ssl/t1_lib.c

   1 /* ssl/t1_lib.c */
   2 /* Copyright (C) 1995-1998 Eric Young (eay@cryptsoft.com)
   3  * All rights reserved.
   4  *
   5  * This package is an SSL implementation written
   6  * by Eric Young (eay@cryptsoft.com).
   7  * The implementation was written so as to conform with Netscapes SSL.
   8  *
   9  * This library is free for commercial and non-commercial use as long as
  10  * the following conditions are aheared to.  The following conditions
  11  * apply to all code found in this distribution, be it the RC4, RSA,
  12  * lhash, DES, etc., code; not just the SSL code.  The SSL documentation
  13  * included with this distribution is covered by the same copyright terms
  14  * except that the holder is Tim Hudson (tjh@cryptsoft.com).
  15  *
  16  * Copyright remains Eric Young's, and as such any Copyright notices in
  17  * the code are not to be removed.
  18  * If this package is used in a product, Eric Young should be given attribution
  19  * as the author of the parts of the library used.
  20  * This can be in the form of a textual message at program startup or
  21  * in documentation (online or textual) provided with the package.
  22  *
  23  * Redistribution and use in source and binary forms, with or without
  24  * modification, are permitted provided that the following conditions
  25  * are met:
  26  * 1. Redistributions of source code must retain the copyright
  27  *    notice, this list of conditions and the following disclaimer.
  28  * 2. Redistributions in binary form must reproduce the above copyright
  29  *    notice, this list of conditions and the following disclaimer in the
  30  *    documentation and/or other materials provided with the distribution.
  31  * 3. All advertising materials mentioning features or use of this software
  32  *    must display the following acknowledgement:
  33  *    "This product includes cryptographic software written by
  34  *     Eric Young (eay@cryptsoft.com)"
  35  *    The word 'cryptographic' can be left out if the rouines from the library
  36  *    being used are not cryptographic related :-).
  37  * 4. If you include any Windows specific code (or a derivative thereof) from
  38  *    the apps directory (application code) you must include an acknowledgement:
  39  *    "This product includes software written by Tim Hudson (tjh@cryptsoft.com)"
  40  *
  41  * THIS SOFTWARE IS PROVIDED BY ERIC YOUNG ``AS IS'' AND
  42  * ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
  43  * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE
  44  * ARE DISCLAIMED.  IN NO EVENT SHALL THE AUTHOR OR CONTRIBUTORS BE LIABLE
  45  * FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL
  46  * DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS
  47  * OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION)
  48  * HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT
  49  * LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY
  50  * OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF
  51  * SUCH DAMAGE.
  52  *
  53  * The licence and distribution terms for any publically available version or
  54  * derivative of this code cannot be changed.  i.e. this code cannot simply be
  55  * copied and put under another distribution licence
  56  * [including the GNU Public Licence.]
  57  */
  58 /* ====================================================================
  59  * Copyright (c) 1998-2007 The OpenSSL Project.  All rights reserved.
  60  *
  61  * Redistribution and use in source and binary forms, with or without
  62  * modification, are permitted provided that the following conditions
  63  * are met:
  64  *
  65  * 1. Redistributions of source code must retain the above copyright
  66  *    notice, this list of conditions and the following disclaimer.
  67  *
  68  * 2. Redistributions in binary form must reproduce the above copyright
  69  *    notice, this list of conditions and the following disclaimer in
  70  *    the documentation and/or other materials provided with the
  71  *    distribution.
  72  *
  73  * 3. All advertising materials mentioning features or use of this
  74  *    software must display the following acknowledgment:
  75  *    "This product includes software developed by the OpenSSL Project
  76  *    for use in the OpenSSL Toolkit. (http://www.openssl.org/)"
  77  *
  78  * 4. The names "OpenSSL Toolkit" and "OpenSSL Project" must not be used to
  79  *    endorse or promote products derived from this software without
  80  *    prior written permission. For written permission, please contact
  81  *    openssl-core@openssl.org.
  82  *
  83  * 5. Products derived from this software may not be called "OpenSSL"
  84  *    nor may "OpenSSL" appear in their names without prior written
  85  *    permission of the OpenSSL Project.
