ssl/t1_lib.c

   1 /* ssl/t1_lib.c */
   2 /* Copyright (C) 1995-1998 Eric Young (eay@cryptsoft.com)
   3  * All rights reserved.
   4  *
   5  * This package is an SSL implementation written
   6  * by Eric Young (eay@cryptsoft.com).
   7  * The implementation was written so as to conform with Netscapes SSL.
   8  *
   9  * This library is free for commercial and non-commercial use as long as
  10  * the following conditions are aheared to.  The following conditions
  11  * apply to all code found in this distribution, be it the RC4, RSA,
  12  * lhash, DES, etc., code; not just the SSL code.  The SSL documentation
  13  * included with this distribution is covered by the same copyright terms
  14  * except that the holder is Tim Hudson (tjh@cryptsoft.com).
  15  *
  16  * Copyright remains Eric Young's, and as such any Copyright notices in
  17  * the code are not to be removed.
  18  * If this package is used in a product, Eric Young should be given attribution
  19  * as the author of the parts of the library used.
  20  * This can be in the form of a textual message at program startup or
  21  * in documentation (online or textual) provided with the package.
  22  *
  23  * Redistribution and use in source and binary forms, with or without
  24  * modification, are permitted provided that the following conditions
  25  * are met:
  26  * 1. Redistributions of source code must retain the copyright
  27  *    notice, this list of conditions and the following disclaimer.
  28  * 2. Redistributions in binary form must reproduce the above copyright
  29  *    notice, this list of conditions and the following disclaimer in the
  30  *    documentation and/or other materials provided with the distribution.
  31  * 3. All advertising materials mentioning features or use of this software
  32  *    must display the following acknowledgement:
  33  *    "This product includes cryptographic software written by
  34  *     Eric Young (eay@cryptsoft.com)"
  35  *    The word 'cryptographic' can be left out if the rouines from the library
  36  *    being used are not cryptographic related :-).
  37  * 4. If you include any Windows specific code (or a derivative thereof) from
  38  *    the apps directory (application code) you must include an acknowledgement:
  39  *    "This product includes software written by Tim Hudson (tjh@cryptsoft.com)"
  40  *
  41  * THIS SOFTWARE IS PROVIDED BY ERIC YOUNG ``AS IS'' AND
  42  * ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
  43  * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE
  44  * ARE DISCLAIMED.  IN NO EVENT SHALL THE AUTHOR OR CONTRIBUTORS BE LIABLE
  45  * FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL
  46  * DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS
  47  * OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION)
  48  * HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT
  49  * LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY
  50  * OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF
  51  * SUCH DAMAGE.
  52  *
  53  * The licence and distribution terms for any publically available version or
  54  * derivative of this code cannot be changed.  i.e. this code cannot simply be
  55  * copied and put under another distribution licence
  56  * [including the GNU Public Licence.]
  57  */
  58 /* ====================================================================
  59  * Copyright (c) 1998-2007 The OpenSSL Project.  All rights reserved.
  60  *
  61  * Redistribution and use in source and binary forms, with or without
  62  * modification, are permitted provided that the following conditions
  63  * are met:
  64  *
  65  * 1. Redistributions of source code must retain the above copyright
  66  *    notice, this list of conditions and the following disclaimer.
  67  *
  68  * 2. Redistributions in binary form must reproduce the above copyright
  69  *    notice, this list of conditions and the following disclaimer in
  70  *    the documentation and/or other materials provided with the
  71  *    distribution.
  72  *
  73  * 3. All advertising materials mentioning features or use of this
  74  *    software must display the following acknowledgment:
  75  *    "This product includes software developed by the OpenSSL Project
  76  *    for use in the OpenSSL Toolkit. (http://www.openssl.org/)"
  77  *
  78  * 4. The names "OpenSSL Toolkit" and "OpenSSL Project" must not be used to
  79  *    endorse or promote products derived from this software without
  80  *    prior written permission. For written permission, please contact
  81  *    openssl-core@openssl.org.
  82  *
  83  * 5. Products derived from this software may not be called "OpenSSL"
  84  *    nor may "OpenSSL" appear in their names without prior written
  85  *    permission of the OpenSSL Project.
  86  *
  87  * 6. Redistributions of any form whatsoever must retain the following
  88  *    acknowledgment:
  89  *    "This product includes software developed by the OpenSSL Project
  90  *    for use in the OpenSSL Toolkit (http://www.openssl.org/)"
  91  *
  92  * THIS SOFTWARE IS PROVIDED BY THE OpenSSL PROJECT ``AS IS'' AND ANY
  93  * EXPRESSED OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
  94  * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
  95  * PURPOSE ARE DISCLAIMED.  IN NO EVENT SHALL THE OpenSSL PROJECT OR
  96  * ITS CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL,
  97  * SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT
  98  * NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES;
  99  * LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION)
 100  * HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT,
 101  * STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE)
 102  * ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED
 103  * OF THE POSSIBILITY OF SUCH DAMAGE.
 104  * ====================================================================
 105  *
 106  * This product includes cryptographic software written by Eric Young
 107  * (eay@cryptsoft.com).  This product includes software written by Tim
 108  * Hudson (tjh@cryptsoft.com).
 109  *
 110  */
 111
 112 #include <stdio.h>
 113 #include <openssl/objects.h>
 114 #include <openssl/evp.h>
 115 #include <openssl/hmac.h>
 116 #include <openssl/ocsp.h>
 117 #include <openssl/rand.h>
 118 #include "ssl_locl.h"
 119
 120 const char tls1_version_str[]="TLSv1" OPENSSL_VERSION_PTEXT;
 121
 122 #ifndef OPENSSL_NO_TLSEXT
 123 static int tls_decrypt_ticket(SSL *s, const unsigned char *tick, int ticklen,
 124                                 const unsigned char *sess_id, int sesslen,
 125                                 SSL_SESSION **psess);
 126 #endif
 127
 128 SSL3_ENC_METHOD TLSv1_enc_data={
 129         tls1_enc,
 130         tls1_mac,
 131         tls1_setup_key_block,
 132         tls1_generate_master_secret,
 133         tls1_change_cipher_state,
 134         tls1_final_finish_mac,
 135         TLS1_FINISH_MAC_LENGTH,
 136         tls1_cert_verify_mac,
 137         TLS_MD_CLIENT_FINISH_CONST,TLS_MD_CLIENT_FINISH_CONST_SIZE,
 138         TLS_MD_SERVER_FINISH_CONST,TLS_MD_SERVER_FINISH_CONST_SIZE,
 139         tls1_alert_code,
 140         tls1_export_keying_material,
 141         };
 142
 143 long tls1_default_timeout(void)
 144         {
 145         /* 2 hours, the 24 hours mentioned in the TLSv1 spec
 146          * is way too long for http, the cache would over fill */
 147         return(60*60*2);
 148         }
 149
 150 int tls1_new(SSL *s)
 151         {
 152         if (!ssl3_new(s)) return(0);
 153         s->method->ssl_clear(s);
 154         return(1);
 155         }
 156
 157 void tls1_free(SSL *s)
 158         {
 159 #ifndef OPENSSL_NO_TLSEXT
 160         if (s->tlsext_session_ticket)
 161                 {
 162                 OPENSSL_free(s->tlsext_session_ticket);
 163                 }
 164 #endif /* OPENSSL_NO_TLSEXT */
 165         ssl3_free(s);
 166         }
 167
 168 void tls1_clear(SSL *s)
 169         {
 170         ssl3_clear(s);
 171         s->version = s->method->version;
 172         }
 173
 174 #ifndef OPENSSL_NO_EC
 175
 176 static int nid_list[] =
 177         {
 178                 NID_sect163k1, /* sect163k1 (1) */
 179                 NID_sect163r1, /* sect163r1 (2) */
 180                 NID_sect163r2, /* sect163r2 (3) */
 181                 NID_sect193r1, /* sect193r1 (4) */
 182                 NID_sect193r2, /* sect193r2 (5) */
 183                 NID_sect233k1, /* sect233k1 (6) */
 184                 NID_sect233r1, /* sect233r1 (7) */
 185                 NID_sect239k1, /* sect239k1 (8) */
 186                 NID_sect283k1, /* sect283k1 (9) */
 187                 NID_sect283r1, /* sect283r1 (10) */
 188                 NID_sect409k1, /* sect409k1 (11) */
 189                 NID_sect409r1, /* sect409r1 (12) */
 190                 NID_sect571k1, /* sect571k1 (13) */
 191                 NID_sect571r1, /* sect571r1 (14) */
 192                 NID_secp160k1, /* secp160k1 (15) */
 193                 NID_secp160r1, /* secp160r1 (16) */
 194                 NID_secp160r2, /* secp160r2 (17) */
 195                 NID_secp192k1, /* secp192k1 (18) */
 196                 NID_X9_62_prime192v1, /* secp192r1 (19) */
 197                 NID_secp224k1, /* secp224k1 (20) */
 198                 NID_secp224r1, /* secp224r1 (21) */
 199                 NID_secp256k1, /* secp256k1 (22) */
 200                 NID_X9_62_prime256v1, /* secp256r1 (23) */
 201                 NID_secp384r1, /* secp384r1 (24) */
 202                 NID_secp521r1  /* secp521r1 (25) */
 203         };
 204
 205 static int pref_list[] =
 206         {
 207                 NID_sect571r1, /* sect571r1 (14) */
 208                 NID_sect571k1, /* sect571k1 (13) */
 209                 NID_secp521r1, /* secp521r1 (25) */
 210                 NID_sect409k1, /* sect409k1 (11) */
 211                 NID_sect409r1, /* sect409r1 (12) */
 212                 NID_secp384r1, /* secp384r1 (24) */
 213                 NID_sect283k1, /* sect283k1 (9) */
 214                 NID_sect283r1, /* sect283r1 (10) */
 215                 NID_secp256k1, /* secp256k1 (22) */
 216                 NID_X9_62_prime256v1, /* secp256r1 (23) */
 217                 NID_sect239k1, /* sect239k1 (8) */
 218                 NID_sect233k1, /* sect233k1 (6) */
 219                 NID_sect233r1, /* sect233r1 (7) */
 220                 NID_secp224k1, /* secp224k1 (20) */
 221                 NID_secp224r1, /* secp224r1 (21) */
 222                 NID_sect193r1, /* sect193r1 (4) */
 223                 NID_sect193r2, /* sect193r2 (5) */
 224                 NID_secp192k1, /* secp192k1 (18) */
 225                 NID_X9_62_prime192v1, /* secp192r1 (19) */
 226                 NID_sect163k1, /* sect163k1 (1) */
 227                 NID_sect163r1, /* sect163r1 (2) */
 228                 NID_sect163r2, /* sect163r2 (3) */
 229                 NID_secp160k1, /* secp160k1 (15) */
 230                 NID_secp160r1, /* secp160r1 (16) */
 231                 NID_secp160r2, /* secp160r2 (17) */
 232         };
 233
 234 int tls1_ec_curve_id2nid(int curve_id)
 235         {
 236         /* ECC curves from draft-ietf-tls-ecc-12.txt (Oct. 17, 2005) */
 237         if ((curve_id < 1) || ((unsigned int)curve_id >
 238                                 sizeof(nid_list)/sizeof(nid_list[0])))
 239                 return 0;
 240         return nid_list[curve_id-1];
 241         }
 242
 243 int tls1_ec_nid2curve_id(int nid)
 244         {
 245         /* ECC curves from draft-ietf-tls-ecc-12.txt (Oct. 17, 2005) */
 246         switch (nid)
 247                 {
 248         case NID_sect163k1: /* sect163k1 (1) */
 249                 return 1;
 250         case NID_sect163r1: /* sect163r1 (2) */
 251                 return 2;
 252         case NID_sect163r2: /* sect163r2 (3) */
 253                 return 3;
 254         case NID_sect193r1: /* sect193r1 (4) */
 255                 return 4;
 256         case NID_sect193r2: /* sect193r2 (5) */
 257                 return 5;
 258         case NID_sect233k1: /* sect233k1 (6) */
 259                 return 6;
 260         case NID_sect233r1: /* sect233r1 (7) */
 261                 return 7;
 262         case NID_sect239k1: /* sect239k1 (8) */
 263                 return 8;
 264         case NID_sect283k1: /* sect283k1 (9) */
 265                 return 9;
 266         case NID_sect283r1: /* sect283r1 (10) */
 267                 return 10;
 268         case NID_sect409k1: /* sect409k1 (11) */
 269                 return 11;
 270         case NID_sect409r1: /* sect409r1 (12) */
 271                 return 12;
 272         case NID_sect571k1: /* sect571k1 (13) */
 273                 return 13;
 274         case NID_sect571r1: /* sect571r1 (14) */
 275                 return 14;
 276         case NID_secp160k1: /* secp160k1 (15) */
 277                 return 15;
 278         case NID_secp160r1: /* secp160r1 (16) */
 279                 return 16;
 280         case NID_secp160r2: /* secp160r2 (17) */
 281                 return 17;
 282         case NID_secp192k1: /* secp192k1 (18) */
 283                 return 18;
 284         case NID_X9_62_prime192v1: /* secp192r1 (19) */
 285                 return 19;
 286         case NID_secp224k1: /* secp224k1 (20) */
 287                 return 20;
 288         case NID_secp224r1: /* secp224r1 (21) */
 289                 return 21;
 290         case NID_secp256k1: /* secp256k1 (22) */
 291                 return 22;
 292         case NID_X9_62_prime256v1: /* secp256r1 (23) */
 293                 return 23;
 294         case NID_secp384r1: /* secp384r1 (24) */
 295                 return 24;
 296         case NID_secp521r1:  /* secp521r1 (25) */
 297                 return 25;
 298         default:
 299                 return 0;
 300                 }
 301         }
 302 #endif /* OPENSSL_NO_EC */
 303
 304 #ifndef OPENSSL_NO_TLSEXT
 305
 306 /* List of supported signature algorithms and hashes. Should make this
 307  * customisable at some point, for now include everything we support.
