGALGS(s))
1311                 {
1312                 size_t salglen;
1313                 const unsigned char *salg;
1314                 salglen = tls12_get_psigalgs(s, &salg);
1315                 if ((size_t)(limit - ret) < salglen + 6)
1316                         return NULL;
1317                 s2n(TLSEXT_TYPE_signature_algorithms,ret);
1318                 s2n(salglen + 2, ret);
1319                 s2n(salglen, ret);
1320                 memcpy(ret, salg, salglen);
1321                 ret += salglen;
1322                 }
1323
1324 #ifdef TLSEXT_TYPE_opaque_prf_input
1325         if (s->s3->client_opaque_prf_input != NULL &&
1326             s->version != DTLS1_VERSION)
1327                 {
1328                 size_t col = s->s3->client_opaque_prf_input_len;
1329
1330                 if ((long)(limit - ret - 6 - col < 0))
1331                         return NULL;
1332                 if (col > 0xFFFD) /* can't happen */
1333                         return NULL;
1334
1335                 s2n(TLSEXT_TYPE_opaque_prf_input, ret);
1336                 s2n(col + 2, ret);
1337                 s2n(col, ret);
1338                 memcpy(ret, s->s3->client_opaque_prf_input, col);
1339                 ret += col;
1340                 }
1341 #endif
1342
1343         if (s->tlsext_status_type == TLSEXT_STATUSTYPE_ocsp &&
1344             s->version != DTLS1_VERSION)
1345                 {
1346                 int i;
1347                 long extlen, idlen, itmp;
1348                 OCSP_RESPID *id;
1349
1350                 idlen = 0;
1351                 for (i = 0; i < sk_OCSP_RESPID_num(s->tlsext_ocsp_ids); i++)
1352                         {
1353                         id = sk_OCSP_RESPID_value(s->tlsext_ocsp_ids, i);
1354                         itmp = i2d_OCSP_RESPID(id, NULL);
1355                         if (itmp <= 0)
1356                                 return NULL;
1357                         idlen += itmp + 2;
1358                         }
1359
1360                 if (s->tlsext_ocsp_exts)
1361                         {
1362                         extlen = i2d_X509_EXTENSIONS(s->tlsext_ocsp_exts, NULL);
1363                         if (extlen < 0)
1364                                 return NULL;
1365                         }
1366                 else
1367                         extlen = 0;
1368
1369                 if ((long)(limit - ret - 7 - extlen - idlen) < 0) return NULL;
1370                 s2n(TLSEXT_TYPE_status_request, ret);
1371                 if (extlen + idlen > 0xFFF0)
1372                         return NULL;
1373                 s2n(extlen + idlen + 5, ret);
1374                 *(ret++) = TLSEXT_STATUSTYPE_ocsp;
1375                 s2n(idlen, ret);
1376                 for (i = 0; i < sk_OCSP_RESPID_num(s->tlsext_ocsp_ids); i++)
1377                         {
1378                         /* save position of id len */
1379                         unsigned char *q = ret;
1380                         id = sk_OCSP_RESPID_value(s->tlsext_ocsp_ids, i);
1381                         /* skip over id len */
1382                         ret += 2;
1383                         itmp = i2d_OCSP_RESPID(id, &ret);
1384                         /* write id len */
1385                         s2n(itmp, q);
1386                         }
1387                 s2n(extlen, ret);
1388                 if (extlen > 0)
1389                         i2d_X509_EXTENSIONS(s->tlsext_ocsp_exts, &ret);
1390                 }
1391
1392 #ifndef OPENSSL_NO_HEARTBEATS
1393         /* Add Heartbeat extension */
1394         s2n(TLSEXT_TYPE_heartbeat,ret);
1395         s2n(1,ret);
1396         /* Set mode:
1397          * 1: peer may send requests
1398          * 2: peer not allowed to send requests
1399          */
1400         if (s->tlsext_heartbeat & SSL_TLSEXT_HB_DONT_RECV_REQUESTS)
1401                 *(ret++) = SSL_TLSEXT_HB_DONT_SEND_REQUESTS;
1402         else
1403                 *(ret++) = SSL_TLSEXT_HB_ENABLED;
1404 #endif
1405
1406 #ifndef OPENSSL_NO_NEXTPROTONEG
1407         if (s->ctx->next_proto_select_cb && !s->s3->tmp.finish_md_len)
1408                 {
1409                 /* The client advertises an emtpy extension to indicate its
1410                  * support for Next Protocol Negotiation */
1411                 if (limit - ret - 4 < 0)
1412                         return NULL;
1413                 s2n(TLSEXT_TYPE_next_proto_neg,ret);
1414                 s2n(0,ret);
1415                 }
1416 #endif
1417
1418         if(SSL_get_srtp_profiles(s))
1419                 {
1420                 int el;
1421
1422                 ssl_add_clienthello_use_srtp_ext(s, 0, &el, 0);
1423
1424                 if((limit - p - 4 - el) < 0) return NULL;
1425
1426                 s2n(TLSEXT_TYPE_use_srtp,ret);
1427                 s2n(el,ret);
1428
1429                 if(ssl_add_clienthello_use_srtp_ext(s, ret, &el, el))
1430                         {
1431                         SSLerr(SSL_F_SSL_ADD_CLIENTHELLO_TLSEXT, ERR_R_INTERNAL_ERROR);
1432                         return NULL;
1433                         }
1434                 ret += el;
1435                 }
1436
1437         /* Add TLS extension Server_Authz_DataFormats to the ClientHello */
1438         /* 2 bytes for extension type */
1439         /* 2 bytes for extension length */
1440         /* 1 byte for the list length */
1441         /* 1 byte for the list (we only support audit proofs) */
1442         if (s->ctx->tlsext_authz_server_audit_proof_cb != NULL)
1443                 {
1444                 const unsigned short ext_len = 2;
1445                 const unsigned char list_len = 1;
1446
1447                 if (limit < ret + 6)
1448                         return NULL;
1449
1450                 s2n(TLSEXT_TYPE_server_authz, ret);
1451                 /* Extension length: 2 bytes */
1452                 s2n(ext_len, ret);
1453                 *(ret++) = list_len;
1454                 *(ret++) = TLSEXT_AUTHZDATAFORMAT_audit_proof;
1455                 }
1456
1457         /* Add custom TLS Extensions to ClientHello */
1458         if (s->ctx->custom_cli_ext_records_count)
1459                 {
1460                 size_t i;
1461                 custom_cli_ext_record* record;
1462
1463                 for (i = 0; i < s->ctx->custom_cli_ext_records_count; i++)
1464                         {
1465                         const unsigned char* out = NULL;
1466                         unsigned short outlen = 0;
1467
1468                         record = &s->ctx->custom_cli_ext_records[i];
1469                         /* NULL callback sends empty extension */
1470                         /* -1 from callback omits extension */
1471                         if (record->fn1)
1472                                 {
1473                                 int cb_retval = 0;
1474                                 cb_retval = record->fn1(s, record->ext_type,
1475                                                         &out, &outlen,
1476                                                         record->arg);
1477                                 if (cb_retval == 0)
1478                                         return NULL; /* error */
1479                                 if (cb_retval == -1)
1480                                         continue; /* skip this extension */
1481                                 }
1482                         if (limit < ret + 4 + outlen)
1483                                 return NULL;
1484                         s2n(record->ext_type, ret);
1485                         s2n(outlen, ret);
1486                         memcpy(ret, out, outlen);
1487                         ret += outlen;
1488                         }
1489                 }
1490
1491         if ((extdatalen = ret-p-2) == 0)
1492                 return p;
1493
1494         s2n(extdatalen,p);
1495         return ret;
1496         }
1497
1498 unsigned char *ssl_add_serverhello_tlsext(SSL *s, unsigned char *p, unsigned char *limit)
1499         {
1500         int extdatalen=0;
1501         unsigned char *ret = p;
1502 #ifndef OPENSSL_NO_NEXTPROTONEG
1503         int next_proto_neg_seen;
1504 #endif
1505 #ifndef OPENSSL_NO_EC
1506         unsigned long alg_k = s->s3->tmp.new_cipher->algorithm_mkey;
1507         unsigned long alg_a = s->s3->tmp.new_cipher->algorithm_auth;
1508         int using_ecc = (alg_k & (SSL_kEECDH|SSL_kECDHr|SSL_kECDHe)) || (alg_a & SSL_aECDSA);
1509         using_ecc = using_ecc && (s->session->tlsext_ecpointformatlist != NULL);
1510 #endif
1511         /* don't add extensions for SSLv3, unless doing secure renegotiation */
1512         if (s->version == SSL3_VERSION && !s->s3->send_connection_binding)
1513                 return p;
1514
1515         ret+=2;
1516         if (ret>=limit) return NULL; /* this really never occurs, but ... */
1517
1518         if (!s->hit && s->servername_done == 1 && s->session->tlsext_hostname != NULL)
1519                 {
1520                 if ((long)(limit - ret - 4) < 0) return NULL;
1521
1522                 s2n(TLSEXT_TYPE_server_name,ret);
1523                 s2n(0,ret);
1524                 }
1525
1526         if(s->s3->send_connection_binding)
1527         {
1528           int el;
1529
1530           if(!ssl_add_serverhello_renegotiate_ext(s, 0, &el, 0))
1531               {
1532               SSLerr(SSL_F_SSL_ADD_SERVERHELLO_TLSEXT, ERR_R_INTERNAL_ERROR);
1533               return NULL;
1534               }
1535
1536           if((limit - p - 4 - el) < 0) return NULL;
1537
1538           s2n(TLSEXT_TYPE_renegotiate,ret);
1539           s2n(el,ret);
1540
1541           if(!ssl_add_serverhello_renegotiate_ext(s, ret, &el, el))
1542               {
1543               SSLerr(SSL_F_SSL_ADD_SERVERHELLO_TLSEXT, ERR_R_INTERNAL_ERROR);
1544               return NULL;
1545               }
1546
1547           ret += el;
1548         }
1549
1550 #ifndef OPENSSL_NO_EC
1551         if (using_ecc && s->version != DTLS1_VERSION)
1552                 {
1553                 const unsigned char *plist;
1554                 size_t plistlen;
1555                 /* Add TLS extension ECPointFormats to the ServerHello message */
1556                 long lenmax;
1557
1558                 tls1_get_formatlist(s, &plist, &plistlen);
1559
1560                 if ((lenmax = limit - ret - 5) < 0) return NULL;
1561                 if (plistlen > (size_t)lenmax) return NULL;
1562                 if (plistlen > 255)
1563                         {
1564                         SSLerr(SSL_F_SSL_ADD_SERVERHELLO_TLSEXT, ERR_R_INTERNAL_ERROR);
1565                         return NULL;
1566                         }
1567
1568                 s2n(TLSEXT_TYPE_ec_point_formats,ret);
1569                 s2n(plistlen + 1,ret);
1570                 *(ret++) = (unsigned char) plistlen;
1571                 memcpy(ret, plist, plistlen);
1572                 ret+=plistlen;
1573
1574                 }
1575         /* Currently the server should not respond with a SupportedCurves extension */
1576 #endif /* OPENSSL_NO_EC */
1577
1578         if (s->tlsext_ticket_expected
1579                 && !(SSL_get_options(s) & SSL_OP_NO_TICKET))
1580                 {
1581                 if ((long)(limit - ret - 4) < 0) return NULL;
1582                 s2n(TLSEXT_TYPE_session_ticket,ret);
1583                 s2n(0,ret);
1584                 }
1585
1586         if (s->tlsext_status_expected)
1587                 {
1588                 if ((long)(limit - ret - 4) < 0) return NULL;
1589                 s2n(TLSEXT_TYPE_status_request,ret);
1590                 s2n(0,ret);
1591                 }
1592
1593 #ifdef TLSEXT_TYPE_opaque_prf_input
1594         if (s->s3->server_opaque_prf_input != NULL &&
1595             s->version != DTLS1_VERSION)
1596                 {
1597                 size_t sol = s->s3->server_opaque_prf_input_len;
1598
1599                 if ((long)(limit - ret - 6 - sol) < 0)
1600                         return NULL;
1601                 if (sol > 0xFFFD) /* can't happen */
1602                         return NULL;
1603
1604                 s2n(TLSEXT_TYPE_opaque_prf_input, ret);
1605                 s2n(sol + 2, ret);
1606                 s2n(sol, ret);
1607                 memcpy(ret, s->s3->server_opaque_prf_input, sol);
1608                 ret += sol;
1609                 }
1610 #endif
1611
1612         if(s->srtp_profile)
1613                 {
1614                 int el;
1615
1616                 ssl_add_serverhello_use_srtp_ext(s, 0, &el, 0);
1617
1618                 if((limit - p - 4 - el) < 0) return NULL;
1619
1620                 s2n(TLSEXT_TYPE_use_srtp,ret);
1621                 s2n(el,ret);
1622
1623                 if(ssl_add_serverhello_use_srtp_ext(s, ret, &el, el))
1624                         {
1625                         SSLerr(SSL_F_SSL_ADD_SERVERHELLO_TLSEXT, ERR_R_INTERNAL_ERROR);
1626                         return NULL;
1627                         }
1628                 ret+=el;
1629                 }
1630
1631         if (((s->s3->tmp.new_cipher->id & 0xFFFF)==0x80 || (s->s3->tmp.new_cipher->id & 0xFFFF)==0x81)
1632                 && (SSL_get_options(s) & SSL_OP_CRYPTOPRO_TLSEXT_BUG))
1633                 { const unsigned char cryptopro_ext[36] = {
1634                         0xfd, 0xe8, /*65000*/
1635                         0x00, 0x20, /*32 bytes length*/
1636                         0x30, 0x1e, 0x30, 0x08, 0x06, 0x06, 0x2a, 0x85,
1637                         0x03,   0x02, 0x02, 0x09, 0x30, 0x08, 0x06, 0x06,
1638                         0x2a, 0x85, 0x03, 0x02, 0x02, 0x16, 0x30, 0x08,
1639                         0x06, 0x06, 0x2a, 0x85, 0x03, 0x02, 0x02, 0x17};
1640                         if (limit-ret<36) return NULL;
1641                         memcpy(ret,cryptopro_ext,36);
1642                         ret+=36;
1643
1644                 }
1645
1646 #ifndef OPENSSL_NO_HEARTBEATS
1647         /* Add Heartbeat extension if we've received one */
1648         if (s->tlsext_heartbeat & SSL_TLSEXT_HB_ENABLED)
1649                 {
1650                 s2n(TLSEXT_TYPE_heartbeat,ret);
1651                 s2n(1,ret);
1652                 /* Set mode:
1653                  * 1: peer may send requests
1654                  * 2: peer not allowed to send requests
1655                  */
1656                 if (s->tlsext_heartbeat & SSL_TLSEXT_HB_DONT_RECV_REQUESTS)
1657                         *(ret++) = SSL_TLSEXT_HB_DONT_SEND_REQUESTS;
1658                 else
1659                         *(ret++) = SSL_TLSEXT_HB_ENABLED;
1660
1661                 }
1662 #endif
1663
1664 #ifndef OPENSSL_NO_NEXTPROTONEG
1665         next_proto_neg_seen = s->s3->next_proto_neg_seen;
1666         s->s3->next_proto_neg_seen = 0;
1667         if (next_proto_neg_seen && s->ctx->next_protos_advertised_cb)
1668                 {
1669                 const unsigned char *npa;
1670                 unsigned int npalen;
1671                 int r;
1672
1673                 r = s->ctx->next_protos_advertised_cb(s, &npa, &npalen, s->ctx->next_protos_advertised_cb_arg);
1674                 if (r == SSL_TLSEXT_ERR_OK)
1675                         {
1676                         if ((long)(limit - ret - 4 - npalen) < 0) return NULL;
1677                         s2n(TLSEXT_TYPE_next_proto_neg,ret);
1678                         s2n(npalen,ret);
1679                         memcpy(ret, npa, npalen);
1680                         ret += npalen;
1681                         s->s3->next_proto_neg_seen = 1;
1682                         }
1683                 }
1684 #endif
1685
1686         /* If the client supports authz then see whether we have any to offer
1687          * to it. */
1688         if (s->s3->tlsext_authz_client_types_len)
1689                 {
1690                 size_t authz_length;
1691                 /* By now we already know the new cipher, so we can look ahead
1692                  * to see whether the cert we are going to send
1693                  * has any authz data attached to it. */
1694                 const unsigned char* authz = ssl_get_authz_data(s, &authz_length);
1695                 const unsigned char* const orig_authz = authz;
1696                 size_t i;
1697                 unsigned authz_count = 0;
1698
1699                 /* The authz data contains a number of the following structures:
1700                  *      uint8_t authz_type
1701                  *      uint16_t length
1702                  *      uint8_t data[length]
1703                  *
1704                  * First we walk over it to find the number of authz elements. */
1705                 for (i = 0; i < authz_length; i++)
1706                         {
1707                         unsigned short length;
1708                         unsigned char type;
1709
1710                         type = *(authz++);
1711                         if (memchr(s->s3->tlsext_authz_client_types,
1712                                    type,
1713                                    s->s3->tlsext_authz_client_types_len) != NULL)
1714                                 authz_count++;
1715
1716                         n2s(authz, length);
1717                         /* n2s increments authz by 2 */
1718                         i += 2;
1719                         authz += length;
1720                         i += length;
1721                         }
1722
1723                 if (authz_count)
1724                         {
1725                         /* Add TLS extension server_authz to the ServerHello message
1726                          * 2 bytes for extension type
1727                          * 2 bytes for extension length
1728                          * 1 byte for the list length
1729                          * n bytes for the list */
1730                         const unsigned short ext_len = 1 + authz_count;
1731
1732                         if ((long)(limit - ret - 4 - ext_len) < 0) return NULL;
1733                         s2n(TLSEXT_TYPE_server_authz, ret);
1734                         s2n(ext_len, ret);
1735                         *(ret++) = authz_count;
1736                         s->s3->tlsext_authz_promised_to_client = 1;
1737                         }
1738
1739                 authz = orig_authz;
1740                 for (i = 0; i < authz_length; i++)
1741                         {
1742                         unsigned short length;
1743                         unsigned char type;
1744
1745                         authz_count++;
1746                         type = *(authz++);
1747                         if (memchr(s->s3->tlsext_authz_client_types,
1748                                    type,
1749                                    s->s3->tlsext_authz_client_types_len) != NULL)
1750                                 *(ret++) = type;
1751                         n2s(authz, length);
1752                         /* n2s increments authz by 2 */
1753                         i += 2;
1754                         authz += length;
1755                         i += length;
1756                         }
1757                 }
1758
1759         /* If custom types were sent in ClientHello, add ServerHello responses */
1760         if (s->s3->tlsext_custom_types_count)
1761                 {
1762                 size_t i;
1763
1764                 for (i = 0; i < s->s3->tlsext_custom_types_count; i++)
1765                         {
1766                         size_t j;
1767                         custom_srv_ext_record *record;
1768
1769                         for (j = 0; j < s->ctx->custom_srv_ext_records_count; j++)
1770                                 {
1771                                 record = &s->ctx->custom_srv_ext_records[j];
1772                                 if (s->s3->tlsext_custom_types[i] == record->ext_type)
1773                                         {
1774                                         const unsigned char *out = NULL;
1775                                         unsigned short outlen = 0;
1776                                         int cb_retval = 0;
1777
1778                                         /* NULL callback or -1 omits extension */
1779                                         if (!record->fn2)
1780                                                 break;
1781                                         cb_retval = record->fn2(s, record->ext_type,
1782                                                                 &out, &outlen,
1783                                                                 record->arg);
1784                                         if (cb_retval == 0)
1785                                                 return NULL; /* error */
1786                                         if (cb_retval == -1)
1787                                                 break; /* skip this extension */
1788                                         if (limit < ret + 4 + outlen)
1789                                                 return NULL;
1790                                         s2n(record->ext_type, ret);
1791                                         s2n(outlen, ret);
1792                                         memcpy(ret, out, outlen);
1793                                         ret += outlen;
1794                                         break;
1795                                         }
1796                                 }
1797                         }
1798                 }
1799
1800         if ((extdatalen = ret-p-2)== 0)
1801                 return p;
1802
1803         s2n(extdatalen,p);
1804         return ret;
1805         }
1806
1807 #ifndef OPENSSL_NO_EC
1808 /* ssl_check_for_safari attempts to fingerprint Safari using OS X
1809  * SecureTransport using the TLS extension block in |d|, of length |n|.
