ssl/t1_lib.c

   1 /* ssl/t1_lib.c */
   2 /* Copyright (C) 1995-1998 Eric Young (eay@cryptsoft.com)
   3  * All rights reserved.
   4  *
   5  * This package is an SSL implementation written
   6  * by Eric Young (eay@cryptsoft.com).
   7  * The implementation was written so as to conform with Netscapes SSL.
   8  *
   9  * This library is free for commercial and non-commercial use as long as
  10  * the following conditions are aheared to.  The following conditions
  11  * apply to all code found in this distribution, be it the RC4, RSA,
  12  * lhash, DES, etc., code; not just the SSL code.  The SSL documentation
  13  * included with this distribution is covered by the same copyright terms
  14  * except that the holder is Tim Hudson (tjh@cryptsoft.com).
  15  *
  16  * Copyright remains Eric Young's, and as such any Copyright notices in
  17  * the code are not to be removed.
  18  * If this package is used in a product, Eric Young should be given attribution
  19  * as the author of the parts of the library used.
  20  * This can be in the form of a textual message at program startup or
  21  * in documentation (online or textual) provided with the package.
  22  *
  23  * Redistribution and use in source and binary forms, with or without
  24  * modification, are permitted provided that the following conditions
  25  * are met:
  26  * 1. Redistributions of source code must retain the copyright
  27  *    notice, this list of conditions and the following disclaimer.
  28  * 2. Redistributions in binary form must reproduce the above copyright
  29  *    notice, this list of conditions and the following disclaimer in the
  30  *    documentation and/or other materials provided with the distribution.
  31  * 3. All advertising materials mentioning features or use of this software
  32  *    must display the following acknowledgement:
  33  *    "This product includes cryptographic software written by
  34  *     Eric Young (eay@cryptsoft.com)"
  35  *    The word 'cryptographic' can be left out if the rouines from the library
  36  *    being used are not cryptographic related :-).
  37  * 4. If you include any Windows specific code (or a derivative thereof) from
  38  *    the apps directory (application code) you must include an acknowledgement:
  39  *    "This product includes software written by Tim Hudson (tjh@cryptsoft.com)"
  40  *
  41  * THIS SOFTWARE IS PROVIDED BY ERIC YOUNG ``AS IS'' AND
  42  * ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
  43  * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE
  44  * ARE DISCLAIMED.  IN NO EVENT SHALL THE AUTHOR OR CONTRIBUTORS BE LIABLE
  45  * FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL
  46  * DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS
  47  * OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION)
  48  * HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT
  49  * LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY
  50  * OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF
  51  * SUCH DAMAGE.
  52  *
  53  * The licence and distribution terms for any publically available version or
  54  * derivative of this code cannot be changed.  i.e. this code cannot simply be
  55  * copied and put under another distribution licence
  56  * [including the GNU Public Licence.]
  57  */
  58 /* ====================================================================
  59  * Copyright (c) 1998-2007 The OpenSSL Project.  All rights reserved.
  60  *
  61  * Redistribution and use in source and binary forms, with or without
  62  * modification, are permitted provided that the following conditions
  63  * are met:
  64  *
  65  * 1. Redistributions of source code must retain the above copyright
  66  *    notice, this list of conditions and the following disclaimer.
  67  *
  68  * 2. Redistributions in binary form must reproduce the above copyright
  69  *    notice, this list of conditions and the following disclaimer in
  70  *    the documentation and/or other materials provided with the
  71  *    distribution.
  72  *
  73  * 3. All advertising materials mentioning features or use of this
  74  *    software must display the following acknowledgment:
  75  *    "This product includes software developed by the OpenSSL Project
  76  *    for use in the OpenSSL Toolkit. (http://www.openssl.org/)"
  77  *
  78  * 4. The names "OpenSSL Toolkit" and "OpenSSL Project" must not be used to
  79  *    endorse or promote products derived from this software without
  80  *    prior written permission. For written permission, please contact
  81  *    openssl-core@openssl.org.
  82  *
  83  * 5. Products derived from this software may not be called "OpenSSL"
  84  *    nor may "OpenSSL" appear in their names without prior written
  85  *    permission of the OpenSSL Project.
  86  *
  87  * 6. Redistributions of any form whatsoever must retain the following
  88  *    acknowledgment:
  89  *    "This product includes software developed by the OpenSSL Project
  90  *    for use in the OpenSSL Toolkit (http://www.openssl.org/)"
  91  *
  92  * THIS SOFTWARE IS PROVIDED BY THE OpenSSL PROJECT ``AS IS'' AND ANY
  93  * EXPRESSED OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
  94  * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
  95  * PURPOSE ARE DISCLAIMED.  IN NO EVENT SHALL THE OpenSSL PROJECT OR
  96  * ITS CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL,
  97  * SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT
  98  * NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES;
  99  * LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION)
 100  * HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT,
 101  * STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE)
 102  * ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED
 103  * OF THE POSSIBILITY OF SUCH DAMAGE.
 104  * ====================================================================
 105  *
 106  * This product includes cryptographic software written by Eric Young
 107  * (eay@cryptsoft.com).  This product includes software written by Tim
 108  * Hudson (tjh@cryptsoft.com).
 109  *
 110  */
 111
 112 #include <stdio.h>
 113 #include <openssl/objects.h>
 114 #include <openssl/evp.h>
 115 #include <openssl/hmac.h>
 116 #include <openssl/ocsp.h>
 117 #include <openssl/rand.h>
 118 #include "ssl_locl.h"
 119
 120 const char tls1_version_str[]="TLSv1" OPENSSL_VERSION_PTEXT;
 121
 122 #ifndef OPENSSL_NO_TLSEXT
 123 static int tls_decrypt_ticket(SSL *s, const unsigned char *tick, int ticklen,
 124                                 const unsigned char *sess_id, int sesslen,
 125                                 SSL_SESSION **psess);
 126 static int ssl_check_clienthello_tlsext_early(SSL *s);
 127 int ssl_check_serverhello_tlsext(SSL *s);
 128 #endif
 129
 130 SSL3_ENC_METHOD TLSv1_enc_data={
 131         tls1_enc,
 132         tls1_mac,
 133         tls1_setup_key_block,
 134         tls1_generate_master_secret,
 135         tls1_change_cipher_state,
 136         tls1_final_finish_mac,
 137         TLS1_FINISH_MAC_LENGTH,
 138         tls1_cert_verify_mac,
 139         TLS_MD_CLIENT_FINISH_CONST,TLS_MD_CLIENT_FINISH_CONST_SIZE,
 140         TLS_MD_SERVER_FINISH_CONST,TLS_MD_SERVER_FINISH_CONST_SIZE,
 141         tls1_alert_code,
 142         tls1_export_keying_material,
 143         0,
 144         SSL3_HM_HEADER_LENGTH,
 145         ssl3_set_handshake_header,
 146         ssl3_handshake_write
 147         };
 148
 149 SSL3_ENC_METHOD TLSv1_1_enc_data={
 150         tls1_enc,
 151         tls1_mac,
 152         tls1_setup_key_block,
 153         tls1_generate_master_secret,
 154         tls1_change_cipher_state,
 155         tls1_final_finish_mac,
 156         TLS1_FINISH_MAC_LENGTH,
 157         tls1_cert_verify_mac,
 158         TLS_MD_CLIENT_FINISH_CONST,TLS_MD_CLIENT_FINISH_CONST_SIZE,
 159         TLS_MD_SERVER_FINISH_CONST,TLS_MD_SERVER_FINISH_CONST_SIZE,
 160         tls1_alert_code,
 161         tls1_export_keying_material,
 162         SSL_ENC_FLAG_EXPLICIT_IV,
 163         SSL3_HM_HEADER_LENGTH,
 164         ssl3_set_handshake_header,
 165         ssl3_handshake_write
 166         };
 167
 168 SSL3_ENC_METHOD TLSv1_2_enc_data={
 169         tls1_enc,
 170         tls1_mac,
 171         tls1_setup_key_block,
 172         tls1_generate_master_secret,
 173         tls1_change_cipher_state,
 174         tls1_final_finish_mac,
 175         TLS1_FINISH_MAC_LENGTH,
 176         tls1_cert_verify_mac,
 177         TLS_MD_CLIENT_FINISH_CONST,TLS_MD_CLIENT_FINISH_CONST_SIZE,
 178         TLS_MD_SERVER_FINISH_CONST,TLS_MD_SERVER_FINISH_CONST_SIZE,
 179         tls1_alert_code,
 180         tls1_export_keying_material,
 181         SSL_ENC_FLAG_EXPLICIT_IV|SSL_ENC_FLAG_SIGALGS|SSL_ENC_FLAG_SHA256_PRF
 182                 |SSL_ENC_FLAG_TLS1_2_CIPHERS,
 183         SSL3_HM_HEADER_LENGTH,
 184         ssl3_set_handshake_header,
 185         ssl3_handshake_write
 186         };
 187
 188 long tls1_default_timeout(void)
 189         {
 190         /* 2 hours, the 24 hours mentioned in the TLSv1 spec
 191          * is way too long for http, the cache would over fill */
 192         return(60*60*2);
 193         }
 194
 195 int tls1_new(SSL *s)
 196         {
 197         if (!ssl3_new(s)) return(0);
 198         s->method->ssl_clear(s);
 199         return(1);
 200         }
 201
 202 void tls1_free(SSL *s)
 203         {
 204 #ifndef OPENSSL_NO_TLSEXT
 205         if (s->tlsext_session_ticket)
 206                 {
 207                 OPENSSL_free(s->tlsext_session_ticket);
 208                 }
 209 #endif /* OPENSSL_NO_TLSEXT */
 210         ssl3_free(s);
 211         }
 212
 213 void tls1_clear(SSL *s)
 214         {
 215         ssl3_clear(s);
 216         s->version = s->method->version;
 217         }
 218
 219 #ifndef OPENSSL_NO_EC
 220
 221 static int nid_list[] =
 222         {
 223                 NID_sect163k1, /* sect163k1 (1) */
 224                 NID_sect163r1, /* sect163r1 (2) */
 225                 NID_sect163r2, /* sect163r2 (3) */
 226                 NID_sect193r1, /* sect193r1 (4) */
 227                 NID_sect193r2, /* sect193r2 (5) */
 228                 NID_sect233k1, /* sect233k1 (6) */
 229                 NID_sect233r1, /* sect233r1 (7) */
 230                 NID_sect239k1, /* sect239k1 (8) */
 231                 NID_sect283k1, /* sect283k1 (9) */
 232                 NID_sect283r1, /* sect283r1 (10) */
 233                 NID_sect409k1, /* sect409k1 (11) */
 234                 NID_sect409r1, /* sect409r1 (12) */
 235                 NID_sect571k1, /* sect571k1 (13) */
 236                 NID_sect571r1, /* sect571r1 (14) */
 237                 NID_secp160k1, /* secp160k1 (15) */
 238                 NID_secp160r1, /* secp160r1 (16) */
 239                 NID_secp160r2, /* secp160r2 (17) */
 240                 NID_secp192k1, /* secp192k1 (18) */
 241                 NID_X9_62_prime192v1, /* secp192r1 (19) */
 242                 NID_secp224k1, /* secp224k1 (20) */
 243                 NID_secp224r1, /* secp224r1 (21) */
 244                 NID_secp256k1, /* secp256k1 (22) */
 245                 NID_X9_62_prime256v1, /* secp256r1 (23) */
 246                 NID_secp384r1, /* secp384r1 (24) */
 247                 NID_secp521r1,  /* secp521r1 (25) */
 248                 NID_brainpoolP256r1,  /* brainpoolP256r1 (26) */
 249                 NID_brainpoolP384r1,  /* brainpoolP384r1 (27) */
 250                 NID_brainpoolP512r1  /* brainpool512r1 (28) */
 251         };
 252
 253
 254 static const unsigned char ecformats_default[] =
 255         {
 256         TLSEXT_ECPOINTFORMAT_uncompressed,
 257         TLSEXT_ECPOINTFORMAT_ansiX962_compressed_prime,
 258         TLSEXT_ECPOINTFORMAT_ansiX962_compressed_char2
 259         };
 260
 261 static const unsigned char eccurves_default[] =
 262         {
 263                 0,14, /* sect571r1 (14) */
 264                 0,13, /* sect571k1 (13) */
 265                 0,25, /* secp521r1 (25) */
 266                 0,28, /* brainpool512r1 (28) */
 267                 0,11, /* sect409k1 (11) */
 268                 0,12, /* sect409r1 (12) */
 269                 0,27, /* brainpoolP384r1 (27) */
 270                 0,24, /* secp384r1 (24) */
 271                 0,9,  /* sect283k1 (9) */
 272                 0,10, /* sect283r1 (10) */
 273                 0,26, /* brainpoolP256r1 (26) */
 274                 0,22, /* secp256k1 (22) */
 275                 0,23, /* secp256r1 (23) */
 276                 0,8,  /* sect239k1 (8) */
 277                 0,6,  /* sect233k1 (6) */
 278                 0,7,  /* sect233r1 (7) */
 279                 0,20, /* secp224k1 (20) */
 280                 0,21, /* secp224r1 (21) */
 281                 0,4,  /* sect193r1 (4) */
 282                 0,5,  /* sect193r2 (5) */
 283                 0,18, /* secp192k1 (18) */
 284                 0,19, /* secp192r1 (19) */
 285                 0,1,  /* sect163k1 (1) */
 286                 0,2,  /* sect163r1 (2) */
 287                 0,3,  /* sect163r2 (3) */
 288                 0,15, /* secp160k1 (15) */
 289                 0,16, /* secp160r1 (16) */
 290                 0,17, /* secp160r2 (17) */
 291         };
 292
 293 static const unsigned char suiteb_curves[] =
 294         {
 295                 0, TLSEXT_curve_P_256,
 296                 0, TLSEXT_curve_P_384
 297         };
 298
 299 int tls1_ec_curve_id2nid(int curve_id)
 300         {
 301         /* ECC curves from draft-ietf-tls-ecc-12.txt (Oct. 17, 2005) */
 302         if ((curve_id < 1) || ((unsigned int)curve_id >
 303                                 sizeof(nid_list)/sizeof(nid_list[0])))
 304                 return 0;
 305         return nid_list[curve_id-1];
 306         }
 307
 308 int tls1_ec_nid2curve_id(int nid)
 309         {
 310         /* ECC curves from draft-ietf-tls-ecc-12.txt (Oct. 17, 2005) */
 311         switch (nid)
 312                 {
 313         case NID_sect163k1: /* sect163k1 (1) */
 314                 return 1;
 315         case NID_sect163r1: /* sect163r1 (2) */
 316                 return 2;
 317         case NID_sect163r2: /* sect163r2 (3) */
 318                 return 3;
 319         case NID_sect193r1: /* sect193r1 (4) */
 320                 return 4;
 321         case NID_sect193r2: /* sect193r2 (5) */
 322                 return 5;
 323         case NID_sect233k1: /* sect233k1 (6) */
 324                 return 6;
 325         case NID_sect233r1: /* sect233r1 (7) */
 326                 return 7;
 327         case NID_sect239k1: /* sect239k1 (8) */
 328                 return 8;
 329         case NID_sect283k1: /* sect283k1 (9) */
 330                 return 9;
 331         case NID_sect283r1: /* sect283r1 (10) */
 332                 return 10;
 333         case NID_sect409k1: /* sect409k1 (11) */
 334                 return 11;
 335         case NID_sect409r1: /* sect409r1 (12) */
 336                 return 12;
 337         case NID_sect571k1: /* sect571k1 (13) */
 338                 return 13;
 339         case NID_sect571r1: /* sect571r1 (14) */
 340                 return 14;
 341         case NID_secp160k1: /* secp160k1 (15) */
 342                 return 15;
 343         case NID_secp160r1: /* secp160r1 (16) */
 344                 return 16;
 345         case NID_secp160r2: /* secp160r2 (17) */
 346                 return 17;
 347         case NID_secp192k1: /* secp192k1 (18) */
 348                 return 18;
 349         case NID_X9_62_prime192v1: /* secp192r1 (19) */
 350                 return 19;
 351         case NID_secp224k1: /* secp224k1 (20) */
 352                 return 20;
 353         case NID_secp224r1: /* secp224r1 (21) */
 354                 return 21;
 355         case NID_secp256k1: /* secp256k1 (22) */
 356                 return 22;
 357         case NID_X9_62_prime256v1: /* secp256r1 (23) */
 358                 return 23;
 359         case NID_secp384r1: /* secp384r1 (24) */
 360                 return 24;
 361         case NID_secp521r1:  /* secp521r1 (25) */
 362                 return 25;
 363         default:
 364                 return 0;
 365                 }
 366         }
 367 /* Get curves list, if "sess" is set return client curves otherwise
 368  * preferred list
 369  */
 370 static void tls1_get_curvelist(SSL *s, int sess,
 371                                         const unsigned char **pcurves,
 372                                         size_t *pcurveslen)
 373         {
 374         if (sess)
 375                 {
 376                 *pcurves = s->session->tlsext_ellipticcurvelist;
 377                 *pcurveslen = s->session->tlsext_ellipticcurvelist_length;
 378                 return;
 379                 }
 380         /* For Suite B mode only include P-256, P-384 */
 381         switch (tls1_suiteb(s))
 382                 {
 383         case SSL_CERT_FLAG_SUITEB_128_LOS:
 384                 *pcurves = suiteb_curves;
 385                 *pcurveslen = sizeof(suiteb_curves);
 386                 break;
 387
 388         case SSL_CERT_FLAG_SUITEB_128_LOS_ONLY:
 389                 *pcurves = suiteb_curves;
 390                 *pcurveslen = 2;
 391                 break;
 392
 393         case SSL_CERT_FLAG_SUITEB_192_LOS:
 394                 *pcurves = suiteb_curves + 2;
 395                 *pcurveslen = 2;
 396                 break;
 397         default:
 398                 *pcurves = s->tlsext_ellipticcurvelist;
 399                 *pcurveslen = s->tlsext_ellipticcurvelist_length;
 400                 }
 401         if (!*pcurves)
 402                 {
 403                 *pcurves = eccurves_default;
 404                 *pcurveslen = sizeof(eccurves_default);
 405                 }
 406         }
 407 /* Check a curve is one of our preferences */
 408 int tls1_check_curve(SSL *s, const unsigned char *p, size_t len)
 409         {
 410         const unsigned char *curves;
 411         size_t curveslen, i;
 412         unsigned int suiteb_flags = tls1_suiteb(s);
 413         if (len != 3 || p[0] != NAMED_CURVE_TYPE)
 414                 return 0;
 415         /* Check curve matches Suite B preferences */
 416         if (suiteb_flags)
 417                 {
 418                 unsigned long cid = s->s3->tmp.new_cipher->id;
 419                 if (p[1])
 420                         return 0;
 421                 if (cid == TLS1_CK_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256)
 422                         {
 423                         if (p[2] != TLSEXT_curve_P_256)
 424                                 return 0;
 425                         }
 426                 else if (cid == TLS1_CK_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384)
 427                         {
 428                         if (p[2] != TLSEXT_curve_P_384)
 429                                 return 0;
 430                         }
 431                 else    /* Should never happen */
 432                         return 0;
 433                 }
 434         tls1_get_curvelist(s, 0, &curves, &curveslen);
 435         for (i = 0; i < curveslen; i += 2, curves += 2)
 436                 {
 437                 if (p[1] == curves[0] && p[2] == curves[1])
 438                         return 1;
 439                 }
 440         return 0;
 441         }
 442
 443 /* Return nth shared curve. If nmatch == -1 return number of
 444  * matches. For nmatch == -2 return the NID of the curve to use for
 445  * an EC tmp key.
 446  */
 447
 448 int tls1_shared_curve(SSL *s, int nmatch)
 449         {
 450         const unsigned char *pref, *supp;
 451         size_t preflen, supplen, i, j;
 452         int k;
 453         /* Can't do anything on client side */
 454         if (s->server == 0)
 455                 return -1;
 456         if (nmatch == -2)
 457                 {
 458                 if (tls1_suiteb(s))
 459                         {
 460                         /* For Suite B ciphersuite determines curve: we
 461                          * already know these are acceptable due to previous
 462                          * checks.