 308  */
 309
 310 #ifdef OPENSSL_NO_RSA
 311 #define tlsext_sigalg_rsa(md) /* */
 312 #else
 313 #define tlsext_sigalg_rsa(md) md, TLSEXT_signature_rsa,
 314 #endif
 315
 316 #ifdef OPENSSL_NO_DSA
 317 #define tlsext_sigalg_dsa(md) /* */
 318 #else
 319 #define tlsext_sigalg_dsa(md) md, TLSEXT_signature_dsa,
 320 #endif
 321
 322 #ifdef OPENSSL_NO_ECDSA
 323 #define tlsext_sigalg_ecdsa(md) /* */
 324 #else
 325 #define tlsext_sigalg_ecdsa(md) md, TLSEXT_signature_ecdsa,
 326 #endif
 327
 328 #define tlsext_sigalg(md) \
 329                 tlsext_sigalg_rsa(md) \
 330                 tlsext_sigalg_dsa(md) \
 331                 tlsext_sigalg_ecdsa(md)
 332
 333 static unsigned char tls12_sigalgs[] = {
 334 #ifndef OPENSSL_NO_SHA512
 335         tlsext_sigalg(TLSEXT_hash_sha512)
 336         tlsext_sigalg(TLSEXT_hash_sha384)
 337 #endif
 338 #ifndef OPENSSL_NO_SHA256
 339         tlsext_sigalg(TLSEXT_hash_sha256)
 340         tlsext_sigalg(TLSEXT_hash_sha224)
 341 #endif
 342 #ifndef OPENSSL_NO_SHA
 343         tlsext_sigalg(TLSEXT_hash_sha1)
 344 #endif
 345 };
 346
 347 int tls12_get_req_sig_algs(SSL *s, unsigned char *p)
 348         {
 349         size_t slen = sizeof(tls12_sigalgs);
 350         if (p)
 351                 memcpy(p, tls12_sigalgs, slen);
 352         return (int)slen;
 353         }
 354
 355 unsigned char *ssl_add_clienthello_tlsext(SSL *s, unsigned char *buf, unsigned char *limit)
 356         {
 357         int extdatalen=0;
 358         unsigned char *orig = buf;
 359         unsigned char *ret = buf;
 360
 361         /* don't add extensions for SSLv3 unless doing secure renegotiation */
 362         if (s->client_version == SSL3_VERSION
 363                                         && !s->s3->send_connection_binding)
 364                 return orig;
 365
 366         ret+=2;
 367
 368         if (ret>=limit) return NULL; /* this really never occurs, but ... */
 369
 370         if (s->tlsext_hostname != NULL)
 371                 {
 372                 /* Add TLS extension servername to the Client Hello message */
 373                 unsigned long size_str;
 374                 long lenmax;
 375
 376                 /* check for enough space.
 377                    4 for the servername type and entension length
 378                    2 for servernamelist length
 379                    1 for the hostname type
 380                    2 for hostname length
 381                    + hostname length
 382                 */
 383
 384                 if ((lenmax = limit - ret - 9) < 0
 385                     || (size_str = strlen(s->tlsext_hostname)) > (unsigned long)lenmax)
 386                         return NULL;
 387
 388                 /* extension type and length */
 389                 s2n(TLSEXT_TYPE_server_name,ret);
 390                 s2n(size_str+5,ret);
 391
 392                 /* length of servername list */
 393                 s2n(size_str+3,ret);
 394
 395                 /* hostname type, length and hostname */
 396                 *(ret++) = (unsigned char) TLSEXT_NAMETYPE_host_name;
 397                 s2n(size_str,ret);
 398                 memcpy(ret, s->tlsext_hostname, size_str);
 399                 ret+=size_str;
 400                 }
 401
 402         /* Add RI if renegotiating */
 403         if (s->renegotiate)
 404           {
 405           int el;
 406
 407           if(!ssl_add_clienthello_renegotiate_ext(s, 0, &el, 0))
 408               {
 409               SSLerr(SSL_F_SSL_ADD_CLIENTHELLO_TLSEXT, ERR_R_INTERNAL_ERROR);
 410               return NULL;
 411               }
 412
 413           if((limit - ret - 4 - el) < 0) return NULL;
 414
 415           s2n(TLSEXT_TYPE_renegotiate,ret);
 416           s2n(el,ret);
 417
 418           if(!ssl_add_clienthello_renegotiate_ext(s, ret, &el, el))
 419               {
 420               SSLerr(SSL_F_SSL_ADD_CLIENTHELLO_TLSEXT, ERR_R_INTERNAL_ERROR);
 421               return NULL;
 422               }
 423
 424           ret += el;
 425         }
 426
 427 #ifndef OPENSSL_NO_SRP
 428         /* Add SRP username if there is one */
 429         if (s->srp_ctx.login != NULL)
 430                 { /* Add TLS extension SRP username to the Client Hello message */
 431
 432                 int login_len = strlen(s->srp_ctx.login);
 433                 if (login_len > 255 || login_len == 0)
 434                         {
 435                         SSLerr(SSL_F_SSL_ADD_CLIENTHELLO_TLSEXT, ERR_R_INTERNAL_ERROR);
 436                         return NULL;
 437                         }
 438
 439                 /* check for enough space.
 440                    4 for the srp type type and entension length
 441                    1 for the srp user identity
 442                    + srp user identity length
 443                 */
 444                 if ((limit - ret - 5 - login_len) < 0) return NULL;
 445
 446                 /* fill in the extension */
 447                 s2n(TLSEXT_TYPE_srp,ret);
 448                 s2n(login_len+1,ret);
 449                 (*ret++) = (unsigned char) login_len;
 450                 memcpy(ret, s->srp_ctx.login, login_len);
 451                 ret+=login_len;
 452                 }
 453 #endif
 454
 455 #ifndef OPENSSL_NO_EC
 456         if (s->tlsext_ecpointformatlist != NULL &&
 457             s->version != DTLS1_VERSION)
 458                 {
 459                 /* Add TLS extension ECPointFormats to the ClientHello message */
 460                 long lenmax;
 461
 462                 if ((lenmax = limit - ret - 5) < 0) return NULL;
 463                 if (s->tlsext_ecpointformatlist_length > (unsigned long)lenmax) return NULL;
 464                 if (s->tlsext_ecpointformatlist_length > 255)
 465                         {
 466                         SSLerr(SSL_F_SSL_ADD_CLIENTHELLO_TLSEXT, ERR_R_INTERNAL_ERROR);
 467                         return NULL;
 468                         }
 469
 470                 s2n(TLSEXT_TYPE_ec_point_formats,ret);
 471                 s2n(s->tlsext_ecpointformatlist_length + 1,ret);
 472                 *(ret++) = (unsigned char) s->tlsext_ecpointformatlist_length;
 473                 memcpy(ret, s->tlsext_ecpointformatlist, s->tlsext_ecpointformatlist_length);
 474                 ret+=s->tlsext_ecpointformatlist_length;
 475                 }
 476         if (s->tlsext_ellipticcurvelist != NULL &&
 477             s->version != DTLS1_VERSION)
 478                 {
 479                 /* Add TLS extension EllipticCurves to the ClientHello message */
 480                 long lenmax;
 481
 482                 if ((lenmax = limit - ret - 6) < 0) return NULL;
 483                 if (s->tlsext_ellipticcurvelist_length > (unsigned long)lenmax) return NULL;
 484                 if (s->tlsext_ellipticcurvelist_length > 65532)
 485                         {
 486                         SSLerr(SSL_F_SSL_ADD_CLIENTHELLO_TLSEXT, ERR_R_INTERNAL_ERROR);
 487                         return NULL;
 488                         }
 489
 490                 s2n(TLSEXT_TYPE_elliptic_curves,ret);
 491                 s2n(s->tlsext_ellipticcurvelist_length + 2, ret);
 492
 493                 /* NB: draft-ietf-tls-ecc-12.txt uses a one-byte prefix for
 494                  * elliptic_curve_list, but the examples use two bytes.
 495                  * http://www1.ietf.org/mail-archive/web/tls/current/msg00538.html
 496                  * resolves this to two bytes.
 497                  */
 498                 s2n(s->tlsext_ellipticcurvelist_length, ret);
 499                 memcpy(ret, s->tlsext_ellipticcurvelist, s->tlsext_ellipticcurvelist_length);
 500                 ret+=s->tlsext_ellipticcurvelist_length;
 501                 }
 502 #endif /* OPENSSL_NO_EC */
 503
 504         if (!(SSL_get_options(s) & SSL_OP_NO_TICKET))
 505                 {
 506                 int ticklen;
 507                 if (!s->new_session && s->session && s->session->tlsext_tick)
 508                         ticklen = s->session->tlsext_ticklen;
 509                 else if (s->session && s->tlsext_session_ticket &&
 510                          s->tlsext_session_ticket->data)
 511                         {
 512                         ticklen = s->tlsext_session_ticket->length;
 513                         s->session->tlsext_tick = OPENSSL_malloc(ticklen);
 514                         if (!s->session->tlsext_tick)
 515                                 return NULL;
 516                         memcpy(s->session->tlsext_tick,
 517                                s->tlsext_session_ticket->data,
 518                                ticklen);
 519                         s->session->tlsext_ticklen = ticklen;
 520                         }
 521                 else
 522                         ticklen = 0;
 523                 if (ticklen == 0 && s->tlsext_session_ticket &&
 524                     s->tlsext_session_ticket->data == NULL)
 525                         goto skip_ext;
 526                 /* Check for enough room 2 for extension type, 2 for len
 527                  * rest for ticket
 528                  */
 529                 if ((long)(limit - ret - 4 - ticklen) < 0) return NULL;
 530                 s2n(TLSEXT_TYPE_session_ticket,ret);
 531                 s2n(ticklen,ret);
 532                 if (ticklen)
 533                         {
 534                         memcpy(ret, s->session->tlsext_tick, ticklen);
 535                         ret += ticklen;
 536                         }
 537                 }
 538                 skip_ext:
 539
 540         if (TLS1_get_client_version(s) >= TLS1_2_VERSION)
 541                 {
 542                 if ((size_t)(limit - ret) < sizeof(tls12_sigalgs) + 6)
 543                         return NULL;
 544                 s2n(TLSEXT_TYPE_signature_algorithms,ret);
 545                 s2n(sizeof(tls12_sigalgs) + 2, ret);
 546                 s2n(sizeof(tls12_sigalgs), ret);
 547                 memcpy(ret, tls12_sigalgs, sizeof(tls12_sigalgs));
 548                 ret += sizeof(tls12_sigalgs);
 549                 }
 550
 551 #ifdef TLSEXT_TYPE_opaque_prf_input
 552         if (s->s3->client_opaque_prf_input != NULL &&
 553             s->version != DTLS1_VERSION)
 554                 {
 555                 size_t col = s->s3->client_opaque_prf_input_len;
 556
 557                 if ((long)(limit - ret - 6 - col < 0))
 558                         return NULL;
 559                 if (col > 0xFFFD) /* can't happen */
 560                         return NULL;
 561
 562                 s2n(TLSEXT_TYPE_opaque_prf_input, ret);
 563                 s2n(col + 2, ret);
 564                 s2n(col, ret);
 565                 memcpy(ret, s->s3->client_opaque_prf_input, col);
 566                 ret += col;
 567                 }
 568 #endif
 569
 570         if (s->tlsext_status_type == TLSEXT_STATUSTYPE_ocsp &&
 571             s->version != DTLS1_VERSION)
 572                 {
 573                 int i;
 574                 long extlen, idlen, itmp;
 575                 OCSP_RESPID *id;
 576
 577                 idlen = 0;
 578                 for (i = 0; i < sk_OCSP_RESPID_num(s->tlsext_ocsp_ids); i++)
 579                         {
 580                         id = sk_OCSP_RESPID_value(s->tlsext_ocsp_ids, i);
 581                         itmp = i2d_OCSP_RESPID(id, NULL);
 582                         if (itmp <= 0)
 583                                 return NULL;
 584                         idlen += itmp + 2;
 585                         }
 586
 587                 if (s->tlsext_ocsp_exts)
 588                         {
 589                         extlen = i2d_X509_EXTENSIONS(s->tlsext_ocsp_exts, NULL);
 590                         if (extlen < 0)
 591                                 return NULL;
 592                         }
 593                 else
 594                         extlen = 0;
 595
 596                 if ((long)(limit - ret - 7 - extlen - idlen) < 0) return NULL;
 597                 s2n(TLSEXT_TYPE_status_request, ret);
 598                 if (extlen + idlen > 0xFFF0)
 599                         return NULL;
 600                 s2n(extlen + idlen + 5, ret);
 601                 *(ret++) = TLSEXT_STATUSTYPE_ocsp;
 602                 s2n(idlen, ret);
 603                 for (i = 0; i < sk_OCSP_RESPID_num(s->tlsext_ocsp_ids); i++)
 604                         {
 605                         /* save position of id len */
 606                         unsigned char *q = ret;
 607                         id = sk_OCSP_RESPID_value(s->tlsext_ocsp_ids, i);
 608                         /* skip over id len */
 609                         ret += 2;
 610                         itmp = i2d_OCSP_RESPID(id, &ret);
 611                         /* write id len */
 612                         s2n(itmp, q);
 613                         }
 614                 s2n(extlen, ret);
 615                 if (extlen > 0)
 616                         i2d_X509_EXTENSIONS(s->tlsext_ocsp_exts, &ret);
 617                 }
 618
 619 #ifndef OPENSSL_NO_HEARTBEATS
 620         /* Add Heartbeat extension */
 621         if ((limit - ret - 4 - 1) < 0)
 622                 return NULL;
 623         s2n(TLSEXT_TYPE_heartbeat,ret);
 624         s2n(1,ret);
 625         /* Set mode:
 626          * 1: peer may send requests
 627          * 2: peer not allowed to send requests
 628          */
 629         if (s->tlsext_heartbeat & SSL_TLSEXT_HB_DONT_RECV_REQUESTS)
 630                 *(ret++) = SSL_TLSEXT_HB_DONT_SEND_REQUESTS;
 631         else
 632                 *(ret++) = SSL_TLSEXT_HB_ENABLED;
 633 #endif
 634
 635 #ifndef OPENSSL_NO_NEXTPROTONEG
 636         if (s->ctx->next_proto_select_cb && !s->s3->tmp.finish_md_len)
 637                 {
 638                 /* The client advertises an emtpy extension to indicate its
 639                  * support for Next Protocol Negotiation */
 640                 if (limit - ret - 4 < 0)
 641                         return NULL;
 642                 s2n(TLSEXT_TYPE_next_proto_neg,ret);
 643                 s2n(0,ret);
 644                 }
 645 #endif
 646
 647 #ifndef OPENSSL_NO_SRTP
 648         if(SSL_get_srtp_profiles(s))
 649                 {
 650                 int el;
 651
 652                 ssl_add_clienthello_use_srtp_ext(s, 0, &el, 0);
 653
 654                 if((limit - ret - 4 - el) < 0) return NULL;
 655
 656                 s2n(TLSEXT_TYPE_use_srtp,ret);
 657                 s2n(el,ret);
 658
 659                 if(ssl_add_clienthello_use_srtp_ext(s, ret, &el, el))
 660                         {
 661                         SSLerr(SSL_F_SSL_ADD_CLIENTHELLO_TLSEXT, ERR_R_INTERNAL_ERROR);
 662                         return NULL;
 663                         }
 664                 ret += el;
 665                 }
 666 #endif
 667         /* Add padding to workaround bugs in F5 terminators.