1810  * Safari, since 10.6, sends exactly these extensions, in this order:
1811  *   SNI,
1812  *   elliptic_curves
1813  *   ec_point_formats
1814  *
1815  * We wish to fingerprint Safari because they broke ECDHE-ECDSA support in 10.8,
1816  * but they advertise support. So enabling ECDHE-ECDSA ciphers breaks them.
1817  * Sadly we cannot differentiate 10.6, 10.7 and 10.8.4 (which work), from
1818  * 10.8..10.8.3 (which don't work).
1819  */
1820 static void ssl_check_for_safari(SSL *s, const unsigned char *data, const unsigned char *d, int n) {
1821         unsigned short type, size;
1822         static const unsigned char kSafariExtensionsBlock[] = {
1823                 0x00, 0x0a,  /* elliptic_curves extension */
1824                 0x00, 0x08,  /* 8 bytes */
1825                 0x00, 0x06,  /* 6 bytes of curve ids */
1826                 0x00, 0x17,  /* P-256 */
1827                 0x00, 0x18,  /* P-384 */
1828                 0x00, 0x19,  /* P-521 */
1829
1830                 0x00, 0x0b,  /* ec_point_formats */
1831                 0x00, 0x02,  /* 2 bytes */
1832                 0x01,        /* 1 point format */
1833                 0x00,        /* uncompressed */
1834         };
1835
1836         /* The following is only present in TLS 1.2 */
1837         static const unsigned char kSafariTLS12ExtensionsBlock[] = {
1838                 0x00, 0x0d,  /* signature_algorithms */
1839                 0x00, 0x0c,  /* 12 bytes */
1840                 0x00, 0x0a,  /* 10 bytes */
1841                 0x05, 0x01,  /* SHA-384/RSA */
1842                 0x04, 0x01,  /* SHA-256/RSA */
1843                 0x02, 0x01,  /* SHA-1/RSA */
1844                 0x04, 0x03,  /* SHA-256/ECDSA */
1845                 0x02, 0x03,  /* SHA-1/ECDSA */
1846         };
1847
1848         if (data >= (d+n-2))
1849                 return;
1850         data += 2;
1851
1852         if (data > (d+n-4))
1853                 return;
1854         n2s(data,type);
1855         n2s(data,size);
1856
1857         if (type != TLSEXT_TYPE_server_name)
1858                 return;
1859
1860         if (data+size > d+n)
1861                 return;
1862         data += size;
1863
1864         if (TLS1_get_client_version(s) >= TLS1_2_VERSION)
1865                 {
1866                 const size_t len1 = sizeof(kSafariExtensionsBlock);
1867                 const size_t len2 = sizeof(kSafariTLS12ExtensionsBlock);
1868
1869                 if (data + len1 + len2 != d+n)
1870                         return;
1871                 if (memcmp(data, kSafariExtensionsBlock, len1) != 0)
1872                         return;
1873                 if (memcmp(data + len1, kSafariTLS12ExtensionsBlock, len2) != 0)
1874                         return;
1875                 }
1876         else
1877                 {
1878                 const size_t len = sizeof(kSafariExtensionsBlock);
1879
1880                 if (data + len != d+n)
1881                         return;
1882                 if (memcmp(data, kSafariExtensionsBlock, len) != 0)
1883                         return;
1884                 }
1885
1886         s->s3->is_probably_safari = 1;
1887 }
1888 #endif /* !OPENSSL_NO_EC */
1889
1890 static int ssl_scan_clienthello_tlsext(SSL *s, unsigned char **p, unsigned char *d, int n, int *al)
1891         {
1892         unsigned short type;
1893         unsigned short size;
1894         unsigned short len;
1895         unsigned char *data = *p;
1896         int renegotiate_seen = 0;
1897         size_t i;
1898
1899         s->servername_done = 0;
1900         s->tlsext_status_type = -1;
1901 #ifndef OPENSSL_NO_NEXTPROTONEG
1902         s->s3->next_proto_neg_seen = 0;
1903 #endif
1904
1905         /* Clear observed custom extensions */
1906         s->s3->tlsext_custom_types_count = 0;
1907         if (s->s3->tlsext_custom_types != NULL)
1908                 {
1909                 OPENSSL_free(s->s3->tlsext_custom_types);
1910                 s->s3->tlsext_custom_types = NULL;
1911                 }
1912
1913 #ifndef OPENSSL_NO_HEARTBEATS
1914         s->tlsext_heartbeat &= ~(SSL_TLSEXT_HB_ENABLED |
1915                                SSL_TLSEXT_HB_DONT_SEND_REQUESTS);
1916 #endif
1917
1918 #ifndef OPENSSL_NO_EC
1919         if (s->options & SSL_OP_SAFARI_ECDHE_ECDSA_BUG)
1920                 ssl_check_for_safari(s, data, d, n);
1921 #endif /* !OPENSSL_NO_EC */
1922
1923         /* Clear any signature algorithms extension received */
1924         if (s->cert->peer_sigalgs)
1925                 {
1926                 OPENSSL_free(s->cert->peer_sigalgs);
1927                 s->cert->peer_sigalgs = NULL;
1928                 }
1929         /* Clear any shared sigtnature algorithms */
1930         if (s->cert->shared_sigalgs)
1931                 {
1932                 OPENSSL_free(s->cert->shared_sigalgs);
1933                 s->cert->shared_sigalgs = NULL;
1934                 }
1935         /* Clear certificate digests and validity flags */
1936         for (i = 0; i < SSL_PKEY_NUM; i++)
1937                 {
1938                 s->cert->pkeys[i].digest = NULL;
1939                 s->cert->pkeys[i].valid_flags = 0;
1940                 }
1941
1942         if (data >= (d+n-2))
1943                 goto ri_check;
1944         n2s(data,len);
1945
1946         if (data > (d+n-len))
1947                 goto ri_check;
1948
1949         while (data <= (d+n-4))
1950                 {
1951                 n2s(data,type);
1952                 n2s(data,size);
1953
1954                 if (data+size > (d+n))
1955                         goto ri_check;
1956 #if 0
1957                 fprintf(stderr,"Received extension type %d size %d\n",type,size);
1958 #endif
1959                 if (s->tlsext_debug_cb)
1960                         s->tlsext_debug_cb(s, 0, type, data, size,
1961                                                 s->tlsext_debug_arg);
1962 /* The servername extension is treated as follows:
1963
1964    - Only the hostname type is supported with a maximum length of 255.
1965    - The servername is rejected if too long or if it contains zeros,
1966      in which case an fatal alert is generated.
1967    - The servername field is maintained together with the session cache.
1968    - When a session is resumed, the servername call back invoked in order
1969      to allow the application to position itself to the right context.
1970    - The servername is acknowledged if it is new for a session or when
1971      it is identical to a previously used for the same session.
1972      Applications can control the behaviour.  They can at any time
1973      set a 'desirable' servername for a new SSL object. This can be the
1974      case for example with HTTPS when a Host: header field is received and
1975      a renegotiation is requested. In this case, a possible servername
1976      presented in the new client hello is only acknowledged if it matches
1977      the value of the Host: field.
1978    - Applications must  use SSL_OP_NO_SESSION_RESUMPTION_ON_RENEGOTIATION
1979      if they provide for changing an explicit servername context for the session,
1980      i.e. when the session has been established with a servername extension.
1981    - On session reconnect, the servername extension may be absent.