  86  *
  87  * 6. Redistributions of any form whatsoever must retain the following
  88  *    acknowledgment:
  89  *    "This product includes software developed by the OpenSSL Project
  90  *    for use in the OpenSSL Toolkit (http://www.openssl.org/)"
  91  *
  92  * THIS SOFTWARE IS PROVIDED BY THE OpenSSL PROJECT ``AS IS'' AND ANY
  93  * EXPRESSED OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
  94  * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
  95  * PURPOSE ARE DISCLAIMED.  IN NO EVENT SHALL THE OpenSSL PROJECT OR
  96  * ITS CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL,
  97  * SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT
  98  * NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES;
  99  * LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION)
 100  * HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT,
 101  * STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE)
 102  * ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED
 103  * OF THE POSSIBILITY OF SUCH DAMAGE.
 104  * ====================================================================
 105  *
 106  * This product includes cryptographic software written by Eric Young
 107  * (eay@cryptsoft.com).  This product includes software written by Tim
 108  * Hudson (tjh@cryptsoft.com).
 109  *
 110  */
 111
 112 #include <stdio.h>
 113 #include <openssl/objects.h>
 114 #include <openssl/evp.h>
 115 #include <openssl/hmac.h>
 116 #include <openssl/ocsp.h>
 117 #include <openssl/rand.h>
 118 #include "ssl_locl.h"
 119
 120 const char tls1_version_str[]="TLSv1" OPENSSL_VERSION_PTEXT;
 121
 122 #ifndef OPENSSL_NO_TLSEXT
 123 static int tls_decrypt_ticket(SSL *s, const unsigned char *tick, int ticklen,
 124                                 const unsigned char *sess_id, int sesslen,
 125                                 SSL_SESSION **psess);
 126 static int ssl_check_clienthello_tlsext(SSL *s);
 127 int ssl_check_serverhello_tlsext(SSL *s);
 128 #endif
 129
 130 SSL3_ENC_METHOD TLSv1_enc_data={
 131         tls1_enc,
 132         tls1_mac,
 133         tls1_setup_key_block,
 134         tls1_generate_master_secret,
 135         tls1_change_cipher_state,
 136         tls1_final_finish_mac,
 137         TLS1_FINISH_MAC_LENGTH,
 138         tls1_cert_verify_mac,
 139         TLS_MD_CLIENT_FINISH_CONST,TLS_MD_CLIENT_FINISH_CONST_SIZE,
 140         TLS_MD_SERVER_FINISH_CONST,TLS_MD_SERVER_FINISH_CONST_SIZE,
 141         tls1_alert_code,
 142         tls1_export_keying_material,
 143         };
 144
 145 long tls1_default_timeout(void)
 146         {
 147         /* 2 hours, the 24 hours mentioned in the TLSv1 spec
 148          * is way too long for http, the cache would over fill */
 149         return(60*60*2);
 150         }
 151
 152 int tls1_new(SSL *s)
 153         {
 154         if (!ssl3_new(s)) return(0);
 155         s->method->ssl_clear(s);
 156         return(1);
 157         }
 158
 159 void tls1_free(SSL *s)
 160         {
 161 #ifndef OPENSSL_NO_TLSEXT
 162         if (s->tlsext_session_ticket)
 163                 {
 164                 OPENSSL_free(s->tlsext_session_ticket);
 165                 }
 166 #endif /* OPENSSL_NO_TLSEXT */
 167         ssl3_free(s);
 168         }
 169
 170 void tls1_clear(SSL *s)
 171         {
 172         ssl3_clear(s);
 173         s->version = s->method->version;
 174         }
 175
 176 #ifndef OPENSSL_NO_EC
 177
 178 static int nid_list[] =
 179         {
 180                 NID_sect163k1, /* sect163k1 (1) */
 181                 NID_sect163r1, /* sect163r1 (2) */
 182                 NID_sect163r2, /* sect163r2 (3) */
 183                 NID_sect193r1, /* sect193r1 (4) */