 463                          */
 464                         unsigned long cid = s->s3->tmp.new_cipher->id;
 465                         if (cid == TLS1_CK_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256)
 466                                 return NID_X9_62_prime256v1; /* P-256 */
 467                         if (cid == TLS1_CK_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384)
 468                                 return NID_secp384r1; /* P-384 */
 469                         /* Should never happen */
 470                         return NID_undef;
 471                         }
 472                 /* If not Suite B just return first preference shared curve */
 473                 nmatch = 0;
 474                 }
 475         tls1_get_curvelist(s, !!(s->options & SSL_OP_CIPHER_SERVER_PREFERENCE),
 476                                 &supp, &supplen);
 477         tls1_get_curvelist(s, !(s->options & SSL_OP_CIPHER_SERVER_PREFERENCE),
 478                                 &pref, &preflen);
 479         preflen /= 2;
 480         supplen /= 2;
 481         k = 0;
 482         for (i = 0; i < preflen; i++, pref+=2)
 483                 {
 484                 const unsigned char *tsupp = supp;
 485                 for (j = 0; j < supplen; j++, tsupp+=2)
 486                         {
 487                         if (pref[0] == tsupp[0] && pref[1] == tsupp[1])
 488                                 {
 489                                 if (nmatch == k)
 490                                         {
 491                                         int id = (pref[0] << 8) | pref[1];
 492                                         return tls1_ec_curve_id2nid(id);
 493                                         }
 494                                 k++;
 495                                 }
 496                         }
 497                 }
 498         if (nmatch == -1)
 499                 return k;
 500         return 0;
 501         }
 502
 503 int tls1_set_curves(unsigned char **pext, size_t *pextlen,
 504                         int *curves, size_t ncurves)
 505         {
 506         unsigned char *clist, *p;
 507         size_t i;
 508         /* Bitmap of curves included to detect duplicates: only works
 509          * while curve ids < 32
 510          */
 511         unsigned long dup_list = 0;
 512         clist = OPENSSL_malloc(ncurves * 2);
 513         if (!clist)
 514                 return 0;
 515         for (i = 0, p = clist; i < ncurves; i++)
 516                 {
 517                 unsigned long idmask;
 518                 int id;
 519                 id = tls1_ec_nid2curve_id(curves[i]);
 520                 idmask = 1L << id;
 521                 if (!id || (dup_list & idmask))
 522                         {
 523                         OPENSSL_free(clist);
 524                         return 0;
 525                         }
 526                 dup_list |= idmask;
 527                 s2n(id, p);
 528                 }
 529         if (*pext)
 530                 OPENSSL_free(*pext);
 531         *pext = clist;
 532         *pextlen = ncurves * 2;
 533         return 1;
 534         }
 535
 536 #define MAX_CURVELIST   25
 537
 538 typedef struct
 539         {
 540         size_t nidcnt;
 541         int nid_arr[MAX_CURVELIST];
 542         } nid_cb_st;
 543
 544 static int nid_cb(const char *elem, int len, void *arg)
 545         {
 546         nid_cb_st *narg = arg;
 547         size_t i;
 548         int nid;
 549         char etmp[20];
 550         if (narg->nidcnt == MAX_CURVELIST)
 551                 return 0;
 552         if (len > (int)(sizeof(etmp) - 1))
 553                 return 0;
 554         memcpy(etmp, elem, len);
 555         etmp[len] = 0;
 556         nid = EC_curve_nist2nid(etmp);
 557         if (nid == NID_undef)
 558                 nid = OBJ_sn2nid(etmp);
 559         if (nid == NID_undef)
 560                 nid = OBJ_ln2nid(etmp);
 561         if (nid == NID_undef)
 562                 return 0;
 563         for (i = 0; i < narg->nidcnt; i++)
 564                 if (narg->nid_arr[i] == nid)
 565                         return 0;
 566         narg->nid_arr[narg->nidcnt++] = nid;
 567         return 1;
 568         }
 569 /* Set curves based on a colon separate list */
 570 int tls1_set_curves_list(unsigned char **pext, size_t *pextlen,
 571                                 const char *str)
 572         {
 573         nid_cb_st ncb;
 574         ncb.nidcnt = 0;
 575         if (!CONF_parse_list(str, ':', 1, nid_cb, &ncb))
 576                 return 0;
 577         if (pext == NULL)
 578                 return 1;
 579         return tls1_set_curves(pext, pextlen, ncb.nid_arr, ncb.nidcnt);
 580         }
 581 /* For an EC key set TLS id and required compression based on parameters */
 582 static int tls1_set_ec_id(unsigned char *curve_id, unsigned char *comp_id,
 583                                 EC_KEY *ec)
 584         {
 585         int is_prime, id;
 586         const EC_GROUP *grp;
 587         const EC_POINT *pt;
 588         const EC_METHOD *meth;
 589         if (!ec)
 590                 return 0;
 591         /* Determine if it is a prime field */
 592         grp = EC_KEY_get0_group(ec);
 593         pt = EC_KEY_get0_public_key(ec);
 594         if (!grp || !pt)
 595                 return 0;
 596         meth = EC_GROUP_method_of(grp);
 597         if (!meth)
 598                 return 0;
 599         if (EC_METHOD_get_field_type(meth) == NID_X9_62_prime_field)
 600                 is_prime = 1;
 601         else
 602                 is_prime = 0;
 603         /* Determine curve ID */
 604         id = EC_GROUP_get_curve_name(grp);
 605         id = tls1_ec_nid2curve_id(id);
 606         /* If we have an ID set it, otherwise set arbitrary explicit curve */
 607         if (id)
 608                 {
 609                 curve_id[0] = 0;
 610                 curve_id[1] = (unsigned char)id;
 611                 }
 612         else
 613                 {
 614                 curve_id[0] = 0xff;
 615                 if (is_prime)
 616                         curve_id[1] = 0x01;
 617                 else
 618                         curve_id[1] = 0x02;
 619                 }
 620         if (comp_id)
 621                 {
 622                 if (EC_KEY_get_conv_form(ec) == POINT_CONVERSION_COMPRESSED)
 623                         {
 624                         if (is_prime)
 625                                 *comp_id = TLSEXT_ECPOINTFORMAT_ansiX962_compressed_prime;
 626                         else
 627                                 *comp_id = TLSEXT_ECPOINTFORMAT_ansiX962_compressed_char2;
 628                         }
 629                 else
 630                         *comp_id = TLSEXT_ECPOINTFORMAT_uncompressed;
 631                 }
 632         return 1;
 633         }
 634 /* Check an EC key is compatible with extensions */
 635 static int tls1_check_ec_key(SSL *s,
 636                         unsigned char *curve_id, unsigned char *comp_id)
 637         {
 638         const unsigned char *p;
 639         size_t plen, i;
 640         int j;
 641         /* If point formats extension present check it, otherwise everything
 642          * is supported (see RFC4492).
 643          */
 644         if (comp_id && s->session->tlsext_ecpointformatlist)
 645                 {
 646                 p = s->session->tlsext_ecpointformatlist;
 647                 plen = s->session->tlsext_ecpointformatlist_length;
 648                 for (i = 0; i < plen; i++, p++)
 649                         {
 650                         if (*comp_id == *p)
 651                                 break;
 652                         }
 653                 if (i == plen)
 654                         return 0;
 655                 }
 656         if (!curve_id)
 657                 return 1;
 658         /* Check curve is consistent with client and server preferences */
 659         for (j = 0; j <= 1; j++)
 660                 {
 661                 tls1_get_curvelist(s, j, &p, &plen);
 662                 for (i = 0; i < plen; i+=2, p+=2)
 663                         {
 664                         if (p[0] == curve_id[0] && p[1] == curve_id[1])
 665                                 break;
 666                         }
 667                 if (i == plen)
 668                         return 0;
 669                 /* For clients can only check sent curve list */
 670                 if (!s->server)
 671                         return 1;
 672                 }
 673         return 1;
 674         }
 675
 676 static void tls1_get_formatlist(SSL *s, const unsigned char **pformats,
 677                                         size_t *pformatslen)
 678         {
 679         /* If we have a custom point format list use it otherwise
 680          * use default */
 681         if (s->tlsext_ecpointformatlist)
 682                 {
 683                 *pformats = s->tlsext_ecpointformatlist;
 684                 *pformatslen = s->tlsext_ecpointformatlist_length;
 685                 }
 686         else
 687                 {
 688                 *pformats = ecformats_default;
 689                 /* For Suite B we don't support char2 fields */
 690                 if (tls1_suiteb(s))
 691                         *pformatslen = sizeof(ecformats_default) - 1;
 692                 else
 693                         *pformatslen = sizeof(ecformats_default);
 694                 }
 695         }
 696
 697 /* Check cert parameters compatible with extensions: currently just checks
 698  * EC certificates have compatible curves and compression.
 699  */
 700 static int tls1_check_cert_param(SSL *s, X509 *x, int set_ee_md)
 701         {
 702         unsigned char comp_id, curve_id[2];
 703         EVP_PKEY *pkey;
 704         int rv;
 705         pkey = X509_get_pubkey(x);
 706         if (!pkey)
 707                 return 0;
 708         /* If not EC nothing to do */
 709         if (pkey->type != EVP_PKEY_EC)
 710                 {
 711                 EVP_PKEY_free(pkey);
 712                 return 1;
 713                 }
 714         rv = tls1_set_ec_id(curve_id, &comp_id, pkey->pkey.ec);
 715         EVP_PKEY_free(pkey);
 716         if (!rv)
 717                 return 0;
 718         /* Can't check curve_id for client certs as we don't have a
 719          * supported curves extension.
 720          */
 721         rv = tls1_check_ec_key(s, s->server ? curve_id : NULL, &comp_id);
 722         if (!rv)
 723                 return 0;
 724         /* Special case for suite B. We *MUST* sign using SHA256+P-256 or
 725          * SHA384+P-384, adjust digest if necessary.
 726          */
 727         if (set_ee_md && tls1_suiteb(s))
 728                 {
 729                 int check_md;
 730                 size_t i;
 731                 CERT *c = s->cert;
 732                 if (curve_id[0])
 733                         return 0;
 734                 /* Check to see we have necessary signing algorithm */
 735                 if (curve_id[1] == TLSEXT_curve_P_256)
 736                         check_md = NID_ecdsa_with_SHA256;
 737                 else if (curve_id[1] == TLSEXT_curve_P_384)
 738                         check_md = NID_ecdsa_with_SHA384;
 739                 else
 740                         return 0; /* Should never happen */
 741                 for (i = 0; i < c->shared_sigalgslen; i++)
 742                         if (check_md == c->shared_sigalgs[i].signandhash_nid)
 743                                 break;
 744                 if (i == c->shared_sigalgslen)
 745                         return 0;
 746                 if (set_ee_md == 2)
 747                         {
 748                         if (check_md == NID_ecdsa_with_SHA256)
 749                                 c->pkeys[SSL_PKEY_ECC].digest = EVP_sha256();
 750                         else
 751                                 c->pkeys[SSL_PKEY_ECC].digest = EVP_sha384();
 752                         }
 753                 }
 754         return rv;
 755         }
 756 /* Check EC temporary key is compatible with client extensions */
 757 int tls1_check_ec_tmp_key(SSL *s, unsigned long cid)
 758         {
 759         unsigned char curve_id[2];
 760         EC_KEY *ec = s->cert->ecdh_tmp;
 761 #ifdef OPENSSL_SSL_DEBUG_BROKEN_PROTOCOL
 762         /* Allow any curve: not just those peer supports */
 763         if (s->cert->cert_flags & SSL_CERT_FLAG_BROKEN_PROTOCOL)
 764                 return 1;
 765 #endif
 766         /* If Suite B, AES128 MUST use P-256 and AES256 MUST use P-384,
 767          * no other curves permitted.
 768          */
 769         if (tls1_suiteb(s))
 770                 {
 771                 /* Curve to check determined by ciphersuite */
 772                 if (cid == TLS1_CK_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256)
 773                         curve_id[1] = TLSEXT_curve_P_256;
 774                 else if (cid == TLS1_CK_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384)
 775                         curve_id[1] = TLSEXT_curve_P_384;
 776                 else
 777                         return 0;
 778                 curve_id[0] = 0;
 779                 /* Check this curve is acceptable */
 780                 if (!tls1_check_ec_key(s, curve_id, NULL))
 781                         return 0;
 782                 /* If auto or setting curve from callback assume OK */
 783                 if (s->cert->ecdh_tmp_auto || s->cert->ecdh_tmp_cb)
 784                         return 1;
 785                 /* Otherwise check curve is acceptable */
 786                 else
 787                         {
 788                         unsigned char curve_tmp[2];
 789                         if (!ec)
 790                                 return 0;
 791                         if (!tls1_set_ec_id(curve_tmp, NULL, ec))
 792                                 return 0;
 793                         if (!curve_tmp[0] || curve_tmp[1] == curve_id[1])
 794                                 return 1;
 795                         return 0;
 796                         }
 797
 798                 }
 799         if (s->cert->ecdh_tmp_auto)
 800                 {
 801                 /* Need a shared curve */
 802                 if (tls1_shared_curve(s, 0))
 803                         return 1;
 804                 else return 0;
 805                 }
 806         if (!ec)
 807                 {
 808                 if (s->cert->ecdh_tmp_cb)
 809                         return 1;
 810                 else
 811                         return 0;
 812                 }
 813         if (!tls1_set_ec_id(curve_id, NULL, ec))
 814                 return 0;
 815 /* Set this to allow use of invalid curves for testing */
 816 #if 0
 817         return 1;
 818 #else
 819         return tls1_check_ec_key(s, curve_id, NULL);
 820 #endif
 821         }
 822
 823 #else
 824
 825 static int tls1_check_cert_param(SSL *s, X509 *x, int set_ee_md)
 826         {
 827         return 1;
 828         }
 829
 830 #endif /* OPENSSL_NO_EC */
 831
 832 #ifndef OPENSSL_NO_TLSEXT
 833
 834 /* List of supported signature algorithms and hashes. Should make this
 835  * customisable at some point, for now include everything we support.
 836  */
 837
 838 #ifdef OPENSSL_NO_RSA
 839 #define tlsext_sigalg_rsa(md) /* */
 840 #else
 841 #define tlsext_sigalg_rsa(md) md, TLSEXT_signature_rsa,
 842 #endif
 843
 844 #ifdef OPENSSL_NO_DSA
 845 #define tlsext_sigalg_dsa(md) /* */
 846 #else
 847 #define tlsext_sigalg_dsa(md) md, TLSEXT_signature_dsa,
 848 #endif
 849
 850 #ifdef OPENSSL_NO_ECDSA
 851 #define tlsext_sigalg_ecdsa(md) /* */
 852 #else
 853 #define tlsext_sigalg_ecdsa(md) md, TLSEXT_signature_ecdsa,
 854 #endif
 855
 856 #define tlsext_sigalg(md) \
 857                 tlsext_sigalg_rsa(md) \
 858                 tlsext_sigalg_dsa(md) \
 859                 tlsext_sigalg_ecdsa(md)
 860
 861 static unsigned char tls12_sigalgs[] = {
 862 #ifndef OPENSSL_NO_SHA512
 863         tlsext_sigalg(TLSEXT_hash_sha512)
 864         tlsext_sigalg(TLSEXT_hash_sha384)
 865 #endif
 866 #ifndef OPENSSL_NO_SHA256
 867         tlsext_sigalg(TLSEXT_hash_sha256)
 868         tlsext_sigalg(TLSEXT_hash_sha224)
 869 #endif
 870 #ifndef OPENSSL_NO_SHA
 871         tlsext_sigalg(TLSEXT_hash_sha1)
 872 #endif
 873 #ifndef OPENSSL_NO_MD5
 874         tlsext_sigalg_rsa(TLSEXT_hash_md5)
 875 #endif
 876 };
 877 #ifndef OPENSSL_NO_ECDSA
 878 static unsigned char suiteb_sigalgs[] = {
 879         tlsext_sigalg_ecdsa(TLSEXT_hash_sha256)
 880         tlsext_sigalg_ecdsa(TLSEXT_hash_sha384)
 881 };
 882 #endif
 883 size_t tls12_get_psigalgs(SSL *s, const unsigned char **psigs)
 884         {
 885         /* If Suite B mode use Suite B sigalgs only, ignore any other
 886          * preferences.
 887          */
 888 #ifndef OPENSSL_NO_EC
 889         switch (tls1_suiteb(s))
 890                 {
 891         case SSL_CERT_FLAG_SUITEB_128_LOS:
 892                 *psigs = suiteb_sigalgs;
 893                 return sizeof(suiteb_sigalgs);
 894
 895         case SSL_CERT_FLAG_SUITEB_128_LOS_ONLY:
 896                 *psigs = suiteb_sigalgs;
 897                 return 2;
 898
 899         case SSL_CERT_FLAG_SUITEB_192_LOS:
 900                 *psigs = suiteb_sigalgs + 2;
 901                 return 2;
 902                 }
 903 #endif
 904         /* If server use client authentication sigalgs if not NULL */
 905         if (s->server && s->cert->client_sigalgs)
 906                 {
 907                 *psigs = s->cert->client_sigalgs;
 908                 return s->cert->client_sigalgslen;
 909                 }
 910         else if (s->cert->conf_sigalgs)
 911                 {
 912                 *psigs = s->cert->conf_sigalgs;
 913                 return s->cert->conf_sigalgslen;
 914                 }
 915         else
 916                 {
 917                 *psigs = tls12_sigalgs;
 918 #ifdef OPENSSL_FIPS
 919                 /* If FIPS mode don't include MD5 which is last */
 920                 if (FIPS_mode())
 921                         return sizeof(tls12_sigalgs) - 2;
 922                 else
 923 #endif
 924                         return sizeof(tls12_sigalgs);
 925                 }
 926         }
 927 /* Check signature algorithm is consistent with sent supported signature
 928  * algorithms and if so return relevant digest.
 929  */
 930 int tls12_check_peer_sigalg(const EVP_MD **pmd, SSL *s,
 931                                 const unsigned char *sig, EVP_PKEY *pkey)
 932         {
 933         const unsigned char *sent_sigs;
 934         size_t sent_sigslen, i;
 935         int sigalg = tls12_get_sigid(pkey);
 936         /* Should never happen */
 937         if (sigalg == -1)
 938                 return -1;
 939         /* Check key type is consistent with signature */
 940         if (sigalg != (int)sig[1])
 941                 {
 942                 SSLerr(SSL_F_TLS12_CHECK_PEER_SIGALG,SSL_R_WRONG_SIGNATURE_TYPE);
 943                 return 0;
 944                 }
 945 #ifndef OPENSSL_NO_EC
 946         if (pkey->type == EVP_PKEY_EC)
 947                 {
 948                 unsigned char curve_id[2], comp_id;
 949                 /* Check compression and curve matches extensions */
 950                 if (!tls1_set_ec_id(curve_id, &comp_id, pkey->pkey.ec))
 951                         return 0;
 952                 if (!s->server && !tls1_check_ec_key(s, curve_id, &comp_id))
 953                         {
 954                         SSLerr(SSL_F_TLS12_CHECK_PEER_SIGALG,SSL_R_WRONG_CURVE);
 955                         return 0;
 956                         }
 957                 /* If Suite B only P-384+SHA384 or P-256+SHA-256 allowed */
 958                 if (tls1_suiteb(s))
 959                         {
 960                         if (curve_id[0])
 961                                 return 0;
 962                         if (curve_id[1] == TLSEXT_curve_P_256)
 963                                 {
 964                                 if (sig[0] != TLSEXT_hash_sha256)
 965                                         {
 966                                         SSLerr(SSL_F_TLS12_CHECK_PEER_SIGALG,
 967                                                 SSL_R_ILLEGAL_SUITEB_DIGEST);
 968                                         return 0;
 969                                         }
 970                                 }
 971                         else if (curve_id[1] == TLSEXT_curve_P_384)
 972                                 {
 973                                 if (sig[0] != TLSEXT_hash_sha384)
 974                                         {
 975                                         SSLerr(SSL_F_TLS12_CHECK_PEER_SIGALG,
 976                                                 SSL_R_ILLEGAL_SUITEB_DIGEST);
 977                                         return 0;
 978                                         }
 979                                 }
 980                         else
 981                                 return 0;
 982                         }
 983                 }
 984         else if (tls1_suiteb(s))
 985                 return 0;
 986 #endif
 987
 988         /* Check signature matches a type we sent */
 989         sent_sigslen = tls12_get_psigalgs(s, &sent_sigs);
 990         for (i = 0; i < sent_sigslen; i+=2, sent_sigs+=2)
 991                 {
 992                 if (sig[0] == sent_sigs[0] && sig[1] == sent_sigs[1])
 993                         break;
 994                 }
 995         /* Allow fallback to SHA1 if not strict mode */
 996         if (i == sent_sigslen && (sig[0] != TLSEXT_hash_sha1 || s->cert->cert_flags & SSL_CERT_FLAGS_CHECK_TLS_STRICT))
 997                 {
 998                 SSLerr(SSL_F_TLS12_CHECK_PEER_SIGALG,SSL_R_WRONG_SIGNATURE_TYPE);
 999                 return 0;
1000                 }
1001         *pmd = tls12_get_hash(sig[0]);
1002         if (*pmd == NULL)
1003                 {
1004                 SSLerr(SSL_F_TLS12_CHECK_PEER_SIGALG,SSL_R_UNKNOWN_DIGEST);
1005                 return 0;
1006                 }
1007         /* Store the digest used so applications can retrieve it if they
1008          * wish.
1009          */
1010         if (s->session && s->session->sess_cert)
1011                 s->session->sess_cert->peer_key->digest = *pmd;
1012         return 1;
1013         }
1014 /* Get a mask of disabled algorithms: an algorithm is disabled
1015  * if it isn't supported or doesn't appear in supported signature
1016  * algorithms. Unlike ssl_cipher_get_disabled this applies to a specific
1017  * session and not global settings.
1018  *
1019  */
1020 void ssl_set_client_disabled(SSL *s)
1021         {
1022         CERT *c = s->cert;
1023         const unsigned char *sigalgs;
1024         size_t i, sigalgslen;
1025         int have_rsa = 0, have_dsa = 0, have_ecdsa = 0;
1026         c->mask_a = 0;
1027         c->mask_k = 0;
1028         /* Don't allow TLS 1.2 only ciphers if we don't suppport them */
1029         if (!SSL_CLIENT_USE_TLS1_2_CIPHERS(s))
1030                 c->mask_ssl = SSL_TLSV1_2;
1031         else
1032                 c->mask_ssl = 0;
1033         /* Now go through all signature algorithms seeing if we support
1034          * any for RSA, DSA, ECDSA. Do this for all versions not just
1035          * TLS 1.2.
1036          */
1037         sigalgslen = tls12_get_psigalgs(s, &sigalgs);
1038         for (i = 0; i < sigalgslen; i += 2, sigalgs += 2)
1039                 {
1040                 switch(sigalgs[1])
1041                         {
1042 #ifndef OPENSSL_NO_RSA
1043                 case TLSEXT_signature_rsa:
1044                         have_rsa = 1;
1045                         break;
1046 #endif
1047 #ifndef OPENSSL_NO_DSA
1048                 case TLSEXT_signature_dsa:
1049                         have_dsa = 1;
1050                         break;
1051 #endif
1052 #ifndef OPENSSL_NO_ECDSA
1053                 case TLSEXT_signature_ecdsa:
1054                         have_ecdsa = 1;
1055                         break;
1056 #endif
1057                         }
1058                 }
1059         /* Disable auth and static DH if we don't include any appropriate
1060          * signature algorithms.
1061          */
1062         if (!have_rsa)
1063                 {
1064                 c->mask_a |= SSL_aRSA;
1065                 c->mask_k |= SSL_kDHr|SSL_kECDHr;
1066                 }
1067         if (!have_dsa)
1068                 {
1069                 c->mask_a |= SSL_aDSS;
1070                 c->mask_k |= SSL_kDHd;
1071                 }
1072         if (!have_ecdsa)
1073                 {
1074                 c->mask_a |= SSL_aECDSA;
1075                 c->mask_k |= SSL_kECDHe;
1076                 }
1077 #ifndef OPENSSL_NO_KRB5
1078         if (!kssl_tgt_is_available(s->kssl_ctx))
1079                 {
1080                 c->mask_a |= SSL_aKRB5;
1081                 c->mask_k |= SSL_kKRB5;
1082                 }
1083 #endif
1084 #ifndef OPENSSL_NO_PSK
1085         /* with PSK there must be client callback set */
1086         if (!s->psk_client_callback)
1087                 {
1088                 c->mask_a |= SSL_aPSK;
1089                 c->mask_k |= SSL_kPSK;
1090                 }
1091 #endif /* OPENSSL_NO_PSK */
1092         c->valid = 1;
1093         }
1094
1095 /* byte_compare is a compare function for qsort(3) that compares bytes. */
1096 static int byte_compare(const void *in_a, const void *in_b)
1097         {
1098         unsigned char a = *((const unsigned char*) in_a);
1099         unsigned char b = *((const unsigned char*) in_b);
1100
1101         if (a > b)
1102                 return 1;
1103         else if (a < b)
1104                 return -1;
1105         return 0;
1106 }
1107
1108 unsigned char *ssl_add_clienthello_tlsext(SSL *s, unsigned char *p, unsigned char *limit)
1109         {
1110         int extdatalen=0;
1111         unsigned char *ret = p;
1112 #ifndef OPENSSL_NO_EC
1113         /* See if we support any ECC ciphersuites */
1114         int using_ecc = 0;
1115         if (s->version >= TLS1_VERSION || SSL_IS_DTLS(s))
1116                 {
1117                 int i;
1118                 unsigned long alg_k, alg_a;
1119                 STACK_OF(SSL_CIPHER) *cipher_stack = SSL_get_ciphers(s);
1120
1121                 for (i = 0; i < sk_SSL_CIPHER_num(cipher_stack); i++)
1122                         {
1123                         SSL_CIPHER *c = sk_SSL_CIPHER_value(cipher_stack, i);
1124
1125                         alg_k = c->algorithm_mkey;
1126                         alg_a = c->algorithm_auth;
1127                         if ((alg_k & (SSL_kEECDH|SSL_kECDHr|SSL_kECDHe)
1128                                 || (alg_a & SSL_aECDSA)))
1129                                 {
1130                                 using_ecc = 1;
1131                                 break;
1132                                 }
1133                         }
1134                 }
1135 #endif
1136
1137         /* don't add extensions for SSLv3 unless doing secure renegotiation */
1138         if (s->client_version == SSL3_VERSION
1139                                         && !s->s3->send_connection_binding)
1140                 return p;
1141
1142         ret+=2;
1143
1144         if (ret>=limit) return NULL; /* this really never occurs, but ... */
1145
1146         if (s->tlsext_hostname != NULL)
1147                 {
1148                 /* Add TLS extension servername to the Client Hello message */
1149                 unsigned long size_str;
1150                 long lenmax;
1151
1152                 /* check for enough space.