1982
1983 */
1984
1985                 if (type == TLSEXT_TYPE_server_name)
1986                         {
1987                         unsigned char *sdata;
1988                         int servname_type;
1989                         int dsize;
1990
1991                         if (size < 2)
1992                                 {
1993                                 *al = SSL_AD_DECODE_ERROR;
1994                                 return 0;
1995                                 }
1996                         n2s(data,dsize);
1997                         size -= 2;
1998                         if (dsize > size  )
1999                                 {
2000                                 *al = SSL_AD_DECODE_ERROR;
2001                                 return 0;
2002                                 }
2003
2004                         sdata = data;
2005                         while (dsize > 3)
2006                                 {
2007                                 servname_type = *(sdata++);
2008                                 n2s(sdata,len);
2009                                 dsize -= 3;
2010
2011                                 if (len > dsize)
2012                                         {
2013                                         *al = SSL_AD_DECODE_ERROR;
2014                                         return 0;
2015                                         }
2016                                 if (s->servername_done == 0)
2017                                 switch (servname_type)
2018                                         {
2019                                 case TLSEXT_NAMETYPE_host_name:
2020                                         if (!s->hit)
2021                                                 {
2022                                                 if(s->session->tlsext_hostname)
2023                                                         {
2024                                                         *al = SSL_AD_DECODE_ERROR;
2025                                                         return 0;
2026                                                         }
2027                                                 if (len > TLSEXT_MAXLEN_host_name)
2028                                                         {
2029                                                         *al = TLS1_AD_UNRECOGNIZED_NAME;
2030                                                         return 0;
2031                                                         }
2032                                                 if ((s->session->tlsext_hostname = OPENSSL_malloc(len+1)) == NULL)
2033                                                         {
2034                                                         *al = TLS1_AD_INTERNAL_ERROR;
2035                                                         return 0;
2036                                                         }
2037                                                 memcpy(s->session->tlsext_hostname, sdata, len);
2038                                                 s->session->tlsext_hostname[len]='\0';
2039                                                 if (strlen(s->session->tlsext_hostname) != len) {
2040                                                         OPENSSL_free(s->session->tlsext_hostname);
2041                                                         s->session->tlsext_hostname = NULL;
2042                                                         *al = TLS1_AD_UNRECOGNIZED_NAME;
2043                                                         return 0;
2044                                                 }
2045                                                 s->servername_done = 1;
2046
2047                                                 }
2048                                         else
2049                                                 s->servername_done = s->session->tlsext_hostname
2050                                                         && strlen(s->session->tlsext_hostname) == len
2051                                                         && strncmp(s->session->tlsext_hostname, (char *)sdata, len) == 0;
2052
2053                                         break;
2054
2055                                 default:
2056                                         break;
2057                                         }
2058
2059                                 dsize -= len;
2060                                 }
2061                         if (dsize != 0)
2062                                 {
2063                                 *al = SSL_AD_DECODE_ERROR;
2064                                 return 0;
2065                                 }
2066
2067                         }
2068 #ifndef OPENSSL_NO_SRP
2069                 else if (type == TLSEXT_TYPE_srp)
2070                         {
2071                         if (size <= 0 || ((len = data[0])) != (size -1))
2072                                 {
2073                                 *al = SSL_AD_DECODE_ERROR;
2074                                 return 0;
2075                                 }
2076                         if (s->srp_ctx.login != NULL)
2077                                 {
2078                                 *al = SSL_AD_DECODE_ERROR;
2079                                 return 0;
2080                                 }
2081                         if ((s->srp_ctx.login = OPENSSL_malloc(len+1)) == NULL)
2082                                 return -1;
2083                         memcpy(s->srp_ctx.login, &data[1], len);
2084                         s->srp_ctx.login[len]='\0';
2085
2086                         if (strlen(s->srp_ctx.login) != len)
2087                                 {
2088                                 *al = SSL_AD_DECODE_ERROR;
2089                                 return 0;
2090                                 }
2091                         }
2092 #endif
2093
2094 #ifndef OPENSSL_NO_EC
2095                 else if (type == TLSEXT_TYPE_ec_point_formats &&
2096                      s->version != DTLS1_VERSION)
2097                         {
2098                         unsigned char *sdata = data;
2099                         int ecpointformatlist_length = *(sdata++);
2100
2101                         if (ecpointformatlist_length != size - 1 ||
2102                                 ecpointformatlist_length < 1)
2103                                 {
2104                                 *al = TLS1_AD_DECODE_ERROR;
2105                                 return 0;
2106                                 }
2107                         if (!s->hit)
2108                                 {
2109                                 if(s->session->tlsext_ecpointformatlist)
2110                                         {
2111                                         OPENSSL_free(s->session->tlsext_ecpointformatlist);
2112                                         s->session->tlsext_ecpointformatlist = NULL;
2113                                         }
2114                                 s->session->tlsext_ecpointformatlist_length = 0;
2115                                 if ((s->session->tlsext_ecpointformatlist = OPENSSL_malloc(ecpointformatlist_length)) == NULL)
2116                                         {
2117                                         *al = TLS1_AD_INTERNAL_ERROR;
2118                                         return 0;
2119                                         }
2120                                 s->session->tlsext_ecpointformatlist_length = ecpointformatlist_length;
2121                                 memcpy(s->session->tlsext_ecpointformatlist, sdata, ecpointformatlist_length);
2122                                 }
2123 #if 0
2124                         fprintf(stderr,"ssl_parse_clienthello_tlsext s->session->tlsext_ecpointformatlist (length=%i) ", s->session->tlsext_ecpointformatlist_length);
2125                         sdata = s->session->tlsext_ecpointformatlist;
2126                         for (i = 0; i < s->session->tlsext_ecpointformatlist_length; i++)
2127                                 fprintf(stderr,"%i ",*(sdata++));
2128                         fprintf(stderr,"\n");
2129 #endif
2130                         }
2131                 else if (type == TLSEXT_TYPE_elliptic_curves &&
2132                      s->version != DTLS1_VERSION)
2133                         {
2134                         unsigned char *sdata = data;
2135                         int ellipticcurvelist_length = (*(sdata++) << 8);
2136                         ellipticcurvelist_length += (*(sdata++));
2137
2138                         if (ellipticcurvelist_length != size - 2 ||
2139                                 ellipticcurvelist_length < 1)
2140                                 {
2141                                 *al = TLS1_AD_DECODE_ERROR;
2142                                 return 0;
2143                                 }
2144                         if (!s->hit)
2145                                 {
2146                                 if(s->session->tlsext_ellipticcurvelist)
2147                                         {
2148                                         *al = TLS1_AD_DECODE_ERROR;
2149                                         return 0;
2150                                         }
2151                                 s->session->tlsext_ellipticcurvelist_length = 0;
2152                                 if ((s->session->tlsext_ellipticcurvelist = OPENSSL_malloc(ellipticcurvelist_length)) == NULL)
2153                                         {
2154                                         *al = TLS1_AD_INTERNAL_ERROR;
2155                                         return 0;
2156                                         }
2157                                 s->session->tlsext_ellipticcurvelist_length = ellipticcurvelist_length;
2158                                 memcpy(s->session->tlsext_ellipticcurvelist, sdata, ellipticcurvelist_length);
2159                                 }
2160 #if 0
2161                         fprintf(stderr,"ssl_parse_clienthello_tlsext s->session->tlsext_ellipticcurvelist (length=%i) ", s->session->tlsext_ellipticcurvelist_length);
2162                         sdata = s->session->tlsext_ellipticcurvelist;
2163                         for (i = 0; i < s->session->tlsext_ellipticcurvelist_length; i++)
2164                                 fprintf(stderr,"%i ",*(sdata++));
2165                         fprintf(stderr,"\n");
2166 #endif
2167                         }
2168 #endif /* OPENSSL_NO_EC */
2169 #ifdef TLSEXT_TYPE_opaque_prf_input
2170                 else if (type == TLSEXT_TYPE_opaque_prf_input &&
2171                      s->version != DTLS1_VERSION)
2172                         {
2173                         unsigned char *sdata = data;
2174
2175                         if (size < 2)
2176                                 {
2177                                 *al = SSL_AD_DECODE_ERROR;
2178                                 return 0;
2179                                 }
2180                         n2s(sdata, s->s3->client_opaque_prf_input_len);
2181                         if (s->s3->client_opaque_prf_input_len != size - 2)
2182                                 {
2183                                 *al = SSL_AD_DECODE_ERROR;
2184                                 return 0;
2185                                 }
2186
2187                         if (s->s3->client_opaque_prf_input != NULL) /* shouldn't really happen */
2188                                 OPENSSL_free(s->s3->client_opaque_prf_input);
2189                         if (s->s3->client_opaque_prf_input_len == 0)
2190                                 s->s3->client_opaque_prf_input = OPENSSL_malloc(1); /* dummy byte just to get non-NULL */
2191                         else
2192                                 s->s3->client_opaque_prf_input = BUF_memdup(sdata, s->s3->client_opaque_prf_input_len);
2193                         if (s->s3->client_opaque_prf_input == NULL)
2194                                 {
2195                                 *al = TLS1_AD_INTERNAL_ERROR;
2196                                 return 0;
2197                                 }
2198                         }
2199 #endif
2200                 else if (type == TLSEXT_TYPE_session_ticket)
2201                         {
2202                         if (s->tls_session_ticket_ext_cb &&
2203                             !s->tls_session_ticket_ext_cb(s, data, size, s->tls_session_ticket_ext_cb_arg))
2204                                 {
2205                                 *al = TLS1_AD_INTERNAL_ERROR;
2206                                 return 0;
2207                                 }
2208                         }
2209                 else if (type == TLSEXT_TYPE_renegotiate)
2210                         {
2211                         if(!ssl_parse_clienthello_renegotiate_ext(s, data, size, al))
2212                                 return 0;
2213                         renegotiate_seen = 1;
2214                         }
2215                 else if (type == TLSEXT_TYPE_signature_algorithms)
2216                         {
2217                         int dsize;
2218                         if (s->cert->peer_sigalgs || size < 2)
2219                                 {
2220                                 *al = SSL_AD_DECODE_ERROR;
2221                                 return 0;
2222                                 }
2223                         n2s(data,dsize);
2224                         size -= 2;
2225                         if (dsize != size || dsize & 1 || !dsize)
2226                                 {
2227                                 *al = SSL_AD_DECODE_ERROR;
2228                                 return 0;
2229                                 }
2230                         if (!tls1_process_sigalgs(s, data, dsize))
2231                                 {
2232                                 *al = SSL_AD_DECODE_ERROR;
2233                                 return 0;
2234                                 }
2235                         /* If sigalgs received and no shared algorithms fatal
2236                          * error.
2237                          */
2238                         if (s->cert->peer_sigalgs && !s->cert->shared_sigalgs)
2239                                 {
2240                                 SSLerr(SSL_F_SSL_SCAN_CLIENTHELLO_TLSEXT,
2241                                         SSL_R_NO_SHARED_SIGATURE_ALGORITHMS);
2242                                 *al = SSL_AD_ILLEGAL_PARAMETER;
2243                                 return 0;
2244                                 }
2245                         }
2246                 else if (type == TLSEXT_TYPE_status_request &&
2247                          s->version != DTLS1_VERSION && s->ctx->tlsext_status_cb)
2248                         {
2249
2250                         if (size < 5)
2251                                 {
2252                                 *al = SSL_AD_DECODE_ERROR;
2253                                 return 0;
2254                                 }
2255
2256                         s->tlsext_status_type = *data++;
2257                         size--;
2258                         if (s->tlsext_status_type == TLSEXT_STATUSTYPE_ocsp)
2259                                 {
2260                                 const unsigned char *sdata;
2261                                 int dsize;
2262                                 /* Read in responder_id_list */
2263                                 n2s(data,dsize);
2264                                 size -= 2;
2265                                 if (dsize > size  )
2266                                         {
2267                                         *al = SSL_AD_DECODE_ERROR;
2268                                         return 0;
2269                                         }
2270                                 while (dsize > 0)
2271                                         {
2272                                         OCSP_RESPID *id;
2273                                         int idsize;
2274                                         if (dsize < 4)
2275                                                 {
2276                                                 *al = SSL_AD_DECODE_ERROR;
2277                                                 return 0;
2278                                                 }
2279                                         n2s(data, idsize);
2280                                         dsize -= 2 + idsize;
2281                                         size -= 2 + idsize;
2282                                         if (dsize < 0)
2283                                                 {
2284                                                 *al = SSL_AD_DECODE_ERROR;
2285                                                 return 0;
2286                                                 }
2287                                         sdata = data;
2288                                         data += idsize;
2289                                         id = d2i_OCSP_RESPID(NULL,
2290                                                                 &sdata, idsize);
2291                                         if (!id)
2292                                                 {
2293                                                 *al = SSL_AD_DECODE_ERROR;
2294                                                 return 0;
2295                                                 }
2296                                         if (data != sdata)
2297                                                 {
2298                                                 OCSP_RESPID_free(id);
2299                                                 *al = SSL_AD_DECODE_ERROR;
2300                                                 return 0;
2301                                                 }
2302                                         if (!s->tlsext_ocsp_ids
2303                                                 && !(s->tlsext_ocsp_ids =
2304                                                 sk_OCSP_RESPID_new_null()))
2305                                                 {
2306                                                 OCSP_RESPID_free(id);
2307                                                 *al = SSL_AD_INTERNAL_ERROR;
2308                                                 return 0;
2309                                                 }
2310                                         if (!sk_OCSP_RESPID_push(
2311                                                         s->tlsext_ocsp_ids, id))
2312                                                 {
2313                                                 OCSP_RESPID_free(id);
2314                                                 *al = SSL_AD_INTERNAL_ERROR;
2315                                                 return 0;
2316                                                 }
2317                                         }
2318
2319                                 /* Read in request_extensions */
2320                                 if (size < 2)
2321                                         {
2322                                         *al = SSL_AD_DECODE_ERROR;
2323                                         return 0;
2324                                         }
2325                                 n2s(data,dsize);
2326                                 size -= 2;
2327                                 if (dsize != size)
2328                                         {
2329                                         *al = SSL_AD_DECODE_ERROR;
2330                                         return 0;
2331                                         }
2332                                 sdata = data;
2333                                 if (dsize > 0)
2334                                         {
2335                                         if (s->tlsext_ocsp_exts)
2336                                                 {
2337                                                 sk_X509_EXTENSION_pop_free(s->tlsext_ocsp_exts,
2338                                                                            X509_EXTENSION_free);
2339                                                 }
2340
2341                                         s->tlsext_ocsp_exts =
2342                                                 d2i_X509_EXTENSIONS(NULL,
2343                                                         &sdata, dsize);
2344                                         if (!s->tlsext_ocsp_exts
2345                                                 || (data + dsize != sdata))
2346                                                 {
2347                                                 *al = SSL_AD_DECODE_ERROR;
2348                                                 return 0;
2349                                                 }
2350                                         }
2351                                 }
2352                                 /* We don't know what to do with any other type
2353                                 * so ignore it.
2354                                 */
2355                                 else
2356                                         s->tlsext_status_type = -1;
2357                         }
2358 #ifndef OPENSSL_NO_HEARTBEATS
2359                 else if (type == TLSEXT_TYPE_heartbeat)
2360                         {
2361                         switch(data[0])
2362                                 {
2363                                 case 0x01:      /* Client allows us to send HB requests */
2364                                                         s->tlsext_heartbeat |= SSL_TLSEXT_HB_ENABLED;
2365                                                         break;
2366                                 case 0x02:      /* Client doesn't accept HB requests */
2367                                                         s->tlsext_heartbeat |= SSL_TLSEXT_HB_ENABLED;
2368                                                         s->tlsext_heartbeat |= SSL_TLSEXT_HB_DONT_SEND_REQUESTS;
2369                                                         break;
2370                                 default:        *al = SSL_AD_ILLEGAL_PARAMETER;
2371                                                         return 0;
2372                                 }
2373                         }
2374 #endif
2375 #ifndef OPENSSL_NO_NEXTPROTONEG
2376                 else if (type == TLSEXT_TYPE_next_proto_neg &&
2377                          s->s3->tmp.finish_md_len == 0)
2378                         {
2379                         /* We shouldn't accept this extension on a
2380                          * renegotiation.
2381                          *
2382                          * s->new_session will be set on renegotiation, but we
2383                          * probably shouldn't rely that it couldn't be set on
2384                          * the initial renegotation too in certain cases (when
2385                          * there's some other reason to disallow resuming an
2386                          * earlier session -- the current code won't be doing
2387                          * anything like that, but this might change).
2388
2389                          * A valid sign that there's been a previous handshake
2390                          * in this connection is if s->s3->tmp.finish_md_len >
2391                          * 0.  (We are talking about a check that will happen
2392                          * in the Hello protocol round, well before a new
2393                          * Finished message could have been computed.) */
2394                         s->s3->next_proto_neg_seen = 1;
2395                         }
2396 #endif
2397
2398                 /* session ticket processed earlier */
2399                 else if (type == TLSEXT_TYPE_use_srtp)
2400                         {
2401                         if(ssl_parse_clienthello_use_srtp_ext(s, data, size,
2402                                                               al))
2403                                 return 0;
2404                         }
2405
2406                 else if (type == TLSEXT_TYPE_server_authz)
2407                         {
2408                         unsigned char *sdata = data;
2409                         unsigned char server_authz_dataformatlist_length;
2410
2411                         if (size == 0)
2412                                 {
2413                                 *al = TLS1_AD_DECODE_ERROR;
2414                                 return 0;
2415                                 }
2416
2417                         server_authz_dataformatlist_length = *(sdata++);
2418
2419                         if (server_authz_dataformatlist_length != size - 1)
2420                                 {
2421                                 *al = TLS1_AD_DECODE_ERROR;
2422                                 return 0;
2423                                 }
2424
2425                         /* Successful session resumption uses the same authz
2426                          * information as the original session so we ignore this
2427                          * in the case of a session resumption. */
2428                         if (!s->hit)
2429                                 {
2430                                 if (s->s3->tlsext_authz_client_types != NULL)
2431                                         OPENSSL_free(s->s3->tlsext_authz_client_types);
2432                                 s->s3->tlsext_authz_client_types =
2433                                         OPENSSL_malloc(server_authz_dataformatlist_length);
2434                                 if (!s->s3->tlsext_authz_client_types)
2435                                         {
2436                                         *al = TLS1_AD_INTERNAL_ERROR;
2437                                         return 0;
2438                                         }
2439
2440                                 s->s3->tlsext_authz_client_types_len =
2441                                         server_authz_dataformatlist_length;
2442                                 memcpy(s->s3->tlsext_authz_client_types,
2443                                        sdata,
2444                                        server_authz_dataformatlist_length);
2445
2446                                 /* Sort the types in order to check for duplicates. */
2447                                 qsort(s->s3->tlsext_authz_client_types,
2448                                       server_authz_dataformatlist_length,
2449                                       1 /* element size */,
2450                                       byte_compare);
2451
2452                                 for (i = 0; i < server_authz_dataformatlist_length; i++)
2453                                         {
2454                                         if (i > 0 &&
2455                                             s->s3->tlsext_authz_client_types[i] ==
2456                                               s->s3->tlsext_authz_client_types[i-1])
2457                                                 {
2458                                                 *al = TLS1_AD_DECODE_ERROR;
2459                                                 return 0;
2460                                                 }
2461                                         }
2462                                 }
2463                         }
2464
2465                 /* If this ClientHello extension was unhandled and this is
2466                  * a nonresumed connection, check whether the extension is a
2467                  * custom TLS Extension (has a custom_srv_ext_record), and if
2468                  * so call the callback and record the extension number so that
2469                  * an appropriate ServerHello may be later returned.