 668          * See https://tools.ietf.org/html/draft-agl-tls-padding-03
 669          *
 670          * NB: because this code works out the length of all existing
 671          * extensions it MUST always appear last.
 672          */
 673         if (s->options & SSL_OP_TLSEXT_PADDING)
 674                 {
 675                 int hlen = ret - (unsigned char *)s->init_buf->data;
 676                 /* The code in s23_clnt.c to build ClientHello messages
 677                  * includes the 5-byte record header in the buffer, while
 678                  * the code in s3_clnt.c does not.
 679                  */
 680                 if (s->state == SSL23_ST_CW_CLNT_HELLO_A)
 681                         hlen -= 5;
 682                 if (hlen > 0xff && hlen < 0x200)
 683                         {
 684                         hlen = 0x200 - hlen;
 685                         if (hlen >= 4)
 686                                 hlen -= 4;
 687                         else
 688                                 hlen = 0;
 689
 690                         s2n(TLSEXT_TYPE_padding, ret);
 691                         s2n(hlen, ret);
 692                         memset(ret, 0, hlen);
 693                         ret += hlen;
 694                         }
 695                 }
 696
 697         if ((extdatalen = ret-orig-2)== 0)
 698                 return orig;
 699
 700         s2n(extdatalen, orig);
 701         return ret;
 702         }
 703
 704 unsigned char *ssl_add_serverhello_tlsext(SSL *s, unsigned char *buf, unsigned char *limit)
 705         {
 706         int extdatalen=0;
 707         unsigned char *orig = buf;
 708         unsigned char *ret = buf;
 709 #ifndef OPENSSL_NO_NEXTPROTONEG
 710         int next_proto_neg_seen;
 711 #endif
 712
 713         /* don't add extensions for SSLv3, unless doing secure renegotiation */
 714         if (s->version == SSL3_VERSION && !s->s3->send_connection_binding)
 715                 return orig;
 716
 717         ret+=2;
 718         if (ret>=limit) return NULL; /* this really never occurs, but ... */
 719
 720         if (!s->hit && s->servername_done == 1 && s->session->tlsext_hostname != NULL)
 721                 {
 722                 if ((long)(limit - ret - 4) < 0) return NULL;
 723
 724                 s2n(TLSEXT_TYPE_server_name,ret);
 725                 s2n(0,ret);
 726                 }
 727
 728         if(s->s3->send_connection_binding)
 729         {
 730           int el;
 731
 732           if(!ssl_add_serverhello_renegotiate_ext(s, 0, &el, 0))
 733               {
 734               SSLerr(SSL_F_SSL_ADD_SERVERHELLO_TLSEXT, ERR_R_INTERNAL_ERROR);
 735               return NULL;
 736               }
 737
 738           if((limit - ret - 4 - el) < 0) return NULL;
 739
 740           s2n(TLSEXT_TYPE_renegotiate,ret);
 741           s2n(el,ret);
 742
 743           if(!ssl_add_serverhello_renegotiate_ext(s, ret, &el, el))
 744               {
 745               SSLerr(SSL_F_SSL_ADD_SERVERHELLO_TLSEXT, ERR_R_INTERNAL_ERROR);
 746               return NULL;
 747               }
 748
 749           ret += el;
 750         }
 751
 752 #ifndef OPENSSL_NO_EC
 753         if (s->tlsext_ecpointformatlist != NULL &&
 754             s->version != DTLS1_VERSION)
 755                 {
 756                 /* Add TLS extension ECPointFormats to the ServerHello message */
 757                 long lenmax;
 758
 759                 if ((lenmax = limit - ret - 5) < 0) return NULL;
 760                 if (s->tlsext_ecpointformatlist_length > (unsigned long)lenmax) return NULL;
 761                 if (s->tlsext_ecpointformatlist_length > 255)
 762                         {
 763                         SSLerr(SSL_F_SSL_ADD_SERVERHELLO_TLSEXT, ERR_R_INTERNAL_ERROR);
 764                         return NULL;
 765                         }
 766
 767                 s2n(TLSEXT_TYPE_ec_point_formats,ret);
 768                 s2n(s->tlsext_ecpointformatlist_length + 1,ret);
 769                 *(ret++) = (unsigned char) s->tlsext_ecpointformatlist_length;
 770                 memcpy(ret, s->tlsext_ecpointformatlist, s->tlsext_ecpointformatlist_length);
 771                 ret+=s->tlsext_ecpointformatlist_length;
 772
 773                 }
 774         /* Currently the server should not respond with a SupportedCurves extension */
 775 #endif /* OPENSSL_NO_EC */
 776
 777         if (s->tlsext_ticket_expected
 778                 && !(SSL_get_options(s) & SSL_OP_NO_TICKET))
 779                 {
 780                 if ((long)(limit - ret - 4) < 0) return NULL;
 781                 s2n(TLSEXT_TYPE_session_ticket,ret);
 782                 s2n(0,ret);
 783                 }
 784
 785         if (s->tlsext_status_expected)
 786                 {
 787                 if ((long)(limit - ret - 4) < 0) return NULL;
 788                 s2n(TLSEXT_TYPE_status_request,ret);
 789                 s2n(0,ret);
 790                 }
 791
 792 #ifdef TLSEXT_TYPE_opaque_prf_input
 793         if (s->s3->server_opaque_prf_input != NULL &&
 794             s->version != DTLS1_VERSION)
 795                 {
 796                 size_t sol = s->s3->server_opaque_prf_input_len;
 797
 798                 if ((long)(limit - ret - 6 - sol) < 0)
 799                         return NULL;
 800                 if (sol > 0xFFFD) /* can't happen */
 801                         return NULL;
 802
 803                 s2n(TLSEXT_TYPE_opaque_prf_input, ret);
 804                 s2n(sol + 2, ret);
 805                 s2n(sol, ret);
 806                 memcpy(ret, s->s3->server_opaque_prf_input, sol);
 807                 ret += sol;
 808                 }
 809 #endif
 810
 811 #ifndef OPENSSL_NO_SRTP
 812         if(s->srtp_profile)
 813                 {
 814                 int el;
 815
 816                 ssl_add_serverhello_use_srtp_ext(s, 0, &el, 0);
 817
 818                 if((limit - ret - 4 - el) < 0) return NULL;
 819
 820                 s2n(TLSEXT_TYPE_use_srtp,ret);
 821                 s2n(el,ret);
 822
 823                 if(ssl_add_serverhello_use_srtp_ext(s, ret, &el, el))
 824                         {
 825                         SSLerr(SSL_F_SSL_ADD_SERVERHELLO_TLSEXT, ERR_R_INTERNAL_ERROR);
 826                         return NULL;
 827                         }
 828                 ret+=el;
 829                 }
 830 #endif
 831
 832         if (((s->s3->tmp.new_cipher->id & 0xFFFF)==0x80 || (s->s3->tmp.new_cipher->id & 0xFFFF)==0x81)
 833                 && (SSL_get_options(s) & SSL_OP_CRYPTOPRO_TLSEXT_BUG))
 834                 { const unsigned char cryptopro_ext[36] = {
 835                         0xfd, 0xe8, /*65000*/
 836                         0x00, 0x20, /*32 bytes length*/
 837                         0x30, 0x1e, 0x30, 0x08, 0x06, 0x06, 0x2a, 0x85,
 838                         0x03,   0x02, 0x02, 0x09, 0x30, 0x08, 0x06, 0x06,
 839                         0x2a, 0x85, 0x03, 0x02, 0x02, 0x16, 0x30, 0x08,
 840                         0x06, 0x06, 0x2a, 0x85, 0x03, 0x02, 0x02, 0x17};
 841                         if (limit-ret<36) return NULL;
 842                         memcpy(ret,cryptopro_ext,36);
 843                         ret+=36;
 844
 845                 }
 846
 847 #ifndef OPENSSL_NO_HEARTBEATS
 848         /* Add Heartbeat extension if we've received one */
 849         if (s->tlsext_heartbeat & SSL_TLSEXT_HB_ENABLED)
 850                 {
 851                 if ((limit - ret - 4 - 1) < 0)
 852                         return NULL;
 853                 s2n(TLSEXT_TYPE_heartbeat,ret);
 854                 s2n(1,ret);
 855                 /* Set mode:
 856                  * 1: peer may send requests
 857                  * 2: peer not allowed to send requests
 858                  */
 859                 if (s->tlsext_heartbeat & SSL_TLSEXT_HB_DONT_RECV_REQUESTS)
 860                         *(ret++) = SSL_TLSEXT_HB_DONT_SEND_REQUESTS;
 861                 else
 862                         *(ret++) = SSL_TLSEXT_HB_ENABLED;
 863
 864                 }
 865 #endif
 866
 867 #ifndef OPENSSL_NO_NEXTPROTONEG
 868         next_proto_neg_seen = s->s3->next_proto_neg_seen;
 869         s->s3->next_proto_neg_seen = 0;
 870         if (next_proto_neg_seen && s->ctx->next_protos_advertised_cb)
 871                 {
 872                 const unsigned char *npa;
 873                 unsigned int npalen;
 874                 int r;
 875
 876                 r = s->ctx->next_protos_advertised_cb(s, &npa, &npalen, s->ctx->next_protos_advertised_cb_arg);
 877                 if (r == SSL_TLSEXT_ERR_OK)
 878                         {
 879                         if ((long)(limit - ret - 4 - npalen) < 0) return NULL;
 880                         s2n(TLSEXT_TYPE_next_proto_neg,ret);
 881                         s2n(npalen,ret);
 882                         memcpy(ret, npa, npalen);
 883                         ret += npalen;
 884                         s->s3->next_proto_neg_seen = 1;
 885                         }
 886                 }
 887 #endif
 888
 889         if ((extdatalen = ret-orig-2)== 0)
 890                 return orig;
 891
 892         s2n(extdatalen, orig);
 893         return ret;
 894         }
 895
 896 #ifndef OPENSSL_NO_EC
 897 /* ssl_check_for_safari attempts to fingerprint Safari using OS X
 898  * SecureTransport using the TLS extension block in |d|, of length |n|.
 899  * Safari, since 10.6, sends exactly these extensions, in this order:
 900  *   SNI,
 901  *   elliptic_curves
 902  *   ec_point_formats
 903  *
 904  * We wish to fingerprint Safari because they broke ECDHE-ECDSA support in 10.8,
 905  * but they advertise support. So enabling ECDHE-ECDSA ciphers breaks them.
 906  * Sadly we cannot differentiate 10.6, 10.7 and 10.8.4 (which work), from
 907  * 10.8..10.8.3 (which don't work).
 908  */
 909 static void ssl_check_for_safari(SSL *s, const unsigned char *data, const unsigned char *d, int n) {
 910         unsigned short type, size;
 911         static const unsigned char kSafariExtensionsBlock[] = {
 912                 0x00, 0x0a,  /* elliptic_curves extension */
 913                 0x00, 0x08,  /* 8 bytes */
 914                 0x00, 0x06,  /* 6 bytes of curve ids */
 915                 0x00, 0x17,  /* P-256 */
 916                 0x00, 0x18,  /* P-384 */
 917                 0x00, 0x19,  /* P-521 */
 918
 919                 0x00, 0x0b,  /* ec_point_formats */
 920                 0x00, 0x02,  /* 2 bytes */
 921                 0x01,        /* 1 point format */
 922                 0x00,        /* uncompressed */
 923         };
 924
 925         /* The following is only present in TLS 1.2 */
 926         static const unsigned char kSafariTLS12ExtensionsBlock[] = {
 927                 0x00, 0x0d,  /* signature_algorithms */
 928                 0x00, 0x0c,  /* 12 bytes */
 929                 0x00, 0x0a,  /* 10 bytes */
 930                 0x05, 0x01,  /* SHA-384/RSA */
 931                 0x04, 0x01,  /* SHA-256/RSA */
 932                 0x02, 0x01,  /* SHA-1/RSA */
 933                 0x04, 0x03,  /* SHA-256/ECDSA */
 934                 0x02, 0x03,  /* SHA-1/ECDSA */
 935         };
 936
 937         if (data >= (d+n-2))
 938                 return;
 939         data += 2;
 940
 941         if (data > (d+n-4))
 942                 return;
 943         n2s(data,type);
 944         n2s(data,size);
 945
 946         if (type != TLSEXT_TYPE_server_name)
 947                 return;
 948
 949         if (data+size > d+n)
 950                 return;
 951         data += size;
 952
 953         if (TLS1_get_client_version(s) >= TLS1_2_VERSION)
 954                 {
 955                 const size_t len1 = sizeof(kSafariExtensionsBlock);
 956                 const size_t len2 = sizeof(kSafariTLS12ExtensionsBlock);
 957
 958                 if (data + len1 + len2 != d+n)
 959                         return;
 960                 if (memcmp(data, kSafariExtensionsBlock, len1) != 0)
 961                         return;
 962                 if (memcmp(data + len1, kSafariTLS12ExtensionsBlock, len2) != 0)
 963                         return;
 964                 }
 965         else
 966                 {
 967                 const size_t len = sizeof(kSafariExtensionsBlock);
 968
 969                 if (data + len != d+n)
 970                         return;
 971                 if (memcmp(data, kSafariExtensionsBlock, len) != 0)
 972                         return;
 973                 }
 974
 975         s->s3->is_probably_safari = 1;
 976 }
 977 #endif /* !OPENSSL_NO_EC */
 978
 979 int ssl_parse_clienthello_tlsext(SSL *s, unsigned char **p, unsigned char *d, int n, int *al)
 980         {
 981         unsigned short type;
 982         unsigned short size;
 983         unsigned short len;
 984         unsigned char *data = *p;
 985         int renegotiate_seen = 0;
 986         int sigalg_seen = 0;
 987
 988         s->servername_done = 0;
 989         s->tlsext_status_type = -1;
 990 #ifndef OPENSSL_NO_NEXTPROTONEG
 991         s->s3->next_proto_neg_seen = 0;
 992 #endif
 993
 994 #ifndef OPENSSL_NO_HEARTBEATS
 995         s->tlsext_heartbeat &= ~(SSL_TLSEXT_HB_ENABLED |
 996                                SSL_TLSEXT_HB_DONT_SEND_REQUESTS);
 997 #endif
 998
 999 #ifndef OPENSSL_NO_EC
1000         if (s->options & SSL_OP_SAFARI_ECDHE_ECDSA_BUG)
1001                 ssl_check_for_safari(s, data, d, n);
1002 #endif /* !OPENSSL_NO_EC */
1003
1004         if (data >= (d+n-2))
1005                 goto ri_check;
1006         n2s(data,len);
1007
1008         if (data > (d+n-len))
1009                 goto ri_check;
1010
1011         while (data <= (d+n-4))
1012                 {
1013                 n2s(data,type);
1014                 n2s(data,size);
1015
1016                 if (data+size > (d+n))
1017                         goto ri_check;
1018 #if 0
1019                 fprintf(stderr,"Received extension type %d size %d\n",type,size);
1020 #endif
1021                 if (s->tlsext_debug_cb)
1022                         s->tlsext_debug_cb(s, 0, type, data, size,
1023                                                 s->tlsext_debug_arg);
1024 /* The servername extension is treated as follows:
1025
1026    - Only the hostname type is supported with a maximum length of 255.