1153                    4 for the servername type and entension length
1154                    2 for servernamelist length
1155                    1 for the hostname type
1156                    2 for hostname length
1157                    + hostname length
1158                 */
1159
1160                 if ((lenmax = limit - ret - 9) < 0
1161                     || (size_str = strlen(s->tlsext_hostname)) > (unsigned long)lenmax)
1162                         return NULL;
1163
1164                 /* extension type and length */
1165                 s2n(TLSEXT_TYPE_server_name,ret);
1166                 s2n(size_str+5,ret);
1167
1168                 /* length of servername list */
1169                 s2n(size_str+3,ret);
1170
1171                 /* hostname type, length and hostname */
1172                 *(ret++) = (unsigned char) TLSEXT_NAMETYPE_host_name;
1173                 s2n(size_str,ret);
1174                 memcpy(ret, s->tlsext_hostname, size_str);
1175                 ret+=size_str;
1176                 }
1177
1178         /* Add RI if renegotiating */
1179         if (s->renegotiate)
1180           {
1181           int el;
1182
1183           if(!ssl_add_clienthello_renegotiate_ext(s, 0, &el, 0))
1184               {
1185               SSLerr(SSL_F_SSL_ADD_CLIENTHELLO_TLSEXT, ERR_R_INTERNAL_ERROR);
1186               return NULL;
1187               }
1188
1189           if((limit - p - 4 - el) < 0) return NULL;
1190
1191           s2n(TLSEXT_TYPE_renegotiate,ret);
1192           s2n(el,ret);
1193
1194           if(!ssl_add_clienthello_renegotiate_ext(s, ret, &el, el))
1195               {
1196               SSLerr(SSL_F_SSL_ADD_CLIENTHELLO_TLSEXT, ERR_R_INTERNAL_ERROR);
1197               return NULL;
1198               }
1199
1200           ret += el;
1201         }
1202
1203 #ifndef OPENSSL_NO_SRP
1204         /* Add SRP username if there is one */
1205         if (s->srp_ctx.login != NULL)
1206                 { /* Add TLS extension SRP username to the Client Hello message */
1207
1208                 int login_len = strlen(s->srp_ctx.login);
1209                 if (login_len > 255 || login_len == 0)
1210                         {
1211                         SSLerr(SSL_F_SSL_ADD_CLIENTHELLO_TLSEXT, ERR_R_INTERNAL_ERROR);
1212                         return NULL;
1213                         }
1214
1215                 /* check for enough space.
1216                    4 for the srp type type and entension length
1217                    1 for the srp user identity
1218                    + srp user identity length
1219                 */
1220                 if ((limit - ret - 5 - login_len) < 0) return NULL;
1221
1222                 /* fill in the extension */
1223                 s2n(TLSEXT_TYPE_srp,ret);
1224                 s2n(login_len+1,ret);
1225                 (*ret++) = (unsigned char) login_len;
1226                 memcpy(ret, s->srp_ctx.login, login_len);
1227                 ret+=login_len;
1228                 }
1229 #endif
1230
1231 #ifndef OPENSSL_NO_EC
1232         if (using_ecc)
1233                 {
1234                 /* Add TLS extension ECPointFormats to the ClientHello message */
1235                 long lenmax;
1236                 const unsigned char *plist;
1237                 size_t plistlen;
1238
1239                 tls1_get_formatlist(s, &plist, &plistlen);
1240
1241                 if ((lenmax = limit - ret - 5) < 0) return NULL;
1242                 if (plistlen > (size_t)lenmax) return NULL;
1243                 if (plistlen > 255)
1244                         {
1245                         SSLerr(SSL_F_SSL_ADD_CLIENTHELLO_TLSEXT, ERR_R_INTERNAL_ERROR);
1246                         return NULL;
1247                         }
1248
1249                 s2n(TLSEXT_TYPE_ec_point_formats,ret);
1250                 s2n(plistlen + 1,ret);
1251                 *(ret++) = (unsigned char)plistlen ;
1252                 memcpy(ret, plist, plistlen);
1253                 ret+=plistlen;
1254
1255                 /* Add TLS extension EllipticCurves to the ClientHello message */
1256                 plist = s->tlsext_ellipticcurvelist;
1257                 tls1_get_curvelist(s, 0, &plist, &plistlen);
1258
1259                 if ((lenmax = limit - ret - 6) < 0) return NULL;
1260                 if (plistlen > (size_t)lenmax) return NULL;
1261                 if (plistlen > 65532)
1262                         {
1263                         SSLerr(SSL_F_SSL_ADD_CLIENTHELLO_TLSEXT, ERR_R_INTERNAL_ERROR);
1264                         return NULL;
1265                         }
1266
1267                 s2n(TLSEXT_TYPE_elliptic_curves,ret);
1268                 s2n(plistlen + 2, ret);
1269
1270                 /* NB: draft-ietf-tls-ecc-12.txt uses a one-byte prefix for
1271                  * elliptic_curve_list, but the examples use two bytes.
1272                  * http://www1.ietf.org/mail-archive/web/tls/current/msg00538.html
1273                  * resolves this to two bytes.
1274                  */
1275                 s2n(plistlen, ret);
1276                 memcpy(ret, plist, plistlen);
1277                 ret+=plistlen;
1278                 }
1279 #endif /* OPENSSL_NO_EC */
1280
1281         if (!(SSL_get_options(s) & SSL_OP_NO_TICKET))
1282                 {
1283                 int ticklen;
1284                 if (!s->new_session && s->session && s->session->tlsext_tick)
1285                         ticklen = s->session->tlsext_ticklen;
1286                 else if (s->session && s->tlsext_session_ticket &&
1287                          s->tlsext_session_ticket->data)
1288                         {
1289                         ticklen = s->tlsext_session_ticket->length;
1290                         s->session->tlsext_tick = OPENSSL_malloc(ticklen);
1291                         if (!s->session->tlsext_tick)
1292                                 return NULL;
1293                         memcpy(s->session->tlsext_tick,
1294                                s->tlsext_session_ticket->data,
1295                                ticklen);
1296                         s->session->tlsext_ticklen = ticklen;
1297                         }
1298                 else
1299                         ticklen = 0;
1300                 if (ticklen == 0 && s->tlsext_session_ticket &&
1301                     s->tlsext_session_ticket->data == NULL)
1302                         goto skip_ext;
1303                 /* Check for enough room 2 for extension type, 2 for len
1304                  * rest for ticket
1305                  */
1306                 if ((long)(limit - ret - 4 - ticklen) < 0) return NULL;
1307                 s2n(TLSEXT_TYPE_session_ticket,ret);
1308                 s2n(ticklen,ret);
1309                 if (ticklen)
1310                         {
1311                         memcpy(ret, s->session->tlsext_tick, ticklen);
1312                         ret += ticklen;
1313                         }
1314                 }
1315                 skip_ext:
1316
1317         if (SSL_USE_SIGALGS(s))
1318                 {
1319                 size_t salglen;
1320                 const unsigned char *salg;
1321                 salglen = tls12_get_psigalgs(s, &salg);
1322                 if ((size_t)(limit - ret) < salglen + 6)
1323                         return NULL;
1324                 s2n(TLSEXT_TYPE_signature_algorithms,ret);
1325                 s2n(salglen + 2, ret);
1326                 s2n(salglen, ret);
1327                 memcpy(ret, salg, salglen);
1328                 ret += salglen;
1329                 }
1330
1331 #ifdef TLSEXT_TYPE_opaque_prf_input
1332         if (s->s3->client_opaque_prf_input != NULL)
1333                 {
1334                 size_t col = s->s3->client_opaque_prf_input_len;
1335
1336                 if ((long)(limit - ret - 6 - col < 0))
1337                         return NULL;
1338                 if (col > 0xFFFD) /* can't happen */
1339                         return NULL;
1340
1341                 s2n(TLSEXT_TYPE_opaque_prf_input, ret);
1342                 s2n(col + 2, ret);
1343                 s2n(col, ret);
1344                 memcpy(ret, s->s3->client_opaque_prf_input, col);
1345                 ret += col;
1346                 }
1347 #endif
1348
1349         if (s->tlsext_status_type == TLSEXT_STATUSTYPE_ocsp)
1350                 {
1351                 int i;
1352                 long extlen, idlen, itmp;
1353                 OCSP_RESPID *id;
1354
1355                 idlen = 0;
1356                 for (i = 0; i < sk_OCSP_RESPID_num(s->tlsext_ocsp_ids); i++)
1357                         {
1358                         id = sk_OCSP_RESPID_value(s->tlsext_ocsp_ids, i);
1359                         itmp = i2d_OCSP_RESPID(id, NULL);
1360                         if (itmp <= 0)
1361                                 return NULL;
1362                         idlen += itmp + 2;
1363                         }
1364
1365                 if (s->tlsext_ocsp_exts)
1366                         {
1367                         extlen = i2d_X509_EXTENSIONS(s->tlsext_ocsp_exts, NULL);
1368                         if (extlen < 0)
1369                                 return NULL;
1370                         }
1371                 else
1372                         extlen = 0;
1373
1374                 if ((long)(limit - ret - 7 - extlen - idlen) < 0) return NULL;
1375                 s2n(TLSEXT_TYPE_status_request, ret);
1376                 if (extlen + idlen > 0xFFF0)
1377                         return NULL;
1378                 s2n(extlen + idlen + 5, ret);
1379                 *(ret++) = TLSEXT_STATUSTYPE_ocsp;
1380                 s2n(idlen, ret);
1381                 for (i = 0; i < sk_OCSP_RESPID_num(s->tlsext_ocsp_ids); i++)
1382                         {
1383                         /* save position of id len */
1384                         unsigned char *q = ret;
1385                         id = sk_OCSP_RESPID_value(s->tlsext_ocsp_ids, i);
1386                         /* skip over id len */
1387                         ret += 2;
1388                         itmp = i2d_OCSP_RESPID(id, &ret);
1389                         /* write id len */
1390                         s2n(itmp, q);
1391                         }
1392                 s2n(extlen, ret);
1393                 if (extlen > 0)
1394                         i2d_X509_EXTENSIONS(s->tlsext_ocsp_exts, &ret);
1395                 }
1396
1397 #ifndef OPENSSL_NO_HEARTBEATS
1398         /* Add Heartbeat extension */
1399         s2n(TLSEXT_TYPE_heartbeat,ret);
1400         s2n(1,ret);
1401         /* Set mode:
1402          * 1: peer may send requests
1403          * 2: peer not allowed to send requests
1404          */
1405         if (s->tlsext_heartbeat & SSL_TLSEXT_HB_DONT_RECV_REQUESTS)
1406                 *(ret++) = SSL_TLSEXT_HB_DONT_SEND_REQUESTS;
1407         else
1408                 *(ret++) = SSL_TLSEXT_HB_ENABLED;
1409 #endif
1410
1411 #ifndef OPENSSL_NO_NEXTPROTONEG
1412         if (s->ctx->next_proto_select_cb && !s->s3->tmp.finish_md_len)
1413                 {
1414                 /* The client advertises an emtpy extension to indicate its
1415                  * support for Next Protocol Negotiation */
1416                 if (limit - ret - 4 < 0)
1417                         return NULL;
1418                 s2n(TLSEXT_TYPE_next_proto_neg,ret);
1419                 s2n(0,ret);
1420                 }
1421 #endif
1422
1423         if (s->alpn_client_proto_list && !s->s3->tmp.finish_md_len)
1424                 {
1425                 if ((size_t)(limit - ret) < 6 + s->alpn_client_proto_list_len)
1426                         return NULL;
1427                 s2n(TLSEXT_TYPE_application_layer_protocol_negotiation,ret);
1428                 s2n(2 + s->alpn_client_proto_list_len,ret);
1429                 s2n(s->alpn_client_proto_list_len,ret);
1430                 memcpy(ret, s->alpn_client_proto_list,
1431                        s->alpn_client_proto_list_len);
1432                 ret += s->alpn_client_proto_list_len;
1433                 }
1434
1435         if(SSL_get_srtp_profiles(s))
1436                 {
1437                 int el;
1438
1439                 ssl_add_clienthello_use_srtp_ext(s, 0, &el, 0);
1440
1441                 if((limit - p - 4 - el) < 0) return NULL;
1442
1443                 s2n(TLSEXT_TYPE_use_srtp,ret);
1444                 s2n(el,ret);
1445
1446                 if(ssl_add_clienthello_use_srtp_ext(s, ret, &el, el))
1447                         {
1448                         SSLerr(SSL_F_SSL_ADD_CLIENTHELLO_TLSEXT, ERR_R_INTERNAL_ERROR);
1449                         return NULL;
1450                         }
1451                 ret += el;
1452                 }
1453
1454         /* Add TLS extension Server_Authz_DataFormats to the ClientHello */
1455         /* 2 bytes for extension type */
1456         /* 2 bytes for extension length */
1457         /* 1 byte for the list length */
1458         /* 1 byte for the list (we only support audit proofs) */
1459         if (s->ctx->tlsext_authz_server_audit_proof_cb != NULL)
1460                 {
1461                 const unsigned short ext_len = 2;
1462                 const unsigned char list_len = 1;
1463
1464                 if (limit < ret + 6)
1465                         return NULL;
1466
1467                 s2n(TLSEXT_TYPE_server_authz, ret);
1468                 /* Extension length: 2 bytes */
1469                 s2n(ext_len, ret);
1470                 *(ret++) = list_len;
1471                 *(ret++) = TLSEXT_AUTHZDATAFORMAT_audit_proof;
1472                 }
1473
1474         /* Add custom TLS Extensions to ClientHello */
1475         if (s->ctx->custom_cli_ext_records_count)
1476                 {
1477                 size_t i;
1478                 custom_cli_ext_record* record;
1479
1480                 for (i = 0; i < s->ctx->custom_cli_ext_records_count; i++)
1481                         {
1482                         const unsigned char* out = NULL;
1483                         unsigned short outlen = 0;
1484
1485                         record = &s->ctx->custom_cli_ext_records[i];
1486                         /* NULL callback sends empty extension */
1487                         /* -1 from callback omits extension */
1488                         if (record->fn1)
1489                                 {
1490                                 int cb_retval = 0;
1491                                 cb_retval = record->fn1(s, record->ext_type,
1492                                                         &out, &outlen,
1493                                                         record->arg);
1494                                 if (cb_retval == 0)
1495                                         return NULL; /* error */
1496                                 if (cb_retval == -1)
1497                                         continue; /* skip this extension */
1498                                 }
1499                         if (limit < ret + 4 + outlen)
1500                                 return NULL;
1501                         s2n(record->ext_type, ret);
1502                         s2n(outlen, ret);
1503                         memcpy(ret, out, outlen);
1504                         ret += outlen;
1505                         }
1506                 }
1507
1508         if ((extdatalen = ret-p-2) == 0)
1509                 return p;
1510
1511         s2n(extdatalen,p);
1512         return ret;
1513         }
1514
1515 unsigned char *ssl_add_serverhello_tlsext(SSL *s, unsigned char *p, unsigned char *limit)
1516         {
1517         int extdatalen=0;
1518         unsigned char *ret = p;
1519 #ifndef OPENSSL_NO_NEXTPROTONEG
1520         int next_proto_neg_seen;
1521 #endif
1522 #ifndef OPENSSL_NO_EC
1523         unsigned long alg_k = s->s3->tmp.new_cipher->algorithm_mkey;
1524         unsigned long alg_a = s->s3->tmp.new_cipher->algorithm_auth;
1525         int using_ecc = (alg_k & (SSL_kEECDH|SSL_kECDHr|SSL_kECDHe)) || (alg_a & SSL_aECDSA);
1526         using_ecc = using_ecc && (s->session->tlsext_ecpointformatlist != NULL);
1527 #endif
1528         /* don't add extensions for SSLv3, unless doing secure renegotiation */
1529         if (s->version == SSL3_VERSION && !s->s3->send_connection_binding)
1530                 return p;
1531
1532         ret+=2;
1533         if (ret>=limit) return NULL; /* this really never occurs, but ... */
1534
1535         if (!s->hit && s->servername_done == 1 && s->session->tlsext_hostname != NULL)
1536                 {
1537                 if ((long)(limit - ret - 4) < 0) return NULL;
1538
1539                 s2n(TLSEXT_TYPE_server_name,ret);
1540                 s2n(0,ret);
1541                 }
1542
1543         if(s->s3->send_connection_binding)
1544         {
1545           int el;
1546
1547           if(!ssl_add_serverhello_renegotiate_ext(s, 0, &el, 0))
1548               {
1549               SSLerr(SSL_F_SSL_ADD_SERVERHELLO_TLSEXT, ERR_R_INTERNAL_ERROR);
1550               return NULL;
1551               }
1552
1553           if((limit - p - 4 - el) < 0) return NULL;
1554
1555           s2n(TLSEXT_TYPE_renegotiate,ret);
1556           s2n(el,ret);
1557
1558           if(!ssl_add_serverhello_renegotiate_ext(s, ret, &el, el))
1559               {
1560               SSLerr(SSL_F_SSL_ADD_SERVERHELLO_TLSEXT, ERR_R_INTERNAL_ERROR);
1561               return NULL;
1562               }
1563
1564           ret += el;
1565         }
1566
1567 #ifndef OPENSSL_NO_EC
1568         if (using_ecc)
1569                 {
1570                 const unsigned char *plist;
1571                 size_t plistlen;
1572                 /* Add TLS extension ECPointFormats to the ServerHello message */
1573                 long lenmax;
1574
1575                 tls1_get_formatlist(s, &plist, &plistlen);
1576
1577                 if ((lenmax = limit - ret - 5) < 0) return NULL;
1578                 if (plistlen > (size_t)lenmax) return NULL;
1579                 if (plistlen > 255)
1580                         {
1581                         SSLerr(SSL_F_SSL_ADD_SERVERHELLO_TLSEXT, ERR_R_INTERNAL_ERROR);
1582                         return NULL;
1583                         }
1584
1585                 s2n(TLSEXT_TYPE_ec_point_formats,ret);
1586                 s2n(plistlen + 1,ret);
1587                 *(ret++) = (unsigned char) plistlen;
1588                 memcpy(ret, plist, plistlen);
1589                 ret+=plistlen;
1590
1591                 }
1592         /* Currently the server should not respond with a SupportedCurves extension */
1593 #endif /* OPENSSL_NO_EC */
1594
1595         if (s->tlsext_ticket_expected
1596                 && !(SSL_get_options(s) & SSL_OP_NO_TICKET))
1597                 {
1598                 if ((long)(limit - ret - 4) < 0) return NULL;
1599                 s2n(TLSEXT_TYPE_session_ticket,ret);
1600                 s2n(0,ret);
1601                 }
1602
1603         if (s->tlsext_status_expected)
1604                 {
1605                 if ((long)(limit - ret - 4) < 0) return NULL;
1606                 s2n(TLSEXT_TYPE_status_request,ret);
1607                 s2n(0,ret);
1608                 }
1609
1610 #ifdef TLSEXT_TYPE_opaque_prf_input
1611         if (s->s3->server_opaque_prf_input != NULL)
1612                 {
1613                 size_t sol = s->s3->server_opaque_prf_input_len;
1614
1615                 if ((long)(limit - ret - 6 - sol) < 0)
1616                         return NULL;
1617                 if (sol > 0xFFFD) /* can't happen */
1618                         return NULL;
1619
1620                 s2n(TLSEXT_TYPE_opaque_prf_input, ret);
1621                 s2n(sol + 2, ret);
1622                 s2n(sol, ret);
1623                 memcpy(ret, s->s3->server_opaque_prf_input, sol);
1624                 ret += sol;
1625                 }
1626 #endif
1627
1628         if(s->srtp_profile)
1629                 {
1630                 int el;
1631
1632                 ssl_add_serverhello_use_srtp_ext(s, 0, &el, 0);
1633
1634                 if((limit - p - 4 - el) < 0) return NULL;
1635
1636                 s2n(TLSEXT_TYPE_use_srtp,ret);
1637                 s2n(el,ret);
1638
1639                 if(ssl_add_serverhello_use_srtp_ext(s, ret, &el, el))
1640                         {
1641                         SSLerr(SSL_F_SSL_ADD_SERVERHELLO_TLSEXT, ERR_R_INTERNAL_ERROR);
1642                         return NULL;
1643                         }
1644                 ret+=el;
1645                 }
1646
1647         if (((s->s3->tmp.new_cipher->id & 0xFFFF)==0x80 || (s->s3->tmp.new_cipher->id & 0xFFFF)==0x81)
1648                 && (SSL_get_options(s) & SSL_OP_CRYPTOPRO_TLSEXT_BUG))
1649                 { const unsigned char cryptopro_ext[36] = {
1650                         0xfd, 0xe8, /*65000*/
1651                         0x00, 0x20, /*32 bytes length*/
1652                         0x30, 0x1e, 0x30, 0x08, 0x06, 0x06, 0x2a, 0x85,
1653                         0x03,   0x02, 0x02, 0x09, 0x30, 0x08, 0x06, 0x06,
1654                         0x2a, 0x85, 0x03, 0x02, 0x02, 0x16, 0x30, 0x08,
1655                         0x06, 0x06, 0x2a, 0x85, 0x03, 0x02, 0x02, 0x17};
1656                         if (limit-ret<36) return NULL;
1657                         memcpy(ret,cryptopro_ext,36);
1658                         ret+=36;
1659
1660                 }
1661
1662 #ifndef OPENSSL_NO_HEARTBEATS
1663         /* Add Heartbeat extension if we've received one */
1664         if (s->tlsext_heartbeat & SSL_TLSEXT_HB_ENABLED)
1665                 {
1666                 s2n(TLSEXT_TYPE_heartbeat,ret);
1667                 s2n(1,ret);
1668                 /* Set mode:
1669                  * 1: peer may send requests
1670                  * 2: peer not allowed to send requests
1671                  */
1672                 if (s->tlsext_heartbeat & SSL_TLSEXT_HB_DONT_RECV_REQUESTS)
1673                         *(ret++) = SSL_TLSEXT_HB_DONT_SEND_REQUESTS;
1674                 else
1675                         *(ret++) = SSL_TLSEXT_HB_ENABLED;
1676
1677                 }
1678 #endif
1679
1680 #ifndef OPENSSL_NO_NEXTPROTONEG
1681         next_proto_neg_seen = s->s3->next_proto_neg_seen;
1682         s->s3->next_proto_neg_seen = 0;
1683         if (next_proto_neg_seen && s->ctx->next_protos_advertised_cb)
1684                 {
1685                 const unsigned char *npa;
1686                 unsigned int npalen;
1687                 int r;
1688
1689                 r = s->ctx->next_protos_advertised_cb(s, &npa, &npalen, s->ctx->next_protos_advertised_cb_arg);
1690                 if (r == SSL_TLSEXT_ERR_OK)
1691                         {
1692                         if ((long)(limit - ret - 4 - npalen) < 0) return NULL;
1693                         s2n(TLSEXT_TYPE_next_proto_neg,ret);
1694                         s2n(npalen,ret);
1695                         memcpy(ret, npa, npalen);
1696                         ret += npalen;
1697                         s->s3->next_proto_neg_seen = 1;
1698                         }
1699                 }
1700 #endif
1701
1702         /* If the client supports authz then see whether we have any to offer
1703          * to it. */
1704         if (s->s3->tlsext_authz_client_types_len)
1705                 {
1706                 size_t authz_length;
1707                 /* By now we already know the new cipher, so we can look ahead
1708                  * to see whether the cert we are going to send
1709                  * has any authz data attached to it. */
1710                 const unsigned char* authz = ssl_get_authz_data(s, &authz_length);
1711                 const unsigned char* const orig_authz = authz;
1712                 size_t i;
1713                 unsigned authz_count = 0;
1714
1715                 /* The authz data contains a number of the following structures:
1716                  *      uint8_t authz_type
1717                  *      uint16_t length
1718                  *      uint8_t data[length]
1719                  *
1720                  * First we walk over it to find the number of authz elements. */
1721                 for (i = 0; i < authz_length; i++)
1722                         {
1723                         unsigned short length;
1724                         unsigned char type;
1725
1726                         type = *(authz++);
1727                         if (memchr(s->s3->tlsext_authz_client_types,
1728                                    type,
1729                                    s->s3->tlsext_authz_client_types_len) != NULL)
1730                                 authz_count++;
1731
1732                         n2s(authz, length);
1733                         /* n2s increments authz by 2 */
1734                         i += 2;
1735                         authz += length;
1736                         i += length;
1737                         }
1738
1739                 if (authz_count)
1740                         {
1741                         /* Add TLS extension server_authz to the ServerHello message
1742                          * 2 bytes for extension type
1743                          * 2 bytes for extension length
1744                          * 1 byte for the list length
1745                          * n bytes for the list */
1746                         const unsigned short ext_len = 1 + authz_count;
1747
1748                         if ((long)(limit - ret - 4 - ext_len) < 0) return NULL;
1749                         s2n(TLSEXT_TYPE_server_authz, ret);
1750                         s2n(ext_len, ret);
1751                         *(ret++) = authz_count;
1752                         s->s3->tlsext_authz_promised_to_client = 1;
1753                         }
1754
1755                 authz = orig_authz;
1756                 for (i = 0; i < authz_length; i++)
1757                         {
1758                         unsigned short length;
1759                         unsigned char type;
1760
1761                         authz_count++;
1762                         type = *(authz++);
1763                         if (memchr(s->s3->tlsext_authz_client_types,
1764                                    type,
1765                                    s->s3->tlsext_authz_client_types_len) != NULL)
1766                                 *(ret++) = type;
1767                         n2s(authz, length);
1768                         /* n2s increments authz by 2 */
1769                         i += 2;
1770                         authz += length;
1771                         i += length;
1772                         }
1773                 }
1774
1775         /* If custom types were sent in ClientHello, add ServerHello responses */
1776         if (s->s3->tlsext_custom_types_count)
1777                 {
1778                 size_t i;
1779
1780                 for (i = 0; i < s->s3->tlsext_custom_types_count; i++)
1781                         {
1782                         size_t j;
1783                         custom_srv_ext_record *record;
1784
1785                         for (j = 0; j < s->ctx->custom_srv_ext_records_count; j++)
1786                                 {
1787                                 record = &s->ctx->custom_srv_ext_records[j];
1788                                 if (s->s3->tlsext_custom_types[i] == record->ext_type)
1789                                         {
1790                                         const unsigned char *out = NULL;
1791                                         unsigned short outlen = 0;
1792                                         int cb_retval = 0;
1793
1794                                         /* NULL callback or -1 omits extension */
1795                                         if (!record->fn2)
1796                                                 break;
1797                                         cb_retval = record->fn2(s, record->ext_type,
1798                                                                 &out, &outlen,
1799                                                                 record->arg);
1800                                         if (cb_retval == 0)
1801                                                 return NULL; /* error */
1802                                         if (cb_retval == -1)
1803                                                 break; /* skip this extension */
1804                                         if (limit < ret + 4 + outlen)
1805                                                 return NULL;
1806                                         s2n(record->ext_type, ret);
1807                                         s2n(outlen, ret);
1808                                         memcpy(ret, out, outlen);
1809                                         ret += outlen;
1810                                         break;
1811                                         }
1812                                 }
1813                         }
1814                 }
1815
1816         if (s->s3->alpn_selected)
1817                 {
1818                 const unsigned char *selected = s->s3->alpn_selected;
1819                 unsigned len = s->s3->alpn_selected_len;
1820
1821                 if ((long)(limit - ret - 4 - 2 - 1 - len) < 0)
1822                         return NULL;
1823                 s2n(TLSEXT_TYPE_application_layer_protocol_negotiation,ret);
1824                 s2n(3 + len,ret);
1825                 s2n(1 + len,ret);
1826                 *ret++ = len;
1827                 memcpy(ret, selected, len);
1828                 ret += len;
1829                 }
1830
1831         if ((extdatalen = ret-p-2)== 0)
1832                 return p;
1833
1834         s2n(extdatalen,p);
1835         return ret;
1836         }
1837
1838 #ifndef OPENSSL_NO_EC
1839 /* ssl_check_for_safari attempts to fingerprint Safari using OS X
1840  * SecureTransport using the TLS extension block in |d|, of length |n|.