2470                  */
2471                 else if (!s->hit && s->ctx->custom_srv_ext_records_count)
2472                         {
2473                         custom_srv_ext_record *record;
2474
2475                         for (i=0; i < s->ctx->custom_srv_ext_records_count; i++)
2476                                 {
2477                                 record = &s->ctx->custom_srv_ext_records[i];
2478                                 if (type == record->ext_type)
2479                                         {
2480                                         size_t j;
2481
2482                                         /* Error on duplicate TLS Extensions */
2483                                         for (j = 0; j < s->s3->tlsext_custom_types_count; j++)
2484                                                 {
2485                                                 if (type == s->s3->tlsext_custom_types[j])
2486                                                         {
2487                                                         *al = TLS1_AD_DECODE_ERROR;
2488                                                         return 0;
2489                                                         }
2490                                                 }
2491
2492                                         /* NULL callback still notes the extension */
2493                                         if (record->fn1 && !record->fn1(s, type, data, size, al, record->arg))
2494                                                 return 0;
2495
2496                                         /* Add the (non-duplicated) entry */
2497                                         s->s3->tlsext_custom_types_count++;
2498                                         s->s3->tlsext_custom_types = OPENSSL_realloc(
2499                                                         s->s3->tlsext_custom_types,
2500                                                         s->s3->tlsext_custom_types_count * 2);
2501                                         if (s->s3->tlsext_custom_types == NULL)
2502                                                 {
2503                                                 s->s3->tlsext_custom_types = 0;
2504                                                 *al = TLS1_AD_INTERNAL_ERROR;
2505                                                 return 0;
2506                                                 }
2507                                         s->s3->tlsext_custom_types[
2508                                                         s->s3->tlsext_custom_types_count - 1] = type;
2509                                         }
2510                                 }
2511                         }
2512
2513                 data+=size;
2514                 }
2515
2516         *p = data;
2517
2518         ri_check:
2519
2520         /* Need RI if renegotiating */
2521
2522         if (!renegotiate_seen && s->renegotiate &&
2523                 !(s->options & SSL_OP_ALLOW_UNSAFE_LEGACY_RENEGOTIATION))
2524                 {
2525                 *al = SSL_AD_HANDSHAKE_FAILURE;
2526                 SSLerr(SSL_F_SSL_SCAN_CLIENTHELLO_TLSEXT,
2527                                 SSL_R_UNSAFE_LEGACY_RENEGOTIATION_DISABLED);
2528                 return 0;
2529                 }
2530         /* If no signature algorithms extension set default values */
2531         if (!s->cert->peer_sigalgs)
2532                 ssl_cert_set_default_md(s->cert);
2533
2534         return 1;
2535         }
2536
2537 int ssl_parse_clienthello_tlsext(SSL *s, unsigned char **p, unsigned char *d, int n)
2538         {
2539         int al = -1;
2540         if (ssl_scan_clienthello_tlsext(s, p, d, n, &al) <= 0)
2541                 {
2542                 ssl3_send_alert(s,SSL3_AL_FATAL,al);
2543                 return 0;
2544                 }
2545
2546         if (ssl_check_clienthello_tlsext_early(s) <= 0)
2547                 {
2548                 SSLerr(SSL_F_SSL_PARSE_CLIENTHELLO_TLSEXT,SSL_R_CLIENTHELLO_TLSEXT);
2549                 return 0;
2550                 }
2551         return 1;
2552 }
2553
2554 #ifndef OPENSSL_NO_NEXTPROTONEG
2555 /* ssl_next_proto_validate validates a Next Protocol Negotiation block. No
2556  * elements of zero length are allowed and the set of elements must exactly fill
2557  * the length of the block. */
2558 static char ssl_next_proto_validate(unsigned char *d, unsigned len)
2559         {
2560         unsigned int off = 0;
2561
2562         while (off < len)
2563                 {
2564                 if (d[off] == 0)
2565                         return 0;
2566                 off += d[off];
2567                 off++;
2568                 }
2569
2570         return off == len;
2571         }
2572 #endif
2573
2574 static int ssl_scan_serverhello_tlsext(SSL *s, unsigned char **p, unsigned char *d, int n, int *al)
2575         {
2576         unsigned short length;
2577         unsigned short type;
2578         unsigned short size;
2579         unsigned char *data = *p;
2580         int tlsext_servername = 0;
2581         int renegotiate_seen = 0;
2582
2583 #ifndef OPENSSL_NO_NEXTPROTONEG
2584         s->s3->next_proto_neg_seen = 0;
2585 #endif
2586
2587 #ifndef OPENSSL_NO_HEARTBEATS
2588         s->tlsext_heartbeat &= ~(SSL_TLSEXT_HB_ENABLED |
2589                                SSL_TLSEXT_HB_DONT_SEND_REQUESTS);
2590 #endif
2591
2592         if (data >= (d+n-2))
2593                 goto ri_check;
2594
2595         n2s(data,length);
2596         if (data+length != d+n)
2597                 {
2598                 *al = SSL_AD_DECODE_ERROR;
2599                 return 0;
2600                 }
2601
2602         while(data <= (d+n-4))
2603                 {
2604                 n2s(data,type);
2605                 n2s(data,size);
2606
2607                 if (data+size > (d+n))
2608                         goto ri_check;
2609
2610                 if (s->tlsext_debug_cb)
2611                         s->tlsext_debug_cb(s, 1, type, data, size,
2612                                                 s->tlsext_debug_arg);
2613
2614                 if (type == TLSEXT_TYPE_server_name)
2615                         {
2616                         if (s->tlsext_hostname == NULL || size > 0)
2617                                 {
2618                                 *al = TLS1_AD_UNRECOGNIZED_NAME;
2619                                 return 0;
2620                                 }
2621                         tlsext_servername = 1;
2622                         }
2623
2624 #ifndef OPENSSL_NO_EC
2625                 else if (type == TLSEXT_TYPE_ec_point_formats &&
2626                      s->version != DTLS1_VERSION)
2627                         {
2628                         unsigned char *sdata = data;
2629                         int ecpointformatlist_length = *(sdata++);
2630
2631                         if (ecpointformatlist_length != size - 1)
2632                                 {
2633                                 *al = TLS1_AD_DECODE_ERROR;
2634                                 return 0;
2635                                 }
2636                         s->session->tlsext_ecpointformatlist_length = 0;
2637                         if (s->session->tlsext_ecpointformatlist != NULL) OPENSSL_free(s->session->tlsext_ecpointformatlist);
2638                         if ((s->session->tlsext_ecpointformatlist = OPENSSL_malloc(ecpointformatlist_length)) == NULL)
2639                                 {
2640                                 *al = TLS1_AD_INTERNAL_ERROR;
2641                                 return 0;
2642                                 }
2643                         s->session->tlsext_ecpointformatlist_length = ecpointformatlist_length;
2644                         memcpy(s->session->tlsext_ecpointformatlist, sdata, ecpointformatlist_length);
2645 #if 0
2646                         fprintf(stderr,"ssl_parse_serverhello_tlsext s->session->tlsext_ecpointformatlist ");
2647                         sdata = s->session->tlsext_ecpointformatlist;
2648                         for (i = 0; i < s->session->tlsext_ecpointformatlist_length; i++)
2649                                 fprintf(stderr,"%i ",*(sdata++));
2650                         fprintf(stderr,"\n");
2651 #endif
2652                         }
2653 #endif /* OPENSSL_NO_EC */
2654
2655                 else if (type == TLSEXT_TYPE_session_ticket)
2656                         {
2657                         if (s->tls_session_ticket_ext_cb &&
2658                             !s->tls_session_ticket_ext_cb(s, data, size, s->tls_session_ticket_ext_cb_arg))
2659                                 {
2660                                 *al = TLS1_AD_INTERNAL_ERROR;
2661                                 return 0;
2662                                 }
2663                         if ((SSL_get_options(s) & SSL_OP_NO_TICKET)
2664                                 || (size > 0))
2665                                 {
2666                                 *al = TLS1_AD_UNSUPPORTED_EXTENSION;
2667                                 return 0;
2668                                 }
2669                         s->tlsext_ticket_expected = 1;
2670                         }
2671 #ifdef TLSEXT_TYPE_opaque_prf_input
2672                 else if (type == TLSEXT_TYPE_opaque_prf_input &&
2673                      s->version != DTLS1_VERSION)
2674                         {
2675                         unsigned char *sdata = data;
2676
2677                         if (size < 2)
2678                                 {
2679                                 *al = SSL_AD_DECODE_ERROR;
2680                                 return 0;
2681                                 }
2682                         n2s(sdata, s->s3->server_opaque_prf_input_len);
2683                         if (s->s3->server_opaque_prf_input_len != size - 2)
2684                                 {
2685                                 *al = SSL_AD_DECODE_ERROR;
2686                                 return 0;
2687                                 }
2688
2689                         if (s->s3->server_opaque_prf_input != NULL) /* shouldn't really happen */
2690                                 OPENSSL_free(s->s3->server_opaque_prf_input);
2691                         if (s->s3->server_opaque_prf_input_len == 0)
2692                                 s->s3->server_opaque_prf_input = OPENSSL_malloc(1); /* dummy byte just to get non-NULL */
2693                         else
2694                                 s->s3->server_opaque_prf_input = BUF_memdup(sdata, s->s3->server_opaque_prf_input_len);
2695
2696                         if (s->s3->server_opaque_prf_input == NULL)
2697                                 {
2698                                 *al = TLS1_AD_INTERNAL_ERROR;
2699                                 return 0;
2700                                 }
2701                         }
2702 #endif
2703                 else if (type == TLSEXT_TYPE_status_request &&
2704                          s->version != DTLS1_VERSION)
2705                         {
2706                         /* MUST be empty and only sent if we've requested
2707                          * a status request message.
2708                          */
2709                         if ((s->tlsext_status_type == -1) || (size > 0))
2710                                 {
2711                                 *al = TLS1_AD_UNSUPPORTED_EXTENSION;
2712                                 return 0;
2713                                 }
2714                         /* Set flag to expect CertificateStatus message */
2715                         s->tlsext_status_expected = 1;
2716                         }
2717 #ifndef OPENSSL_NO_NEXTPROTONEG
2718                 else if (type == TLSEXT_TYPE_next_proto_neg &&
2719                          s->s3->tmp.finish_md_len == 0)
2720                         {
2721                         unsigned char *selected;
2722                         unsigned char selected_len;
2723
2724                         /* We must have requested it. */
2725                         if (s->ctx->next_proto_select_cb == NULL)
2726                                 {
2727                                 *al = TLS1_AD_UNSUPPORTED_EXTENSION;
2728                                 return 0;
2729                                 }
2730                         /* The data must be valid */
2731                         if (!ssl_next_proto_validate(data, size))
2732                                 {
2733                                 *al = TLS1_AD_DECODE_ERROR;
2734                                 return 0;
2735                                 }
2736                         if (s->ctx->next_proto_select_cb(s, &selected, &selected_len, data, size, s->ctx->next_proto_select_cb_arg) != SSL_TLSEXT_ERR_OK)
2737                                 {
2738                                 *al = TLS1_AD_INTERNAL_ERROR;
2739                                 return 0;
2740                                 }
2741                         s->next_proto_negotiated = OPENSSL_malloc(selected_len);
2742                         if (!s->next_proto_negotiated)
2743                                 {
2744                                 *al = TLS1_AD_INTERNAL_ERROR;
2745                                 return 0;
2746                                 }
2747                         memcpy(s->next_proto_negotiated, selected, selected_len);
2748                         s->next_proto_negotiated_len = selected_len;
2749                         s->s3->next_proto_neg_seen = 1;
2750                         }
2751 #endif
2752                 else if (type == TLSEXT_TYPE_renegotiate)
2753                         {
2754                         if(!ssl_parse_serverhello_renegotiate_ext(s, data, size, al))
2755                                 return 0;
2756                         renegotiate_seen = 1;
2757                         }
2758 #ifndef OPENSSL_NO_HEARTBEATS
2759                 else if (type == TLSEXT_TYPE_heartbeat)
2760                         {
2761                         switch(data[0])
2762                                 {
2763                                 case 0x01:      /* Server allows us to send HB requests */
2764                                                         s->tlsext_heartbeat |= SSL_TLSEXT_HB_ENABLED;
2765                                                         break;
2766                                 case 0x02:      /* Server doesn't accept HB requests */
2767                                                         s->tlsext_heartbeat |= SSL_TLSEXT_HB_ENABLED;
2768                                                         s->tlsext_heartbeat |= SSL_TLSEXT_HB_DONT_SEND_REQUESTS;
2769                                                         break;
2770                                 default:        *al = SSL_AD_ILLEGAL_PARAMETER;
2771                                                         return 0;
2772                                 }
2773                         }
2774 #endif
2775                 else if (type == TLSEXT_TYPE_use_srtp)
2776                         {
2777                         if(ssl_parse_serverhello_use_srtp_ext(s, data, size,
2778                                                               al))
2779                                 return 0;
2780                         }
2781
2782                 else if (type == TLSEXT_TYPE_server_authz)
2783                         {
2784                         /* We only support audit proofs. It's an error to send
2785                          * an authz hello extension if the client
2786                          * didn't request a proof. */
2787                         unsigned char *sdata = data;
2788                         unsigned char server_authz_dataformatlist_length;
2789
2790                         if (!s->ctx->tlsext_authz_server_audit_proof_cb)
2791                                 {
2792                                 *al = TLS1_AD_UNSUPPORTED_EXTENSION;
2793                                 return 0;
2794                                 }
2795
2796                         if (!size)
2797                                 {
2798                                 *al = TLS1_AD_DECODE_ERROR;
2799                                 return 0;
2800                                 }
2801
2802                         server_authz_dataformatlist_length = *(sdata++);
2803                         if (server_authz_dataformatlist_length != size - 1)
2804                                 {
2805                                 *al = TLS1_AD_DECODE_ERROR;
2806                                 return 0;
2807                                 }
2808
2809                         /* We only support audit proofs, so a legal ServerHello
2810                          * authz list contains exactly one entry. */
2811                         if (server_authz_dataformatlist_length != 1 ||
2812                                 sdata[0] != TLSEXT_AUTHZDATAFORMAT_audit_proof)
2813                                 {
2814                                 *al = TLS1_AD_UNSUPPORTED_EXTENSION;
2815                                 return 0;
2816                                 }
2817
2818                         s->s3->tlsext_authz_server_promised = 1;
2819                         }
2820
2821                 /* If this extension type was not otherwise handled, but
2822                  * matches a custom_cli_ext_record, then send it to the c
2823                  * callback */
2824                 else if (s->ctx->custom_cli_ext_records_count)
2825                         {
2826                         size_t i;
2827                         custom_cli_ext_record* record;
2828
2829                         for (i = 0; i < s->ctx->custom_cli_ext_records_count; i++)
2830                                 {
2831                                 record = &s->ctx->custom_cli_ext_records[i];
2832                                 if (record->ext_type == type)
2833                                         {
2834                                         if (record->fn2 && !record->fn2(s, type, data, size, al, record->arg))
2835                                                 return 0;
2836                                         break;
2837                                         }
2838                                 }
2839                         }
2840
2841                 data += size;
2842                 }
2843
2844         if (data != d+n)
2845                 {
2846                 *al = SSL_AD_DECODE_ERROR;
2847                 return 0;
2848                 }
2849
2850         if (!s->hit && tlsext_servername == 1)
2851                 {
2852                 if (s->tlsext_hostname)
2853                         {
2854                         if (s->session->tlsext_hostname == NULL)
2855                                 {
2856                                 s->session->tlsext_hostname = BUF_strdup(s->tlsext_hostname);
2857                                 if (!s->session->tlsext_hostname)
2858                                         {
2859                                         *al = SSL_AD_UNRECOGNIZED_NAME;
2860                                         return 0;
2861                                         }
2862                                 }
2863                         else
2864                                 {
2865                                 *al = SSL_AD_DECODE_ERROR;
2866                                 return 0;
2867                                 }
2868                         }
2869                 }
2870
2871         *p = data;
2872
2873         ri_check:
2874
2875         /* Determine if we need to see RI. Strictly speaking if we want to
2876          * avoid an attack we should *always* see RI even on initial server
2877          * hello because the client doesn't see any renegotiation during an
2878          * attack. However this would mean we could not connect to any server
2879          * which doesn't support RI so for the immediate future tolerate RI
2880          * absence on initial connect only.