1027    - The servername is rejected if too long or if it contains zeros,
1028      in which case an fatal alert is generated.
1029    - The servername field is maintained together with the session cache.
1030    - When a session is resumed, the servername call back invoked in order
1031      to allow the application to position itself to the right context.
1032    - The servername is acknowledged if it is new for a session or when
1033      it is identical to a previously used for the same session.
1034      Applications can control the behaviour.  They can at any time
1035      set a 'desirable' servername for a new SSL object. This can be the
1036      case for example with HTTPS when a Host: header field is received and
1037      a renegotiation is requested. In this case, a possible servername
1038      presented in the new client hello is only acknowledged if it matches
1039      the value of the Host: field.
1040    - Applications must  use SSL_OP_NO_SESSION_RESUMPTION_ON_RENEGOTIATION
1041      if they provide for changing an explicit servername context for the session,
1042      i.e. when the session has been established with a servername extension.
1043    - On session reconnect, the servername extension may be absent.
1044
1045 */
1046
1047                 if (type == TLSEXT_TYPE_server_name)
1048                         {
1049                         unsigned char *sdata;
1050                         int servname_type;
1051                         int dsize;
1052
1053                         if (size < 2)
1054                                 {
1055                                 *al = SSL_AD_DECODE_ERROR;
1056                                 return 0;
1057                                 }
1058                         n2s(data,dsize);
1059                         size -= 2;
1060                         if (dsize > size  )
1061                                 {
1062                                 *al = SSL_AD_DECODE_ERROR;
1063                                 return 0;
1064                                 }
1065
1066                         sdata = data;
1067                         while (dsize > 3)
1068                                 {
1069                                 servname_type = *(sdata++);
1070                                 n2s(sdata,len);
1071                                 dsize -= 3;
1072
1073                                 if (len > dsize)
1074                                         {
1075                                         *al = SSL_AD_DECODE_ERROR;
1076                                         return 0;
1077                                         }
1078                                 if (s->servername_done == 0)
1079                                 switch (servname_type)
1080                                         {
1081                                 case TLSEXT_NAMETYPE_host_name:
1082                                         if (!s->hit)
1083                                                 {
1084                                                 if(s->session->tlsext_hostname)
1085                                                         {
1086                                                         *al = SSL_AD_DECODE_ERROR;
1087                                                         return 0;
1088                                                         }
1089                                                 if (len > TLSEXT_MAXLEN_host_name)
1090                                                         {
1091                                                         *al = TLS1_AD_UNRECOGNIZED_NAME;
1092                                                         return 0;
1093                                                         }
1094                                                 if ((s->session->tlsext_hostname = OPENSSL_malloc(len+1)) == NULL)
1095                                                         {
1096                                                         *al = TLS1_AD_INTERNAL_ERROR;
1097                                                         return 0;
1098                                                         }
1099                                                 memcpy(s->session->tlsext_hostname, sdata, len);
1100                                                 s->session->tlsext_hostname[len]='\0';
1101                                                 if (strlen(s->session->tlsext_hostname) != len) {
1102                                                         OPENSSL_free(s->session->tlsext_hostname);
1103                                                         s->session->tlsext_hostname = NULL;
1104                                                         *al = TLS1_AD_UNRECOGNIZED_NAME;
1105                                                         return 0;
1106                                                 }
1107                                                 s->servername_done = 1;
1108
1109                                                 }
1110                                         else
1111                                                 s->servername_done = s->session->tlsext_hostname
1112                                                         && strlen(s->session->tlsext_hostname) == len
1113                                                         && strncmp(s->session->tlsext_hostname, (char *)sdata, len) == 0;
1114
1115                                         break;
1116
1117                                 default:
1118                                         break;
1119                                         }
1120
1121                                 dsize -= len;
1122                                 }
1123                         if (dsize != 0)
1124                                 {
1125                                 *al = SSL_AD_DECODE_ERROR;
1126                                 return 0;
1127                                 }
1128
1129                         }
1130 #ifndef OPENSSL_NO_SRP
1131                 else if (type == TLSEXT_TYPE_srp)
1132                         {
1133                         if (size <= 0 || ((len = data[0])) != (size -1))
1134                                 {
1135                                 *al = SSL_AD_DECODE_ERROR;
1136                                 return 0;
1137                                 }
1138                         if (s->srp_ctx.login != NULL)
1139                                 {
1140                                 *al = SSL_AD_DECODE_ERROR;
1141                                 return 0;
1142                                 }
1143                         if ((s->srp_ctx.login = OPENSSL_malloc(len+1)) == NULL)
1144                                 return -1;
1145                         memcpy(s->srp_ctx.login, &data[1], len);
1146                         s->srp_ctx.login[len]='\0';
1147
1148                         if (strlen(s->srp_ctx.login) != len)
1149                                 {
1150                                 *al = SSL_AD_DECODE_ERROR;
1151                                 return 0;
1152                                 }
1153                         }
1154 #endif
1155
1156 #ifndef OPENSSL_NO_EC
1157                 else if (type == TLSEXT_TYPE_ec_point_formats &&
1158                      s->version != DTLS1_VERSION)
1159                         {
1160                         unsigned char *sdata = data;
1161                         int ecpointformatlist_length = *(sdata++);
1162
1163                         if (ecpointformatlist_length != size - 1)
1164                                 {
1165                                 *al = TLS1_AD_DECODE_ERROR;
1166                                 return 0;
1167                                 }
1168                         if (!s->hit)
1169                                 {
1170                                 if(s->session->tlsext_ecpointformatlist)
1171                                         {
1172                                         OPENSSL_free(s->session->tlsext_ecpointformatlist);
1173                                         s->session->tlsext_ecpointformatlist = NULL;
1174                                         }
1175                                 s->session->tlsext_ecpointformatlist_length = 0;
1176                                 if ((s->session->tlsext_ecpointformatlist = OPENSSL_malloc(ecpointformatlist_length)) == NULL)
1177                                         {
1178                                         *al = TLS1_AD_INTERNAL_ERROR;
1179                                         return 0;
1180                                         }
1181                                 s->session->tlsext_ecpointformatlist_length = ecpointformatlist_length;
1182                                 memcpy(s->session->tlsext_ecpointformatlist, sdata, ecpointformatlist_length);
1183                                 }
1184 #if 0
1185                         fprintf(stderr,"ssl_parse_clienthello_tlsext s->session->tlsext_ecpointformatlist (length=%i) ", s->session->tlsext_ecpointformatlist_length);
1186                         sdata = s->session->tlsext_ecpointformatlist;
1187                         for (i = 0; i < s->session->tlsext_ecpointformatlist_length; i++)
1188                                 fprintf(stderr,"%i ",*(sdata++));
1189                         fprintf(stderr,"\n");
1190 #endif
1191                         }
1192                 else if (type == TLSEXT_TYPE_elliptic_curves &&
1193                      s->version != DTLS1_VERSION)
1194                         {
1195                         unsigned char *sdata = data;
1196                         int ellipticcurvelist_length = (*(sdata++) << 8);
1197                         ellipticcurvelist_length += (*(sdata++));
1198
1199                         if (ellipticcurvelist_length != size - 2 ||
1200                                 ellipticcurvelist_length < 1)
1201                                 {
1202                                 *al = TLS1_AD_DECODE_ERROR;
1203                                 return 0;
1204                                 }
1205                         if (!s->hit)
1206                                 {
1207                                 if(s->session->tlsext_ellipticcurvelist)
1208                                         {
1209                                         *al = TLS1_AD_DECODE_ERROR;
1210                                         return 0;
1211                                         }
1212                                 s->session->tlsext_ellipticcurvelist_length = 0;
1213                                 if ((s->session->tlsext_ellipticcurvelist = OPENSSL_malloc(ellipticcurvelist_length)) == NULL)
1214                                         {
1215                                         *al = TLS1_AD_INTERNAL_ERROR;
1216                                         return 0;
1217                                         }
1218                                 s->session->tlsext_ellipticcurvelist_length = ellipticcurvelist_length;
1219                                 memcpy(s->session->tlsext_ellipticcurvelist, sdata, ellipticcurvelist_length);
1220                                 }
1221 #if 0
1222                         fprintf(stderr,"ssl_parse_clienthello_tlsext s->session->tlsext_ellipticcurvelist (length=%i) ", s->session->tlsext_ellipticcurvelist_length);
1223                         sdata = s->session->tlsext_ellipticcurvelist;
1224                         for (i = 0; i < s->session->tlsext_ellipticcurvelist_length; i++)
1225                                 fprintf(stderr,"%i ",*(sdata++));
1226                         fprintf(stderr,"\n");
1227 #endif
1228                         }
1229 #endif /* OPENSSL_NO_EC */
1230 #ifdef TLSEXT_TYPE_opaque_prf_input
1231                 else if (type == TLSEXT_TYPE_opaque_prf_input &&
1232                      s->version != DTLS1_VERSION)
1233                         {
1234                         unsigned char *sdata = data;
1235
1236                         if (size < 2)
1237                                 {
1238                                 *al = SSL_AD_DECODE_ERROR;
1239                                 return 0;
1240                                 }
1241                         n2s(sdata, s->s3->client_opaque_prf_input_len);
1242                         if (s->s3->client_opaque_prf_input_len != size - 2)
1243                                 {
1244                                 *al = SSL_AD_DECODE_ERROR;
1245                                 return 0;
1246                                 }
1247
1248                         if (s->s3->client_opaque_prf_input != NULL) /* shouldn't really happen */
1249                                 OPENSSL_free(s->s3->client_opaque_prf_input);
1250                         if (s->s3->client_opaque_prf_input_len == 0)
1251                                 s->s3->client_opaque_prf_input = OPENSSL_malloc(1); /* dummy byte just to get non-NULL */
1252                         else
1253                                 s->s3->client_opaque_prf_input = BUF_memdup(sdata, s->s3->client_opaque_prf_input_len);
1254                         if (s->s3->client_opaque_prf_input == NULL)
1255                                 {
1256                                 *al = TLS1_AD_INTERNAL_ERROR;
1257                                 return 0;
1258                                 }
1259                         }
1260 #endif
1261                 else if (type == TLSEXT_TYPE_session_ticket)
1262                         {
1263                         if (s->tls_session_ticket_ext_cb &&
1264                             !s->tls_session_ticket_ext_cb(s, data, size, s->tls_session_ticket_ext_cb_arg))
1265                                 {
1266                                 *al = TLS1_AD_INTERNAL_ERROR;
1267                                 return 0;
1268                                 }
1269                         }
1270                 else if (type == TLSEXT_TYPE_renegotiate)
1271                         {
1272                         if(!ssl_parse_clienthello_renegotiate_ext(s, data, size, al))
1273                                 return 0;
1274                         renegotiate_seen = 1;
1275                         }
1276                 else if (type == TLSEXT_TYPE_signature_algorithms)
1277                         {
1278                         int dsize;
1279                         if (sigalg_seen || size < 2)
1280                                 {
1281                                 *al = SSL_AD_DECODE_ERROR;
1282                                 return 0;
1283                                 }
1284                         sigalg_seen = 1;
1285                         n2s(data,dsize);
1286                         size -= 2;
1287                         if (dsize != size || dsize & 1)
1288                                 {
1289                                 *al = SSL_AD_DECODE_ERROR;
1290                                 return 0;
1291                                 }
1292                         if (!tls1_process_sigalgs(s, data, dsize))
1293                                 {
1294                                 *al = SSL_AD_DECODE_ERROR;
1295                                 return 0;
1296                                 }
1297                         }
1298                 else if (type == TLSEXT_TYPE_status_request &&
1299                          s->version != DTLS1_VERSION)
1300                         {
1301
1302                         if (size < 5)
1303                                 {
1304                                 *al = SSL_AD_DECODE_ERROR;
1305                                 return 0;
1306                                 }
1307
1308                         s->tlsext_status_type = *data++;
1309                         size--;
1310                         if (s->tlsext_status_type == TLSEXT_STATUSTYPE_ocsp)
1311                                 {
1312                                 const unsigned char *sdata;
1313                                 int dsize;
1314                                 /* Read in responder_id_list */
1315                                 n2s(data,dsize);
1316                                 size -= 2;
1317                                 if (dsize > size  )
1318                                         {
1319                                         *al = SSL_AD_DECODE_ERROR;
1320                                         return 0;
1321                                         }
1322                                 while (dsize > 0)
1323                                         {
1324                                         OCSP_RESPID *id;
1325                                         int idsize;
1326                                         if (dsize < 4)
1327                                                 {
1328                                                 *al = SSL_AD_DECODE_ERROR;
1329                                                 return 0;
1330                                                 }
1331                                         n2s(data, idsize);
1332                                         dsize -= 2 + idsize;
1333                                         size -= 2 + idsize;
1334                                         if (dsize < 0)
1335                                                 {
1336                                                 *al = SSL_AD_DECODE_ERROR;
1337                                                 return 0;
1338                                                 }
1339                                         sdata = data;
1340                                         data += idsize;
1341                                         id = d2i_OCSP_RESPID(NULL,
1342                                                                 &sdata, idsize);
1343                                         if (!id)
1344                                                 {
1345                                                 *al = SSL_AD_DECODE_ERROR;
1346                                                 return 0;
1347                                                 }
1348                                         if (data != sdata)
1349                                                 {
1350                                                 OCSP_RESPID_free(id);
1351                                                 *al = SSL_AD_DECODE_ERROR;
1352                                                 return 0;
1353                                                 }
1354                                         if (!s->tlsext_ocsp_ids
1355                                                 && !(s->tlsext_ocsp_ids =
1356                                                 sk_OCSP_RESPID_new_null()))
1357                                                 {
1358                                                 OCSP_RESPID_free(id);
1359                                                 *al = SSL_AD_INTERNAL_ERROR;
1360                                                 return 0;
1361                                                 }
1362                                         if (!sk_OCSP_RESPID_push(
1363                                                         s->tlsext_ocsp_ids, id))
1364                                                 {
1365                                                 OCSP_RESPID_free(id);
1366                                                 *al = SSL_AD_INTERNAL_ERROR;
1367                                                 return 0;
1368                                                 }
1369                                         }
1370
1371                                 /* Read in request_extensions */
1372                                 if (size < 2)
1373                                         {
1374                                         *al = SSL_AD_DECODE_ERROR;
1375                                         return 0;
1376                                         }
1377                                 n2s(data,dsize);
1378                                 size -= 2;
1379                                 if (dsize != size)
1380                                         {
1381                                         *al = SSL_AD_DECODE_ERROR;
1382                                         return 0;
1383                                         }
1384                                 sdata = data;
1385                                 if (dsize > 0)
1386                                         {
1387                                         if (s->tlsext_ocsp_exts)
1388                                                 {
1389                                                 sk_X509_EXTENSION_pop_free(s->tlsext_ocsp_exts,
1390                                                                            X509_EXTENSION_free);
1391                                                 }
1392
1393                                         s->tlsext_ocsp_exts =
1394                                                 d2i_X509_EXTENSIONS(NULL,
1395                                                         &sdata, dsize);
1396                                         if (!s->tlsext_ocsp_exts
1397                                                 || (data + dsize != sdata))
1398                                                 {
1399                                                 *al = SSL_AD_DECODE_ERROR;
1400                                                 return 0;
1401                                                 }
1402                                         }
1403                                 }
1404                                 /* We don't know what to do with any other type
1405                                 * so ignore it.