1841  * Safari, since 10.6, sends exactly these extensions, in this order:
1842  *   SNI,
1843  *   elliptic_curves
1844  *   ec_point_formats
1845  *
1846  * We wish to fingerprint Safari because they broke ECDHE-ECDSA support in 10.8,
1847  * but they advertise support. So enabling ECDHE-ECDSA ciphers breaks them.
1848  * Sadly we cannot differentiate 10.6, 10.7 and 10.8.4 (which work), from
1849  * 10.8..10.8.3 (which don't work).
1850  */
1851 static void ssl_check_for_safari(SSL *s, const unsigned char *data, const unsigned char *d, int n) {
1852         unsigned short type, size;
1853         static const unsigned char kSafariExtensionsBlock[] = {
1854                 0x00, 0x0a,  /* elliptic_curves extension */
1855                 0x00, 0x08,  /* 8 bytes */
1856                 0x00, 0x06,  /* 6 bytes of curve ids */
1857                 0x00, 0x17,  /* P-256 */
1858                 0x00, 0x18,  /* P-384 */
1859                 0x00, 0x19,  /* P-521 */
1860
1861                 0x00, 0x0b,  /* ec_point_formats */
1862                 0x00, 0x02,  /* 2 bytes */
1863                 0x01,        /* 1 point format */
1864                 0x00,        /* uncompressed */
1865         };
1866
1867         /* The following is only present in TLS 1.2 */
1868         static const unsigned char kSafariTLS12ExtensionsBlock[] = {
1869                 0x00, 0x0d,  /* signature_algorithms */
1870                 0x00, 0x0c,  /* 12 bytes */
1871                 0x00, 0x0a,  /* 10 bytes */
1872                 0x05, 0x01,  /* SHA-384/RSA */
1873                 0x04, 0x01,  /* SHA-256/RSA */
1874                 0x02, 0x01,  /* SHA-1/RSA */
1875                 0x04, 0x03,  /* SHA-256/ECDSA */
1876                 0x02, 0x03,  /* SHA-1/ECDSA */
1877         };
1878
1879         if (data >= (d+n-2))
1880                 return;
1881         data += 2;
1882
1883         if (data > (d+n-4))
1884                 return;
1885         n2s(data,type);
1886         n2s(data,size);
1887
1888         if (type != TLSEXT_TYPE_server_name)
1889                 return;
1890
1891         if (data+size > d+n)
1892                 return;
1893         data += size;
1894
1895         if (TLS1_get_client_version(s) >= TLS1_2_VERSION)
1896                 {
1897                 const size_t len1 = sizeof(kSafariExtensionsBlock);
1898                 const size_t len2 = sizeof(kSafariTLS12ExtensionsBlock);
1899
1900                 if (data + len1 + len2 != d+n)
1901                         return;
1902                 if (memcmp(data, kSafariExtensionsBlock, len1) != 0)
1903                         return;
1904                 if (memcmp(data + len1, kSafariTLS12ExtensionsBlock, len2) != 0)
1905                         return;
1906                 }
1907         else
1908                 {
1909                 const size_t len = sizeof(kSafariExtensionsBlock);
1910
1911                 if (data + len != d+n)
1912                         return;
1913                 if (memcmp(data, kSafariExtensionsBlock, len) != 0)
1914                         return;
1915                 }
1916
1917         s->s3->is_probably_safari = 1;
1918 }
1919 #endif /* !OPENSSL_NO_EC */
1920
1921 /* tls1_alpn_handle_client_hello is called to process the ALPN extension in a
1922  * ClientHello.
1923  *   data: the contents of the extension, not including the type and length.
1924  *   data_len: the number of bytes in |data|
1925  *   al: a pointer to the alert value to send in the event of a non-zero
1926  *       return.
1927  *
1928  *   returns: 0 on success. */
1929 static int tls1_alpn_handle_client_hello(SSL *s, const unsigned char *data,
1930                                          unsigned data_len, int *al)
1931         {
1932         unsigned i;
1933         unsigned proto_len;
1934         const unsigned char *selected;
1935         unsigned char selected_len;
1936         int r;
1937
1938         if (s->ctx->alpn_select_cb == NULL)
1939                 return 0;
1940
1941         if (data_len < 2)
1942                 goto parse_error;
1943
1944         /* data should contain a uint16 length followed by a series of 8-bit,
1945          * length-prefixed strings. */
1946         i = ((unsigned) data[0]) << 8 |
1947             ((unsigned) data[1]);
1948         data_len -= 2;
1949         data += 2;
1950         if (data_len != i)
1951                 goto parse_error;
1952
1953         if (data_len < 2)
1954                 goto parse_error;
1955
1956         for (i = 0; i < data_len;)
1957                 {
1958                 proto_len = data[i];
1959                 i++;
1960
1961                 if (proto_len == 0)
1962                         goto parse_error;
1963
1964                 if (i + proto_len < i || i + proto_len > data_len)
1965                         goto parse_error;
1966
1967                 i += proto_len;
1968                 }
1969
1970         r = s->ctx->alpn_select_cb(s, &selected, &selected_len, data, data_len,
1971                                    s->ctx->alpn_select_cb_arg);
1972         if (r == SSL_TLSEXT_ERR_OK) {
1973                 if (s->s3->alpn_selected)
1974                         OPENSSL_free(s->s3->alpn_selected);
1975                 s->s3->alpn_selected = OPENSSL_malloc(selected_len);
1976                 if (!s->s3->alpn_selected)
1977                         {
1978                         *al = SSL_AD_INTERNAL_ERROR;
1979                         return -1;
1980                         }
1981                 memcpy(s->s3->alpn_selected, selected, selected_len);
1982                 s->s3->alpn_selected_len = selected_len;
1983         }
1984         return 0;
1985
1986 parse_error:
1987         *al = SSL_AD_DECODE_ERROR;
1988         return -1;
1989         }
1990
1991 static int ssl_scan_clienthello_tlsext(SSL *s, unsigned char **p, unsigned char *d, int n, int *al)
1992         {
1993         unsigned short type;
1994         unsigned short size;
1995         unsigned short len;
1996         unsigned char *data = *p;
1997         int renegotiate_seen = 0;
1998         size_t i;
1999
2000         s->servername_done = 0;
2001         s->tlsext_status_type = -1;
2002 #ifndef OPENSSL_NO_NEXTPROTONEG
2003         s->s3->next_proto_neg_seen = 0;
2004 #endif
2005
2006         /* Clear observed custom extensions */
2007         s->s3->tlsext_custom_types_count = 0;
2008         if (s->s3->tlsext_custom_types != NULL)
2009                 {
2010                 OPENSSL_free(s->s3->tlsext_custom_types);
2011                 s->s3->tlsext_custom_types = NULL;
2012                 }
2013
2014         if (s->s3->alpn_selected)
2015                 {
2016                 OPENSSL_free(s->s3->alpn_selected);
2017                 s->s3->alpn_selected = NULL;
2018                 }
2019
2020 #ifndef OPENSSL_NO_HEARTBEATS
2021         s->tlsext_heartbeat &= ~(SSL_TLSEXT_HB_ENABLED |
2022                                SSL_TLSEXT_HB_DONT_SEND_REQUESTS);
2023 #endif
2024
2025 #ifndef OPENSSL_NO_EC
2026         if (s->options & SSL_OP_SAFARI_ECDHE_ECDSA_BUG)
2027                 ssl_check_for_safari(s, data, d, n);
2028 #endif /* !OPENSSL_NO_EC */
2029
2030         /* Clear any signature algorithms extension received */
2031         if (s->cert->peer_sigalgs)
2032                 {
2033                 OPENSSL_free(s->cert->peer_sigalgs);
2034                 s->cert->peer_sigalgs = NULL;
2035                 }
2036         /* Clear any shared sigtnature algorithms */
2037         if (s->cert->shared_sigalgs)
2038                 {
2039                 OPENSSL_free(s->cert->shared_sigalgs);
2040                 s->cert->shared_sigalgs = NULL;
2041                 }
2042         /* Clear certificate digests and validity flags */
2043         for (i = 0; i < SSL_PKEY_NUM; i++)
2044                 {
2045                 s->cert->pkeys[i].digest = NULL;
2046                 s->cert->pkeys[i].valid_flags = 0;
2047                 }
2048
2049         if (data >= (d+n-2))
2050                 goto ri_check;
2051         n2s(data,len);
2052
2053         if (data > (d+n-len))
2054                 goto ri_check;
2055
2056         while (data <= (d+n-4))
2057                 {
2058                 n2s(data,type);
2059                 n2s(data,size);
2060
2061                 if (data+size > (d+n))
2062                         goto ri_check;
2063 #if 0
2064                 fprintf(stderr,"Received extension type %d size %d\n",type,size);
2065 #endif
2066                 if (s->tlsext_debug_cb)
2067                         s->tlsext_debug_cb(s, 0, type, data, size,
2068                                                 s->tlsext_debug_arg);
2069 /* The servername extension is treated as follows:
2070
2071    - Only the hostname type is supported with a maximum length of 255.
2072    - The servername is rejected if too long or if it contains zeros,
2073      in which case an fatal alert is generated.
2074    - The servername field is maintained together with the session cache.
2075    - When a session is resumed, the servername call back invoked in order
2076      to allow the application to position itself to the right context.
2077    - The servername is acknowledged if it is new for a session or when
2078      it is identical to a previously used for the same session.
2079      Applications can control the behaviour.  They can at any time
2080      set a 'desirable' servername for a new SSL object. This can be the
2081      case for example with HTTPS when a Host: header field is received and
2082      a renegotiation is requested. In this case, a possible servername
2083      presented in the new client hello is only acknowledged if it matches
2084      the value of the Host: field.
2085    - Applications must  use SSL_OP_NO_SESSION_RESUMPTION_ON_RENEGOTIATION
2086      if they provide for changing an explicit servername context for the session,
2087      i.e. when the session has been established with a servername extension.
2088    - On session reconnect, the servername extension may be absent.
2089
2090 */
2091
2092                 if (type == TLSEXT_TYPE_server_name)
2093                         {
2094                         unsigned char *sdata;
2095                         int servname_type;
2096                         int dsize;
2097
2098                         if (size < 2)
2099                                 {
2100                                 *al = SSL_AD_DECODE_ERROR;
2101                                 return 0;
2102                                 }
2103                         n2s(data,dsize);
2104                         size -= 2;
2105                         if (dsize > size  )
2106                                 {
2107                                 *al = SSL_AD_DECODE_ERROR;
2108                                 return 0;
2109                                 }
2110
2111                         sdata = data;
2112                         while (dsize > 3)
2113                                 {
2114                                 servname_type = *(sdata++);
2115                                 n2s(sdata,len);
2116                                 dsize -= 3;
2117
2118                                 if (len > dsize)
2119                                         {
2120                                         *al = SSL_AD_DECODE_ERROR;
2121                                         return 0;
2122                                         }
2123                                 if (s->servername_done == 0)
2124                                 switch (servname_type)
2125                                         {
2126                                 case TLSEXT_NAMETYPE_host_name:
2127                                         if (!s->hit)
2128                                                 {
2129                                                 if(s->session->tlsext_hostname)
2130                                                         {
2131                                                         *al = SSL_AD_DECODE_ERROR;
2132                                                         return 0;
2133                                                         }
2134                                                 if (len > TLSEXT_MAXLEN_host_name)
2135                                                         {
2136                                                         *al = TLS1_AD_UNRECOGNIZED_NAME;
2137                                                         return 0;
2138                                                         }
2139                                                 if ((s->session->tlsext_hostname = OPENSSL_malloc(len+1)) == NULL)
2140                                                         {
2141                                                         *al = TLS1_AD_INTERNAL_ERROR;
2142                                                         return 0;
2143                                                         }
2144                                                 memcpy(s->session->tlsext_hostname, sdata, len);
2145                                                 s->session->tlsext_hostname[len]='\0';
2146                                                 if (strlen(s->session->tlsext_hostname) != len) {
2147                                                         OPENSSL_free(s->session->tlsext_hostname);
2148                                                         s->session->tlsext_hostname = NULL;
2149                                                         *al = TLS1_AD_UNRECOGNIZED_NAME;
2150                                                         return 0;
2151                                                 }
2152                                                 s->servername_done = 1;
2153
2154                                                 }
2155                                         else
2156                                                 s->servername_done = s->session->tlsext_hostname
2157                                                         && strlen(s->session->tlsext_hostname) == len
2158                                                         && strncmp(s->session->tlsext_hostname, (char *)sdata, len) == 0;
2159
2160                                         break;
2161
2162                                 default:
2163                                         break;
2164                                         }
2165
2166                                 dsize -= len;
2167                                 }
2168                         if (dsize != 0)
2169                                 {
2170                                 *al = SSL_AD_DECODE_ERROR;
2171                                 return 0;
2172                                 }
2173
2174                         }
2175 #ifndef OPENSSL_NO_SRP
2176                 else if (type == TLSEXT_TYPE_srp)
2177                         {
2178                         if (size <= 0 || ((len = data[0])) != (size -1))
2179                                 {
2180                                 *al = SSL_AD_DECODE_ERROR;
2181                                 return 0;
2182                                 }
2183                         if (s->srp_ctx.login != NULL)
2184                                 {
2185                                 *al = SSL_AD_DECODE_ERROR;
2186                                 return 0;
2187                                 }
2188                         if ((s->srp_ctx.login = OPENSSL_malloc(len+1)) == NULL)
2189                                 return -1;
2190                         memcpy(s->srp_ctx.login, &data[1], len);
2191                         s->srp_ctx.login[len]='\0';
2192
2193                         if (strlen(s->srp_ctx.login) != len)
2194                                 {
2195                                 *al = SSL_AD_DECODE_ERROR;
2196                                 return 0;
2197                                 }
2198                         }
2199 #endif
2200
2201 #ifndef OPENSSL_NO_EC
2202                 else if (type == TLSEXT_TYPE_ec_point_formats)
2203                         {
2204                         unsigned char *sdata = data;
2205                         int ecpointformatlist_length = *(sdata++);
2206
2207                         if (ecpointformatlist_length != size - 1 ||
2208                                 ecpointformatlist_length < 1)
2209                                 {
2210                                 *al = TLS1_AD_DECODE_ERROR;
2211                                 return 0;
2212                                 }
2213                         if (!s->hit)
2214                                 {
2215                                 if(s->session->tlsext_ecpointformatlist)
2216                                         {
2217                                         OPENSSL_free(s->session->tlsext_ecpointformatlist);
2218                                         s->session->tlsext_ecpointformatlist = NULL;
2219                                         }
2220                                 s->session->tlsext_ecpointformatlist_length = 0;
2221                                 if ((s->session->tlsext_ecpointformatlist = OPENSSL_malloc(ecpointformatlist_length)) == NULL)
2222                                         {
2223                                         *al = TLS1_AD_INTERNAL_ERROR;
2224                                         return 0;
2225                                         }
2226                                 s->session->tlsext_ecpointformatlist_length = ecpointformatlist_length;
2227                                 memcpy(s->session->tlsext_ecpointformatlist, sdata, ecpointformatlist_length);
2228                                 }
2229 #if 0
2230                         fprintf(stderr,"ssl_parse_clienthello_tlsext s->session->tlsext_ecpointformatlist (length=%i) ", s->session->tlsext_ecpointformatlist_length);
2231                         sdata = s->session->tlsext_ecpointformatlist;
2232                         for (i = 0; i < s->session->tlsext_ecpointformatlist_length; i++)
2233                                 fprintf(stderr,"%i ",*(sdata++));
2234                         fprintf(stderr,"\n");
2235 #endif
2236                         }
2237                 else if (type == TLSEXT_TYPE_elliptic_curves)
2238                         {
2239                         unsigned char *sdata = data;
2240                         int ellipticcurvelist_length = (*(sdata++) << 8);
2241                         ellipticcurvelist_length += (*(sdata++));
2242
2243                         if (ellipticcurvelist_length != size - 2 ||
2244                                 ellipticcurvelist_length < 1)
2245                                 {
2246                                 *al = TLS1_AD_DECODE_ERROR;
2247                                 return 0;
2248                                 }
2249                         if (!s->hit)
2250                                 {
2251                                 if(s->session->tlsext_ellipticcurvelist)
2252                                         {
2253                                         *al = TLS1_AD_DECODE_ERROR;
2254                                         return 0;
2255                                         }
2256                                 s->session->tlsext_ellipticcurvelist_length = 0;
2257                                 if ((s->session->tlsext_ellipticcurvelist = OPENSSL_malloc(ellipticcurvelist_length)) == NULL)
2258                                         {
2259                                         *al = TLS1_AD_INTERNAL_ERROR;
2260                                         return 0;
2261                                         }
2262                                 s->session->tlsext_ellipticcurvelist_length = ellipticcurvelist_length;
2263                                 memcpy(s->session->tlsext_ellipticcurvelist, sdata, ellipticcurvelist_length);
2264                                 }
2265 #if 0
2266                         fprintf(stderr,"ssl_parse_clienthello_tlsext s->session->tlsext_ellipticcurvelist (length=%i) ", s->session->tlsext_ellipticcurvelist_length);
2267                         sdata = s->session->tlsext_ellipticcurvelist;
2268                         for (i = 0; i < s->session->tlsext_ellipticcurvelist_length; i++)
2269                                 fprintf(stderr,"%i ",*(sdata++));
2270                         fprintf(stderr,"\n");
2271 #endif
2272                         }
2273 #endif /* OPENSSL_NO_EC */
2274 #ifdef TLSEXT_TYPE_opaque_prf_input
2275                 else if (type == TLSEXT_TYPE_opaque_prf_input)
2276                         {
2277                         unsigned char *sdata = data;
2278
2279                         if (size < 2)
2280                                 {
2281                                 *al = SSL_AD_DECODE_ERROR;
2282                                 return 0;
2283                                 }
2284                         n2s(sdata, s->s3->client_opaque_prf_input_len);
2285                         if (s->s3->client_opaque_prf_input_len != size - 2)
2286                                 {
2287                                 *al = SSL_AD_DECODE_ERROR;
2288                                 return 0;
2289                                 }
2290
2291                         if (s->s3->client_opaque_prf_input != NULL) /* shouldn't really happen */
2292                                 OPENSSL_free(s->s3->client_opaque_prf_input);
2293                         if (s->s3->client_opaque_prf_input_len == 0)
2294                                 s->s3->client_opaque_prf_input = OPENSSL_malloc(1); /* dummy byte just to get non-NULL */
2295                         else
2296                                 s->s3->client_opaque_prf_input = BUF_memdup(sdata, s->s3->client_opaque_prf_input_len);
2297                         if (s->s3->client_opaque_prf_input == NULL)
2298                                 {
2299                                 *al = TLS1_AD_INTERNAL_ERROR;
2300                                 return 0;
2301                                 }
2302                         }
2303 #endif
2304                 else if (type == TLSEXT_TYPE_session_ticket)
2305                         {
2306                         if (s->tls_session_ticket_ext_cb &&
2307                             !s->tls_session_ticket_ext_cb(s, data, size, s->tls_session_ticket_ext_cb_arg))
2308                                 {
2309                                 *al = TLS1_AD_INTERNAL_ERROR;
2310                                 return 0;
2311                                 }
2312                         }
2313                 else if (type == TLSEXT_TYPE_renegotiate)
2314                         {
2315                         if(!ssl_parse_clienthello_renegotiate_ext(s, data, size, al))
2316                                 return 0;
2317                         renegotiate_seen = 1;
2318                         }
2319                 else if (type == TLSEXT_TYPE_signature_algorithms)
2320                         {
2321                         int dsize;
2322                         if (s->cert->peer_sigalgs || size < 2)
2323                                 {
2324                                 *al = SSL_AD_DECODE_ERROR;
2325                                 return 0;
2326                                 }
2327                         n2s(data,dsize);
2328                         size -= 2;
2329                         if (dsize != size || dsize & 1 || !dsize)
2330                                 {
2331                                 *al = SSL_AD_DECODE_ERROR;
2332                                 return 0;
2333                                 }
2334                         if (!tls1_process_sigalgs(s, data, dsize))
2335                                 {
2336                                 *al = SSL_AD_DECODE_ERROR;
2337                                 return 0;
2338                                 }
2339                         /* If sigalgs received and no shared algorithms fatal
2340                          * error.