2881          */
2882         if (!renegotiate_seen
2883                 && !(s->options & SSL_OP_LEGACY_SERVER_CONNECT)
2884                 && !(s->options & SSL_OP_ALLOW_UNSAFE_LEGACY_RENEGOTIATION))
2885                 {
2886                 *al = SSL_AD_HANDSHAKE_FAILURE;
2887                 SSLerr(SSL_F_SSL_SCAN_SERVERHELLO_TLSEXT,
2888                                 SSL_R_UNSAFE_LEGACY_RENEGOTIATION_DISABLED);
2889                 return 0;
2890                 }
2891
2892         return 1;
2893         }
2894
2895
2896 int ssl_prepare_clienthello_tlsext(SSL *s)
2897         {
2898
2899 #ifdef TLSEXT_TYPE_opaque_prf_input
2900         {
2901                 int r = 1;
2902
2903                 if (s->ctx->tlsext_opaque_prf_input_callback != 0)
2904                         {
2905                         r = s->ctx->tlsext_opaque_prf_input_callback(s, NULL, 0, s->ctx->tlsext_opaque_prf_input_callback_arg);
2906                         if (!r)
2907                                 return -1;
2908                         }
2909
2910                 if (s->tlsext_opaque_prf_input != NULL)
2911                         {
2912                         if (s->s3->client_opaque_prf_input != NULL) /* shouldn't really happen */
2913                                 OPENSSL_free(s->s3->client_opaque_prf_input);
2914
2915                         if (s->tlsext_opaque_prf_input_len == 0)
2916                                 s->s3->client_opaque_prf_input = OPENSSL_malloc(1); /* dummy byte just to get non-NULL */
2917                         else
2918                                 s->s3->client_opaque_prf_input = BUF_memdup(s->tlsext_opaque_prf_input, s->tlsext_opaque_prf_input_len);
2919                         if (s->s3->client_opaque_prf_input == NULL)
2920                                 {
2921                                 SSLerr(SSL_F_SSL_PREPARE_CLIENTHELLO_TLSEXT,ERR_R_MALLOC_FAILURE);
2922                                 return -1;
2923                                 }
2924                         s->s3->client_opaque_prf_input_len = s->tlsext_opaque_prf_input_len;
2925                         }
2926
2927                 if (r == 2)
2928                         /* at callback's request, insist on receiving an appropriate server opaque PRF input */
2929                         s->s3->server_opaque_prf_input_len = s->tlsext_opaque_prf_input_len;
2930         }
2931 #endif
2932
2933         return 1;
2934         }
2935
2936 int ssl_prepare_serverhello_tlsext(SSL *s)
2937         {
2938         return 1;
2939         }
2940
2941 static int ssl_check_clienthello_tlsext_early(SSL *s)
2942         {
2943         int ret=SSL_TLSEXT_ERR_NOACK;
2944         int al = SSL_AD_UNRECOGNIZED_NAME;
2945
2946 #ifndef OPENSSL_NO_EC
2947         /* The handling of the ECPointFormats extension is done elsewhere, namely in
2948          * ssl3_choose_cipher in s3_lib.c.
2949          */
2950         /* The handling of the EllipticCurves extension is done elsewhere, namely in
2951          * ssl3_choose_cipher in s3_lib.c.
2952          */
2953 #endif
2954
2955         if (s->ctx != NULL && s->ctx->tlsext_servername_callback != 0)
2956                 ret = s->ctx->tlsext_servername_callback(s, &al, s->ctx->tlsext_servername_arg);
2957         else if (s->initial_ctx != NULL && s->initial_ctx->tlsext_servername_callback != 0)
2958                 ret = s->initial_ctx->tlsext_servername_callback(s, &al, s->initial_ctx->tlsext_servername_arg);
2959
2960 #ifdef TLSEXT_TYPE_opaque_prf_input
2961         {
2962                 /* This sort of belongs into ssl_prepare_serverhello_tlsext(),
2963                  * but we might be sending an alert in response to the client hello,
2964                  * so this has to happen here in
2965                  * ssl_check_clienthello_tlsext_early(). */
2966
2967                 int r = 1;
2968
2969                 if (s->ctx->tlsext_opaque_prf_input_callback != 0)
2970                         {
2971                         r = s->ctx->tlsext_opaque_prf_input_callback(s, NULL, 0, s->ctx->tlsext_opaque_prf_input_callback_arg);
2972                         if (!r)
2973                                 {
2974                                 ret = SSL_TLSEXT_ERR_ALERT_FATAL;
2975                                 al = SSL_AD_INTERNAL_ERROR;
2976                                 goto err;
2977                                 }
2978                         }
2979
2980                 if (s->s3->server_opaque_prf_input != NULL) /* shouldn't really happen */
2981                         OPENSSL_free(s->s3->server_opaque_prf_input);
2982                 s->s3->server_opaque_prf_input = NULL;
2983
2984                 if (s->tlsext_opaque_prf_input != NULL)
2985                         {
2986                         if (s->s3->client_opaque_prf_input != NULL &&
2987                                 s->s3->client_opaque_prf_input_len == s->tlsext_opaque_prf_input_len)
2988                                 {
2989                                 /* can only use this extension if we have a server opaque PRF input
2990                                  * of the same length as the client opaque PRF input! */
2991
2992                                 if (s->tlsext_opaque_prf_input_len == 0)
2993                                         s->s3->server_opaque_prf_input = OPENSSL_malloc(1); /* dummy byte just to get non-NULL */
2994                                 else
2995                                         s->s3->server_opaque_prf_input = BUF_memdup(s->tlsext_opaque_prf_input, s->tlsext_opaque_prf_input_len);
2996                                 if (s->s3->server_opaque_prf_input == NULL)
2997                                         {
2998                                         ret = SSL_TLSEXT_ERR_ALERT_FATAL;
2999                                         al = SSL_AD_INTERNAL_ERROR;
3000                                         goto err;
3001                                         }
3002                                 s->s3->server_opaque_prf_input_len = s->tlsext_opaque_prf_input_len;
3003                                 }
3004                         }
3005
3006                 if (r == 2 && s->s3->server_opaque_prf_input == NULL)
3007                         {
3008                         /* The callback wants to enforce use of the extension,
3009                          * but we can't do that with the client opaque PRF input;
3010                          * abort the handshake.
3011                          */
3012                         ret = SSL_TLSEXT_ERR_ALERT_FATAL;
3013                         al = SSL_AD_HANDSHAKE_FAILURE;
3014                         }
3015         }
3016
3017  err:
3018 #endif
3019         switch (ret)
3020                 {
3021                 case SSL_TLSEXT_ERR_ALERT_FATAL:
3022                         ssl3_send_alert(s,SSL3_AL_FATAL,al);
3023                         return -1;
3024
3025                 case SSL_TLSEXT_ERR_ALERT_WARNING:
3026                         ssl3_send_alert(s,SSL3_AL_WARNING,al);
3027                         return 1;
3028
3029                 case SSL_TLSEXT_ERR_NOACK:
3030                         s->servername_done=0;
3031                         default:
3032                 return 1;
3033                 }
3034         }
3035
3036 int ssl_check_clienthello_tlsext_late(SSL *s)
3037         {
3038         int ret = SSL_TLSEXT_ERR_OK;
3039         int al;
3040
3041         /* If status request then ask callback what to do.
3042          * Note: this must be called after servername callbacks in case
3043          * the certificate has changed, and must be called after the cipher
3044          * has been chosen because this may influence which certificate is sent
3045          */
3046         if ((s->tlsext_status_type != -1) && s->ctx && s->ctx->tlsext_status_cb)
3047                 {
3048                 int r;
3049                 CERT_PKEY *certpkey;
3050                 certpkey = ssl_get_server_send_pkey(s);
3051                 /* If no certificate can't return certificate status */
3052                 if (certpkey == NULL)
3053                         {
3054                         s->tlsext_status_expected = 0;
3055                         return 1;
3056                         }
3057                 /* Set current certificate to one we will use so
3058                  * SSL_get_certificate et al can pick it up.
3059                  */
3060                 s->cert->key = certpkey;
3061                 r = s->ctx->tlsext_status_cb(s, s->ctx->tlsext_status_arg);
3062                 switch (r)
3063                         {
3064                         /* We don't want to send a status request response */
3065                         case SSL_TLSEXT_ERR_NOACK:
3066                                 s->tlsext_status_expected = 0;
3067                                 break;
3068                         /* status request response should be sent */
3069                         case SSL_TLSEXT_ERR_OK:
3070                                 if (s->tlsext_ocsp_resp)
3071                                         s->tlsext_status_expected = 1;
3072                                 else
3073                                         s->tlsext_status_expected = 0;
3074                                 break;
3075                         /* something bad happened */
3076                         case SSL_TLSEXT_ERR_ALERT_FATAL:
3077                                 ret = SSL_TLSEXT_ERR_ALERT_FATAL;
3078                                 al = SSL_AD_INTERNAL_ERROR;
3079                                 goto err;
3080                         }
3081                 }
3082         else
3083                 s->tlsext_status_expected = 0;
3084
3085  err:
3086         switch (ret)
3087                 {
3088                 case SSL_TLSEXT_ERR_ALERT_FATAL:
3089                         ssl3_send_alert(s, SSL3_AL_FATAL, al);
3090                         return -1;
3091
3092                 case SSL_TLSEXT_ERR_ALERT_WARNING:
3093                         ssl3_send_alert(s, SSL3_AL_WARNING, al);
3094                         return 1;
3095
3096                 default:
3097                         return 1;
3098                 }
3099         }
3100
3101 int ssl_check_serverhello_tlsext(SSL *s)
3102         {
3103         int ret=SSL_TLSEXT_ERR_NOACK;
3104         int al = SSL_AD_UNRECOGNIZED_NAME;
3105
3106 #ifndef OPENSSL_NO_EC
3107         /* If we are client and using an elliptic curve cryptography cipher
3108          * suite, then if server returns an EC point formats lists extension
3109          * it must contain uncompressed.
3110          */
3111         unsigned long alg_k = s->s3->tmp.new_cipher->algorithm_mkey;
3112         unsigned long alg_a = s->s3->tmp.new_cipher->algorithm_auth;
3113         if ((s->tlsext_ecpointformatlist != NULL) && (s->tlsext_ecpointformatlist_length > 0) &&
3114             (s->session->tlsext_ecpointformatlist != NULL) && (s->session->tlsext_ecpointformatlist_length > 0) &&
3115             ((alg_k & (SSL_kEECDH|SSL_kECDHr|SSL_kECDHe)) || (alg_a & SSL_aECDSA)))
3116                 {
3117                 /* we are using an ECC cipher */
3118                 size_t i;
3119                 unsigned char *list;
3120                 int found_uncompressed = 0;
3121                 list = s->session->tlsext_ecpointformatlist;
3122                 for (i = 0; i < s->session->tlsext_ecpointformatlist_length; i++)
3123                         {
3124                         if (*(list++) == TLSEXT_ECPOINTFORMAT_uncompressed)
3125                                 {
3126                                 found_uncompressed = 1;
3127                                 break;
3128                                 }
3129                         }
3130                 if (!found_uncompressed)
3131                         {
3132                         SSLerr(SSL_F_SSL_CHECK_SERVERHELLO_TLSEXT,SSL_R_TLS_INVALID_ECPOINTFORMAT_LIST);
3133                         return -1;
3134                         }
3135                 }
3136         ret = SSL_TLSEXT_ERR_OK;
3137 #endif /* OPENSSL_NO_EC */
3138
3139         if (s->ctx != NULL && s->ctx->tlsext_servername_callback != 0)
3140                 ret = s->ctx->tlsext_servername_callback(s, &al, s->ctx->tlsext_servername_arg);
3141         else if (s->initial_ctx != NULL && s->initial_ctx->tlsext_servername_callback != 0)
3142                 ret = s->initial_ctx->tlsext_servername_callback(s, &al, s->initial_ctx->tlsext_servername_arg);
3143
3144 #ifdef TLSEXT_TYPE_opaque_prf_input
3145         if (s->s3->server_opaque_prf_input_len > 0)
3146                 {
3147                 /* This case may indicate that we, as a client, want to insist on using opaque PRF inputs.
3148                  * So first verify that we really have a value from the server too. */
3149
3150                 if (s->s3->server_opaque_prf_input == NULL)
3151                         {
3152                         ret = SSL_TLSEXT_ERR_ALERT_FATAL;
3153                         al = SSL_AD_HANDSHAKE_FAILURE;
3154                         }
3155
3156                 /* Anytime the server *has* sent an opaque PRF input, we need to check
3157                  * that we have a client opaque PRF input of the same size. */
3158                 if (s->s3->client_opaque_prf_input == NULL ||
3159                     s->s3->client_opaque_prf_input_len != s->s3->server_opaque_prf_input_len)
3160                         {
3161                         ret = SSL_TLSEXT_ERR_ALERT_FATAL;
3162                         al = SSL_AD_ILLEGAL_PARAMETER;
3163                         }
3164                 }
3165 #endif
3166
3167         /* If we've requested certificate status and we wont get one
3168          * tell the callback
3169          */
3170         if ((s->tlsext_status_type != -1) && !(s->tlsext_status_expected)
3171                         && s->ctx && s->ctx->tlsext_status_cb)
3172                 {
3173                 int r;
3174                 /* Set resp to NULL, resplen to -1 so callback knows
3175                  * there is no response.
3176                  */
3177                 if (s->tlsext_ocsp_resp)
3178                         {
3179                         OPENSSL_free(s->tlsext_ocsp_resp);
3180                         s->tlsext_ocsp_resp = NULL;
3181                         }
3182                 s->tlsext_ocsp_resplen = -1;
3183                 r = s->ctx->tlsext_status_cb(s, s->ctx->tlsext_status_arg);
3184                 if (r == 0)
3185                         {
3186                         al = SSL_AD_BAD_CERTIFICATE_STATUS_RESPONSE;
3187                         ret = SSL_TLSEXT_ERR_ALERT_FATAL;
3188                         }
3189                 if (r < 0)
3190                         {
3191                         al = SSL_AD_INTERNAL_ERROR;
3192                         ret = SSL_TLSEXT_ERR_ALERT_FATAL;
3193                         }
3194                 }
3195
3196         switch (ret)
3197                 {
3198                 case SSL_TLSEXT_ERR_ALERT_FATAL:
3199                         ssl3_send_alert(s,SSL3_AL_FATAL,al);
3200                         return -1;
3201
3202                 case SSL_TLSEXT_ERR_ALERT_WARNING:
3203                         ssl3_send_alert(s,SSL3_AL_WARNING,al);
3204                         return 1;
3205
3206                 case SSL_TLSEXT_ERR_NOACK:
3207                         s->servername_done=0;
3208                         default:
3209                 return 1;
3210                 }
3211         }
3212
3213 int ssl_parse_serverhello_tlsext(SSL *s, unsigned char **p, unsigned char *d, int n)
3214         {
3215         int al = -1;
3216         if (s->version < SSL3_VERSION)
3217                 return 1;
3218         if (ssl_scan_serverhello_tlsext(s, p, d, n, &al) <= 0)
3219                 {
3220                 ssl3_send_alert(s,SSL3_AL_FATAL,al);
3221                 return 0;
3222                 }
3223
3224         if (ssl_check_serverhello_tlsext(s) <= 0)
3225                 {
3226                 SSLerr(SSL_F_SSL_PARSE_SERVERHELLO_TLSEXT,SSL_R_SERVERHELLO_TLSEXT);
3227                 return 0;
3228                 }
3229         return 1;
3230 }
3231
3232 /* Since the server cache lookup is done early on in the processing of the
3233  * ClientHello, and other operations depend on the result, we need to handle
3234  * any TLS session ticket extension at the same time.
3235  *
3236  *   session_id: points at the session ID in the ClientHello. This code will
3237  *       read past the end of this in order to parse out the session ticket
3238  *       extension, if any.
3239  *   len: the length of the session ID.
3240  *   limit: a pointer to the first byte after the ClientHello.
3241  *   ret: (output) on return, if a ticket was decrypted, then this is set to
3242  *       point to the resulting session.
3243  *
3244  * If s->tls_session_secret_cb is set then we are expecting a pre-shared key
3245  * ciphersuite, in which case we have no use for session tickets and one will
3246  * never be decrypted, nor will s->tlsext_ticket_expected be set to 1.