1406                                 */
1407                                 else
1408                                         s->tlsext_status_type = -1;
1409                         }
1410 #ifndef OPENSSL_NO_HEARTBEATS
1411                 else if (type == TLSEXT_TYPE_heartbeat)
1412                         {
1413                         switch(data[0])
1414                                 {
1415                                 case 0x01:      /* Client allows us to send HB requests */
1416                                                         s->tlsext_heartbeat |= SSL_TLSEXT_HB_ENABLED;
1417                                                         break;
1418                                 case 0x02:      /* Client doesn't accept HB requests */
1419                                                         s->tlsext_heartbeat |= SSL_TLSEXT_HB_ENABLED;
1420                                                         s->tlsext_heartbeat |= SSL_TLSEXT_HB_DONT_SEND_REQUESTS;
1421                                                         break;
1422                                 default:        *al = SSL_AD_ILLEGAL_PARAMETER;
1423                                                         return 0;
1424                                 }
1425                         }
1426 #endif
1427 #ifndef OPENSSL_NO_NEXTPROTONEG
1428                 else if (type == TLSEXT_TYPE_next_proto_neg &&
1429                          s->s3->tmp.finish_md_len == 0)
1430                         {
1431                         /* We shouldn't accept this extension on a
1432                          * renegotiation.
1433                          *
1434                          * s->new_session will be set on renegotiation, but we
1435                          * probably shouldn't rely that it couldn't be set on
1436                          * the initial renegotation too in certain cases (when
1437                          * there's some other reason to disallow resuming an
1438                          * earlier session -- the current code won't be doing
1439                          * anything like that, but this might change).
1440
1441                          * A valid sign that there's been a previous handshake
1442                          * in this connection is if s->s3->tmp.finish_md_len >
1443                          * 0.  (We are talking about a check that will happen
1444                          * in the Hello protocol round, well before a new
1445                          * Finished message could have been computed.) */
1446                         s->s3->next_proto_neg_seen = 1;
1447                         }
1448 #endif
1449
1450                 /* session ticket processed earlier */
1451 #ifndef OPENSSL_NO_SRTP
1452                 else if (type == TLSEXT_TYPE_use_srtp)
1453                         {
1454                         if(ssl_parse_clienthello_use_srtp_ext(s, data, size,
1455                                                               al))
1456                                 return 0;
1457                         }
1458 #endif
1459
1460                 data+=size;
1461                 }
1462
1463         *p = data;
1464
1465         ri_check:
1466
1467         /* Need RI if renegotiating */
1468
1469         if (!renegotiate_seen && s->renegotiate &&
1470                 !(s->options & SSL_OP_ALLOW_UNSAFE_LEGACY_RENEGOTIATION))
1471                 {
1472                 *al = SSL_AD_HANDSHAKE_FAILURE;
1473                 SSLerr(SSL_F_SSL_PARSE_CLIENTHELLO_TLSEXT,
1474                                 SSL_R_UNSAFE_LEGACY_RENEGOTIATION_DISABLED);
1475                 return 0;
1476                 }
1477
1478         return 1;
1479         }
1480
1481 #ifndef OPENSSL_NO_NEXTPROTONEG
1482 /* ssl_next_proto_validate validates a Next Protocol Negotiation block. No
1483  * elements of zero length are allowed and the set of elements must exactly fill
1484  * the length of the block. */
1485 static char ssl_next_proto_validate(unsigned char *d, unsigned len)
1486         {
1487         unsigned int off = 0;
1488
1489         while (off < len)
1490                 {
1491                 if (d[off] == 0)
1492                         return 0;
1493                 off += d[off];
1494                 off++;
1495                 }
1496
1497         return off == len;
1498         }
1499 #endif
1500
1501 int ssl_parse_serverhello_tlsext(SSL *s, unsigned char **p, unsigned char *d, int n, int *al)
1502         {
1503         unsigned short length;
1504         unsigned short type;
1505         unsigned short size;
1506         unsigned char *data = *p;
1507         int tlsext_servername = 0;
1508         int renegotiate_seen = 0;
1509
1510 #ifndef OPENSSL_NO_NEXTPROTONEG
1511         s->s3->next_proto_neg_seen = 0;
1512 #endif
1513
1514 #ifndef OPENSSL_NO_HEARTBEATS
1515         s->tlsext_heartbeat &= ~(SSL_TLSEXT_HB_ENABLED |
1516                                SSL_TLSEXT_HB_DONT_SEND_REQUESTS);
1517 #endif
1518
1519         if (data >= (d+n-2))
1520                 goto ri_check;
1521
1522         n2s(data,length);
1523         if (data+length != d+n)
1524                 {
1525                 *al = SSL_AD_DECODE_ERROR;
1526                 return 0;
1527                 }
1528
1529         while(data <= (d+n-4))
1530                 {
1531                 n2s(data,type);
1532                 n2s(data,size);
1533
1534                 if (data+size > (d+n))
1535                         goto ri_check;
1536
1537                 if (s->tlsext_debug_cb)
1538                         s->tlsext_debug_cb(s, 1, type, data, size,
1539                                                 s->tlsext_debug_arg);
1540
1541                 if (type == TLSEXT_TYPE_server_name)
1542                         {
1543                         if (s->tlsext_hostname == NULL || size > 0)
1544                                 {
1545                                 *al = TLS1_AD_UNRECOGNIZED_NAME;
1546                                 return 0;
1547                                 }
1548                         tlsext_servername = 1;
1549                         }
1550
1551 #ifndef OPENSSL_NO_EC
1552                 else if (type == TLSEXT_TYPE_ec_point_formats &&
1553                      s->version != DTLS1_VERSION)
1554                         {
1555                         unsigned char *sdata = data;
1556                         int ecpointformatlist_length = *(sdata++);
1557
1558                         if (ecpointformatlist_length != size - 1 ||
1559                                 ecpointformatlist_length < 1)
1560                                 {
1561                                 *al = TLS1_AD_DECODE_ERROR;
1562                                 return 0;
1563                                 }
1564                         s->session->tlsext_ecpointformatlist_length = 0;
1565                         if (s->session->tlsext_ecpointformatlist != NULL) OPENSSL_free(s->session->tlsext_ecpointformatlist);
1566                         if ((s->session->tlsext_ecpointformatlist = OPENSSL_malloc(ecpointformatlist_length)) == NULL)
1567                                 {
1568                                 *al = TLS1_AD_INTERNAL_ERROR;
1569                                 return 0;
1570                                 }
1571                         s->session->tlsext_ecpointformatlist_length = ecpointformatlist_length;
1572                         memcpy(s->session->tlsext_ecpointformatlist, sdata, ecpointformatlist_length);
1573 #if 0
1574                         fprintf(stderr,"ssl_parse_serverhello_tlsext s->session->tlsext_ecpointformatlist ");
1575                         sdata = s->session->tlsext_ecpointformatlist;
1576                         for (i = 0; i < s->session->tlsext_ecpointformatlist_length; i++)
1577                                 fprintf(stderr,"%i ",*(sdata++));
1578                         fprintf(stderr,"\n");
1579 #endif
1580                         }
1581 #endif /* OPENSSL_NO_EC */
1582
1583                 else if (type == TLSEXT_TYPE_session_ticket)
1584                         {
1585                         if (s->tls_session_ticket_ext_cb &&
1586                             !s->tls_session_ticket_ext_cb(s, data, size, s->tls_session_ticket_ext_cb_arg))
1587                                 {
1588                                 *al = TLS1_AD_INTERNAL_ERROR;
1589                                 return 0;
1590                                 }
1591                         if ((SSL_get_options(s) & SSL_OP_NO_TICKET)
1592                                 || (size > 0))
1593                                 {
1594                                 *al = TLS1_AD_UNSUPPORTED_EXTENSION;
1595                                 return 0;
1596                                 }
1597                         s->tlsext_ticket_expected = 1;
1598                         }
1599 #ifdef TLSEXT_TYPE_opaque_prf_input
1600                 else if (type == TLSEXT_TYPE_opaque_prf_input &&
1601                      s->version != DTLS1_VERSION)
1602                         {
1603                         unsigned char *sdata = data;
1604
1605                         if (size < 2)
1606                                 {
1607                                 *al = SSL_AD_DECODE_ERROR;
1608                                 return 0;
1609                                 }
1610                         n2s(sdata, s->s3->server_opaque_prf_input_len);
1611                         if (s->s3->server_opaque_prf_input_len != size - 2)
1612                                 {
1613                                 *al = SSL_AD_DECODE_ERROR;
1614                                 return 0;
1615                                 }
1616
1617                         if (s->s3->server_opaque_prf_input != NULL) /* shouldn't really happen */
1618                                 OPENSSL_free(s->s3->server_opaque_prf_input);
1619                         if (s->s3->server_opaque_prf_input_len == 0)
1620                                 s->s3->server_opaque_prf_input = OPENSSL_malloc(1); /* dummy byte just to get non-NULL */
1621                         else
1622                                 s->s3->server_opaque_prf_input = BUF_memdup(sdata, s->s3->server_opaque_prf_input_len);
1623
1624                         if (s->s3->server_opaque_prf_input == NULL)
1625                                 {
1626                                 *al = TLS1_AD_INTERNAL_ERROR;
1627                                 return 0;
1628                                 }
1629                         }
1630 #endif
1631                 else if (type == TLSEXT_TYPE_status_request &&
1632                          s->version != DTLS1_VERSION)
1633                         {
1634                         /* MUST be empty and only sent if we've requested
1635                          * a status request message.
1636                          */
1637                         if ((s->tlsext_status_type == -1) || (size > 0))
1638                                 {
1639                                 *al = TLS1_AD_UNSUPPORTED_EXTENSION;
1640                                 return 0;
1641                                 }
1642                         /* Set flag to expect CertificateStatus message */
1643                         s->tlsext_status_expected = 1;
1644                         }
1645 #ifndef OPENSSL_NO_NEXTPROTONEG
1646                 else if (type == TLSEXT_TYPE_next_proto_neg &&
1647                          s->s3->tmp.finish_md_len == 0)
1648                         {
1649                         unsigned char *selected;
1650                         unsigned char selected_len;
1651
1652                         /* We must have requested it. */
1653                         if (s->ctx->next_proto_select_cb == NULL)
1654                                 {
1655                                 *al = TLS1_AD_UNSUPPORTED_EXTENSION;
1656                                 return 0;
1657                                 }
1658                         /* The data must be valid */
1659                         if (!ssl_next_proto_validate(data, size))
1660                                 {
1661                                 *al = TLS1_AD_DECODE_ERROR;
1662                                 return 0;
1663                                 }
1664                         if (s->ctx->next_proto_select_cb(s, &selected, &selected_len, data, size, s->ctx->next_proto_select_cb_arg) != SSL_TLSEXT_ERR_OK)
1665                                 {
1666                                 *al = TLS1_AD_INTERNAL_ERROR;
1667                                 return 0;
1668                                 }
1669                         s->next_proto_negotiated = OPENSSL_malloc(selected_len);
1670                         if (!s->next_proto_negotiated)
1671                                 {
1672                                 *al = TLS1_AD_INTERNAL_ERROR;
1673                                 return 0;
1674                                 }
1675                         memcpy(s->next_proto_negotiated, selected, selected_len);
1676                         s->next_proto_negotiated_len = selected_len;
1677                         s->s3->next_proto_neg_seen = 1;
1678                         }
1679 #endif
1680                 else if (type == TLSEXT_TYPE_renegotiate)
1681                         {
1682                         if(!ssl_parse_serverhello_renegotiate_ext(s, data, size, al))
1683                                 return 0;
1684                         renegotiate_seen = 1;
1685                         }
1686 #ifndef OPENSSL_NO_HEARTBEATS
1687                 else if (type == TLSEXT_TYPE_heartbeat)
1688                         {
1689                         switch(data[0])
1690                                 {
1691                                 case 0x01:      /* Server allows us to send HB requests */
1692                                                         s->tlsext_heartbeat |= SSL_TLSEXT_HB_ENABLED;
1693                                                         break;
1694                                 case 0x02:      /* Server doesn't accept HB requests */
1695                                                         s->tlsext_heartbeat |= SSL_TLSEXT_HB_ENABLED;
1696                                                         s->tlsext_heartbeat |= SSL_TLSEXT_HB_DONT_SEND_REQUESTS;
1697                                                         break;
1698                                 default:        *al = SSL_AD_ILLEGAL_PARAMETER;
1699                                                         return 0;
1700                                 }
1701                         }
1702 #endif
1703 #ifndef OPENSSL_NO_SRTP
1704                 else if (type == TLSEXT_TYPE_use_srtp)
1705                         {
1706                         if(ssl_parse_serverhello_use_srtp_ext(s, data, size,
1707                                                               al))
1708                                 return 0;
1709                         }
1710 #endif
1711
1712                 data+=size;
1713                 }
1714
1715         if (data != d+n)
1716                 {
1717                 *al = SSL_AD_DECODE_ERROR;
1718                 return 0;
1719                 }
1720
1721         if (!s->hit && tlsext_servername == 1)
1722                 {
1723                 if (s->tlsext_hostname)
1724                         {
1725                         if (s->session->tlsext_hostname == NULL)
1726                                 {
1727                                 s->session->tlsext_hostname = BUF_strdup(s->tlsext_hostname);
1728                                 if (!s->session->tlsext_hostname)
1729                                         {
1730                                         *al = SSL_AD_UNRECOGNIZED_NAME;
1731                                         return 0;
1732                                         }
1733                                 }
1734                         else
1735                                 {
1736                                 *al = SSL_AD_DECODE_ERROR;
1737                                 return 0;
1738                                 }
1739                         }
1740                 }
1741
1742         *p = data;
1743
1744         ri_check:
1745
1746         /* Determine if we need to see RI. Strictly speaking if we want to
1747          * avoid an attack we should *always* see RI even on initial server
1748          * hello because the client doesn't see any renegotiation during an
1749          * attack. However this would mean we could not connect to any server
1750          * which doesn't support RI so for the immediate future tolerate RI
1751          * absence on initial connect only.