2341                          */
2342                         if (s->cert->peer_sigalgs && !s->cert->shared_sigalgs)
2343                                 {
2344                                 SSLerr(SSL_F_SSL_SCAN_CLIENTHELLO_TLSEXT,
2345                                         SSL_R_NO_SHARED_SIGATURE_ALGORITHMS);
2346                                 *al = SSL_AD_ILLEGAL_PARAMETER;
2347                                 return 0;
2348                                 }
2349                         }
2350                 else if (type == TLSEXT_TYPE_status_request
2351                          && s->ctx->tlsext_status_cb)
2352                         {
2353
2354                         if (size < 5)
2355                                 {
2356                                 *al = SSL_AD_DECODE_ERROR;
2357                                 return 0;
2358                                 }
2359
2360                         s->tlsext_status_type = *data++;
2361                         size--;
2362                         if (s->tlsext_status_type == TLSEXT_STATUSTYPE_ocsp)
2363                                 {
2364                                 const unsigned char *sdata;
2365                                 int dsize;
2366                                 /* Read in responder_id_list */
2367                                 n2s(data,dsize);
2368                                 size -= 2;
2369                                 if (dsize > size  )
2370                                         {
2371                                         *al = SSL_AD_DECODE_ERROR;
2372                                         return 0;
2373                                         }
2374                                 while (dsize > 0)
2375                                         {
2376                                         OCSP_RESPID *id;
2377                                         int idsize;
2378                                         if (dsize < 4)
2379                                                 {
2380                                                 *al = SSL_AD_DECODE_ERROR;
2381                                                 return 0;
2382                                                 }
2383                                         n2s(data, idsize);
2384                                         dsize -= 2 + idsize;
2385                                         size -= 2 + idsize;
2386                                         if (dsize < 0)
2387                                                 {
2388                                                 *al = SSL_AD_DECODE_ERROR;
2389                                                 return 0;
2390                                                 }
2391                                         sdata = data;
2392                                         data += idsize;
2393                                         id = d2i_OCSP_RESPID(NULL,
2394                                                                 &sdata, idsize);
2395                                         if (!id)
2396                                                 {
2397                                                 *al = SSL_AD_DECODE_ERROR;
2398                                                 return 0;
2399                                                 }
2400                                         if (data != sdata)
2401                                                 {
2402                                                 OCSP_RESPID_free(id);
2403                                                 *al = SSL_AD_DECODE_ERROR;
2404                                                 return 0;
2405                                                 }
2406                                         if (!s->tlsext_ocsp_ids
2407                                                 && !(s->tlsext_ocsp_ids =
2408                                                 sk_OCSP_RESPID_new_null()))
2409                                                 {
2410                                                 OCSP_RESPID_free(id);
2411                                                 *al = SSL_AD_INTERNAL_ERROR;
2412                                                 return 0;
2413                                                 }
2414                                         if (!sk_OCSP_RESPID_push(
2415                                                         s->tlsext_ocsp_ids, id))
2416                                                 {
2417                                                 OCSP_RESPID_free(id);
2418                                                 *al = SSL_AD_INTERNAL_ERROR;
2419                                                 return 0;
2420                                                 }
2421                                         }
2422
2423                                 /* Read in request_extensions */
2424                                 if (size < 2)
2425                                         {
2426                                         *al = SSL_AD_DECODE_ERROR;
2427                                         return 0;
2428                                         }
2429                                 n2s(data,dsize);
2430                                 size -= 2;
2431                                 if (dsize != size)
2432                                         {
2433                                         *al = SSL_AD_DECODE_ERROR;
2434                                         return 0;
2435                                         }
2436                                 sdata = data;
2437                                 if (dsize > 0)
2438                                         {
2439                                         if (s->tlsext_ocsp_exts)
2440                                                 {
2441                                                 sk_X509_EXTENSION_pop_free(s->tlsext_ocsp_exts,
2442                                                                            X509_EXTENSION_free);
2443                                                 }
2444
2445                                         s->tlsext_ocsp_exts =
2446                                                 d2i_X509_EXTENSIONS(NULL,
2447                                                         &sdata, dsize);
2448                                         if (!s->tlsext_ocsp_exts
2449                                                 || (data + dsize != sdata))
2450                                                 {
2451                                                 *al = SSL_AD_DECODE_ERROR;
2452                                                 return 0;
2453                                                 }
2454                                         }
2455                                 }
2456                                 /* We don't know what to do with any other type
2457                                 * so ignore it.
2458                                 */
2459                                 else
2460                                         s->tlsext_status_type = -1;
2461                         }
2462 #ifndef OPENSSL_NO_HEARTBEATS
2463                 else if (type == TLSEXT_TYPE_heartbeat)
2464                         {
2465                         switch(data[0])
2466                                 {
2467                                 case 0x01:      /* Client allows us to send HB requests */
2468                                                         s->tlsext_heartbeat |= SSL_TLSEXT_HB_ENABLED;
2469                                                         break;
2470                                 case 0x02:      /* Client doesn't accept HB requests */
2471                                                         s->tlsext_heartbeat |= SSL_TLSEXT_HB_ENABLED;
2472                                                         s->tlsext_heartbeat |= SSL_TLSEXT_HB_DONT_SEND_REQUESTS;
2473                                                         break;
2474                                 default:        *al = SSL_AD_ILLEGAL_PARAMETER;
2475                                                         return 0;
2476                                 }
2477                         }
2478 #endif
2479 #ifndef OPENSSL_NO_NEXTPROTONEG
2480                 else if (type == TLSEXT_TYPE_next_proto_neg &&
2481                          s->s3->tmp.finish_md_len == 0 &&
2482                          s->s3->alpn_selected == NULL)
2483                         {
2484                         /* We shouldn't accept this extension on a
2485                          * renegotiation.
2486                          *
2487                          * s->new_session will be set on renegotiation, but we
2488                          * probably shouldn't rely that it couldn't be set on
2489                          * the initial renegotation too in certain cases (when
2490                          * there's some other reason to disallow resuming an
2491                          * earlier session -- the current code won't be doing
2492                          * anything like that, but this might change).
2493
2494                          * A valid sign that there's been a previous handshake
2495                          * in this connection is if s->s3->tmp.finish_md_len >
2496                          * 0.  (We are talking about a check that will happen
2497                          * in the Hello protocol round, well before a new
2498                          * Finished message could have been computed.) */
2499                         s->s3->next_proto_neg_seen = 1;
2500                         }
2501 #endif
2502
2503                 else if (type == TLSEXT_TYPE_application_layer_protocol_negotiation &&
2504                          s->ctx->alpn_select_cb &&
2505                          s->s3->tmp.finish_md_len == 0)
2506                         {
2507                         if (tls1_alpn_handle_client_hello(s, data, size, al) != 0)
2508                                 return 0;
2509                         /* ALPN takes precedence over NPN. */
2510                         s->s3->next_proto_neg_seen = 0;
2511                         }
2512
2513                 /* session ticket processed earlier */
2514                 else if (type == TLSEXT_TYPE_use_srtp)
2515                         {
2516                         if(ssl_parse_clienthello_use_srtp_ext(s, data, size,
2517                                                               al))
2518                                 return 0;
2519                         }
2520
2521                 else if (type == TLSEXT_TYPE_server_authz)
2522                         {
2523                         unsigned char *sdata = data;
2524                         unsigned char server_authz_dataformatlist_length;
2525
2526                         if (size == 0)
2527                                 {
2528                                 *al = TLS1_AD_DECODE_ERROR;
2529                                 return 0;
2530                                 }
2531
2532                         server_authz_dataformatlist_length = *(sdata++);
2533
2534                         if (server_authz_dataformatlist_length != size - 1)
2535                                 {
2536                                 *al = TLS1_AD_DECODE_ERROR;
2537                                 return 0;
2538                                 }
2539
2540                         /* Successful session resumption uses the same authz
2541                          * information as the original session so we ignore this
2542                          * in the case of a session resumption. */
2543                         if (!s->hit)
2544                                 {
2545                                 if (s->s3->tlsext_authz_client_types != NULL)
2546                                         OPENSSL_free(s->s3->tlsext_authz_client_types);
2547                                 s->s3->tlsext_authz_client_types =
2548                                         OPENSSL_malloc(server_authz_dataformatlist_length);
2549                                 if (!s->s3->tlsext_authz_client_types)
2550                                         {
2551                                         *al = TLS1_AD_INTERNAL_ERROR;
2552                                         return 0;
2553                                         }
2554
2555                                 s->s3->tlsext_authz_client_types_len =
2556                                         server_authz_dataformatlist_length;
2557                                 memcpy(s->s3->tlsext_authz_client_types,
2558                                        sdata,
2559                                        server_authz_dataformatlist_length);
2560
2561                                 /* Sort the types in order to check for duplicates. */
2562                                 qsort(s->s3->tlsext_authz_client_types,
2563                                       server_authz_dataformatlist_length,
2564                                       1 /* element size */,
2565                                       byte_compare);
2566
2567                                 for (i = 0; i < server_authz_dataformatlist_length; i++)
2568                                         {
2569                                         if (i > 0 &&
2570                                             s->s3->tlsext_authz_client_types[i] ==
2571                                               s->s3->tlsext_authz_client_types[i-1])
2572                                                 {
2573                                                 *al = TLS1_AD_DECODE_ERROR;
2574                                                 return 0;
2575                                                 }
2576                                         }
2577                                 }
2578                         }
2579
2580                 /* If this ClientHello extension was unhandled and this is
2581                  * a nonresumed connection, check whether the extension is a
2582                  * custom TLS Extension (has a custom_srv_ext_record), and if
2583                  * so call the callback and record the extension number so that
2584                  * an appropriate ServerHello may be later returned.
2585                  */
2586                 else if (!s->hit && s->ctx->custom_srv_ext_records_count)
2587                         {
2588                         custom_srv_ext_record *record;
2589
2590                         for (i=0; i < s->ctx->custom_srv_ext_records_count; i++)
2591                                 {
2592                                 record = &s->ctx->custom_srv_ext_records[i];
2593                                 if (type == record->ext_type)
2594                                         {
2595                                         size_t j;
2596
2597                                         /* Error on duplicate TLS Extensions */
2598                                         for (j = 0; j < s->s3->tlsext_custom_types_count; j++)
2599                                                 {
2600                                                 if (type == s->s3->tlsext_custom_types[j])
2601                                                         {
2602                                                         *al = TLS1_AD_DECODE_ERROR;
2603                                                         return 0;
2604                                                         }
2605                                                 }
2606
2607                                         /* NULL callback still notes the extension */
2608                                         if (record->fn1 && !record->fn1(s, type, data, size, al, record->arg))
2609                                                 return 0;
2610
2611                                         /* Add the (non-duplicated) entry */
2612                                         s->s3->tlsext_custom_types_count++;
2613                                         s->s3->tlsext_custom_types = OPENSSL_realloc(
2614                                                         s->s3->tlsext_custom_types,
2615                                                         s->s3->tlsext_custom_types_count * 2);
2616                                         if (s->s3->tlsext_custom_types == NULL)
2617                                                 {
2618                                                 s->s3->tlsext_custom_types = 0;
2619                                                 *al = TLS1_AD_INTERNAL_ERROR;
2620                                                 return 0;
2621                                                 }
2622                                         s->s3->tlsext_custom_types[
2623                                                         s->s3->tlsext_custom_types_count - 1] = type;
2624                                         }
2625                                 }
2626                         }
2627
2628                 data+=size;
2629                 }
2630
2631         *p = data;
2632
2633         ri_check:
2634
2635         /* Need RI if renegotiating */
2636
2637         if (!renegotiate_seen && s->renegotiate &&
2638                 !(s->options & SSL_OP_ALLOW_UNSAFE_LEGACY_RENEGOTIATION))
2639                 {
2640                 *al = SSL_AD_HANDSHAKE_FAILURE;
2641                 SSLerr(SSL_F_SSL_SCAN_CLIENTHELLO_TLSEXT,
2642                                 SSL_R_UNSAFE_LEGACY_RENEGOTIATION_DISABLED);
2643                 return 0;
2644                 }
2645         /* If no signature algorithms extension set default values */
2646         if (!s->cert->peer_sigalgs)
2647                 ssl_cert_set_default_md(s->cert);
2648
2649         return 1;
2650         }
2651
2652 int ssl_parse_clienthello_tlsext(SSL *s, unsigned char **p, unsigned char *d, int n)
2653         {
2654         int al = -1;
2655         if (ssl_scan_clienthello_tlsext(s, p, d, n, &al) <= 0)
2656                 {
2657                 ssl3_send_alert(s,SSL3_AL_FATAL,al);
2658                 return 0;
2659                 }
2660
2661         if (ssl_check_clienthello_tlsext_early(s) <= 0)
2662                 {
2663                 SSLerr(SSL_F_SSL_PARSE_CLIENTHELLO_TLSEXT,SSL_R_CLIENTHELLO_TLSEXT);
2664                 return 0;
2665                 }
2666         return 1;
2667 }
2668
2669 #ifndef OPENSSL_NO_NEXTPROTONEG
2670 /* ssl_next_proto_validate validates a Next Protocol Negotiation block. No
2671  * elements of zero length are allowed and the set of elements must exactly fill
2672  * the length of the block. */
2673 static char ssl_next_proto_validate(unsigned char *d, unsigned len)
2674         {
2675         unsigned int off = 0;
2676
2677         while (off < len)
2678                 {
2679                 if (d[off] == 0)
2680                         return 0;
2681                 off += d[off];
2682                 off++;
2683                 }
2684
2685         return off == len;
2686         }
2687 #endif
2688
2689 static int ssl_scan_serverhello_tlsext(SSL *s, unsigned char **p, unsigned char *d, int n, int *al)
2690         {
2691         unsigned short length;
2692         unsigned short type;
2693         unsigned short size;
2694         unsigned char *data = *p;
2695         int tlsext_servername = 0;
2696         int renegotiate_seen = 0;
2697
2698 #ifndef OPENSSL_NO_NEXTPROTONEG
2699         s->s3->next_proto_neg_seen = 0;
2700 #endif
2701
2702         if (s->s3->alpn_selected)
2703                 {
2704                 OPENSSL_free(s->s3->alpn_selected);
2705                 s->s3->alpn_selected = NULL;
2706                 }
2707
2708 #ifndef OPENSSL_NO_HEARTBEATS
2709         s->tlsext_heartbeat &= ~(SSL_TLSEXT_HB_ENABLED |
2710                                SSL_TLSEXT_HB_DONT_SEND_REQUESTS);
2711 #endif
2712
2713         if (data >= (d+n-2))
2714                 goto ri_check;
2715
2716         n2s(data,length);
2717         if (data+length != d+n)
2718                 {
2719                 *al = SSL_AD_DECODE_ERROR;
2720                 return 0;
2721                 }
2722
2723         while(data <= (d+n-4))
2724                 {
2725                 n2s(data,type);
2726                 n2s(data,size);
2727
2728                 if (data+size > (d+n))
2729                         goto ri_check;
2730
2731                 if (s->tlsext_debug_cb)
2732                         s->tlsext_debug_cb(s, 1, type, data, size,
2733                                                 s->tlsext_debug_arg);
2734
2735                 if (type == TLSEXT_TYPE_server_name)
2736                         {
2737                         if (s->tlsext_hostname == NULL || size > 0)
2738                                 {
2739                                 *al = TLS1_AD_UNRECOGNIZED_NAME;
2740                                 return 0;
2741                                 }
2742                         tlsext_servername = 1;
2743                         }
2744
2745 #ifndef OPENSSL_NO_EC
2746                 else if (type == TLSEXT_TYPE_ec_point_formats)
2747                         {
2748                         unsigned char *sdata = data;
2749                         int ecpointformatlist_length = *(sdata++);
2750
2751                         if (ecpointformatlist_length != size - 1)
2752                                 {
2753                                 *al = TLS1_AD_DECODE_ERROR;
2754                                 return 0;
2755                                 }
2756                         s->session->tlsext_ecpointformatlist_length = 0;
2757                         if (s->session->tlsext_ecpointformatlist != NULL) OPENSSL_free(s->session->tlsext_ecpointformatlist);
2758                         if ((s->session->tlsext_ecpointformatlist = OPENSSL_malloc(ecpointformatlist_length)) == NULL)
2759                                 {
2760                                 *al = TLS1_AD_INTERNAL_ERROR;
2761                                 return 0;
2762                                 }
2763                         s->session->tlsext_ecpointformatlist_length = ecpointformatlist_length;
2764                         memcpy(s->session->tlsext_ecpointformatlist, sdata, ecpointformatlist_length);
2765 #if 0
2766                         fprintf(stderr,"ssl_parse_serverhello_tlsext s->session->tlsext_ecpointformatlist ");
2767                         sdata = s->session->tlsext_ecpointformatlist;
2768                         for (i = 0; i < s->session->tlsext_ecpointformatlist_length; i++)
2769                                 fprintf(stderr,"%i ",*(sdata++));
2770                         fprintf(stderr,"\n");
2771 #endif
2772                         }
2773 #endif /* OPENSSL_NO_EC */
2774
2775                 else if (type == TLSEXT_TYPE_session_ticket)
2776                         {
2777                         if (s->tls_session_ticket_ext_cb &&
2778                             !s->tls_session_ticket_ext_cb(s, data, size, s->tls_session_ticket_ext_cb_arg))
2779                                 {
2780                                 *al = TLS1_AD_INTERNAL_ERROR;
2781                                 return 0;
2782                                 }
2783                         if ((SSL_get_options(s) & SSL_OP_NO_TICKET)
2784                                 || (size > 0))
2785                                 {
2786                                 *al = TLS1_AD_UNSUPPORTED_EXTENSION;
2787                                 return 0;
2788                                 }
2789                         s->tlsext_ticket_expected = 1;
2790                         }
2791 #ifdef TLSEXT_TYPE_opaque_prf_input
2792                 else if (type == TLSEXT_TYPE_opaque_prf_input)
2793                         {
2794                         unsigned char *sdata = data;
2795
2796                         if (size < 2)
2797                                 {
2798                                 *al = SSL_AD_DECODE_ERROR;
2799                                 return 0;
2800                                 }
2801                         n2s(sdata, s->s3->server_opaque_prf_input_len);
2802                         if (s->s3->server_opaque_prf_input_len != size - 2)
2803                                 {
2804                                 *al = SSL_AD_DECODE_ERROR;
2805                                 return 0;
2806                                 }
2807
2808                         if (s->s3->server_opaque_prf_input != NULL) /* shouldn't really happen */
2809                                 OPENSSL_free(s->s3->server_opaque_prf_input);
2810                         if (s->s3->server_opaque_prf_input_len == 0)
2811                                 s->s3->server_opaque_prf_input = OPENSSL_malloc(1); /* dummy byte just to get non-NULL */
2812                         else
2813                                 s->s3->server_opaque_prf_input = BUF_memdup(sdata, s->s3->server_opaque_prf_input_len);
2814
2815                         if (s->s3->server_opaque_prf_input == NULL)
2816                                 {
2817                                 *al = TLS1_AD_INTERNAL_ERROR;
2818                                 return 0;
2819                                 }
2820                         }
2821 #endif
2822                 else if (type == TLSEXT_TYPE_status_request)
2823                         {
2824                         /* MUST be empty and only sent if we've requested
2825                          * a status request message.