3247  *
3248  * Returns:
3249  *   -1: fatal error, either from parsing or decrypting the ticket.
3250  *    0: no ticket was found (or was ignored, based on settings).
3251  *    1: a zero length extension was found, indicating that the client supports
3252  *       session tickets but doesn't currently have one to offer.
3253  *    2: either s->tls_session_secret_cb was set, or a ticket was offered but
3254  *       couldn't be decrypted because of a non-fatal error.
3255  *    3: a ticket was successfully decrypted and *ret was set.
3256  *
3257  * Side effects:
3258  *   Sets s->tlsext_ticket_expected to 1 if the server will have to issue
3259  *   a new session ticket to the client because the client indicated support
3260  *   (and s->tls_session_secret_cb is NULL) but the client either doesn't have
3261  *   a session ticket or we couldn't use the one it gave us, or if
3262  *   s->ctx->tlsext_ticket_key_cb asked to renew the client's ticket.
3263  *   Otherwise, s->tlsext_ticket_expected is set to 0.
3264  */
3265 int tls1_process_ticket(SSL *s, unsigned char *session_id, int len,
3266                         const unsigned char *limit, SSL_SESSION **ret)
3267         {
3268         /* Point after session ID in client hello */
3269         const unsigned char *p = session_id + len;
3270         unsigned short i;
3271
3272         *ret = NULL;
3273         s->tlsext_ticket_expected = 0;
3274
3275         /* If tickets disabled behave as if no ticket present
3276          * to permit stateful resumption.
3277          */
3278         if (SSL_get_options(s) & SSL_OP_NO_TICKET)
3279                 return 0;
3280         if ((s->version <= SSL3_VERSION) || !limit)
3281                 return 0;
3282         if (p >= limit)
3283                 return -1;
3284         /* Skip past DTLS cookie */
3285         if (SSL_IS_DTLS(s))
3286                 {
3287                 i = *(p++);
3288                 p+= i;
3289                 if (p >= limit)
3290                         return -1;
3291                 }
3292         /* Skip past cipher list */
3293         n2s(p, i);
3294         p+= i;
3295         if (p >= limit)
3296                 return -1;
3297         /* Skip past compression algorithm list */
3298         i = *(p++);
3299         p += i;
3300         if (p > limit)
3301                 return -1;
3302         /* Now at start of extensions */
3303         if ((p + 2) >= limit)
3304                 return 0;
3305         n2s(p, i);
3306         while ((p + 4) <= limit)
3307                 {
3308                 unsigned short type, size;
3309                 n2s(p, type);
3310                 n2s(p, size);
3311                 if (p + size > limit)
3312                         return 0;
3313                 if (type == TLSEXT_TYPE_session_ticket)
3314                         {
3315                         int r;
3316                         if (size == 0)
3317                                 {
3318                                 /* The client will accept a ticket but doesn't
3319                                  * currently have one. */
3320                                 s->tlsext_ticket_expected = 1;
3321                                 return 1;
3322                                 }
3323                         if (s->tls_session_secret_cb)
3324                                 {
3325                                 /* Indicate that the ticket couldn't be
3326                                  * decrypted rather than generating the session
3327                                  * from ticket now, trigger abbreviated
3328                                  * handshake based on external mechanism to
3329                                  * calculate the master secret later. */
3330                                 return 2;
3331                                 }
3332                         r = tls_decrypt_ticket(s, p, size, session_id, len, ret);
3333                         switch (r)
3334                                 {
3335                                 case 2: /* ticket couldn't be decrypted */
3336                                         s->tlsext_ticket_expected = 1;
3337                                         return 2;
3338                                 case 3: /* ticket was decrypted */
3339                                         return r;
3340                                 case 4: /* ticket decrypted but need to renew */
3341                                         s->tlsext_ticket_expected = 1;
3342                                         return 3;
3343                                 default: /* fatal error */
3344                                         return -1;
3345                                 }
3346                         }
3347                 p += size;
3348                 }
3349         return 0;
3350         }
3351
3352 /* tls_decrypt_ticket attempts to decrypt a session ticket.
3353  *
3354  *   etick: points to the body of the session ticket extension.
3355  *   eticklen: the length of the session tickets extenion.
3356  *   sess_id: points at the session ID.
3357  *   sesslen: the length of the session ID.
3358  *   psess: (output) on return, if a ticket was decrypted, then this is set to
3359  *       point to the resulting session.
3360  *
3361  * Returns:
3362  *   -1: fatal error, either from parsing or decrypting the ticket.
3363  *    2: the ticket couldn't be decrypted.
3364  *    3: a ticket was successfully decrypted and *psess was set.
3365  *    4: same as 3, but the ticket needs to be renewed.
3366  */
3367 static int tls_decrypt_ticket(SSL *s, const unsigned char *etick, int eticklen,
3368                                 const unsigned char *sess_id, int sesslen,
3369                                 SSL_SESSION **psess)
3370         {
3371         SSL_SESSION *sess;
3372         unsigned char *sdec;
3373         const unsigned char *p;
3374         int slen, mlen, renew_ticket = 0;
3375         unsigned char tick_hmac[EVP_MAX_MD_SIZE];
3376         HMAC_CTX hctx;
3377         EVP_CIPHER_CTX ctx;
3378         SSL_CTX *tctx = s->initial_ctx;
3379         /* Need at least keyname + iv + some encrypted data */
3380         if (eticklen < 48)
3381                 return 2;
3382         /* Initialize session ticket encryption and HMAC contexts */
3383         HMAC_CTX_init(&hctx);
3384         EVP_CIPHER_CTX_init(&ctx);
3385         if (tctx->tlsext_ticket_key_cb)
3386                 {
3387                 unsigned char *nctick = (unsigned char *)etick;
3388                 int rv = tctx->tlsext_ticket_key_cb(s, nctick, nctick + 16,
3389                                                         &ctx, &hctx, 0);
3390                 if (rv < 0)
3391                         return -1;
3392                 if (rv == 0)
3393                         return 2;
3394                 if (rv == 2)
3395                         renew_ticket = 1;
3396                 }
3397         else
3398                 {
3399                 /* Check key name matches */
3400                 if (memcmp(etick, tctx->tlsext_tick_key_name, 16))
3401                         return 2;
3402                 HMAC_Init_ex(&hctx, tctx->tlsext_tick_hmac_key, 16,
3403                                         tlsext_tick_md(), NULL);
3404                 EVP_DecryptInit_ex(&ctx, EVP_aes_128_cbc(), NULL,
3405                                 tctx->tlsext_tick_aes_key, etick + 16);
3406                 }
3407         /* Attempt to process session ticket, first conduct sanity and
3408          * integrity checks on ticket.
3409          */
3410         mlen = HMAC_size(&hctx);
3411         if (mlen < 0)
3412                 {
3413                 EVP_CIPHER_CTX_cleanup(&ctx);
3414                 return -1;
3415                 }
3416         eticklen -= mlen;
3417         /* Check HMAC of encrypted ticket */
3418         HMAC_Update(&hctx, etick, eticklen);
3419         HMAC_Final(&hctx, tick_hmac, NULL);
3420         HMAC_CTX_cleanup(&hctx);
3421         if (CRYPTO_memcmp(tick_hmac, etick + eticklen, mlen))
3422                 return 2;
3423         /* Attempt to decrypt session data */
3424         /* Move p after IV to start of encrypted ticket, update length */
3425         p = etick + 16 + EVP_CIPHER_CTX_iv_length(&ctx);
3426         eticklen -= 16 + EVP_CIPHER_CTX_iv_length(&ctx);
3427         sdec = OPENSSL_malloc(eticklen);
3428         if (!sdec)
3429                 {
3430                 EVP_CIPHER_CTX_cleanup(&ctx);
3431                 return -1;
3432                 }
3433         EVP_DecryptUpdate(&ctx, sdec, &slen, p, eticklen);
3434         if (EVP_DecryptFinal(&ctx, sdec + slen, &mlen) <= 0)
3435                 return 2;
3436         slen += mlen;
3437         EVP_CIPHER_CTX_cleanup(&ctx);
3438         p = sdec;
3439
3440         sess = d2i_SSL_SESSION(NULL, &p, slen);
3441         OPENSSL_free(sdec);
3442         if (sess)
3443                 {
3444                 /* The session ID, if non-empty, is used by some clients to
3445                  * detect that the ticket has been accepted. So we copy it to
3446                  * the session structure. If it is empty set length to zero
3447                  * as required by standard.
3448                  */
3449                 if (sesslen)
3450                         memcpy(sess->session_id, sess_id, sesslen);
3451                 sess->session_id_length = sesslen;
3452                 *psess = sess;
3453                 if (renew_ticket)
3454                         return 4;
3455                 else
3456                         return 3;
3457                 }
3458         ERR_clear_error();
3459         /* For session parse failure, indicate that we need to send a new
3460          * ticket. */
3461         return 2;
3462         }
3463
3464 /* Tables to translate from NIDs to TLS v1.2 ids */
3465
3466 typedef struct
3467         {
3468         int nid;
3469         int id;
3470         } tls12_lookup;
3471
3472 static tls12_lookup tls12_md[] = {
3473         {NID_md5, TLSEXT_hash_md5},
3474         {NID_sha1, TLSEXT_hash_sha1},
3475         {NID_sha224, TLSEXT_hash_sha224},
3476         {NID_sha256, TLSEXT_hash_sha256},
3477         {NID_sha384, TLSEXT_hash_sha384},
3478         {NID_sha512, TLSEXT_hash_sha512}
3479 };
3480
3481 static tls12_lookup tls12_sig[] = {
3482         {EVP_PKEY_RSA, TLSEXT_signature_rsa},
3483         {EVP_PKEY_DSA, TLSEXT_signature_dsa},
3484         {EVP_PKEY_EC, TLSEXT_signature_ecdsa}
3485 };
3486
3487 static int tls12_find_id(int nid, tls12_lookup *table, size_t tlen)
3488         {
3489         size_t i;
3490         for (i = 0; i < tlen; i++)
3491                 {
3492                 if (table[i].nid == nid)
3493                         return table[i].id;
3494                 }
3495         return -1;
3496         }
3497
3498 static int tls12_find_nid(int id, tls12_lookup *table, size_t tlen)
3499         {
3500         size_t i;
3501         for (i = 0; i < tlen; i++)
3502                 {
3503                 if ((table[i].id) == id)
3504                         return table[i].nid;
3505                 }
3506         return NID_undef;
3507         }
3508
3509 int tls12_get_sigandhash(unsigned char *p, const EVP_PKEY *pk, const EVP_MD *md)
3510         {
3511         int sig_id, md_id;
3512         if (!md)
3513                 return 0;
3514         md_id = tls12_find_id(EVP_MD_type(md), tls12_md,
3515                                 sizeof(tls12_md)/sizeof(tls12_lookup));
3516         if (md_id == -1)
3517                 return 0;
3518         sig_id = tls12_get_sigid(pk);
3519         if (sig_id == -1)
3520                 return 0;
3521         p[0] = (unsigned char)md_id;
3522         p[1] = (unsigned char)sig_id;
3523         return 1;
3524         }
3525
3526 int tls12_get_sigid(const EVP_PKEY *pk)
3527         {
3528         return tls12_find_id(pk->type, tls12_sig,
3529                                 sizeof(tls12_sig)/sizeof(tls12_lookup));
3530         }
3531
3532 const EVP_MD *tls12_get_hash(unsigned char hash_alg)
3533         {
3534         switch(hash_alg)
3535                 {
3536 #ifndef OPENSSL_NO_MD5
3537                 case TLSEXT_hash_md5:
3538 #ifdef OPENSSL_FIPS
3539                 if (FIPS_mode())
3540                         return NULL;
3541 #endif
3542                 return EVP_md5();
3543 #endif
3544 #ifndef OPENSSL_NO_SHA
3545                 case TLSEXT_hash_sha1:
3546                 return EVP_sha1();
3547 #endif
3548 #ifndef OPENSSL_NO_SHA256
3549                 case TLSEXT_hash_sha224:
3550                 return EVP_sha224();
3551
3552                 case TLSEXT_hash_sha256:
3553                 return EVP_sha256();
3554 #endif
3555 #ifndef OPENSSL_NO_SHA512
3556                 case TLSEXT_hash_sha384:
3557                 return EVP_sha384();
3558
3559                 case TLSEXT_hash_sha512:
3560                 return EVP_sha512();
3561 #endif
3562                 default:
3563                 return NULL;
3564
3565                 }
3566         }
3567
3568 static int tls12_get_pkey_idx(unsigned char sig_alg)
3569         {
3570         switch(sig_alg)
3571                 {
3572 #ifndef OPENSSL_NO_RSA
3573         case TLSEXT_signature_rsa:
3574                 return SSL_PKEY_RSA_SIGN;
3575 #endif
3576 #ifndef OPENSSL_NO_DSA
3577         case TLSEXT_signature_dsa:
3578                 return SSL_PKEY_DSA_SIGN;
3579 #endif
3580 #ifndef OPENSSL_NO_ECDSA
3581         case TLSEXT_signature_ecdsa:
3582                 return SSL_PKEY_ECC;
3583 #endif
3584                 }
3585         return -1;
3586         }
3587
3588 /* Convert TLS 1.2 signature algorithm extension values into NIDs */
3589 static void tls1_lookup_sigalg(int *phash_nid, int *psign_nid,
3590                         int *psignhash_nid, const unsigned char *data)
3591         {
3592         int sign_nid = 0, hash_nid = 0;
3593         if (!phash_nid && !psign_nid && !psignhash_nid)
3594                 return;
3595         if (phash_nid || psignhash_nid)
3596                 {
3597                 hash_nid = tls12_find_nid(data[0], tls12_md,
3598                                         sizeof(tls12_md)/sizeof(tls12_lookup));
3599                 if (phash_nid)
3600                         *phash_nid = hash_nid;
3601                 }
3602         if (psign_nid || psignhash_nid)
3603                 {
3604                 sign_nid = tls12_find_nid(data[1], tls12_sig,
3605                                         sizeof(tls12_sig)/sizeof(tls12_lookup));
3606                 if (psign_nid)
3607                         *psign_nid = sign_nid;
3608                 }
3609         if (psignhash_nid)
3610                 {
3611                 if (sign_nid && hash_nid)
3612                         OBJ_find_sigid_by_algs(psignhash_nid,
3613                                                         hash_nid, sign_nid);
3614                 else
3615                         *psignhash_nid = NID_undef;
3616                 }
3617         }
3618 /* Given preference and allowed sigalgs set shared sigalgs */
3619 static int tls12_do_shared_sigalgs(TLS_SIGALGS *shsig,
3620                                 const unsigned char *pref, size_t preflen,
3621                                 const unsigned char *allow, size_t allowlen)
3622         {
3623         const unsigned char *ptmp, *atmp;
3624         size_t i, j, nmatch = 0;
3625         for (i = 0, ptmp = pref; i < preflen; i+=2, ptmp+=2)
3626                 {
3627                 /* Skip disabled hashes or signature algorithms */
3628                 if (tls12_get_hash(ptmp[0]) == NULL)
3629                         continue;
3630                 if (tls12_get_pkey_idx(ptmp[1]) == -1)
3631                         continue;
3632                 for (j = 0, atmp = allow; j < allowlen; j+=2, atmp+=2)
3633                         {
3634                         if (ptmp[0] == atmp[0] && ptmp[1] == atmp[1])
3635                                 {
3636                                 nmatch++;
3637                                 if (shsig)
3638                                         {
3639                                         shsig->rhash = ptmp[0];
3640                                         shsig->rsign = ptmp[1];
3641                                         tls1_lookup_sigalg(&shsig->hash_nid,
3642                                                 &shsig->sign_nid,
3643                                                 &shsig->signandhash_nid,
3644                                                 ptmp);
3645                                         shsig++;
3646                                         }
3647                                 break;
3648                                 }
3649                         }
3650                 }
3651         return nmatch;
3652         }
3653
3654 /* Set shared signature algorithms for SSL structures */
3655 static int tls1_set_shared_sigalgs(SSL *s)
3656         {
3657         const unsigned char *pref, *allow, *conf;
3658         size_t preflen, allowlen, conflen;
3659         size_t nmatch;
3660         TLS_SIGALGS *salgs = NULL;
3661         CERT *c = s->cert;
3662         unsigned int is_suiteb = tls1_suiteb(s);
3663         /* If client use client signature algorithms if not NULL */
3664         if (!s->server && c->client_sigalgs && !is_suiteb)
3665                 {
3666                 conf = c->client_sigalgs;
3667                 conflen = c->client_sigalgslen;
3668                 }
3669         else if (c->conf_sigalgs && !is_suiteb)
3670                 {
3671                 conf = c->conf_sigalgs;
3672                 conflen = c->conf_sigalgslen;
3673                 }
3674         else
3675                 conflen = tls12_get_psigalgs(s, &conf);
3676         if(s->options & SSL_OP_CIPHER_SERVER_PREFERENCE || is_suiteb)
3677                 {
3678                 pref = conf;
3679                 preflen = conflen;
3680                 allow = c->peer_sigalgs;
3681                 allowlen = c->peer_sigalgslen;
3682                 }
3683         else
3684                 {
3685                 allow = conf;
3686                 allowlen = conflen;
3687                 pref = c->peer_sigalgs;
3688                 preflen = c->peer_sigalgslen;
3689                 }
3690         nmatch = tls12_do_shared_sigalgs(NULL, pref, preflen, allow, allowlen);
3691         if (!nmatch)
3692                 return 1;
3693         salgs = OPENSSL_malloc(nmatch * sizeof(TLS_SIGALGS));
3694         if (!salgs)
3695                 return 0;
3696         nmatch = tls12_do_shared_sigalgs(salgs, pref, preflen, allow, allowlen);
3697         c->shared_sigalgs = salgs;
3698         c->shared_sigalgslen = nmatch;
3699         return 1;
3700         }
3701
3702
3703 /* Set preferred digest for each key type */
3704
3705 int tls1_process_sigalgs(SSL *s, const unsigned char *data, int dsize)
3706         {
3707         int idx;
3708         size_t i;
3709         const EVP_MD *md;
3710         CERT *c = s->cert;
3711         TLS_SIGALGS *sigptr;
3712         /* Extension ignored for inappropriate versions */
3713         if (!SSL_USE_SIGALGS(s))
3714                 return 1;
3715         /* Should never happen */
3716         if (!c)
3717                 return 0;
3718
3719         c->peer_sigalgs = OPENSSL_malloc(dsize);
3720         if (!c->peer_sigalgs)
3721                 return 0;
3722         c->peer_sigalgslen = dsize;
3723         memcpy(c->peer_sigalgs, data, dsize);
3724
3725         tls1_set_shared_sigalgs(s);
3726
3727 #ifdef OPENSSL_SSL_DEBUG_BROKEN_PROTOCOL
3728         if (s->cert->cert_flags & SSL_CERT_FLAG_BROKEN_PROTOCOL)
3729                 {
3730                 /* Use first set signature preference to force message
3731                  * digest, ignoring any peer preferences.