1752          */
1753         if (!renegotiate_seen
1754                 && !(s->options & SSL_OP_LEGACY_SERVER_CONNECT)
1755                 && !(s->options & SSL_OP_ALLOW_UNSAFE_LEGACY_RENEGOTIATION))
1756                 {
1757                 *al = SSL_AD_HANDSHAKE_FAILURE;
1758                 SSLerr(SSL_F_SSL_PARSE_SERVERHELLO_TLSEXT,
1759                                 SSL_R_UNSAFE_LEGACY_RENEGOTIATION_DISABLED);
1760                 return 0;
1761                 }
1762
1763         return 1;
1764         }
1765
1766
1767 int ssl_prepare_clienthello_tlsext(SSL *s)
1768         {
1769 #ifndef OPENSSL_NO_EC
1770         /* If we are client and using an elliptic curve cryptography cipher suite, send the point formats
1771          * and elliptic curves we support.
1772          */
1773         int using_ecc = 0;
1774         int i;
1775         unsigned char *j;
1776         unsigned long alg_k, alg_a;
1777         STACK_OF(SSL_CIPHER) *cipher_stack = SSL_get_ciphers(s);
1778
1779         for (i = 0; i < sk_SSL_CIPHER_num(cipher_stack); i++)
1780                 {
1781                 SSL_CIPHER *c = sk_SSL_CIPHER_value(cipher_stack, i);
1782
1783                 alg_k = c->algorithm_mkey;
1784                 alg_a = c->algorithm_auth;
1785                 if ((alg_k & (SSL_kEECDH|SSL_kECDHr|SSL_kECDHe) || (alg_a & SSL_aECDSA)))
1786                         {
1787                         using_ecc = 1;
1788                         break;
1789                         }
1790                 }
1791         using_ecc = using_ecc && (s->version >= TLS1_VERSION);
1792         if (using_ecc)
1793                 {
1794                 if (s->tlsext_ecpointformatlist != NULL) OPENSSL_free(s->tlsext_ecpointformatlist);
1795                 if ((s->tlsext_ecpointformatlist = OPENSSL_malloc(3)) == NULL)
1796                         {
1797                         SSLerr(SSL_F_SSL_PREPARE_CLIENTHELLO_TLSEXT,ERR_R_MALLOC_FAILURE);
1798                         return -1;
1799                         }
1800                 s->tlsext_ecpointformatlist_length = 3;
1801                 s->tlsext_ecpointformatlist[0] = TLSEXT_ECPOINTFORMAT_uncompressed;
1802                 s->tlsext_ecpointformatlist[1] = TLSEXT_ECPOINTFORMAT_ansiX962_compressed_prime;
1803                 s->tlsext_ecpointformatlist[2] = TLSEXT_ECPOINTFORMAT_ansiX962_compressed_char2;
1804
1805                 /* we support all named elliptic curves in draft-ietf-tls-ecc-12 */
1806                 if (s->tlsext_ellipticcurvelist != NULL) OPENSSL_free(s->tlsext_ellipticcurvelist);
1807                 s->tlsext_ellipticcurvelist_length = sizeof(pref_list)/sizeof(pref_list[0]) * 2;
1808                 if ((s->tlsext_ellipticcurvelist = OPENSSL_malloc(s->tlsext_ellipticcurvelist_length)) == NULL)
1809                         {
1810                         s->tlsext_ellipticcurvelist_length = 0;
1811                         SSLerr(SSL_F_SSL_PREPARE_CLIENTHELLO_TLSEXT,ERR_R_MALLOC_FAILURE);
1812                         return -1;
1813                         }
1814                 for (i = 0, j = s->tlsext_ellipticcurvelist; (unsigned int)i <
1815                                 sizeof(pref_list)/sizeof(pref_list[0]); i++)
1816                         {
1817                         int id = tls1_ec_nid2curve_id(pref_list[i]);
1818                         s2n(id,j);
1819                         }
1820                 }
1821 #endif /* OPENSSL_NO_EC */
1822
1823 #ifdef TLSEXT_TYPE_opaque_prf_input
1824         {
1825                 int r = 1;
1826
1827                 if (s->ctx->tlsext_opaque_prf_input_callback != 0)
1828                         {
1829                         r = s->ctx->tlsext_opaque_prf_input_callback(s, NULL, 0, s->ctx->tlsext_opaque_prf_input_callback_arg);
1830                         if (!r)
1831                                 return -1;
1832                         }
1833
1834                 if (s->tlsext_opaque_prf_input != NULL)
1835                         {
1836                         if (s->s3->client_opaque_prf_input != NULL) /* shouldn't really happen */
1837                                 OPENSSL_free(s->s3->client_opaque_prf_input);
1838
1839                         if (s->tlsext_opaque_prf_input_len == 0)
1840                                 s->s3->client_opaque_prf_input = OPENSSL_malloc(1); /* dummy byte just to get non-NULL */
1841                         else
1842                                 s->s3->client_opaque_prf_input = BUF_memdup(s->tlsext_opaque_prf_input, s->tlsext_opaque_prf_input_len);
1843                         if (s->s3->client_opaque_prf_input == NULL)
1844                                 {
1845                                 SSLerr(SSL_F_SSL_PREPARE_CLIENTHELLO_TLSEXT,ERR_R_MALLOC_FAILURE);
1846                                 return -1;
1847                                 }
1848                         s->s3->client_opaque_prf_input_len = s->tlsext_opaque_prf_input_len;
1849                         }
1850
1851                 if (r == 2)
1852                         /* at callback's request, insist on receiving an appropriate server opaque PRF input */
1853                         s->s3->server_opaque_prf_input_len = s->tlsext_opaque_prf_input_len;
1854         }
1855 #endif
1856
1857         return 1;
1858         }
1859
1860 int ssl_prepare_serverhello_tlsext(SSL *s)
1861         {
1862 #ifndef OPENSSL_NO_EC
1863         /* If we are server and using an ECC cipher suite, send the point formats we support
1864          * if the client sent us an ECPointsFormat extension.  Note that the server is not
1865          * supposed to send an EllipticCurves extension.
1866          */
1867
1868         unsigned long alg_k = s->s3->tmp.new_cipher->algorithm_mkey;
1869         unsigned long alg_a = s->s3->tmp.new_cipher->algorithm_auth;
1870         int using_ecc = (alg_k & (SSL_kEECDH|SSL_kECDHr|SSL_kECDHe)) || (alg_a & SSL_aECDSA);
1871         using_ecc = using_ecc && (s->session->tlsext_ecpointformatlist != NULL);
1872
1873         if (using_ecc)
1874                 {
1875                 if (s->tlsext_ecpointformatlist != NULL) OPENSSL_free(s->tlsext_ecpointformatlist);
1876                 if ((s->tlsext_ecpointformatlist = OPENSSL_malloc(3)) == NULL)
1877                         {
1878                         SSLerr(SSL_F_SSL_PREPARE_SERVERHELLO_TLSEXT,ERR_R_MALLOC_FAILURE);
1879                         return -1;
1880                         }
1881                 s->tlsext_ecpointformatlist_length = 3;
1882                 s->tlsext_ecpointformatlist[0] = TLSEXT_ECPOINTFORMAT_uncompressed;
1883                 s->tlsext_ecpointformatlist[1] = TLSEXT_ECPOINTFORMAT_ansiX962_compressed_prime;
1884                 s->tlsext_ecpointformatlist[2] = TLSEXT_ECPOINTFORMAT_ansiX962_compressed_char2;
1885                 }
1886 #endif /* OPENSSL_NO_EC */
1887
1888         return 1;
1889         }
1890
1891 int ssl_check_clienthello_tlsext_early(SSL *s)
1892         {
1893         int ret=SSL_TLSEXT_ERR_NOACK;
1894         int al = SSL_AD_UNRECOGNIZED_NAME;
1895
1896 #ifndef OPENSSL_NO_EC
1897         /* The handling of the ECPointFormats extension is done elsewhere, namely in
1898          * ssl3_choose_cipher in s3_lib.c.
1899          */
1900         /* The handling of the EllipticCurves extension is done elsewhere, namely in
1901          * ssl3_choose_cipher in s3_lib.c.
1902          */
1903 #endif
1904
1905         if (s->ctx != NULL && s->ctx->tlsext_servername_callback != 0)
1906                 ret = s->ctx->tlsext_servername_callback(s, &al, s->ctx->tlsext_servername_arg);
1907         else if (s->initial_ctx != NULL && s->initial_ctx->tlsext_servername_callback != 0)
1908                 ret = s->initial_ctx->tlsext_servername_callback(s, &al, s->initial_ctx->tlsext_servername_arg);
1909
1910 #ifdef TLSEXT_TYPE_opaque_prf_input
1911         {
1912                 /* This sort of belongs into ssl_prepare_serverhello_tlsext(),
1913                  * but we might be sending an alert in response to the client hello,
1914                  * so this has to happen here in
1915                  * ssl_check_clienthello_tlsext_early(). */
1916
1917                 int r = 1;
1918
1919                 if (s->ctx->tlsext_opaque_prf_input_callback != 0)
1920                         {
1921                         r = s->ctx->tlsext_opaque_prf_input_callback(s, NULL, 0, s->ctx->tlsext_opaque_prf_input_callback_arg);
1922                         if (!r)
1923                                 {
1924                                 ret = SSL_TLSEXT_ERR_ALERT_FATAL;
1925                                 al = SSL_AD_INTERNAL_ERROR;
1926                                 goto err;
1927                                 }
1928                         }
1929
1930                 if (s->s3->server_opaque_prf_input != NULL) /* shouldn't really happen */
1931                         OPENSSL_free(s->s3->server_opaque_prf_input);
1932                 s->s3->server_opaque_prf_input = NULL;
1933
1934                 if (s->tlsext_opaque_prf_input != NULL)
1935                         {
1936                         if (s->s3->client_opaque_prf_input != NULL &&
1937                                 s->s3->client_opaque_prf_input_len == s->tlsext_opaque_prf_input_len)
1938                                 {
1939                                 /* can only use this extension if we have a server opaque PRF input
1940                                  * of the same length as the client opaque PRF input! */
1941
1942                                 if (s->tlsext_opaque_prf_input_len == 0)
1943                                         s->s3->server_opaque_prf_input = OPENSSL_malloc(1); /* dummy byte just to get non-NULL */
1944                                 else
1945                                         s->s3->server_opaque_prf_input = BUF_memdup(s->tlsext_opaque_prf_input, s->tlsext_opaque_prf_input_len);
1946                                 if (s->s3->server_opaque_prf_input == NULL)
1947                                         {
1948                                         ret = SSL_TLSEXT_ERR_ALERT_FATAL;
1949                                         al = SSL_AD_INTERNAL_ERROR;
1950                                         goto err;
1951                                         }
1952                                 s->s3->server_opaque_prf_input_len = s->tlsext_opaque_prf_input_len;
1953                                 }
1954                         }
1955
1956                 if (r == 2 && s->s3->server_opaque_prf_input == NULL)
1957                         {
1958                         /* The callback wants to enforce use of the extension,
1959                          * but we can't do that with the client opaque PRF input;
1960                          * abort the handshake.
1961                          */
1962                         ret = SSL_TLSEXT_ERR_ALERT_FATAL;
1963                         al = SSL_AD_HANDSHAKE_FAILURE;
1964                         }
1965         }
1966
1967  err:
1968 #endif
1969         switch (ret)
1970                 {
1971                 case SSL_TLSEXT_ERR_ALERT_FATAL:
1972                         ssl3_send_alert(s,SSL3_AL_FATAL,al);
1973                         return -1;
1974
1975                 case SSL_TLSEXT_ERR_ALERT_WARNING:
1976                         ssl3_send_alert(s,SSL3_AL_WARNING,al);
1977                         return 1;
1978
1979                 case SSL_TLSEXT_ERR_NOACK:
1980                         s->servername_done=0;
1981                         default:
1982                 return 1;
1983                 }
1984         }
1985
1986 int ssl_check_clienthello_tlsext_late(SSL *s)
1987         {
1988         int ret = SSL_TLSEXT_ERR_OK;
1989         int al;
1990
1991         /* If status request then ask callback what to do.
1992          * Note: this must be called after servername callbacks in case
1993          * the certificate has changed, and must be called after the cipher
1994          * has been chosen because this may influence which certificate is sent
1995          */
1996         if ((s->tlsext_status_type != -1) && s->ctx && s->ctx->tlsext_status_cb)
1997                 {
1998                 int r;
1999                 CERT_PKEY *certpkey;
2000                 certpkey = ssl_get_server_send_pkey(s);
2001                 /* If no certificate can't return certificate status */
2002                 if (certpkey == NULL)
2003                         {
2004                         s->tlsext_status_expected = 0;
2005                         return 1;
2006                         }
2007                 /* Set current certificate to one we will use so
2008                  * SSL_get_certificate et al can pick it up.