2826                          */
2827                         if ((s->tlsext_status_type == -1) || (size > 0))
2828                                 {
2829                                 *al = TLS1_AD_UNSUPPORTED_EXTENSION;
2830                                 return 0;
2831                                 }
2832                         /* Set flag to expect CertificateStatus message */
2833                         s->tlsext_status_expected = 1;
2834                         }
2835 #ifndef OPENSSL_NO_NEXTPROTONEG
2836                 else if (type == TLSEXT_TYPE_next_proto_neg &&
2837                          s->s3->tmp.finish_md_len == 0)
2838                         {
2839                         unsigned char *selected;
2840                         unsigned char selected_len;
2841
2842                         /* We must have requested it. */
2843                         if (s->ctx->next_proto_select_cb == NULL)
2844                                 {
2845                                 *al = TLS1_AD_UNSUPPORTED_EXTENSION;
2846                                 return 0;
2847                                 }
2848                         /* The data must be valid */
2849                         if (!ssl_next_proto_validate(data, size))
2850                                 {
2851                                 *al = TLS1_AD_DECODE_ERROR;
2852                                 return 0;
2853                                 }
2854                         if (s->ctx->next_proto_select_cb(s, &selected, &selected_len, data, size, s->ctx->next_proto_select_cb_arg) != SSL_TLSEXT_ERR_OK)
2855                                 {
2856                                 *al = TLS1_AD_INTERNAL_ERROR;
2857                                 return 0;
2858                                 }
2859                         s->next_proto_negotiated = OPENSSL_malloc(selected_len);
2860                         if (!s->next_proto_negotiated)
2861                                 {
2862                                 *al = TLS1_AD_INTERNAL_ERROR;
2863                                 return 0;
2864                                 }
2865                         memcpy(s->next_proto_negotiated, selected, selected_len);
2866                         s->next_proto_negotiated_len = selected_len;
2867                         s->s3->next_proto_neg_seen = 1;
2868                         }
2869 #endif
2870
2871                 else if (type == TLSEXT_TYPE_application_layer_protocol_negotiation)
2872                         {
2873                         unsigned len;
2874
2875                         /* We must have requested it. */
2876                         if (s->alpn_client_proto_list == NULL)
2877                                 {
2878                                 *al = TLS1_AD_UNSUPPORTED_EXTENSION;
2879                                 return 0;
2880                                 }
2881                         if (size < 4)
2882                                 {
2883                                 *al = TLS1_AD_DECODE_ERROR;
2884                                 return 0;
2885                                 }
2886                         /* The extension data consists of:
2887                          *   uint16 list_length
2888                          *   uint8 proto_length;
2889                          *   uint8 proto[proto_length]; */
2890                         len = data[0];
2891                         len <<= 8;
2892                         len |= data[1];
2893                         if (len != (unsigned) size - 2)
2894                                 {
2895                                 *al = TLS1_AD_DECODE_ERROR;
2896                                 return 0;
2897                                 }
2898                         len = data[2];
2899                         if (len != (unsigned) size - 3)
2900                                 {
2901                                 *al = TLS1_AD_DECODE_ERROR;
2902                                 return 0;
2903                                 }
2904                         if (s->s3->alpn_selected)
2905                                 OPENSSL_free(s->s3->alpn_selected);
2906                         s->s3->alpn_selected = OPENSSL_malloc(len);
2907                         if (!s->s3->alpn_selected)
2908                                 {
2909                                 *al = TLS1_AD_INTERNAL_ERROR;
2910                                 return 0;
2911                                 }
2912                         memcpy(s->s3->alpn_selected, data + 3, len);
2913                         s->s3->alpn_selected_len = len;
2914                         }
2915
2916                 else if (type == TLSEXT_TYPE_renegotiate)
2917                         {
2918                         if(!ssl_parse_serverhello_renegotiate_ext(s, data, size, al))
2919                                 return 0;
2920                         renegotiate_seen = 1;
2921                         }
2922 #ifndef OPENSSL_NO_HEARTBEATS
2923                 else if (type == TLSEXT_TYPE_heartbeat)
2924                         {
2925                         switch(data[0])
2926                                 {
2927                                 case 0x01:      /* Server allows us to send HB requests */
2928                                                         s->tlsext_heartbeat |= SSL_TLSEXT_HB_ENABLED;
2929                                                         break;
2930                                 case 0x02:      /* Server doesn't accept HB requests */
2931                                                         s->tlsext_heartbeat |= SSL_TLSEXT_HB_ENABLED;
2932                                                         s->tlsext_heartbeat |= SSL_TLSEXT_HB_DONT_SEND_REQUESTS;
2933                                                         break;
2934                                 default:        *al = SSL_AD_ILLEGAL_PARAMETER;
2935                                                         return 0;
2936                                 }
2937                         }
2938 #endif
2939                 else if (type == TLSEXT_TYPE_use_srtp)
2940                         {
2941                         if(ssl_parse_serverhello_use_srtp_ext(s, data, size,
2942                                                               al))
2943                                 return 0;
2944                         }
2945
2946                 else if (type == TLSEXT_TYPE_server_authz)
2947                         {
2948                         /* We only support audit proofs. It's an error to send
2949                          * an authz hello extension if the client
2950                          * didn't request a proof. */
2951                         unsigned char *sdata = data;
2952                         unsigned char server_authz_dataformatlist_length;
2953
2954                         if (!s->ctx->tlsext_authz_server_audit_proof_cb)
2955                                 {
2956                                 *al = TLS1_AD_UNSUPPORTED_EXTENSION;
2957                                 return 0;
2958                                 }
2959
2960                         if (!size)
2961                                 {
2962                                 *al = TLS1_AD_DECODE_ERROR;
2963                                 return 0;
2964                                 }
2965
2966                         server_authz_dataformatlist_length = *(sdata++);
2967                         if (server_authz_dataformatlist_length != size - 1)
2968                                 {
2969                                 *al = TLS1_AD_DECODE_ERROR;
2970                                 return 0;
2971                                 }
2972
2973                         /* We only support audit proofs, so a legal ServerHello
2974                          * authz list contains exactly one entry. */
2975                         if (server_authz_dataformatlist_length != 1 ||
2976                                 sdata[0] != TLSEXT_AUTHZDATAFORMAT_audit_proof)
2977                                 {
2978                                 *al = TLS1_AD_UNSUPPORTED_EXTENSION;
2979                                 return 0;
2980                                 }
2981
2982                         s->s3->tlsext_authz_server_promised = 1;
2983                         }
2984
2985                 /* If this extension type was not otherwise handled, but
2986                  * matches a custom_cli_ext_record, then send it to the c
2987                  * callback */
2988                 else if (s->ctx->custom_cli_ext_records_count)
2989                         {
2990                         size_t i;
2991                         custom_cli_ext_record* record;
2992
2993                         for (i = 0; i < s->ctx->custom_cli_ext_records_count; i++)
2994                                 {
2995                                 record = &s->ctx->custom_cli_ext_records[i];
2996                                 if (record->ext_type == type)
2997                                         {
2998                                         if (record->fn2 && !record->fn2(s, type, data, size, al, record->arg))
2999                                                 return 0;
3000                                         break;
3001                                         }
3002                                 }
3003                         }
3004
3005                 data += size;
3006                 }
3007
3008         if (data != d+n)
3009                 {
3010                 *al = SSL_AD_DECODE_ERROR;
3011                 return 0;
3012                 }
3013
3014         if (!s->hit && tlsext_servername == 1)
3015                 {
3016                 if (s->tlsext_hostname)
3017                         {
3018                         if (s->session->tlsext_hostname == NULL)
3019                                 {
3020                                 s->session->tlsext_hostname = BUF_strdup(s->tlsext_hostname);
3021                                 if (!s->session->tlsext_hostname)
3022                                         {
3023                                         *al = SSL_AD_UNRECOGNIZED_NAME;
3024                                         return 0;
3025                                         }
3026                                 }
3027                         else
3028                                 {
3029                                 *al = SSL_AD_DECODE_ERROR;
3030                                 return 0;
3031                                 }
3032                         }
3033                 }
3034
3035         *p = data;
3036
3037         ri_check:
3038
3039         /* Determine if we need to see RI. Strictly speaking if we want to
3040          * avoid an attack we should *always* see RI even on initial server
3041          * hello because the client doesn't see any renegotiation during an
3042          * attack. However this would mean we could not connect to any server
3043          * which doesn't support RI so for the immediate future tolerate RI
3044          * absence on initial connect only.
3045          */
3046         if (!renegotiate_seen
3047                 && !(s->options & SSL_OP_LEGACY_SERVER_CONNECT)
3048                 && !(s->options & SSL_OP_ALLOW_UNSAFE_LEGACY_RENEGOTIATION))
3049                 {
3050                 *al = SSL_AD_HANDSHAKE_FAILURE;
3051                 SSLerr(SSL_F_SSL_SCAN_SERVERHELLO_TLSEXT,
3052                                 SSL_R_UNSAFE_LEGACY_RENEGOTIATION_DISABLED);
3053                 return 0;
3054                 }
3055
3056         return 1;
3057         }
3058
3059
3060 int ssl_prepare_clienthello_tlsext(SSL *s)
3061         {
3062
3063 #ifdef TLSEXT_TYPE_opaque_prf_input
3064         {
3065                 int r = 1;
3066
3067                 if (s->ctx->tlsext_opaque_prf_input_callback != 0)
3068                         {
3069                         r = s->ctx->tlsext_opaque_prf_input_callback(s, NULL, 0, s->ctx->tlsext_opaque_prf_input_callback_arg);
3070                         if (!r)
3071                                 return -1;
3072                         }
3073
3074                 if (s->tlsext_opaque_prf_input != NULL)
3075                         {
3076                         if (s->s3->client_opaque_prf_input != NULL) /* shouldn't really happen */
3077                                 OPENSSL_free(s->s3->client_opaque_prf_input);
3078
3079                         if (s->tlsext_opaque_prf_input_len == 0)
3080                                 s->s3->client_opaque_prf_input = OPENSSL_malloc(1); /* dummy byte just to get non-NULL */
3081                         else
3082                                 s->s3->client_opaque_prf_input = BUF_memdup(s->tlsext_opaque_prf_input, s->tlsext_opaque_prf_input_len);
3083                         if (s->s3->client_opaque_prf_input == NULL)
3084                                 {
3085                                 SSLerr(SSL_F_SSL_PREPARE_CLIENTHELLO_TLSEXT,ERR_R_MALLOC_FAILURE);
3086                                 return -1;
3087                                 }
3088                         s->s3->client_opaque_prf_input_len = s->tlsext_opaque_prf_input_len;
3089                         }
3090
3091                 if (r == 2)
3092                         /* at callback's request, insist on receiving an appropriate server opaque PRF input */
3093                         s->s3->server_opaque_prf_input_len = s->tlsext_opaque_prf_input_len;
3094         }
3095 #endif
3096
3097         return 1;
3098         }
3099
3100 int ssl_prepare_serverhello_tlsext(SSL *s)
3101         {
3102         return 1;
3103         }
3104
3105 static int ssl_check_clienthello_tlsext_early(SSL *s)
3106         {
3107         int ret=SSL_TLSEXT_ERR_NOACK;
3108         int al = SSL_AD_UNRECOGNIZED_NAME;
3109
3110 #ifndef OPENSSL_NO_EC
3111         /* The handling of the ECPointFormats extension is done elsewhere, namely in
3112          * ssl3_choose_cipher in s3_lib.c.
3113          */
3114         /* The handling of the EllipticCurves extension is done elsewhere, namely in
3115          * ssl3_choose_cipher in s3_lib.c.
3116          */
3117 #endif
3118
3119         if (s->ctx != NULL && s->ctx->tlsext_servername_callback != 0)
3120                 ret = s->ctx->tlsext_servername_callback(s, &al, s->ctx->tlsext_servername_arg);
3121         else if (s->initial_ctx != NULL && s->initial_ctx->tlsext_servername_callback != 0)
3122                 ret = s->initial_ctx->tlsext_servername_callback(s, &al, s->initial_ctx->tlsext_servername_arg);
3123
3124 #ifdef TLSEXT_TYPE_opaque_prf_input
3125         {
3126                 /* This sort of belongs into ssl_prepare_serverhello_tlsext(),
3127                  * but we might be sending an alert in response to the client hello,
3128                  * so this has to happen here in
3129                  * ssl_check_clienthello_tlsext_early(). */
3130
3131                 int r = 1;
3132
3133                 if (s->ctx->tlsext_opaque_prf_input_callback != 0)
3134                         {
3135                         r = s->ctx->tlsext_opaque_prf_input_callback(s, NULL, 0, s->ctx->tlsext_opaque_prf_input_callback_arg);
3136                         if (!r)
3137                                 {
3138                                 ret = SSL_TLSEXT_ERR_ALERT_FATAL;
3139                                 al = SSL_AD_INTERNAL_ERROR;
3140                                 goto err;
3141                                 }
3142                         }
3143
3144                 if (s->s3->server_opaque_prf_input != NULL) /* shouldn't really happen */
3145                         OPENSSL_free(s->s3->server_opaque_prf_input);
3146                 s->s3->server_opaque_prf_input = NULL;
3147
3148                 if (s->tlsext_opaque_prf_input != NULL)
3149                         {
3150                         if (s->s3->client_opaque_prf_input != NULL &&
3151                                 s->s3->client_opaque_prf_input_len == s->tlsext_opaque_prf_input_len)
3152                                 {
3153                                 /* can only use this extension if we have a server opaque PRF input
3154                                  * of the same length as the client opaque PRF input! */
3155
3156                                 if (s->tlsext_opaque_prf_input_len == 0)
3157                                         s->s3->server_opaque_prf_input = OPENSSL_malloc(1); /* dummy byte just to get non-NULL */
3158                                 else
3159                                         s->s3->server_opaque_prf_input = BUF_memdup(s->tlsext_opaque_prf_input, s->tlsext_opaque_prf_input_len);
3160                                 if (s->s3->server_opaque_prf_input == NULL)
3161                                         {
3162                                         ret = SSL_TLSEXT_ERR_ALERT_FATAL;
3163                                         al = SSL_AD_INTERNAL_ERROR;
3164                                         goto err;
3165                                         }
3166                                 s->s3->server_opaque_prf_input_len = s->tlsext_opaque_prf_input_len;
3167                                 }
3168                         }
3169
3170                 if (r == 2 && s->s3->server_opaque_prf_input == NULL)
3171                         {
3172                         /* The callback wants to enforce use of the extension,
3173                          * but we can't do that with the client opaque PRF input;
3174                          * abort the handshake.
3175                          */
3176                         ret = SSL_TLSEXT_ERR_ALERT_FATAL;
3177                         al = SSL_AD_HANDSHAKE_FAILURE;
3178                         }
3179         }
3180
3181  err:
3182 #endif
3183         switch (ret)
3184                 {
3185                 case SSL_TLSEXT_ERR_ALERT_FATAL:
3186                         ssl3_send_alert(s,SSL3_AL_FATAL,al);
3187                         return -1;
3188
3189                 case SSL_TLSEXT_ERR_ALERT_WARNING:
3190                         ssl3_send_alert(s,SSL3_AL_WARNING,al);
3191                         return 1;
3192
3193                 case SSL_TLSEXT_ERR_NOACK:
3194                         s->servername_done=0;
3195                         default:
3196                 return 1;
3197                 }
3198         }
3199
3200 int ssl_check_clienthello_tlsext_late(SSL *s)
3201         {
3202         int ret = SSL_TLSEXT_ERR_OK;
3203         int al;
3204
3205         /* If status request then ask callback what to do.
3206          * Note: this must be called after servername callbacks in case
3207          * the certificate has changed, and must be called after the cipher
3208          * has been chosen because this may influence which certificate is sent
3209          */
3210         if ((s->tlsext_status_type != -1) && s->ctx && s->ctx->tlsext_status_cb)
3211                 {
3212                 int r;
3213                 CERT_PKEY *certpkey;
3214                 certpkey = ssl_get_server_send_pkey(s);
3215                 /* If no certificate can't return certificate status */
3216                 if (certpkey == NULL)
3217                         {
3218                         s->tlsext_status_expected = 0;
3219                         return 1;
3220                         }
3221                 /* Set current certificate to one we will use so
3222                  * SSL_get_certificate et al can pick it up.
3223                  */
3224                 s->cert->key = certpkey;
3225                 r = s->ctx->tlsext_status_cb(s, s->ctx->tlsext_status_arg);
3226                 switch (r)
3227                         {
3228                         /* We don't want to send a status request response */
3229                         case SSL_TLSEXT_ERR_NOACK:
3230                                 s->tlsext_status_expected = 0;
3231                                 break;
3232                         /* status request response should be sent */
3233                         case SSL_TLSEXT_ERR_OK:
3234                                 if (s->tlsext_ocsp_resp)
3235                                         s->tlsext_status_expected = 1;
3236                                 else
3237                                         s->tlsext_status_expected = 0;
3238                                 break;
3239                         /* something bad happened */
3240                         case SSL_TLSEXT_ERR_ALERT_FATAL:
3241                                 ret = SSL_TLSEXT_ERR_ALERT_FATAL;
3242                                 al = SSL_AD_INTERNAL_ERROR;
3243                                 goto err;
3244                         }
3245                 }
3246         else
3247                 s->tlsext_status_expected = 0;
3248
3249  err:
3250         switch (ret)
3251                 {
3252                 case SSL_TLSEXT_ERR_ALERT_FATAL:
3253                         ssl3_send_alert(s, SSL3_AL_FATAL, al);
3254                         return -1;
3255
3256                 case SSL_TLSEXT_ERR_ALERT_WARNING:
3257                         ssl3_send_alert(s, SSL3_AL_WARNING, al);
3258                         return 1;
3259
3260                 default:
3261                         return 1;
3262                 }
3263         }
3264
3265 int ssl_check_serverhello_tlsext(SSL *s)
3266         {
3267         int ret=SSL_TLSEXT_ERR_NOACK;
3268         int al = SSL_AD_UNRECOGNIZED_NAME;
3269
3270 #ifndef OPENSSL_NO_EC
3271         /* If we are client and using an elliptic curve cryptography cipher
3272          * suite, then if server returns an EC point formats lists extension
3273          * it must contain uncompressed.
3274          */
3275         unsigned long alg_k = s->s3->tmp.new_cipher->algorithm_mkey;
3276         unsigned long alg_a = s->s3->tmp.new_cipher->algorithm_auth;
3277         if ((s->tlsext_ecpointformatlist != NULL) && (s->tlsext_ecpointformatlist_length > 0) &&
3278             (s->session->tlsext_ecpointformatlist != NULL) && (s->session->tlsext_ecpointformatlist_length > 0) &&
3279             ((alg_k & (SSL_kEECDH|SSL_kECDHr|SSL_kECDHe)) || (alg_a & SSL_aECDSA)))
3280                 {
3281                 /* we are using an ECC cipher */
3282                 size_t i;
3283                 unsigned char *list;
3284                 int found_uncompressed = 0;
3285                 list = s->session->tlsext_ecpointformatlist;
3286                 for (i = 0; i < s->session->tlsext_ecpointformatlist_length; i++)
3287                         {
3288                         if (*(list++) == TLSEXT_ECPOINTFORMAT_uncompressed)
3289                                 {
3290                                 found_uncompressed = 1;
3291                                 break;
3292                                 }
3293                         }
3294                 if (!found_uncompressed)
3295                         {
3296                         SSLerr(SSL_F_SSL_CHECK_SERVERHELLO_TLSEXT,SSL_R_TLS_INVALID_ECPOINTFORMAT_LIST);
3297                         return -1;
3298                         }
3299                 }
3300         ret = SSL_TLSEXT_ERR_OK;
3301 #endif /* OPENSSL_NO_EC */
3302
3303         if (s->ctx != NULL && s->ctx->tlsext_servername_callback != 0)
3304                 ret = s->ctx->tlsext_servername_callback(s, &al, s->ctx->tlsext_servername_arg);
3305         else if (s->initial_ctx != NULL && s->initial_ctx->tlsext_servername_callback != 0)
3306                 ret = s->initial_ctx->tlsext_servername_callback(s, &al, s->initial_ctx->tlsext_servername_arg);
3307
3308 #ifdef TLSEXT_TYPE_opaque_prf_input
3309         if (s->s3->server_opaque_prf_input_len > 0)
3310                 {
3311                 /* This case may indicate that we, as a client, want to insist on using opaque PRF inputs.
3312                  * So first verify that we really have a value from the server too. */
3313
3314                 if (s->s3->server_opaque_prf_input == NULL)
3315                         {
3316                         ret = SSL_TLSEXT_ERR_ALERT_FATAL;
3317                         al = SSL_AD_HANDSHAKE_FAILURE;
3318                         }
3319
3320                 /* Anytime the server *has* sent an opaque PRF input, we need to check
3321                  * that we have a client opaque PRF input of the same size. */
3322                 if (s->s3->client_opaque_prf_input == NULL ||
3323                     s->s3->client_opaque_prf_input_len != s->s3->server_opaque_prf_input_len)
3324                         {
3325                         ret = SSL_TLSEXT_ERR_ALERT_FATAL;
3326                         al = SSL_AD_ILLEGAL_PARAMETER;
3327                         }
3328                 }
3329 #endif
3330
3331         /* If we've requested certificate status and we wont get one
3332          * tell the callback
3333          */
3334         if ((s->tlsext_status_type != -1) && !(s->tlsext_status_expected)
3335                         && s->ctx && s->ctx->tlsext_status_cb)
3336                 {
3337                 int r;
3338                 /* Set resp to NULL, resplen to -1 so callback knows
3339                  * there is no response.
3340                  */
3341                 if (s->tlsext_ocsp_resp)
3342                         {
3343                         OPENSSL_free(s->tlsext_ocsp_resp);
3344                         s->tlsext_ocsp_resp = NULL;
3345                         }
3346                 s->tlsext_ocsp_resplen = -1;
3347                 r = s->ctx->tlsext_status_cb(s, s->ctx->tlsext_status_arg);
3348                 if (r == 0)
3349                         {
3350                         al = SSL_AD_BAD_CERTIFICATE_STATUS_RESPONSE;
3351                         ret = SSL_TLSEXT_ERR_ALERT_FATAL;
3352                         }
3353                 if (r < 0)
3354                         {
3355                         al = SSL_AD_INTERNAL_ERROR;
3356                         ret = SSL_TLSEXT_ERR_ALERT_FATAL;
3357                         }
3358                 }
3359
3360         switch (ret)
3361                 {
3362                 case SSL_TLSEXT_ERR_ALERT_FATAL:
3363                         ssl3_send_alert(s,SSL3_AL_FATAL,al);
3364                         return -1;
3365
3366                 case SSL_TLSEXT_ERR_ALERT_WARNING:
3367                         ssl3_send_alert(s,SSL3_AL_WARNING,al);
3368                         return 1;
3369
3370                 case SSL_TLSEXT_ERR_NOACK:
3371                         s->servername_done=0;
3372                         default:
3373                 return 1;
3374                 }
3375         }
3376
3377 int ssl_parse_serverhello_tlsext(SSL *s, unsigned char **p, unsigned char *d, int n)
3378         {
3379         int al = -1;
3380         if (s->version < SSL3_VERSION)
3381                 return 1;
3382         if (ssl_scan_serverhello_tlsext(s, p, d, n, &al) <= 0)
3383                 {
3384                 ssl3_send_alert(s,SSL3_AL_FATAL,al);
3385                 return 0;
3386                 }
3387
3388         if (ssl_check_serverhello_tlsext(s) <= 0)
3389                 {
3390                 SSLerr(SSL_F_SSL_PARSE_SERVERHELLO_TLSEXT,SSL_R_SERVERHELLO_TLSEXT);
3391                 return 0;
3392                 }
3393         return 1;
3394 }
3395
3396 /* Since the server cache lookup is done early on in the processing of the
3397  * ClientHello, and other operations depend on the result, we need to handle
3398  * any TLS session ticket extension at the same time.
3399  *
3400  *   session_id: points at the session ID in the ClientHello. This code will
3401  *       read past the end of this in order to parse out the session ticket
3402  *       extension, if any.
3403  *   len: the length of the session ID.
3404  *   limit: a pointer to the first byte after the ClientHello.
3405  *   ret: (output) on return, if a ticket was decrypted, then this is set to
3406  *       point to the resulting session.
3407  *
3408  * If s->tls_session_secret_cb is set then we are expecting a pre-shared key
3409  * ciphersuite, in which case we have no use for session tickets and one will
3410  * never be decrypted, nor will s->tlsext_ticket_expected be set to 1.
3411  *
3412  * Returns:
3413  *   -1: fatal error, either from parsing or decrypting the ticket.
3414  *    0: no ticket was found (or was ignored, based on settings).
3415  *    1: a zero length extension was found, indicating that the client supports
3416  *       session tickets but doesn't currently have one to offer.
3417  *    2: either s->tls_session_secret_cb was set, or a ticket was offered but
3418  *       couldn't be decrypted because of a non-fatal error.
3419  *    3: a ticket was successfully decrypted and *ret was set.
3420  *
3421  * Side effects:
3422  *   Sets s->tlsext_ticket_expected to 1 if the server will have to issue
3423  *   a new session ticket to the client because the client indicated support
3424  *   (and s->tls_session_secret_cb is NULL) but the client either doesn't have
3425  *   a session ticket or we couldn't use the one it gave us, or if
3426  *   s->ctx->tlsext_ticket_key_cb asked to renew the client's ticket.
3427  *   Otherwise, s->tlsext_ticket_expected is set to 0.