3732                  */
3733                 const unsigned char *sigs = NULL;
3734                 if (s->server)
3735                         sigs = c->conf_sigalgs;
3736                 else
3737                         sigs = c->client_sigalgs;
3738                 if (sigs)
3739                         {
3740                         idx = tls12_get_pkey_idx(sigs[1]);
3741                         md = tls12_get_hash(sigs[0]);
3742                         c->pkeys[idx].digest = md;
3743                         c->pkeys[idx].valid_flags = CERT_PKEY_EXPLICIT_SIGN;
3744                         if (idx == SSL_PKEY_RSA_SIGN)
3745                                 {
3746                                 c->pkeys[SSL_PKEY_RSA_ENC].valid_flags = CERT_PKEY_EXPLICIT_SIGN;
3747                                 c->pkeys[SSL_PKEY_RSA_ENC].digest = md;
3748                                 }
3749                         }
3750                 }
3751 #endif
3752
3753         for (i = 0, sigptr = c->shared_sigalgs;
3754                         i < c->shared_sigalgslen; i++, sigptr++)
3755                 {
3756                 idx = tls12_get_pkey_idx(sigptr->rsign);
3757                 if (idx > 0 && c->pkeys[idx].digest == NULL)
3758                         {
3759                         md = tls12_get_hash(sigptr->rhash);
3760                         c->pkeys[idx].digest = md;
3761                         c->pkeys[idx].valid_flags = CERT_PKEY_EXPLICIT_SIGN;
3762                         if (idx == SSL_PKEY_RSA_SIGN)
3763                                 {
3764                                 c->pkeys[SSL_PKEY_RSA_ENC].valid_flags = CERT_PKEY_EXPLICIT_SIGN;
3765                                 c->pkeys[SSL_PKEY_RSA_ENC].digest = md;
3766                                 }
3767                         }
3768
3769                 }
3770         /* In strict mode leave unset digests as NULL to indicate we can't
3771          * use the certificate for signing.
3772          */
3773         if (!(s->cert->cert_flags & SSL_CERT_FLAGS_CHECK_TLS_STRICT))
3774                 {
3775                 /* Set any remaining keys to default values. NOTE: if alg is
3776                  * not supported it stays as NULL.
3777                  */
3778 #ifndef OPENSSL_NO_DSA
3779                 if (!c->pkeys[SSL_PKEY_DSA_SIGN].digest)
3780                         c->pkeys[SSL_PKEY_DSA_SIGN].digest = EVP_sha1();
3781 #endif
3782 #ifndef OPENSSL_NO_RSA
3783                 if (!c->pkeys[SSL_PKEY_RSA_SIGN].digest)
3784                         {
3785                         c->pkeys[SSL_PKEY_RSA_SIGN].digest = EVP_sha1();
3786                         c->pkeys[SSL_PKEY_RSA_ENC].digest = EVP_sha1();
3787                         }
3788 #endif
3789 #ifndef OPENSSL_NO_ECDSA
3790                 if (!c->pkeys[SSL_PKEY_ECC].digest)
3791                         c->pkeys[SSL_PKEY_ECC].digest = EVP_sha1();
3792 #endif
3793                 }
3794         return 1;
3795         }
3796
3797
3798 int SSL_get_sigalgs(SSL *s, int idx,
3799                         int *psign, int *phash, int *psignhash,
3800                         unsigned char *rsig, unsigned char *rhash)
3801         {
3802         const unsigned char *psig = s->cert->peer_sigalgs;
3803         if (psig == NULL)
3804                 return 0;
3805         if (idx >= 0)
3806                 {
3807                 idx <<= 1;
3808                 if (idx >= (int)s->cert->peer_sigalgslen)
3809                         return 0;
3810                 psig += idx;
3811                 if (rhash)
3812                         *rhash = psig[0];
3813                 if (rsig)
3814                         *rsig = psig[1];
3815                 tls1_lookup_sigalg(phash, psign, psignhash, psig);
3816                 }
3817         return s->cert->peer_sigalgslen / 2;
3818         }
3819
3820 int SSL_get_shared_sigalgs(SSL *s, int idx,
3821                         int *psign, int *phash, int *psignhash,
3822                         unsigned char *rsig, unsigned char *rhash)
3823         {
3824         TLS_SIGALGS *shsigalgs = s->cert->shared_sigalgs;
3825         if (!shsigalgs || idx >= (int)s->cert->shared_sigalgslen)
3826                 return 0;
3827         shsigalgs += idx;
3828         if (phash)
3829                 *phash = shsigalgs->hash_nid;
3830         if (psign)
3831                 *psign = shsigalgs->sign_nid;
3832         if (psignhash)
3833                 *psignhash = shsigalgs->signandhash_nid;
3834         if (rsig)
3835                 *rsig = shsigalgs->rsign;
3836         if (rhash)
3837                 *rhash = shsigalgs->rhash;
3838         return s->cert->shared_sigalgslen;
3839         }
3840
3841
3842 #ifndef OPENSSL_NO_HEARTBEATS
3843 int
3844 tls1_process_heartbeat(SSL *s)
3845         {
3846         unsigned char *p = &s->s3->rrec.data[0], *pl;
3847         unsigned short hbtype;
3848         unsigned int payload;
3849         unsigned int padding = 16; /* Use minimum padding */
3850
3851         /* Read type and payload length first */
3852         hbtype = *p++;
3853         n2s(p, payload);
3854         pl = p;
3855
3856         if (s->msg_callback)
3857                 s->msg_callback(0, s->version, TLS1_RT_HEARTBEAT,
3858                         &s->s3->rrec.data[0], s->s3->rrec.length,
3859                         s, s->msg_callback_arg);
3860
3861         if (hbtype == TLS1_HB_REQUEST)
3862                 {
3863                 unsigned char *buffer, *bp;
3864                 int r;
3865
3866                 /* Allocate memory for the response, size is 1 bytes
3867                  * message type, plus 2 bytes payload length, plus
3868                  * payload, plus padding
3869                  */
3870                 buffer = OPENSSL_malloc(1 + 2 + payload + padding);
3871                 bp = buffer;
3872
3873                 /* Enter response type, length and copy payload */
3874                 *bp++ = TLS1_HB_RESPONSE;
3875                 s2n(payload, bp);
3876                 memcpy(bp, pl, payload);
3877                 bp += payload;
3878                 /* Random padding */
3879                 RAND_pseudo_bytes(bp, padding);
3880
3881                 r = ssl3_write_bytes(s, TLS1_RT_HEARTBEAT, buffer, 3 + payload + padding);
3882
3883                 if (r >= 0 && s->msg_callback)
3884                         s->msg_callback(1, s->version, TLS1_RT_HEARTBEAT,
3885                                 buffer, 3 + payload + padding,
3886                                 s, s->msg_callback_arg);
3887
3888                 OPENSSL_free(buffer);
3889
3890                 if (r < 0)
3891                         return r;
3892                 }
3893         else if (hbtype == TLS1_HB_RESPONSE)
3894                 {
3895                 unsigned int seq;
3896
3897                 /* We only send sequence numbers (2 bytes unsigned int),
3898                  * and 16 random bytes, so we just try to read the
3899                  * sequence number */
3900                 n2s(pl, seq);
3901
3902                 if (payload == 18 && seq == s->tlsext_hb_seq)
3903                         {
3904                         s->tlsext_hb_seq++;
3905                         s->tlsext_hb_pending = 0;
3906                         }
3907                 }
3908
3909         return 0;
3910         }
3911
3912 int
3913 tls1_heartbeat(SSL *s)
3914         {
3915         unsigned char *buf, *p;
3916         int ret;
3917         unsigned int payload = 18; /* Sequence number + random bytes */
3918         unsigned int padding = 16; /* Use minimum padding */
3919
3920         /* Only send if peer supports and accepts HB requests... */
3921         if (!(s->tlsext_heartbeat & SSL_TLSEXT_HB_ENABLED) ||
3922             s->tlsext_heartbeat & SSL_TLSEXT_HB_DONT_SEND_REQUESTS)
3923                 {
3924                 SSLerr(SSL_F_TLS1_HEARTBEAT,SSL_R_TLS_HEARTBEAT_PEER_DOESNT_ACCEPT);
3925                 return -1;
3926                 }
3927
3928         /* ...and there is none in flight yet... */
3929         if (s->tlsext_hb_pending)
3930                 {
3931                 SSLerr(SSL_F_TLS1_HEARTBEAT,SSL_R_TLS_HEARTBEAT_PENDING);
3932                 return -1;
3933                 }
3934
3935         /* ...and no handshake in progress. */
3936         if (SSL_in_init(s) || s->in_handshake)
3937                 {
3938                 SSLerr(SSL_F_TLS1_HEARTBEAT,SSL_R_UNEXPECTED_MESSAGE);
3939                 return -1;
3940                 }
3941
3942         /* Check if padding is too long, payload and padding
3943          * must not exceed 2^14 - 3 = 16381 bytes in total.
3944          */
3945         OPENSSL_assert(payload + padding <= 16381);
3946
3947         /* Create HeartBeat message, we just use a sequence number
3948          * as payload to distuingish different messages and add
3949          * some random stuff.
3950          *  - Message Type, 1 byte
3951          *  - Payload Length, 2 bytes (unsigned int)
3952          *  - Payload, the sequence number (2 bytes uint)
3953          *  - Payload, random bytes (16 bytes uint)
3954          *  - Padding
3955          */
3956         buf = OPENSSL_malloc(1 + 2 + payload + padding);
3957         p = buf;
3958         /* Message Type */
3959         *p++ = TLS1_HB_REQUEST;
3960         /* Payload length (18 bytes here) */
3961         s2n(payload, p);
3962         /* Sequence number */
3963         s2n(s->tlsext_hb_seq, p);
3964         /* 16 random bytes */
3965         RAND_pseudo_bytes(p, 16);
3966         p += 16;
3967         /* Random padding */
3968         RAND_pseudo_bytes(p, padding);
3969
3970         ret = ssl3_write_bytes(s, TLS1_RT_HEARTBEAT, buf, 3 + payload + padding);
3971         if (ret >= 0)
3972                 {
3973                 if (s->msg_callback)
3974                         s->msg_callback(1, s->version, TLS1_RT_HEARTBEAT,
3975                                 buf, 3 + payload + padding,
3976                                 s, s->msg_callback_arg);
3977
3978                 s->tlsext_hb_pending = 1;
3979                 }
3980
3981         OPENSSL_free(buf);
3982
3983         return ret;
3984         }
3985 #endif
3986
3987 #define MAX_SIGALGLEN   (TLSEXT_hash_num * TLSEXT_signature_num * 2)
3988
3989 typedef struct
3990         {
3991         size_t sigalgcnt;
3992         int sigalgs[MAX_SIGALGLEN];
3993         } sig_cb_st;
3994
3995 static int sig_cb(const char *elem, int len, void *arg)
3996         {
3997         sig_cb_st *sarg = arg;
3998         size_t i;
3999         char etmp[20], *p;
4000         int sig_alg, hash_alg;
4001         if (sarg->sigalgcnt == MAX_SIGALGLEN)
4002                 return 0;
4003         if (len > (int)(sizeof(etmp) - 1))
4004                 return 0;
4005         memcpy(etmp, elem, len);
4006         etmp[len] = 0;
4007         p = strchr(etmp, '+');
4008         if (!p)
4009                 return 0;
4010         *p = 0;
4011         p++;
4012         if (!*p)
4013                 return 0;
4014
4015         if (!strcmp(etmp, "RSA"))
4016                 sig_alg = EVP_PKEY_RSA;
4017         else if (!strcmp(etmp, "DSA"))
4018                 sig_alg = EVP_PKEY_DSA;
4019         else if (!strcmp(etmp, "ECDSA"))
4020                 sig_alg = EVP_PKEY_EC;
4021         else return 0;
4022
4023         hash_alg = OBJ_sn2nid(p);
4024         if (hash_alg == NID_undef)
4025                 hash_alg = OBJ_ln2nid(p);
4026         if (hash_alg == NID_undef)
4027                 return 0;
4028
4029         for (i = 0; i < sarg->sigalgcnt; i+=2)
4030                 {
4031                 if (sarg->sigalgs[i] == sig_alg
4032                         && sarg->sigalgs[i + 1] == hash_alg)
4033                         return 0;
4034                 }
4035         sarg->sigalgs[sarg->sigalgcnt++] = hash_alg;
4036         sarg->sigalgs[sarg->sigalgcnt++] = sig_alg;
4037         return 1;
4038         }
4039
4040 /* Set suppored signature algorithms based on a colon separated list
4041  * of the form sig+hash e.g. RSA+SHA512:DSA+SHA512 */
4042 int tls1_set_sigalgs_list(CERT *c, const char *str, int client)
4043         {
4044         sig_cb_st sig;
4045         sig.sigalgcnt = 0;
4046         if (!CONF_parse_list(str, ':', 1, sig_cb, &sig))
4047                 return 0;
4048         if (c == NULL)
4049                 return 1;
4050         return tls1_set_sigalgs(c, sig.sigalgs, sig.sigalgcnt, client);
4051         }
4052
4053 int tls1_set_sigalgs(CERT *c, const int *psig_nids, size_t salglen, int client)
4054         {
4055         unsigned char *sigalgs, *sptr;
4056         int rhash, rsign;
4057         size_t i;
4058         if (salglen & 1)
4059                 return 0;
4060         sigalgs = OPENSSL_malloc(salglen);
4061         if (sigalgs == NULL)
4062                 return 0;
4063         for (i = 0, sptr = sigalgs; i < salglen; i+=2)
4064                 {
4065                 rhash = tls12_find_id(*psig_nids++, tls12_md,
4066                                         sizeof(tls12_md)/sizeof(tls12_lookup));
4067                 rsign = tls12_find_id(*psig_nids++, tls12_sig,
4068                                 sizeof(tls12_sig)/sizeof(tls12_lookup));
4069
4070                 if (rhash == -1 || rsign == -1)
4071                         goto err;
4072                 *sptr++ = rhash;
4073                 *sptr++ = rsign;
4074                 }
4075
4076         if (client)
4077                 {
4078                 if (c->client_sigalgs)
4079                         OPENSSL_free(c->client_sigalgs);
4080                 c->client_sigalgs = sigalgs;
4081                 c->client_sigalgslen = salglen;
4082                 }
4083         else
4084                 {
4085                 if (c->conf_sigalgs)
4086                         OPENSSL_free(c->conf_sigalgs);
4087                 c->conf_sigalgs = sigalgs;
4088                 c->conf_sigalgslen = salglen;
4089                 }
4090
4091         return 1;
4092
4093         err:
4094         OPENSSL_free(sigalgs);
4095         return 0;
4096         }
4097
4098 static int tls1_check_sig_alg(CERT *c, X509 *x, int default_nid)
4099         {
4100         int sig_nid;
4101         size_t i;
4102         if (default_nid == -1)
4103                 return 1;
4104         sig_nid = X509_get_signature_nid(x);
4105         if (default_nid)
4106                 return sig_nid == default_nid ? 1 : 0;
4107         for (i = 0; i < c->shared_sigalgslen; i++)
4108                 if (sig_nid == c->shared_sigalgs[i].signandhash_nid)
4109                         return 1;
4110         return 0;
4111         }
4112 /* Check to see if a certificate issuer name matches list of CA names */
4113 static int ssl_check_ca_name(STACK_OF(X509_NAME) *names, X509 *x)
4114         {
4115         X509_NAME *nm;
4116         int i;
4117         nm = X509_get_issuer_name(x);
4118         for (i = 0; i < sk_X509_NAME_num(names); i++)
4119                 {
4120                 if(!X509_NAME_cmp(nm, sk_X509_NAME_value(names, i)))
4121                         return 1;
4122                 }
4123         return 0;
4124         }
4125
4126 /* Check certificate chain is consistent with TLS extensions and is
4127  * usable by server. This servers two purposes: it allows users to
4128  * check chains before passing them to the server and it allows the
4129  * server to check chains before attempting to use them.