2009                  */
2010                 s->cert->key = certpkey;
2011                 r = s->ctx->tlsext_status_cb(s, s->ctx->tlsext_status_arg);
2012                 switch (r)
2013                         {
2014                         /* We don't want to send a status request response */
2015                         case SSL_TLSEXT_ERR_NOACK:
2016                                 s->tlsext_status_expected = 0;
2017                                 break;
2018                         /* status request response should be sent */
2019                         case SSL_TLSEXT_ERR_OK:
2020                                 if (s->tlsext_ocsp_resp)
2021                                         s->tlsext_status_expected = 1;
2022                                 else
2023                                         s->tlsext_status_expected = 0;
2024                                 break;
2025                         /* something bad happened */
2026                         case SSL_TLSEXT_ERR_ALERT_FATAL:
2027                                 ret = SSL_TLSEXT_ERR_ALERT_FATAL;
2028                                 al = SSL_AD_INTERNAL_ERROR;
2029                                 goto err;
2030                         }
2031                 }
2032         else
2033                 s->tlsext_status_expected = 0;
2034
2035  err:
2036         switch (ret)
2037                 {
2038                 case SSL_TLSEXT_ERR_ALERT_FATAL:
2039                         ssl3_send_alert(s,SSL3_AL_FATAL,al);
2040                         return -1;
2041
2042                 case SSL_TLSEXT_ERR_ALERT_WARNING:
2043                         ssl3_send_alert(s,SSL3_AL_WARNING,al);
2044                         return 1;
2045
2046                 default:
2047                         return 1;
2048                 }
2049         }
2050
2051 int ssl_check_serverhello_tlsext(SSL *s)
2052         {
2053         int ret=SSL_TLSEXT_ERR_NOACK;
2054         int al = SSL_AD_UNRECOGNIZED_NAME;
2055
2056 #ifndef OPENSSL_NO_EC
2057         /* If we are client and using an elliptic curve cryptography cipher
2058          * suite, then if server returns an EC point formats lists extension
2059          * it must contain uncompressed.
2060          */
2061         unsigned long alg_k = s->s3->tmp.new_cipher->algorithm_mkey;
2062         unsigned long alg_a = s->s3->tmp.new_cipher->algorithm_auth;
2063         if ((s->tlsext_ecpointformatlist != NULL) && (s->tlsext_ecpointformatlist_length > 0) &&
2064             (s->session->tlsext_ecpointformatlist != NULL) && (s->session->tlsext_ecpointformatlist_length > 0) &&
2065             ((alg_k & (SSL_kEECDH|SSL_kECDHr|SSL_kECDHe)) || (alg_a & SSL_aECDSA)))
2066                 {
2067                 /* we are using an ECC cipher */
2068                 size_t i;
2069                 unsigned char *list;
2070                 int found_uncompressed = 0;
2071                 list = s->session->tlsext_ecpointformatlist;
2072                 for (i = 0; i < s->session->tlsext_ecpointformatlist_length; i++)
2073                         {
2074                         if (*(list++) == TLSEXT_ECPOINTFORMAT_uncompressed)
2075                                 {
2076                                 found_uncompressed = 1;
2077                                 break;
2078                                 }
2079                         }
2080                 if (!found_uncompressed)
2081                         {
2082                         SSLerr(SSL_F_SSL_CHECK_SERVERHELLO_TLSEXT,SSL_R_TLS_INVALID_ECPOINTFORMAT_LIST);
2083                         return -1;
2084                         }
2085                 }
2086         ret = SSL_TLSEXT_ERR_OK;
2087 #endif /* OPENSSL_NO_EC */
2088
2089         if (s->ctx != NULL && s->ctx->tlsext_servername_callback != 0)
2090                 ret = s->ctx->tlsext_servername_callback(s, &al, s->ctx->tlsext_servername_arg);
2091         else if (s->initial_ctx != NULL && s->initial_ctx->tlsext_servername_callback != 0)
2092                 ret = s->initial_ctx->tlsext_servername_callback(s, &al, s->initial_ctx->tlsext_servername_arg);
2093
2094 #ifdef TLSEXT_TYPE_opaque_prf_input
2095         if (s->s3->server_opaque_prf_input_len > 0)
2096                 {
2097                 /* This case may indicate that we, as a client, want to insist on using opaque PRF inputs.
2098                  * So first verify that we really have a value from the server too. */
2099
2100                 if (s->s3->server_opaque_prf_input == NULL)
2101                         {
2102                         ret = SSL_TLSEXT_ERR_ALERT_FATAL;
2103                         al = SSL_AD_HANDSHAKE_FAILURE;
2104                         }
2105
2106                 /* Anytime the server *has* sent an opaque PRF input, we need to check
2107                  * that we have a client opaque PRF input of the same size. */
2108                 if (s->s3->client_opaque_prf_input == NULL ||
2109                     s->s3->client_opaque_prf_input_len != s->s3->server_opaque_prf_input_len)
2110                         {
2111                         ret = SSL_TLSEXT_ERR_ALERT_FATAL;
2112                         al = SSL_AD_ILLEGAL_PARAMETER;
2113                         }
2114                 }
2115 #endif
2116
2117         /* If we've requested certificate status and we wont get one
2118          * tell the callback
2119          */
2120         if ((s->tlsext_status_type != -1) && !(s->tlsext_status_expected)
2121                         && s->ctx && s->ctx->tlsext_status_cb)
2122                 {
2123                 int r;
2124                 /* Set resp to NULL, resplen to -1 so callback knows
2125                  * there is no response.
2126                  */
2127                 if (s->tlsext_ocsp_resp)
2128                         {
2129                         OPENSSL_free(s->tlsext_ocsp_resp);
2130                         s->tlsext_ocsp_resp = NULL;
2131                         }
2132                 s->tlsext_ocsp_resplen = -1;
2133                 r = s->ctx->tlsext_status_cb(s, s->ctx->tlsext_status_arg);
2134                 if (r == 0)
2135                         {
2136                         al = SSL_AD_BAD_CERTIFICATE_STATUS_RESPONSE;
2137                         ret = SSL_TLSEXT_ERR_ALERT_FATAL;
2138                         }
2139                 if (r < 0)
2140                         {
2141                         al = SSL_AD_INTERNAL_ERROR;
2142                         ret = SSL_TLSEXT_ERR_ALERT_FATAL;
2143                         }
2144                 }
2145
2146         switch (ret)
2147                 {
2148                 case SSL_TLSEXT_ERR_ALERT_FATAL:
2149                         ssl3_send_alert(s,SSL3_AL_FATAL,al);
2150                         return -1;
2151
2152                 case SSL_TLSEXT_ERR_ALERT_WARNING:
2153                         ssl3_send_alert(s,SSL3_AL_WARNING,al);
2154                         return 1;
2155
2156                 case SSL_TLSEXT_ERR_NOACK:
2157                         s->servername_done=0;
2158                         default:
2159                 return 1;
2160                 }
2161         }
2162
2163 /* Since the server cache lookup is done early on in the processing of the
2164  * ClientHello, and other operations depend on the result, we need to handle
2165  * any TLS session ticket extension at the same time.
2166  *
2167  *   session_id: points at the session ID in the ClientHello. This code will
2168  *       read past the end of this in order to parse out the session ticket
2169  *       extension, if any.
2170  *   len: the length of the session ID.
2171  *   limit: a pointer to the first byte after the ClientHello.
2172  *   ret: (output) on return, if a ticket was decrypted, then this is set to
2173  *       point to the resulting session.
2174  *
2175  * If s->tls_session_secret_cb is set then we are expecting a pre-shared key
2176  * ciphersuite, in which case we have no use for session tickets and one will
2177  * never be decrypted, nor will s->tlsext_ticket_expected be set to 1.
2178  *
2179  * Returns:
2180  *   -1: fatal error, either from parsing or decrypting the ticket.
2181  *    0: no ticket was found (or was ignored, based on settings).
2182  *    1: a zero length extension was found, indicating that the client supports
2183  *       session tickets but doesn't currently have one to offer.
2184  *    2: either s->tls_session_secret_cb was set, or a ticket was offered but
2185  *       couldn't be decrypted because of a non-fatal error.
2186  *    3: a ticket was successfully decrypted and *ret was set.
2187  *
2188  * Side effects:
2189  *   Sets s->tlsext_ticket_expected to 1 if the server will have to issue
2190  *   a new session ticket to the client because the client indicated support
2191  *   (and s->tls_session_secret_cb is NULL) but the client either doesn't have
2192  *   a session ticket or we couldn't use the one it gave us, or if
2193  *   s->ctx->tlsext_ticket_key_cb asked to renew the client's ticket.
2194  *   Otherwise, s->tlsext_ticket_expected is set to 0.
2195  */
2196 int tls1_process_ticket(SSL *s, unsigned char *session_id, int len,
2197                         const unsigned char *limit, SSL_SESSION **ret)
2198         {
2199         /* Point after session ID in client hello */
2200         const unsigned char *p = session_id + len;
2201         unsigned short i;
2202
2203         *ret = NULL;
2204         s->tlsext_ticket_expected = 0;
2205
2206         /* If tickets disabled behave as if no ticket present
2207          * to permit stateful resumption.
2208          */
2209         if (SSL_get_options(s) & SSL_OP_NO_TICKET)
2210                 return 0;
2211         if ((s->version <= SSL3_VERSION) || !limit)
2212                 return 0;
2213         if (p >= limit)
2214                 return -1;
2215         /* Skip past DTLS cookie */
2216         if (s->version == DTLS1_VERSION || s->version == DTLS1_BAD_VER)
2217                 {
2218                 i = *(p++);
2219                 p+= i;
2220                 if (p >= limit)
2221                         return -1;
2222                 }
2223         /* Skip past cipher list */
2224         n2s(p, i);
2225         p+= i;
2226         if (p >= limit)
2227                 return -1;
2228         /* Skip past compression algorithm list */
2229         i = *(p++);
2230         p += i;
2231         if (p > limit)
2232                 return -1;
2233         /* Now at start of extensions */
2234         if ((p + 2) >= limit)
2235                 return 0;
2236         n2s(p, i);
2237         while ((p + 4) <= limit)
2238                 {
2239                 unsigned short type, size;
2240                 n2s(p, type);
2241                 n2s(p, size);
2242                 if (p + size > limit)
2243                         return 0;
2244                 if (type == TLSEXT_TYPE_session_ticket)
2245                         {
2246                         int r;
2247                         if (size == 0)
2248                                 {
2249                                 /* The client will accept a ticket but doesn't
2250                                  * currently have one. */
2251                                 s->tlsext_ticket_expected = 1;
2252                                 return 1;
2253                                 }
2254                         if (s->tls_session_secret_cb)
2255                                 {
2256                                 /* Indicate that the ticket couldn't be
2257                                  * decrypted rather than generating the session
2258                                  * from ticket now, trigger abbreviated
2259                                  * handshake based on external mechanism to
2260                                  * calculate the master secret later. */
2261                                 return 2;
2262                                 }
2263                         r = tls_decrypt_ticket(s, p, size, session_id, len, ret);
2264                         switch (r)
2265                                 {
2266                                 case 2: /* ticket couldn't be decrypted */
2267                                         s->tlsext_ticket_expected = 1;
2268                                         return 2;
2269                                 case 3: /* ticket was decrypted */
2270                                         return r;
2271                                 case 4: /* ticket decrypted but need to renew */
2272                                         s->tlsext_ticket_expected = 1;
2273                                         return 3;
2274                                 default: /* fatal error */
2275                                         return -1;
2276                                 }
2277                         }
2278                 p += size;
2279                 }
2280         return 0;
2281         }
2282
2283 /* tls_decrypt_ticket attempts to decrypt a session ticket.
2284  *
2285  *   etick: points to the body of the session ticket extension.
2286  *   eticklen: the length of the session tickets extenion.
2287  *   sess_id: points at the session ID.
2288  *   sesslen: the length of the session ID.
2289  *   psess: (output) on return, if a ticket was decrypted, then this is set to
2290  *       point to the resulting session.
2291  *
2292  * Returns:
2293  *   -1: fatal error, either from parsing or decrypting the ticket.
2294  *    2: the ticket couldn't be decrypted.
2295  *    3: a ticket was successfully decrypted and *psess was set.
2296  *    4: same as 3, but the ticket needs to be renewed.
2297  */
2298 static int tls_decrypt_ticket(SSL *s, const unsigned char *etick, int eticklen,
2299                                 const unsigned char *sess_id, int sesslen,
2300                                 SSL_SESSION **psess)
2301         {
2302         SSL_SESSION *sess;
2303         unsigned char *sdec;
2304         const unsigned char *p;
2305         int slen, mlen, renew_ticket = 0;
2306         unsigned char tick_hmac[EVP_MAX_MD_SIZE];
2307         HMAC_CTX hctx;
2308         EVP_CIPHER_CTX ctx;
2309         SSL_CTX *tctx = s->initial_ctx;
2310         /* Need at least keyname + iv + some encrypted data */
2311         if (eticklen < 48)
2312                 return 2;
2313         /* Initialize session ticket encryption and HMAC contexts */
2314         HMAC_CTX_init(&hctx);
2315         EVP_CIPHER_CTX_init(&ctx);
2316         if (tctx->tlsext_ticket_key_cb)
2317                 {
2318                 unsigned char *nctick = (unsigned char *)etick;
2319                 int rv = tctx->tlsext_ticket_key_cb(s, nctick, nctick + 16,
2320                                                         &ctx, &hctx, 0);
2321                 if (rv < 0)
2322                         return -1;
2323                 if (rv == 0)
2324                         return 2;
2325                 if (rv == 2)
2326                         renew_ticket = 1;
2327                 }
2328         else
2329                 {
2330                 /* Check key name matches */
2331                 if (memcmp(etick, tctx->tlsext_tick_key_name, 16))
2332                         return 2;
2333                 HMAC_Init_ex(&hctx, tctx->tlsext_tick_hmac_key, 16,
2334                                         tlsext_tick_md(), NULL);
2335                 EVP_DecryptInit_ex(&ctx, EVP_aes_128_cbc(), NULL,
2336                                 tctx->tlsext_tick_aes_key, etick + 16);
2337                 }
2338         /* Attempt to process session ticket, first conduct sanity and
2339          * integrity checks on ticket.