3428  */
3429 int tls1_process_ticket(SSL *s, unsigned char *session_id, int len,
3430                         const unsigned char *limit, SSL_SESSION **ret)
3431         {
3432         /* Point after session ID in client hello */
3433         const unsigned char *p = session_id + len;
3434         unsigned short i;
3435
3436         *ret = NULL;
3437         s->tlsext_ticket_expected = 0;
3438
3439         /* If tickets disabled behave as if no ticket present
3440          * to permit stateful resumption.
3441          */
3442         if (SSL_get_options(s) & SSL_OP_NO_TICKET)
3443                 return 0;
3444         if ((s->version <= SSL3_VERSION) || !limit)
3445                 return 0;
3446         if (p >= limit)
3447                 return -1;
3448         /* Skip past DTLS cookie */
3449         if (SSL_IS_DTLS(s))
3450                 {
3451                 i = *(p++);
3452                 p+= i;
3453                 if (p >= limit)
3454                         return -1;
3455                 }
3456         /* Skip past cipher list */
3457         n2s(p, i);
3458         p+= i;
3459         if (p >= limit)
3460                 return -1;
3461         /* Skip past compression algorithm list */
3462         i = *(p++);
3463         p += i;
3464         if (p > limit)
3465                 return -1;
3466         /* Now at start of extensions */
3467         if ((p + 2) >= limit)
3468                 return 0;
3469         n2s(p, i);
3470         while ((p + 4) <= limit)
3471                 {
3472                 unsigned short type, size;
3473                 n2s(p, type);
3474                 n2s(p, size);
3475                 if (p + size > limit)
3476                         return 0;
3477                 if (type == TLSEXT_TYPE_session_ticket)
3478                         {
3479                         int r;
3480                         if (size == 0)
3481                                 {
3482                                 /* The client will accept a ticket but doesn't
3483                                  * currently have one. */
3484                                 s->tlsext_ticket_expected = 1;
3485                                 return 1;
3486                                 }
3487                         if (s->tls_session_secret_cb)
3488                                 {
3489                                 /* Indicate that the ticket couldn't be
3490                                  * decrypted rather than generating the session
3491                                  * from ticket now, trigger abbreviated
3492                                  * handshake based on external mechanism to
3493                                  * calculate the master secret later. */
3494                                 return 2;
3495                                 }
3496                         r = tls_decrypt_ticket(s, p, size, session_id, len, ret);
3497                         switch (r)
3498                                 {
3499                                 case 2: /* ticket couldn't be decrypted */
3500                                         s->tlsext_ticket_expected = 1;
3501                                         return 2;
3502                                 case 3: /* ticket was decrypted */
3503                                         return r;
3504                                 case 4: /* ticket decrypted but need to renew */
3505                                         s->tlsext_ticket_expected = 1;
3506                                         return 3;
3507                                 default: /* fatal error */
3508                                         return -1;
3509                                 }
3510                         }
3511                 p += size;
3512                 }
3513         return 0;
3514         }
3515
3516 /* tls_decrypt_ticket attempts to decrypt a session ticket.
3517  *
3518  *   etick: points to the body of the session ticket extension.
3519  *   eticklen: the length of the session tickets extenion.
3520  *   sess_id: points at the session ID.
3521  *   sesslen: the length of the session ID.
3522  *   psess: (output) on return, if a ticket was decrypted, then this is set to
3523  *       point to the resulting session.
3524  *
3525  * Returns:
3526  *   -1: fatal error, either from parsing or decrypting the ticket.
3527  *    2: the ticket couldn't be decrypted.
3528  *    3: a ticket was successfully decrypted and *psess was set.
3529  *    4: same as 3, but the ticket needs to be renewed.
3530  */
3531 static int tls_decrypt_ticket(SSL *s, const unsigned char *etick, int eticklen,
3532                                 const unsigned char *sess_id, int sesslen,
3533                                 SSL_SESSION **psess)
3534         {
3535         SSL_SESSION *sess;
3536         unsigned char *sdec;
3537         const unsigned char *p;
3538         int slen, mlen, renew_ticket = 0;
3539         unsigned char tick_hmac[EVP_MAX_MD_SIZE];
3540         HMAC_CTX hctx;
3541         EVP_CIPHER_CTX ctx;
3542         SSL_CTX *tctx = s->initial_ctx;
3543         /* Need at least keyname + iv + some encrypted data */
3544         if (eticklen < 48)
3545                 return 2;
3546         /* Initialize session ticket encryption and HMAC contexts */
3547         HMAC_CTX_init(&hctx);
3548         EVP_CIPHER_CTX_init(&ctx);
3549         if (tctx->tlsext_ticket_key_cb)
3550                 {
3551                 unsigned char *nctick = (unsigned char *)etick;
3552                 int rv = tctx->tlsext_ticket_key_cb(s, nctick, nctick + 16,
3553                                                         &ctx, &hctx, 0);
3554                 if (rv < 0)
3555                         return -1;
3556                 if (rv == 0)
3557                         return 2;
3558                 if (rv == 2)
3559                         renew_ticket = 1;
3560                 }
3561         else
3562                 {
3563                 /* Check key name matches */
3564                 if (memcmp(etick, tctx->tlsext_tick_key_name, 16))
3565                         return 2;
3566                 HMAC_Init_ex(&hctx, tctx->tlsext_tick_hmac_key, 16,
3567                                         tlsext_tick_md(), NULL);
3568                 EVP_DecryptInit_ex(&ctx, EVP_aes_128_cbc(), NULL,
3569                                 tctx->tlsext_tick_aes_key, etick + 16);
3570                 }
3571         /* Attempt to process session ticket, first conduct sanity and
3572          * integrity checks on ticket.
3573          */
3574         mlen = HMAC_size(&hctx);
3575         if (mlen < 0)
3576                 {
3577                 EVP_CIPHER_CTX_cleanup(&ctx);
3578                 return -1;
3579                 }
3580         eticklen -= mlen;
3581         /* Check HMAC of encrypted ticket */
3582         HMAC_Update(&hctx, etick, eticklen);
3583         HMAC_Final(&hctx, tick_hmac, NULL);
3584         HMAC_CTX_cleanup(&hctx);
3585         if (CRYPTO_memcmp(tick_hmac, etick + eticklen, mlen))
3586                 return 2;
3587         /* Attempt to decrypt session data */
3588         /* Move p after IV to start of encrypted ticket, update length */
3589         p = etick + 16 + EVP_CIPHER_CTX_iv_length(&ctx);
3590         eticklen -= 16 + EVP_CIPHER_CTX_iv_length(&ctx);
3591         sdec = OPENSSL_malloc(eticklen);
3592         if (!sdec)
3593                 {
3594                 EVP_CIPHER_CTX_cleanup(&ctx);
3595                 return -1;
3596                 }
3597         EVP_DecryptUpdate(&ctx, sdec, &slen, p, eticklen);
3598         if (EVP_DecryptFinal(&ctx, sdec + slen, &mlen) <= 0)
3599                 return 2;
3600         slen += mlen;
3601         EVP_CIPHER_CTX_cleanup(&ctx);
3602         p = sdec;
3603
3604         sess = d2i_SSL_SESSION(NULL, &p, slen);
3605         OPENSSL_free(sdec);
3606         if (sess)
3607                 {
3608                 /* The session ID, if non-empty, is used by some clients to
3609                  * detect that the ticket has been accepted. So we copy it to
3610                  * the session structure. If it is empty set length to zero
3611                  * as required by standard.
3612                  */
3613                 if (sesslen)
3614                         memcpy(sess->session_id, sess_id, sesslen);
3615                 sess->session_id_length = sesslen;
3616                 *psess = sess;
3617                 if (renew_ticket)
3618                         return 4;
3619                 else
3620                         return 3;
3621                 }
3622         ERR_clear_error();
3623         /* For session parse failure, indicate that we need to send a new
3624          * ticket. */
3625         return 2;
3626         }
3627
3628 /* Tables to translate from NIDs to TLS v1.2 ids */
3629
3630 typedef struct
3631         {
3632         int nid;
3633         int id;
3634         } tls12_lookup;
3635
3636 static tls12_lookup tls12_md[] = {
3637         {NID_md5, TLSEXT_hash_md5},
3638         {NID_sha1, TLSEXT_hash_sha1},
3639         {NID_sha224, TLSEXT_hash_sha224},
3640         {NID_sha256, TLSEXT_hash_sha256},
3641         {NID_sha384, TLSEXT_hash_sha384},
3642         {NID_sha512, TLSEXT_hash_sha512}
3643 };
3644
3645 static tls12_lookup tls12_sig[] = {
3646         {EVP_PKEY_RSA, TLSEXT_signature_rsa},
3647         {EVP_PKEY_DSA, TLSEXT_signature_dsa},
3648         {EVP_PKEY_EC, TLSEXT_signature_ecdsa}
3649 };
3650
3651 static int tls12_find_id(int nid, tls12_lookup *table, size_t tlen)
3652         {
3653         size_t i;
3654         for (i = 0; i < tlen; i++)
3655                 {
3656                 if (table[i].nid == nid)
3657                         return table[i].id;
3658                 }
3659         return -1;
3660         }
3661
3662 static int tls12_find_nid(int id, tls12_lookup *table, size_t tlen)
3663         {
3664         size_t i;
3665         for (i = 0; i < tlen; i++)
3666                 {
3667                 if ((table[i].id) == id)
3668                         return table[i].nid;
3669                 }
3670         return NID_undef;
3671         }
3672
3673 int tls12_get_sigandhash(unsigned char *p, const EVP_PKEY *pk, const EVP_MD *md)
3674         {
3675         int sig_id, md_id;
3676         if (!md)
3677                 return 0;
3678         md_id = tls12_find_id(EVP_MD_type(md), tls12_md,
3679                                 sizeof(tls12_md)/sizeof(tls12_lookup));
3680         if (md_id == -1)
3681                 return 0;
3682         sig_id = tls12_get_sigid(pk);
3683         if (sig_id == -1)
3684                 return 0;
3685         p[0] = (unsigned char)md_id;
3686         p[1] = (unsigned char)sig_id;
3687         return 1;
3688         }
3689
3690 int tls12_get_sigid(const EVP_PKEY *pk)
3691         {
3692         return tls12_find_id(pk->type, tls12_sig,
3693                                 sizeof(tls12_sig)/sizeof(tls12_lookup));
3694         }
3695
3696 const EVP_MD *tls12_get_hash(unsigned char hash_alg)
3697         {
3698         switch(hash_alg)
3699                 {
3700 #ifndef OPENSSL_NO_MD5
3701                 case TLSEXT_hash_md5:
3702 #ifdef OPENSSL_FIPS
3703                 if (FIPS_mode())
3704                         return NULL;
3705 #endif
3706                 return EVP_md5();
3707 #endif
3708 #ifndef OPENSSL_NO_SHA
3709                 case TLSEXT_hash_sha1:
3710                 return EVP_sha1();
3711 #endif
3712 #ifndef OPENSSL_NO_SHA256
3713                 case TLSEXT_hash_sha224:
3714                 return EVP_sha224();
3715
3716                 case TLSEXT_hash_sha256:
3717                 return EVP_sha256();
3718 #endif
3719 #ifndef OPENSSL_NO_SHA512
3720                 case TLSEXT_hash_sha384:
3721                 return EVP_sha384();
3722
3723                 case TLSEXT_hash_sha512:
3724                 return EVP_sha512();
3725 #endif
3726                 default:
3727                 return NULL;
3728
3729                 }
3730         }
3731
3732 static int tls12_get_pkey_idx(unsigned char sig_alg)
3733         {
3734         switch(sig_alg)
3735                 {
3736 #ifndef OPENSSL_NO_RSA
3737         case TLSEXT_signature_rsa:
3738                 return SSL_PKEY_RSA_SIGN;
3739 #endif
3740 #ifndef OPENSSL_NO_DSA
3741         case TLSEXT_signature_dsa:
3742                 return SSL_PKEY_DSA_SIGN;
3743 #endif
3744 #ifndef OPENSSL_NO_ECDSA
3745         case TLSEXT_signature_ecdsa:
3746                 return SSL_PKEY_ECC;
3747 #endif
3748                 }
3749         return -1;
3750         }
3751
3752 /* Convert TLS 1.2 signature algorithm extension values into NIDs */
3753 static void tls1_lookup_sigalg(int *phash_nid, int *psign_nid,
3754                         int *psignhash_nid, const unsigned char *data)
3755         {
3756         int sign_nid = 0, hash_nid = 0;
3757         if (!phash_nid && !psign_nid && !psignhash_nid)
3758                 return;
3759         if (phash_nid || psignhash_nid)
3760                 {
3761                 hash_nid = tls12_find_nid(data[0], tls12_md,
3762                                         sizeof(tls12_md)/sizeof(tls12_lookup));
3763                 if (phash_nid)
3764                         *phash_nid = hash_nid;
3765                 }
3766         if (psign_nid || psignhash_nid)
3767                 {
3768                 sign_nid = tls12_find_nid(data[1], tls12_sig,
3769                                         sizeof(tls12_sig)/sizeof(tls12_lookup));
3770                 if (psign_nid)
3771                         *psign_nid = sign_nid;
3772                 }
3773         if (psignhash_nid)
3774                 {
3775                 if (sign_nid && hash_nid)
3776                         OBJ_find_sigid_by_algs(psignhash_nid,
3777                                                         hash_nid, sign_nid);
3778                 else
3779                         *psignhash_nid = NID_undef;
3780                 }
3781         }
3782 /* Given preference and allowed sigalgs set shared sigalgs */
3783 static int tls12_do_shared_sigalgs(TLS_SIGALGS *shsig,
3784                                 const unsigned char *pref, size_t preflen,
3785                                 const unsigned char *allow, size_t allowlen)
3786         {
3787         const unsigned char *ptmp, *atmp;
3788         size_t i, j, nmatch = 0;
3789         for (i = 0, ptmp = pref; i < preflen; i+=2, ptmp+=2)
3790                 {
3791                 /* Skip disabled hashes or signature algorithms */
3792                 if (tls12_get_hash(ptmp[0]) == NULL)
3793                         continue;
3794                 if (tls12_get_pkey_idx(ptmp[1]) == -1)
3795                         continue;
3796                 for (j = 0, atmp = allow; j < allowlen; j+=2, atmp+=2)
3797                         {
3798                         if (ptmp[0] == atmp[0] && ptmp[1] == atmp[1])
3799                                 {
3800                                 nmatch++;
3801                                 if (shsig)
3802                                         {
3803                                         shsig->rhash = ptmp[0];
3804                                         shsig->rsign = ptmp[1];
3805                                         tls1_lookup_sigalg(&shsig->hash_nid,
3806                                                 &shsig->sign_nid,
3807                                                 &shsig->signandhash_nid,
3808                                                 ptmp);
3809                                         shsig++;
3810                                         }
3811                                 break;
3812                                 }
3813                         }
3814                 }
3815         return nmatch;
3816         }
3817
3818 /* Set shared signature algorithms for SSL structures */
3819 static int tls1_set_shared_sigalgs(SSL *s)
3820         {
3821         const unsigned char *pref, *allow, *conf;
3822         size_t preflen, allowlen, conflen;
3823         size_t nmatch;
3824         TLS_SIGALGS *salgs = NULL;
3825         CERT *c = s->cert;
3826         unsigned int is_suiteb = tls1_suiteb(s);
3827         /* If client use client signature algorithms if not NULL */
3828         if (!s->server && c->client_sigalgs && !is_suiteb)
3829                 {
3830                 conf = c->client_sigalgs;
3831                 conflen = c->client_sigalgslen;
3832                 }
3833         else if (c->conf_sigalgs && !is_suiteb)
3834                 {
3835                 conf = c->conf_sigalgs;
3836                 conflen = c->conf_sigalgslen;
3837                 }
3838         else
3839                 conflen = tls12_get_psigalgs(s, &conf);
3840         if(s->options & SSL_OP_CIPHER_SERVER_PREFERENCE || is_suiteb)
3841                 {
3842                 pref = conf;
3843                 preflen = conflen;
3844                 allow = c->peer_sigalgs;
3845                 allowlen = c->peer_sigalgslen;
3846                 }
3847         else
3848                 {
3849                 allow = conf;
3850                 allowlen = conflen;
3851                 pref = c->peer_sigalgs;
3852                 preflen = c->peer_sigalgslen;
3853                 }
3854         nmatch = tls12_do_shared_sigalgs(NULL, pref, preflen, allow, allowlen);
3855         if (!nmatch)
3856                 return 1;
3857         salgs = OPENSSL_malloc(nmatch * sizeof(TLS_SIGALGS));
3858         if (!salgs)
3859                 return 0;
3860         nmatch = tls12_do_shared_sigalgs(salgs, pref, preflen, allow, allowlen);
3861         c->shared_sigalgs = salgs;
3862         c->shared_sigalgslen = nmatch;
3863         return 1;
3864         }
3865
3866
3867 /* Set preferred digest for each key type */
3868
3869 int tls1_process_sigalgs(SSL *s, const unsigned char *data, int dsize)
3870         {
3871         int idx;
3872         size_t i;
3873         const EVP_MD *md;
3874         CERT *c = s->cert;
3875         TLS_SIGALGS *sigptr;
3876         /* Extension ignored for inappropriate versions */
3877         if (!SSL_USE_SIGALGS(s))
3878                 return 1;
3879         /* Should never happen */
3880         if (!c)
3881                 return 0;
3882
3883         c->peer_sigalgs = OPENSSL_malloc(dsize);
3884         if (!c->peer_sigalgs)
3885                 return 0;
3886         c->peer_sigalgslen = dsize;
3887         memcpy(c->peer_sigalgs, data, dsize);
3888
3889         tls1_set_shared_sigalgs(s);
3890
3891 #ifdef OPENSSL_SSL_DEBUG_BROKEN_PROTOCOL
3892         if (s->cert->cert_flags & SSL_CERT_FLAG_BROKEN_PROTOCOL)
3893                 {
3894                 /* Use first set signature preference to force message
3895                  * digest, ignoring any peer preferences.
3896                  */
3897                 const unsigned char *sigs = NULL;
3898                 if (s->server)
3899                         sigs = c->conf_sigalgs;
3900                 else
3901                         sigs = c->client_sigalgs;
3902                 if (sigs)
3903                         {
3904                         idx = tls12_get_pkey_idx(sigs[1]);
3905                         md = tls12_get_hash(sigs[0]);
3906                         c->pkeys[idx].digest = md;
3907                         c->pkeys[idx].valid_flags = CERT_PKEY_EXPLICIT_SIGN;
3908                         if (idx == SSL_PKEY_RSA_SIGN)
3909                                 {
3910                                 c->pkeys[SSL_PKEY_RSA_ENC].valid_flags = CERT_PKEY_EXPLICIT_SIGN;
3911                                 c->pkeys[SSL_PKEY_RSA_ENC].digest = md;
3912                                 }
3913                         }
3914                 }
3915 #endif
3916
3917         for (i = 0, sigptr = c->shared_sigalgs;
3918                         i < c->shared_sigalgslen; i++, sigptr++)
3919                 {
3920                 idx = tls12_get_pkey_idx(sigptr->rsign);
3921                 if (idx > 0 && c->pkeys[idx].digest == NULL)
3922                         {
3923                         md = tls12_get_hash(sigptr->rhash);
3924                         c->pkeys[idx].digest = md;
3925                         c->pkeys[idx].valid_flags = CERT_PKEY_EXPLICIT_SIGN;
3926                         if (idx == SSL_PKEY_RSA_SIGN)
3927                                 {
3928                                 c->pkeys[SSL_PKEY_RSA_ENC].valid_flags = CERT_PKEY_EXPLICIT_SIGN;
3929                                 c->pkeys[SSL_PKEY_RSA_ENC].digest = md;
3930                                 }
3931                         }
3932
3933                 }
3934         /* In strict mode leave unset digests as NULL to indicate we can't
3935          * use the certificate for signing.
3936          */
3937         if (!(s->cert->cert_flags & SSL_CERT_FLAGS_CHECK_TLS_STRICT))
3938                 {
3939                 /* Set any remaining keys to default values. NOTE: if alg is
3940                  * not supported it stays as NULL.