4130  */
4131
4132 /* Flags which need to be set for a certificate when stict mode not set */
4133
4134 #define CERT_PKEY_VALID_FLAGS \
4135         (CERT_PKEY_EE_SIGNATURE|CERT_PKEY_EE_PARAM)
4136 /* Strict mode flags */
4137 #define CERT_PKEY_STRICT_FLAGS \
4138          (CERT_PKEY_VALID_FLAGS|CERT_PKEY_CA_SIGNATURE|CERT_PKEY_CA_PARAM \
4139          | CERT_PKEY_ISSUER_NAME|CERT_PKEY_CERT_TYPE)
4140
4141 int tls1_check_chain(SSL *s, X509 *x, EVP_PKEY *pk, STACK_OF(X509) *chain,
4142                                                                         int idx)
4143         {
4144         int i;
4145         int rv = 0;
4146         int check_flags = 0, strict_mode;
4147         CERT_PKEY *cpk = NULL;
4148         CERT *c = s->cert;
4149         unsigned int suiteb_flags = tls1_suiteb(s);
4150         /* idx == -1 means checking server chains */
4151         if (idx != -1)
4152                 {
4153                 /* idx == -2 means checking client certificate chains */
4154                 if (idx == -2)
4155                         {
4156                         cpk = c->key;
4157                         idx = cpk - c->pkeys;
4158                         }
4159                 else
4160                         cpk = c->pkeys + idx;
4161                 x = cpk->x509;
4162                 pk = cpk->privatekey;
4163                 chain = cpk->chain;
4164                 strict_mode = c->cert_flags & SSL_CERT_FLAGS_CHECK_TLS_STRICT;
4165                 /* If no cert or key, forget it */
4166                 if (!x || !pk)
4167                         goto end;
4168 #ifdef OPENSSL_SSL_DEBUG_BROKEN_PROTOCOL
4169                 /* Allow any certificate to pass test */
4170                 if (s->cert->cert_flags & SSL_CERT_FLAG_BROKEN_PROTOCOL)
4171                         {
4172                         rv = CERT_PKEY_STRICT_FLAGS|CERT_PKEY_EXPLICIT_SIGN|CERT_PKEY_VALID|CERT_PKEY_SIGN;
4173                         cpk->valid_flags = rv;
4174                         return rv;
4175                         }
4176 #endif
4177                 }
4178         else
4179                 {
4180                 if (!x || !pk)
4181                         goto end;
4182                 idx = ssl_cert_type(x, pk);
4183                 if (idx == -1)
4184                         goto end;
4185                 cpk = c->pkeys + idx;
4186                 if (c->cert_flags & SSL_CERT_FLAGS_CHECK_TLS_STRICT)
4187                         check_flags = CERT_PKEY_STRICT_FLAGS;
4188                 else
4189                         check_flags = CERT_PKEY_VALID_FLAGS;
4190                 strict_mode = 1;
4191                 }
4192
4193         if (suiteb_flags)
4194                 {
4195                 int ok;
4196                 if (check_flags)
4197                         check_flags |= CERT_PKEY_SUITEB;
4198                 ok = X509_chain_check_suiteb(NULL, x, chain, suiteb_flags);
4199                 if (ok != X509_V_OK)
4200                         {
4201                         if (check_flags)
4202                                 rv |= CERT_PKEY_SUITEB;
4203                         else
4204                                 goto end;
4205                         }
4206                 }
4207
4208         /* Check all signature algorithms are consistent with
4209          * signature algorithms extension if TLS 1.2 or later
4210          * and strict mode.
4211          */
4212         if (TLS1_get_version(s) >= TLS1_2_VERSION && strict_mode)
4213                 {
4214                 int default_nid;
4215                 unsigned char rsign = 0;
4216                 if (c->peer_sigalgs)
4217                         default_nid = 0;
4218                 /* If no sigalgs extension use defaults from RFC5246 */
4219                 else
4220                         {
4221                         switch(idx)
4222                                 {
4223                         case SSL_PKEY_RSA_ENC:
4224                         case SSL_PKEY_RSA_SIGN:
4225                         case SSL_PKEY_DH_RSA:
4226                                 rsign = TLSEXT_signature_rsa;
4227                                 default_nid = NID_sha1WithRSAEncryption;
4228                                 break;
4229
4230                         case SSL_PKEY_DSA_SIGN:
4231                         case SSL_PKEY_DH_DSA:
4232                                 rsign = TLSEXT_signature_dsa;
4233                                 default_nid = NID_dsaWithSHA1;
4234                                 break;
4235
4236                         case SSL_PKEY_ECC:
4237                                 rsign = TLSEXT_signature_ecdsa;
4238                                 default_nid = NID_ecdsa_with_SHA1;
4239                                 break;
4240
4241                         default:
4242                                 default_nid = -1;
4243                                 break;
4244                                 }
4245                         }
4246                 /* If peer sent no signature algorithms extension and we
4247                  * have set preferred signature algorithms check we support
4248                  * sha1.
4249                  */
4250                 if (default_nid > 0 && c->conf_sigalgs)
4251                         {
4252                         size_t j;
4253                         const unsigned char *p = c->conf_sigalgs;
4254                         for (j = 0; j < c->conf_sigalgslen; j += 2, p += 2)
4255                                 {
4256                                 if (p[0] == TLSEXT_hash_sha1 && p[1] == rsign)
4257                                         break;
4258                                 }
4259                         if (j == c->conf_sigalgslen)
4260                                 {
4261                                 if (check_flags)
4262                                         goto skip_sigs;
4263                                 else
4264                                         goto end;
4265                                 }
4266                         }
4267                 /* Check signature algorithm of each cert in chain */
4268                 if (!tls1_check_sig_alg(c, x, default_nid))
4269                         {
4270                         if (!check_flags) goto end;
4271                         }
4272                 else
4273                         rv |= CERT_PKEY_EE_SIGNATURE;
4274                 rv |= CERT_PKEY_CA_SIGNATURE;
4275                 for (i = 0; i < sk_X509_num(chain); i++)
4276                         {
4277                         if (!tls1_check_sig_alg(c, sk_X509_value(chain, i),
4278                                                         default_nid))
4279                                 {
4280                                 if (check_flags)
4281                                         {
4282                                         rv &= ~CERT_PKEY_CA_SIGNATURE;
4283                                         break;
4284                                         }
4285                                 else
4286                                         goto end;
4287                                 }
4288                         }
4289                 }
4290         /* Else not TLS 1.2, so mark EE and CA signing algorithms OK */
4291         else if(check_flags)
4292                 rv |= CERT_PKEY_EE_SIGNATURE|CERT_PKEY_CA_SIGNATURE;
4293         skip_sigs:
4294         /* Check cert parameters are consistent */
4295         if (tls1_check_cert_param(s, x, check_flags ? 1 : 2))
4296                 rv |= CERT_PKEY_EE_PARAM;
4297         else if (!check_flags)
4298                 goto end;
4299         if (!s->server)
4300                 rv |= CERT_PKEY_CA_PARAM;
4301         /* In strict mode check rest of chain too */
4302         else if (strict_mode)
4303                 {
4304                 rv |= CERT_PKEY_CA_PARAM;
4305                 for (i = 0; i < sk_X509_num(chain); i++)
4306                         {
4307                         X509 *ca = sk_X509_value(chain, i);
4308                         if (!tls1_check_cert_param(s, ca, 0))
4309                                 {
4310                                 if (check_flags)
4311                                         {
4312                                         rv &= ~CERT_PKEY_CA_PARAM;
4313                                         break;
4314                                         }
4315                                 else
4316                                         goto end;
4317                                 }
4318                         }
4319                 }
4320         if (!s->server && strict_mode)
4321                 {
4322                 STACK_OF(X509_NAME) *ca_dn;
4323                 int check_type = 0;
4324                 switch (pk->type)
4325                         {
4326                 case EVP_PKEY_RSA:
4327                         check_type = TLS_CT_RSA_SIGN;
4328                         break;
4329                 case EVP_PKEY_DSA:
4330                         check_type = TLS_CT_DSS_SIGN;
4331                         break;
4332                 case EVP_PKEY_EC:
4333                         check_type = TLS_CT_ECDSA_SIGN;
4334                         break;
4335                 case EVP_PKEY_DH:
4336                 case EVP_PKEY_DHX:
4337                                 {
4338                                 int cert_type = X509_certificate_type(x, pk);
4339                                 if (cert_type & EVP_PKS_RSA)
4340                                         check_type = TLS_CT_RSA_FIXED_DH;
4341                                 if (cert_type & EVP_PKS_DSA)
4342                                         check_type = TLS_CT_DSS_FIXED_DH;
4343                                 }
4344                         }
4345                 if (check_type)
4346                         {
4347                         const unsigned char *ctypes;
4348                         int ctypelen;
4349                         if (c->ctypes)
4350                                 {
4351                                 ctypes = c->ctypes;
4352                                 ctypelen = (int)c->ctype_num;
4353                                 }
4354                         else
4355                                 {
4356                                 ctypes = (unsigned char *)s->s3->tmp.ctype;
4357                                 ctypelen = s->s3->tmp.ctype_num;
4358                                 }
4359                         for (i = 0; i < ctypelen; i++)
4360                                 {
4361                                 if (ctypes[i] == check_type)
4362                                         {
4363                                         rv |= CERT_PKEY_CERT_TYPE;
4364                                         break;
4365                                         }
4366                                 }
4367                         if (!(rv & CERT_PKEY_CERT_TYPE) && !check_flags)
4368                                 goto end;
4369                         }
4370                 else
4371                         rv |= CERT_PKEY_CERT_TYPE;
4372
4373
4374                 ca_dn = s->s3->tmp.ca_names;
4375
4376                 if (!sk_X509_NAME_num(ca_dn))
4377                         rv |= CERT_PKEY_ISSUER_NAME;
4378
4379                 if (!(rv & CERT_PKEY_ISSUER_NAME))
4380                         {
4381                         if (ssl_check_ca_name(ca_dn, x))
4382                                 rv |= CERT_PKEY_ISSUER_NAME;
4383                         }
4384                 if (!(rv & CERT_PKEY_ISSUER_NAME))
4385                         {
4386                         for (i = 0; i < sk_X509_num(chain); i++)
4387                                 {
4388                                 X509 *xtmp = sk_X509_value(chain, i);
4389                                 if (ssl_check_ca_name(ca_dn, xtmp))
4390                                         {
4391                                         rv |= CERT_PKEY_ISSUER_NAME;
4392                                         break;
4393                                         }
4394                                 }
4395                         }
4396                 if (!check_flags && !(rv & CERT_PKEY_ISSUER_NAME))
4397                         goto end;
4398                 }
4399         else
4400                 rv |= CERT_PKEY_ISSUER_NAME|CERT_PKEY_CERT_TYPE;
4401
4402         if (!check_flags || (rv & check_flags) == check_flags)
4403                 rv |= CERT_PKEY_VALID;
4404
4405         end:
4406
4407         if (TLS1_get_version(s) >= TLS1_2_VERSION)
4408                 {
4409                 if (cpk->valid_flags & CERT_PKEY_EXPLICIT_SIGN)
4410                         rv |= CERT_PKEY_EXPLICIT_SIGN|CERT_PKEY_SIGN;
4411                 else if (cpk->digest)
4412                         rv |= CERT_PKEY_SIGN;
4413                 }
4414         else
4415                 rv |= CERT_PKEY_SIGN|CERT_PKEY_EXPLICIT_SIGN;
4416
4417         /* When checking a CERT_PKEY structure all flags are irrelevant
4418          * if the chain is invalid.
4419          */
4420         if (!check_flags)
4421                 {
4422                 if (rv & CERT_PKEY_VALID)
4423                         cpk->valid_flags = rv;
4424                 else
4425                         {
4426                         /* Preserve explicit sign flag, clear rest */
4427                         cpk->valid_flags &= CERT_PKEY_EXPLICIT_SIGN;
4428                         return 0;
4429                         }
4430                 }
4431         return rv;
4432         }
4433
4434 /* Set validity of certificates in an SSL structure */
4435 void tls1_set_cert_validity(SSL *s)
4436         {
4437         tls1_check_chain(s, NULL, NULL, NULL, SSL_PKEY_RSA_ENC);
4438         tls1_check_chain(s, NULL, NULL, NULL, SSL_PKEY_RSA_SIGN);
4439         tls1_check_chain(s, NULL, NULL, NULL, SSL_PKEY_DSA_SIGN);
4440         tls1_check_chain(s, NULL, NULL, NULL, SSL_PKEY_DH_RSA);
4441         tls1_check_chain(s, NULL, NULL, NULL, SSL_PKEY_DH_DSA);
4442         tls1_check_chain(s, NULL, NULL, NULL, SSL_PKEY_ECC);
4443         }
4444 /* User level utiity function to check a chain is suitable */
4445 int SSL_check_chain(SSL *s, X509 *x, EVP_PKEY *pk, STACK_OF(X509) *chain)
4446         {
4447         return tls1_check_chain(s, x, pk, chain, -1);
4448         }
4449
4450 #endif