2340          */
2341         mlen = HMAC_size(&hctx);
2342         if (mlen < 0)
2343                 {
2344                 EVP_CIPHER_CTX_cleanup(&ctx);
2345                 return -1;
2346                 }
2347         eticklen -= mlen;
2348         /* Check HMAC of encrypted ticket */
2349         HMAC_Update(&hctx, etick, eticklen);
2350         HMAC_Final(&hctx, tick_hmac, NULL);
2351         HMAC_CTX_cleanup(&hctx);
2352         if (CRYPTO_memcmp(tick_hmac, etick + eticklen, mlen))
2353                 return 2;
2354         /* Attempt to decrypt session data */
2355         /* Move p after IV to start of encrypted ticket, update length */
2356         p = etick + 16 + EVP_CIPHER_CTX_iv_length(&ctx);
2357         eticklen -= 16 + EVP_CIPHER_CTX_iv_length(&ctx);
2358         sdec = OPENSSL_malloc(eticklen);
2359         if (!sdec)
2360                 {
2361                 EVP_CIPHER_CTX_cleanup(&ctx);
2362                 return -1;
2363                 }
2364         EVP_DecryptUpdate(&ctx, sdec, &slen, p, eticklen);
2365         if (EVP_DecryptFinal(&ctx, sdec + slen, &mlen) <= 0)
2366                 {
2367                 EVP_CIPHER_CTX_cleanup(&ctx);
2368                 OPENSSL_free(sdec);
2369                 return 2;
2370                 }
2371         slen += mlen;
2372         EVP_CIPHER_CTX_cleanup(&ctx);
2373         p = sdec;
2374
2375         sess = d2i_SSL_SESSION(NULL, &p, slen);
2376         OPENSSL_free(sdec);
2377         if (sess)
2378                 {
2379                 /* The session ID, if non-empty, is used by some clients to
2380                  * detect that the ticket has been accepted. So we copy it to
2381                  * the session structure. If it is empty set length to zero
2382                  * as required by standard.
2383                  */
2384                 if (sesslen)
2385                         memcpy(sess->session_id, sess_id, sesslen);
2386                 sess->session_id_length = sesslen;
2387                 *psess = sess;
2388                 if (renew_ticket)
2389                         return 4;
2390                 else
2391                         return 3;
2392                 }
2393         ERR_clear_error();
2394         /* For session parse failure, indicate that we need to send a new
2395          * ticket. */
2396         return 2;
2397         }
2398
2399 /* Tables to translate from NIDs to TLS v1.2 ids */
2400
2401 typedef struct
2402         {
2403         int nid;
2404         int id;
2405         } tls12_lookup;
2406
2407 static tls12_lookup tls12_md[] = {
2408 #ifndef OPENSSL_NO_MD5
2409         {NID_md5, TLSEXT_hash_md5},
2410 #endif
2411 #ifndef OPENSSL_NO_SHA
2412         {NID_sha1, TLSEXT_hash_sha1},
2413 #endif
2414 #ifndef OPENSSL_NO_SHA256
2415         {NID_sha224, TLSEXT_hash_sha224},
2416         {NID_sha256, TLSEXT_hash_sha256},
2417 #endif
2418 #ifndef OPENSSL_NO_SHA512
2419         {NID_sha384, TLSEXT_hash_sha384},
2420         {NID_sha512, TLSEXT_hash_sha512}
2421 #endif
2422 };
2423
2424 static tls12_lookup tls12_sig[] = {
2425 #ifndef OPENSSL_NO_RSA
2426         {EVP_PKEY_RSA, TLSEXT_signature_rsa},
2427 #endif
2428 #ifndef OPENSSL_NO_DSA
2429         {EVP_PKEY_DSA, TLSEXT_signature_dsa},
2430 #endif
2431 #ifndef OPENSSL_NO_ECDSA
2432         {EVP_PKEY_EC, TLSEXT_signature_ecdsa}
2433 #endif
2434 };
2435
2436 static int tls12_find_id(int nid, tls12_lookup *table, size_t tlen)
2437         {
2438         size_t i;
2439         for (i = 0; i < tlen; i++)
2440                 {
2441                 if (table[i].nid == nid)
2442                         return table[i].id;
2443                 }
2444         return -1;
2445         }
2446 #if 0
2447 static int tls12_find_nid(int id, tls12_lookup *table, size_t tlen)
2448         {
2449         size_t i;
2450         for (i = 0; i < tlen; i++)
2451                 {
2452                 if (table[i].id == id)
2453                         return table[i].nid;
2454                 }
2455         return -1;
2456         }
2457 #endif
2458
2459 int tls12_get_sigandhash(unsigned char *p, const EVP_PKEY *pk, const EVP_MD *md)
2460         {
2461         int sig_id, md_id;
2462         if (!md)
2463                 return 0;
2464         md_id = tls12_find_id(EVP_MD_type(md), tls12_md,
2465                                 sizeof(tls12_md)/sizeof(tls12_lookup));
2466         if (md_id == -1)
2467                 return 0;
2468         sig_id = tls12_get_sigid(pk);
2469         if (sig_id == -1)
2470                 return 0;
2471         p[0] = (unsigned char)md_id;
2472         p[1] = (unsigned char)sig_id;
2473         return 1;
2474         }
2475
2476 int tls12_get_sigid(const EVP_PKEY *pk)
2477         {
2478         return tls12_find_id(pk->type, tls12_sig,
2479                                 sizeof(tls12_sig)/sizeof(tls12_lookup));
2480         }
2481
2482 const EVP_MD *tls12_get_hash(unsigned char hash_alg)
2483         {
2484         switch(hash_alg)
2485                 {
2486 #ifndef OPENSSL_NO_SHA
2487                 case TLSEXT_hash_sha1:
2488                 return EVP_sha1();
2489 #endif
2490 #ifndef OPENSSL_NO_SHA256
2491                 case TLSEXT_hash_sha224:
2492                 return EVP_sha224();
2493
2494                 case TLSEXT_hash_sha256:
2495                 return EVP_sha256();
2496 #endif
2497 #ifndef OPENSSL_NO_SHA512
2498                 case TLSEXT_hash_sha384:
2499                 return EVP_sha384();
2500
2501                 case TLSEXT_hash_sha512:
2502                 return EVP_sha512();
2503 #endif
2504                 default:
2505                 return NULL;
2506
2507                 }
2508         }
2509
2510 /* Set preferred digest for each key type */
2511
2512 int tls1_process_sigalgs(SSL *s, const unsigned char *data, int dsize)
2513         {
2514         int i, idx;
2515         const EVP_MD *md;
2516         CERT *c = s->cert;
2517         /* Extension ignored for TLS versions below 1.2 */
2518         if (TLS1_get_version(s) < TLS1_2_VERSION)
2519                 return 1;
2520         /* Should never happen */
2521         if (!c)
2522                 return 0;
2523
2524         c->pkeys[SSL_PKEY_DSA_SIGN].digest = NULL;
2525         c->pkeys[SSL_PKEY_RSA_SIGN].digest = NULL;
2526         c->pkeys[SSL_PKEY_RSA_ENC].digest = NULL;
2527         c->pkeys[SSL_PKEY_ECC].digest = NULL;
2528
2529         for (i = 0; i < dsize; i += 2)
2530                 {
2531                 unsigned char hash_alg = data[i], sig_alg = data[i+1];
2532
2533                 switch(sig_alg)
2534                         {
2535 #ifndef OPENSSL_NO_RSA
2536                         case TLSEXT_signature_rsa:
2537                         idx = SSL_PKEY_RSA_SIGN;
2538                         break;
2539 #endif
2540 #ifndef OPENSSL_NO_DSA
2541                         case TLSEXT_signature_dsa:
2542                         idx = SSL_PKEY_DSA_SIGN;
2543                         break;
2544 #endif
2545 #ifndef OPENSSL_NO_ECDSA
2546                         case TLSEXT_signature_ecdsa:
2547                         idx = SSL_PKEY_ECC;
2548                         break;
2549 #endif
2550                         default:
2551                         continue;
2552                         }
2553
2554                 if (c->pkeys[idx].digest == NULL)
2555                         {
2556                         md = tls12_get_hash(hash_alg);
2557                         if (md)
2558                                 {
2559                                 c->pkeys[idx].digest = md;
2560                                 if (idx == SSL_PKEY_RSA_SIGN)
2561                                         c->pkeys[SSL_PKEY_RSA_ENC].digest = md;
2562                                 }
2563                         }
2564
2565                 }
2566
2567
2568         /* Set any remaining keys to default values. NOTE: if alg is not
2569          * supported it stays as NULL.
2570          */
2571 #ifndef OPENSSL_NO_DSA
2572         if (!c->pkeys[SSL_PKEY_DSA_SIGN].digest)
2573                 c->pkeys[SSL_PKEY_DSA_SIGN].digest = EVP_sha1();
2574 #endif
2575 #ifndef OPENSSL_NO_RSA
2576         if (!c->pkeys[SSL_PKEY_RSA_SIGN].digest)
2577                 {
2578                 c->pkeys[SSL_PKEY_RSA_SIGN].digest = EVP_sha1();
2579                 c->pkeys[SSL_PKEY_RSA_ENC].digest = EVP_sha1();
2580                 }
2581 #endif
2582 #ifndef OPENSSL_NO_ECDSA
2583         if (!c->pkeys[SSL_PKEY_ECC].digest)
2584                 c->pkeys[SSL_PKEY_ECC].digest = EVP_sha1();
2585 #endif
2586         return 1;
2587         }
2588
2589 #endif
2590
2591 #ifndef OPENSSL_NO_HEARTBEATS
2592 int
2593 tls1_process_heartbeat(SSL *s)
2594         {
2595         unsigned char *p = &s->s3->rrec.data[0], *pl;
2596         unsigned short hbtype;
2597         unsigned int payload;
2598         unsigned int padding = 16; /* Use minimum padding */
2599
2600         if (s->msg_callback)
2601                 s->msg_callback(0, s->version, TLS1_RT_HEARTBEAT,
2602                         &s->s3->rrec.data[0], s->s3->rrec.length,
2603                         s, s->msg_callback_arg);
2604
2605         /* Read type and payload length first */
2606         if (1 + 2 + 16 > s->s3->rrec.length)
2607                 return 0; /* silently discard */
2608         hbtype = *p++;
2609         n2s(p, payload);
2610         if (1 + 2 + payload + 16 > s->s3->rrec.length)
2611                 return 0; /* silently discard per RFC 6520 sec. 4 */
2612         pl = p;
2613
2614         if (hbtype == TLS1_HB_REQUEST)
2615                 {
2616                 unsigned char *buffer, *bp;
2617                 int r;
2618
2619                 /* Allocate memory for the response, size is 1 bytes
2620                  * message type, plus 2 bytes payload length, plus
2621                  * payload, plus padding
2622                  */
2623                 buffer = OPENSSL_malloc(1 + 2 + payload + padding);
2624                 bp = buffer;
2625
2626                 /* Enter response type, length and copy payload */
2627                 *bp++ = TLS1_HB_RESPONSE;
2628                 s2n(payload, bp);
2629                 memcpy(bp, pl, payload);
2630                 bp += payload;
2631                 /* Random padding */
2632                 RAND_pseudo_bytes(bp, padding);
2633
2634                 r = ssl3_write_bytes(s, TLS1_RT_HEARTBEAT, buffer, 3 + payload + padding);
2635
2636                 if (r >= 0 && s->msg_callback)
2637                         s->msg_callback(1, s->version, TLS1_RT_HEARTBEAT,
2638                                 buffer, 3 + payload + padding,
2639                                 s, s->msg_callback_arg);
2640
2641                 OPENSSL_free(buffer);
2642
2643                 if (r < 0)
2644                         return r;
2645                 }
2646         else if (hbtype == TLS1_HB_RESPONSE)
2647                 {
2648                 unsigned int seq;
2649
2650                 /* We only send sequence numbers (2 bytes unsigned int),
2651                  * and 16 random bytes, so we just try to read the
2652                  * sequence number */
2653                 n2s(pl, seq);
2654
2655                 if (payload == 18 && seq == s->tlsext_hb_seq)
2656                         {
2657                         s->tlsext_hb_seq++;
2658                         s->tlsext_hb_pending = 0;
2659                         }
2660                 }
2661
2662         return 0;
2663         }
2664
2665 int
2666 tls1_heartbeat(SSL *s)
2667         {
2668         unsigned char *buf, *p;
2669         int ret;
2670         unsigned int payload = 18; /* Sequence number + random bytes */
2671         unsigned int padding = 16; /* Use minimum padding */
2672
2673         /* Only send if peer supports and accepts HB requests... */
2674         if (!(s->tlsext_heartbeat & SSL_TLSEXT_HB_ENABLED) ||
2675             s->tlsext_heartbeat & SSL_TLSEXT_HB_DONT_SEND_REQUESTS)
2676                 {
2677                 SSLerr(SSL_F_TLS1_HEARTBEAT,SSL_R_TLS_HEARTBEAT_PEER_DOESNT_ACCEPT);
2678                 return -1;
2679                 }
2680
2681         /* ...and there is none in flight yet... */
2682         if (s->tlsext_hb_pending)
2683                 {
2684                 SSLerr(SSL_F_TLS1_HEARTBEAT,SSL_R_TLS_HEARTBEAT_PENDING);
2685                 return -1;
2686                 }
2687
2688         /* ...and no handshake in progress. */
2689         if (SSL_in_init(s) || s->in_handshake)
2690                 {
2691                 SSLerr(SSL_F_TLS1_HEARTBEAT,SSL_R_UNEXPECTED_MESSAGE);
2692                 return -1;
2693                 }
2694
2695         /* Check if padding is too long, payload and padding
2696          * must not exceed 2^14 - 3 = 16381 bytes in total.
2697          */
2698         OPENSSL_assert(payload + padding <= 16381);
2699
2700         /* Create HeartBeat message, we just use a sequence number
2701          * as payload to distuingish different messages and add
2702          * some random stuff.
2703          *  - Message Type, 1 byte
2704          *  - Payload Length, 2 bytes (unsigned int)
2705          *  - Payload, the sequence number (2 bytes uint)
2706          *  - Payload, random bytes (16 bytes uint)
2707          *  - Padding
2708          */
2709         buf = OPENSSL_malloc(1 + 2 + payload + padding);
2710         p = buf;
2711         /* Message Type */
2712         *p++ = TLS1_HB_REQUEST;
2713         /* Payload length (18 bytes here) */
2714         s2n(payload, p);
2715         /* Sequence number */
2716         s2n(s->tlsext_hb_seq, p);
2717         /* 16 random bytes */
2718         RAND_pseudo_bytes(p, 16);
2719         p += 16;
2720         /* Random padding */
2721         RAND_pseudo_bytes(p, padding);
2722
2723         ret = ssl3_write_bytes(s, TLS1_RT_HEARTBEAT, buf, 3 + payload + padding);
2724         if (ret >= 0)
2725                 {
2726                 if (s->msg_callback)
2727                         s->msg_callback(1, s->version, TLS1_RT_HEARTBEAT,
2728                                 buf, 3 + payload + padding,
2729                                 s, s->msg_callback_arg);
2730
2731                 s->tlsext_hb_pending = 1;
2732                 }
2733
2734         OPENSSL_free(buf);
2735
2736         return ret;
2737         }
2738 #endif