3941                  */
3942 #ifndef OPENSSL_NO_DSA
3943                 if (!c->pkeys[SSL_PKEY_DSA_SIGN].digest)
3944                         c->pkeys[SSL_PKEY_DSA_SIGN].digest = EVP_sha1();
3945 #endif
3946 #ifndef OPENSSL_NO_RSA
3947                 if (!c->pkeys[SSL_PKEY_RSA_SIGN].digest)
3948                         {
3949                         c->pkeys[SSL_PKEY_RSA_SIGN].digest = EVP_sha1();
3950                         c->pkeys[SSL_PKEY_RSA_ENC].digest = EVP_sha1();
3951                         }
3952 #endif
3953 #ifndef OPENSSL_NO_ECDSA
3954                 if (!c->pkeys[SSL_PKEY_ECC].digest)
3955                         c->pkeys[SSL_PKEY_ECC].digest = EVP_sha1();
3956 #endif
3957                 }
3958         return 1;
3959         }
3960
3961
3962 int SSL_get_sigalgs(SSL *s, int idx,
3963                         int *psign, int *phash, int *psignhash,
3964                         unsigned char *rsig, unsigned char *rhash)
3965         {
3966         const unsigned char *psig = s->cert->peer_sigalgs;
3967         if (psig == NULL)
3968                 return 0;
3969         if (idx >= 0)
3970                 {
3971                 idx <<= 1;
3972                 if (idx >= (int)s->cert->peer_sigalgslen)
3973                         return 0;
3974                 psig += idx;
3975                 if (rhash)
3976                         *rhash = psig[0];
3977                 if (rsig)
3978                         *rsig = psig[1];
3979                 tls1_lookup_sigalg(phash, psign, psignhash, psig);
3980                 }
3981         return s->cert->peer_sigalgslen / 2;
3982         }
3983
3984 int SSL_get_shared_sigalgs(SSL *s, int idx,
3985                         int *psign, int *phash, int *psignhash,
3986                         unsigned char *rsig, unsigned char *rhash)
3987         {
3988         TLS_SIGALGS *shsigalgs = s->cert->shared_sigalgs;
3989         if (!shsigalgs || idx >= (int)s->cert->shared_sigalgslen)
3990                 return 0;
3991         shsigalgs += idx;
3992         if (phash)
3993                 *phash = shsigalgs->hash_nid;
3994         if (psign)
3995                 *psign = shsigalgs->sign_nid;
3996         if (psignhash)
3997                 *psignhash = shsigalgs->signandhash_nid;
3998         if (rsig)
3999                 *rsig = shsigalgs->rsign;
4000         if (rhash)
4001                 *rhash = shsigalgs->rhash;
4002         return s->cert->shared_sigalgslen;
4003         }
4004
4005
4006 #ifndef OPENSSL_NO_HEARTBEATS
4007 int
4008 tls1_process_heartbeat(SSL *s)
4009         {
4010         unsigned char *p = &s->s3->rrec.data[0], *pl;
4011         unsigned short hbtype;
4012         unsigned int payload;
4013         unsigned int padding = 16; /* Use minimum padding */
4014
4015         /* Read type and payload length first */
4016         hbtype = *p++;
4017         n2s(p, payload);
4018         pl = p;
4019
4020         if (s->msg_callback)
4021                 s->msg_callback(0, s->version, TLS1_RT_HEARTBEAT,
4022                         &s->s3->rrec.data[0], s->s3->rrec.length,
4023                         s, s->msg_callback_arg);
4024
4025         if (hbtype == TLS1_HB_REQUEST)
4026                 {
4027                 unsigned char *buffer, *bp;
4028                 int r;
4029
4030                 /* Allocate memory for the response, size is 1 bytes
4031                  * message type, plus 2 bytes payload length, plus
4032                  * payload, plus padding
4033                  */
4034                 buffer = OPENSSL_malloc(1 + 2 + payload + padding);
4035                 bp = buffer;
4036
4037                 /* Enter response type, length and copy payload */
4038                 *bp++ = TLS1_HB_RESPONSE;
4039                 s2n(payload, bp);
4040                 memcpy(bp, pl, payload);
4041                 bp += payload;
4042                 /* Random padding */
4043                 RAND_pseudo_bytes(bp, padding);
4044
4045                 r = ssl3_write_bytes(s, TLS1_RT_HEARTBEAT, buffer, 3 + payload + padding);
4046
4047                 if (r >= 0 && s->msg_callback)
4048                         s->msg_callback(1, s->version, TLS1_RT_HEARTBEAT,
4049                                 buffer, 3 + payload + padding,
4050                                 s, s->msg_callback_arg);
4051
4052                 OPENSSL_free(buffer);
4053
4054                 if (r < 0)
4055                         return r;
4056                 }
4057         else if (hbtype == TLS1_HB_RESPONSE)
4058                 {
4059                 unsigned int seq;
4060
4061                 /* We only send sequence numbers (2 bytes unsigned int),
4062                  * and 16 random bytes, so we just try to read the
4063                  * sequence number */
4064                 n2s(pl, seq);
4065
4066                 if (payload == 18 && seq == s->tlsext_hb_seq)
4067                         {
4068                         s->tlsext_hb_seq++;
4069                         s->tlsext_hb_pending = 0;
4070                         }
4071                 }
4072
4073         return 0;
4074         }
4075
4076 int
4077 tls1_heartbeat(SSL *s)
4078         {
4079         unsigned char *buf, *p;
4080         int ret;
4081         unsigned int payload = 18; /* Sequence number + random bytes */
4082         unsigned int padding = 16; /* Use minimum padding */
4083
4084         /* Only send if peer supports and accepts HB requests... */
4085         if (!(s->tlsext_heartbeat & SSL_TLSEXT_HB_ENABLED) ||
4086             s->tlsext_heartbeat & SSL_TLSEXT_HB_DONT_SEND_REQUESTS)
4087                 {
4088                 SSLerr(SSL_F_TLS1_HEARTBEAT,SSL_R_TLS_HEARTBEAT_PEER_DOESNT_ACCEPT);
4089                 return -1;
4090                 }
4091
4092         /* ...and there is none in flight yet... */
4093         if (s->tlsext_hb_pending)
4094                 {
4095                 SSLerr(SSL_F_TLS1_HEARTBEAT,SSL_R_TLS_HEARTBEAT_PENDING);
4096                 return -1;
4097                 }
4098
4099         /* ...and no handshake in progress. */
4100         if (SSL_in_init(s) || s->in_handshake)
4101                 {
4102                 SSLerr(SSL_F_TLS1_HEARTBEAT,SSL_R_UNEXPECTED_MESSAGE);
4103                 return -1;
4104                 }
4105
4106         /* Check if padding is too long, payload and padding
4107          * must not exceed 2^14 - 3 = 16381 bytes in total.
4108          */
4109         OPENSSL_assert(payload + padding <= 16381);
4110
4111         /* Create HeartBeat message, we just use a sequence number
4112          * as payload to distuingish different messages and add
4113          * some random stuff.
4114          *  - Message Type, 1 byte
4115          *  - Payload Length, 2 bytes (unsigned int)
4116          *  - Payload, the sequence number (2 bytes uint)
4117          *  - Payload, random bytes (16 bytes uint)
4118          *  - Padding
4119          */
4120         buf = OPENSSL_malloc(1 + 2 + payload + padding);
4121         p = buf;
4122         /* Message Type */
4123         *p++ = TLS1_HB_REQUEST;
4124         /* Payload length (18 bytes here) */
4125         s2n(payload, p);
4126         /* Sequence number */
4127         s2n(s->tlsext_hb_seq, p);
4128         /* 16 random bytes */
4129         RAND_pseudo_bytes(p, 16);
4130         p += 16;
4131         /* Random padding */
4132         RAND_pseudo_bytes(p, padding);
4133
4134         ret = ssl3_write_bytes(s, TLS1_RT_HEARTBEAT, buf, 3 + payload + padding);
4135         if (ret >= 0)
4136                 {
4137                 if (s->msg_callback)
4138                         s->msg_callback(1, s->version, TLS1_RT_HEARTBEAT,
4139                                 buf, 3 + payload + padding,
4140                                 s, s->msg_callback_arg);
4141
4142                 s->tlsext_hb_pending = 1;
4143                 }
4144
4145         OPENSSL_free(buf);
4146
4147         return ret;
4148         }
4149 #endif
4150
4151 #define MAX_SIGALGLEN   (TLSEXT_hash_num * TLSEXT_signature_num * 2)
4152
4153 typedef struct
4154         {
4155         size_t sigalgcnt;
4156         int sigalgs[MAX_SIGALGLEN];
4157         } sig_cb_st;
4158
4159 static int sig_cb(const char *elem, int len, void *arg)
4160         {
4161         sig_cb_st *sarg = arg;
4162         size_t i;
4163         char etmp[20], *p;
4164         int sig_alg, hash_alg;
4165         if (sarg->sigalgcnt == MAX_SIGALGLEN)
4166                 return 0;
4167         if (len > (int)(sizeof(etmp) - 1))
4168                 return 0;
4169         memcpy(etmp, elem, len);
4170         etmp[len] = 0;
4171         p = strchr(etmp, '+');
4172         if (!p)
4173                 return 0;
4174         *p = 0;
4175         p++;
4176         if (!*p)
4177                 return 0;
4178
4179         if (!strcmp(etmp, "RSA"))
4180                 sig_alg = EVP_PKEY_RSA;
4181         else if (!strcmp(etmp, "DSA"))
4182                 sig_alg = EVP_PKEY_DSA;
4183         else if (!strcmp(etmp, "ECDSA"))
4184                 sig_alg = EVP_PKEY_EC;
4185         else return 0;
4186
4187         hash_alg = OBJ_sn2nid(p);
4188         if (hash_alg == NID_undef)
4189                 hash_alg = OBJ_ln2nid(p);
4190         if (hash_alg == NID_undef)
4191                 return 0;
4192
4193         for (i = 0; i < sarg->sigalgcnt; i+=2)
4194                 {
4195                 if (sarg->sigalgs[i] == sig_alg
4196                         && sarg->sigalgs[i + 1] == hash_alg)
4197                         return 0;
4198                 }
4199         sarg->sigalgs[sarg->sigalgcnt++] = hash_alg;
4200         sarg->sigalgs[sarg->sigalgcnt++] = sig_alg;
4201         return 1;
4202         }
4203
4204 /* Set suppored signature algorithms based on a colon separated list
4205  * of the form sig+hash e.g. RSA+SHA512:DSA+SHA512 */
4206 int tls1_set_sigalgs_list(CERT *c, const char *str, int client)
4207         {
4208         sig_cb_st sig;
4209         sig.sigalgcnt = 0;
4210         if (!CONF_parse_list(str, ':', 1, sig_cb, &sig))
4211                 return 0;
4212         if (c == NULL)
4213                 return 1;
4214         return tls1_set_sigalgs(c, sig.sigalgs, sig.sigalgcnt, client);
4215         }
4216
4217 int tls1_set_sigalgs(CERT *c, const int *psig_nids, size_t salglen, int client)
4218         {
4219         unsigned char *sigalgs, *sptr;
4220         int rhash, rsign;
4221         size_t i;
4222         if (salglen & 1)
4223                 return 0;
4224         sigalgs = OPENSSL_malloc(salglen);
4225         if (sigalgs == NULL)
4226                 return 0;
4227         for (i = 0, sptr = sigalgs; i < salglen; i+=2)
4228                 {
4229                 rhash = tls12_find_id(*psig_nids++, tls12_md,
4230                                         sizeof(tls12_md)/sizeof(tls12_lookup));
4231                 rsign = tls12_find_id(*psig_nids++, tls12_sig,
4232                                 sizeof(tls12_sig)/sizeof(tls12_lookup));
4233
4234                 if (rhash == -1 || rsign == -1)
4235                         goto err;
4236                 *sptr++ = rhash;
4237                 *sptr++ = rsign;
4238                 }
4239
4240         if (client)
4241                 {
4242                 if (c->client_sigalgs)
4243                         OPENSSL_free(c->client_sigalgs);
4244                 c->client_sigalgs = sigalgs;
4245                 c->client_sigalgslen = salglen;
4246                 }
4247         else
4248                 {
4249                 if (c->conf_sigalgs)
4250                         OPENSSL_free(c->conf_sigalgs);
4251                 c->conf_sigalgs = sigalgs;
4252                 c->conf_sigalgslen = salglen;
4253                 }
4254
4255         return 1;
4256
4257         err:
4258         OPENSSL_free(sigalgs);
4259         return 0;
4260         }
4261
4262 static int tls1_check_sig_alg(CERT *c, X509 *x, int default_nid)
4263         {
4264         int sig_nid;
4265         size_t i;
4266         if (default_nid == -1)
4267                 return 1;
4268         sig_nid = X509_get_signature_nid(x);
4269         if (default_nid)
4270                 return sig_nid == default_nid ? 1 : 0;
4271         for (i = 0; i < c->shared_sigalgslen; i++)
4272                 if (sig_nid == c->shared_sigalgs[i].signandhash_nid)
4273                         return 1;
4274         return 0;
4275         }
4276 /* Check to see if a certificate issuer name matches list of CA names */
4277 static int ssl_check_ca_name(STACK_OF(X509_NAME) *names, X509 *x)
4278         {
4279         X509_NAME *nm;
4280         int i;
4281         nm = X509_get_issuer_name(x);
4282         for (i = 0; i < sk_X509_NAME_num(names); i++)
4283                 {
4284                 if(!X509_NAME_cmp(nm, sk_X509_NAME_value(names, i)))
4285                         return 1;
4286                 }
4287         return 0;
4288         }
4289
4290 /* Check certificate chain is consistent with TLS extensions and is
4291  * usable by server. This servers two purposes: it allows users to
4292  * check chains before passing them to the server and it allows the
4293  * server to check chains before attempting to use them.
4294  */
4295
4296 /* Flags which need to be set for a certificate when stict mode not set */
4297
4298 #define CERT_PKEY_VALID_FLAGS \
4299         (CERT_PKEY_EE_SIGNATURE|CERT_PKEY_EE_PARAM)
4300 /* Strict mode flags */
4301 #define CERT_PKEY_STRICT_FLAGS \
4302          (CERT_PKEY_VALID_FLAGS|CERT_PKEY_CA_SIGNATURE|CERT_PKEY_CA_PARAM \
4303          | CERT_PKEY_ISSUER_NAME|CERT_PKEY_CERT_TYPE)
4304
4305 int tls1_check_chain(SSL *s, X509 *x, EVP_PKEY *pk, STACK_OF(X509) *chain,
4306                                                                         int idx)
4307         {
4308         int i;
4309         int rv = 0;
4310         int check_flags = 0, strict_mode;
4311         CERT_PKEY *cpk = NULL;
4312         CERT *c = s->cert;
4313         unsigned int suiteb_flags = tls1_suiteb(s);
4314         /* idx == -1 means checking server chains */
4315         if (idx != -1)
4316                 {
4317                 /* idx == -2 means checking client certificate chains */
4318                 if (idx == -2)
4319                         {
4320                         cpk = c->key;
4321                         idx = cpk - c->pkeys;
4322                         }
4323                 else
4324                         cpk = c->pkeys + idx;
4325                 x = cpk->x509;
4326                 pk = cpk->privatekey;
4327                 chain = cpk->chain;
4328                 strict_mode = c->cert_flags & SSL_CERT_FLAGS_CHECK_TLS_STRICT;
4329                 /* If no cert or key, forget it */
4330                 if (!x || !pk)
4331                         goto end;
4332 #ifdef OPENSSL_SSL_DEBUG_BROKEN_PROTOCOL
4333                 /* Allow any certificate to pass test */
4334                 if (s->cert->cert_flags & SSL_CERT_FLAG_BROKEN_PROTOCOL)
4335                         {
4336                         rv = CERT_PKEY_STRICT_FLAGS|CERT_PKEY_EXPLICIT_SIGN|CERT_PKEY_VALID|CERT_PKEY_SIGN;
4337                         cpk->valid_flags = rv;
4338                         return rv;
4339                         }
4340 #endif
4341                 }
4342         else
4343                 {
4344                 if (!x || !pk)
4345                         goto end;
4346                 idx = ssl_cert_type(x, pk);
4347                 if (idx == -1)
4348                         goto end;
4349                 cpk = c->pkeys + idx;
4350                 if (c->cert_flags & SSL_CERT_FLAGS_CHECK_TLS_STRICT)
4351                         check_flags = CERT_PKEY_STRICT_FLAGS;
4352                 else
4353                         check_flags = CERT_PKEY_VALID_FLAGS;
4354                 strict_mode = 1;
4355                 }
4356
4357         if (suiteb_flags)
4358                 {
4359                 int ok;
4360                 if (check_flags)
4361                         check_flags |= CERT_PKEY_SUITEB;
4362                 ok = X509_chain_check_suiteb(NULL, x, chain, suiteb_flags);
4363                 if (ok != X509_V_OK)
4364                         {
4365                         if (check_flags)
4366                                 rv |= CERT_PKEY_SUITEB;
4367                         else
4368                                 goto end;
4369                         }
4370                 }
4371
4372         /* Check all signature algorithms are consistent with
4373          * signature algorithms extension if TLS 1.2 or later
4374          * and strict mode.
4375          */
4376         if (TLS1_get_version(s) >= TLS1_2_VERSION && strict_mode)
4377                 {
4378                 int default_nid;
4379                 unsigned char rsign = 0;
4380                 if (c->peer_sigalgs)
4381                         default_nid = 0;
4382                 /* If no sigalgs extension use defaults from RFC5246 */
4383                 else
4384                         {
4385                         switch(idx)
4386                                 {
4387                         case SSL_PKEY_RSA_ENC:
4388                         case SSL_PKEY_RSA_SIGN:
4389                         case SSL_PKEY_DH_RSA:
4390                                 rsign = TLSEXT_signature_rsa;
4391                                 default_nid = NID_sha1WithRSAEncryption;
4392                                 break;
4393
4394                         case SSL_PKEY_DSA_SIGN:
4395                         case SSL_PKEY_DH_DSA:
4396                                 rsign = TLSEXT_signature_dsa;
4397                                 default_nid = NID_dsaWithSHA1;
4398                                 break;
4399
4400                         case SSL_PKEY_ECC:
4401                                 rsign = TLSEXT_signature_ecdsa;
4402                                 default_nid = NID_ecdsa_with_SHA1;
4403                                 break;
4404
4405                         default:
4406                                 default_nid = -1;
4407                                 break;
4408                                 }
4409                         }
4410                 /* If peer sent no signature algorithms extension and we
4411                  * have set preferred signature algorithms check we support
4412                  * sha1.
4413                  */
4414                 if (default_nid > 0 && c->conf_sigalgs)
4415                         {
4416                         size_t j;
4417                         const unsigned char *p = c->conf_sigalgs;
4418                         for (j = 0; j < c->conf_sigalgslen; j += 2, p += 2)
4419                                 {
4420                                 if (p[0] == TLSEXT_hash_sha1 && p[1] == rsign)
4421                                         break;
4422                                 }
4423                         if (j == c->conf_sigalgslen)
4424                                 {
4425                                 if (check_flags)
4426                                         goto skip_sigs;
4427                                 else
4428                                         goto end;
4429                                 }
4430                         }
4431                 /* Check signature algorithm of each cert in chain */
4432                 if (!tls1_check_sig_alg(c, x, default_nid))
4433                         {
4434                         if (!check_flags) goto end;
4435                         }
4436                 else
4437                         rv |= CERT_PKEY_EE_SIGNATURE;
4438                 rv |= CERT_PKEY_CA_SIGNATURE;
4439                 for (i = 0; i < sk_X509_num(chain); i++)
4440                         {
4441                         if (!tls1_check_sig_alg(c, sk_X509_value(chain, i),
4442                                                         default_nid))
4443                                 {
4444                                 if (check_flags)
4445                                         {
4446                                         rv &= ~CERT_PKEY_CA_SIGNATURE;
4447                                         break;
4448                                         }
4449                                 else
4450                                         goto end;
4451                                 }
4452                         }
4453                 }
4454         /* Else not TLS 1.2, so mark EE and CA signing algorithms OK */
4455         else if(check_flags)
4456                 rv |= CERT_PKEY_EE_SIGNATURE|CERT_PKEY_CA_SIGNATURE;
4457         skip_sigs:
4458         /* Check cert parameters are consistent */
4459         if (tls1_check_cert_param(s, x, check_flags ? 1 : 2))
4460                 rv |= CERT_PKEY_EE_PARAM;
4461         else if (!check_flags)
4462                 goto end;
4463         if (!s->server)
4464                 rv |= CERT_PKEY_CA_PARAM;
4465         /* In strict mode check rest of chain too */
4466         else if (strict_mode)
4467                 {
4468                 rv |= CERT_PKEY_CA_PARAM;
4469                 for (i = 0; i < sk_X509_num(chain); i++)
4470                         {
4471                         X509 *ca = sk_X509_value(chain, i);
4472                         if (!tls1_check_cert_param(s, ca, 0))
4473                                 {
4474                                 if (check_flags)
4475                                         {
4476                                         rv &= ~CERT_PKEY_CA_PARAM;
4477                                         break;
4478                                         }
4479                                 else
4480                                         goto end;
4481                                 }
4482                         }
4483                 }
4484         if (!s->server && strict_mode)
4485                 {
4486                 STACK_OF(X509_NAME) *ca_dn;
4487                 int check_type = 0;
4488                 switch (pk->type)
4489                         {
4490                 case EVP_PKEY_RSA:
4491                         check_type = TLS_CT_RSA_SIGN;
4492                         break;
4493                 case EVP_PKEY_DSA:
4494                         check_type = TLS_CT_DSS_SIGN;
4495                         break;
4496                 case EVP_PKEY_EC:
4497                         check_type = TLS_CT_ECDSA_SIGN;
4498                         break;
4499                 case EVP_PKEY_DH:
4500                 case EVP_PKEY_DHX:
4501                                 {
4502                                 int cert_type = X509_certificate_type(x, pk);
4503                                 if (cert_type & EVP_PKS_RSA)
4504                                         check_type = TLS_CT_RSA_FIXED_DH;
4505                                 if (cert_type & EVP_PKS_DSA)
4506                                         check_type = TLS_CT_DSS_FIXED_DH;
4507                                 }
4508                         }
4509                 if (check_type)
4510                         {
4511                         const unsigned char *ctypes;
4512                         int ctypelen;
4513                         if (c->ctypes)
4514                                 {
4515                                 ctypes = c->ctypes;
4516                                 ctypelen = (int)c->ctype_num;
4517                                 }
4518                         else
4519                                 {
4520                                 ctypes = (unsigned char *)s->s3->tmp.ctype;
4521                                 ctypelen = s->s3->tmp.ctype_num;
4522                                 }
4523                         for (i = 0; i < ctypelen; i++)
4524                                 {
4525                                 if (ctypes[i] == check_type)
4526                                         {
4527                                         rv |= CERT_PKEY_CERT_TYPE;
4528                                         break;
4529                                         }
4530                                 }
4531                         if (!(rv & CERT_PKEY_CERT_TYPE) && !check_flags)
4532                                 goto end;
4533                         }
4534                 else
4535                         rv |= CERT_PKEY_CERT_TYPE;
4536
4537
4538                 ca_dn = s->s3->tmp.ca_names;
4539
4540                 if (!sk_X509_NAME_num(ca_dn))
4541                         rv |= CERT_PKEY_ISSUER_NAME;
4542
4543                 if (!(rv & CERT_PKEY_ISSUER_NAME))
4544                         {
4545                         if (ssl_check_ca_name(ca_dn, x))
4546                                 rv |= CERT_PKEY_ISSUER_NAME;
4547                         }
4548                 if (!(rv & CERT_PKEY_ISSUER_NAME))
4549                         {
4550                         for (i = 0; i < sk_X509_num(chain); i++)
4551                                 {
4552                                 X509 *xtmp = sk_X509_value(chain, i);
4553                                 if (ssl_check_ca_name(ca_dn, xtmp))
4554                                         {
4555                                         rv |= CERT_PKEY_ISSUER_NAME;
4556                                         break;
4557                                         }
4558                                 }
4559                         }
4560                 if (!check_flags && !(rv & CERT_PKEY_ISSUER_NAME))
4561                         goto end;
4562                 }
4563         else
4564                 rv |= CERT_PKEY_ISSUER_NAME|CERT_PKEY_CERT_TYPE;
4565
4566         if (!check_flags || (rv & check_flags) == check_flags)
4567                 rv |= CERT_PKEY_VALID;
4568
4569         end:
4570
4571         if (TLS1_get_version(s) >= TLS1_2_VERSION)
4572                 {
4573                 if (cpk->valid_flags & CERT_PKEY_EXPLICIT_SIGN)
4574                         rv |= CERT_PKEY_EXPLICIT_SIGN|CERT_PKEY_SIGN;
4575                 else if (cpk->digest)
4576                         rv |= CERT_PKEY_SIGN;
4577                 }
4578         else
4579                 rv |= CERT_PKEY_SIGN|CERT_PKEY_EXPLICIT_SIGN;
4580
4581         /* When checking a CERT_PKEY structure all flags are irrelevant
4582          * if the chain is invalid.
4583          */
4584         if (!check_flags)
4585                 {
4586                 if (rv & CERT_PKEY_VALID)
4587                         cpk->valid_flags = rv;
4588                 else
4589                         {
4590                         /* Preserve explicit sign flag, clear rest */
4591                         cpk->valid_flags &= CERT_PKEY_EXPLICIT_SIGN;
4592                         return 0;
4593                         }
4594                 }
4595         return rv;
4596         }
4597
4598 /* Set validity of certificates in an SSL structure */
4599 void tls1_set_cert_validity(SSL *s)
4600         {
4601         tls1_check_chain(s, NULL, NULL, NULL, SSL_PKEY_RSA_ENC);
4602         tls1_check_chain(s, NULL, NULL, NULL, SSL_PKEY_RSA_SIGN);
4603         tls1_check_chain(s, NULL, NULL, NULL, SSL_PKEY_DSA_SIGN);
4604         tls1_check_chain(s, NULL, NULL, NULL, SSL_PKEY_DH_RSA);
4605         tls1_check_chain(s, NULL, NULL, NULL, SSL_PKEY_DH_DSA);
4606         tls1_check_chain(s, NULL, NULL, NULL, SSL_PKEY_ECC);
4607         }
4608 /* User level utiity function to check a chain is suitable */
4609 int SSL_check_chain(SSL *s, X509 *x, EVP_PKEY *pk, STACK_OF(X509) *chain)
4610         {
4611         return tls1_check_chain(s, x, pk, chain, -1);
4612         }
4613
4614 #endif