 184                 NID_sect193r2, /* sect193r2 (5) */
 185                 NID_sect233k1, /* sect233k1 (6) */
 186                 NID_sect233r1, /* sect233r1 (7) */
 187                 NID_sect239k1, /* sect239k1 (8) */
 188                 NID_sect283k1, /* sect283k1 (9) */
 189                 NID_sect283r1, /* sect283r1 (10) */
 190                 NID_sect409k1, /* sect409k1 (11) */
 191                 NID_sect409r1, /* sect409r1 (12) */
 192                 NID_sect571k1, /* sect571k1 (13) */
 193                 NID_sect571r1, /* sect571r1 (14) */
 194                 NID_secp160k1, /* secp160k1 (15) */
 195                 NID_secp160r1, /* secp160r1 (16) */
 196                 NID_secp160r2, /* secp160r2 (17) */
 197                 NID_secp192k1, /* secp192k1 (18) */
 198                 NID_X9_62_prime192v1, /* secp192r1 (19) */
 199                 NID_secp224k1, /* secp224k1 (20) */
 200                 NID_secp224r1, /* secp224r1 (21) */
 201                 NID_secp256k1, /* secp256k1 (22) */
 202                 NID_X9_62_prime256v1, /* secp256r1 (23) */
 203                 NID_secp384r1, /* secp384r1 (24) */
 204                 NID_secp521r1  /* secp521r1 (25) */
 205         };
 206
 207
 208 static const unsigned char ecformats_default[] =
 209         {
 210         TLSEXT_ECPOINTFORMAT_uncompressed,
 211         TLSEXT_ECPOINTFORMAT_ansiX962_compressed_prime,
 212         TLSEXT_ECPOINTFORMAT_ansiX962_compressed_char2
 213         };
 214
 215 static const unsigned char eccurves_default[] =
 216         {
 217                 0,14, /* sect571r1 (14) */
 218                 0,13, /* sect571k1 (13) */
 219                 0,25, /* secp521r1 (25) */
 220                 0,11, /* sect409k1 (11) */
 221                 0,12, /* sect409r1 (12) */
 222                 0,24, /* secp384r1 (24) */
 223                 0,9,  /* sect283k1 (9) */
 224                 0,10, /* sect283r1 (10) */
 225                 0,22, /* secp256k1 (22) */
 226                 0,23, /* secp256r1 (23) */
 227                 0,8,  /* sect239k1 (8) */
 228                 0,6,  /* sect233k1 (6) */
 229                 0,7,  /* sect233r1 (7) */
 230                 0,20, /* secp224k1 (20) */
 231                 0,21, /* secp224r1 (21) */
 232                 0,4,  /* sect193r1 (4) */
 233                 0,5,  /* sect193r2 (5) */
 234                 0,18, /* secp192k1 (18) */
 235                 0,19, /* secp192r1 (19) */
 236                 0,1,  /* sect163k1 (1) */
 237                 0,2,  /* sect163r1 (2) */
 238                 0,3,  /* sect163r2 (3) */
 239                 0,15, /* secp160k1 (15) */
 240                 0,16, /* secp160r1 (16) */
 241                 0,17, /* secp160r2 (17) */
 242         };
 243
 244 int tls1_ec_curve_id2nid(int curve_id)
 245         {
 246         /* ECC curves from draft-ietf-tls-ecc-12.txt (Oct. 17, 2005) */
 247         if ((curve_id < 1) || ((unsigned int)curve_id >
 248                                 sizeof(nid_list)/sizeof(nid_list[0])))
 249                 return 0;
 250         return nid_list[curve_id-1];
 251         }
 252
 253 int tls1_ec_nid2curve_id(int nid)
 254         {
 255         /* ECC curves from draft-ietf-tls-ecc-12.txt (Oct. 17, 2005) */
 256         switch (nid)
 257                 {
 258         case NID_sect163k1: /* sect163k1 (1) */
 259                 return 1;
 260         case NID_sect163r1: /* sect163r1 (2) */
 261                 return 2;
 262         case NID_sect163r2: /* sect163r2 (3) */
 263                 return 3;
 264         case NID_sect193r1: /* sect193r1 (4) */
 265                 return 4;
 266         case NID_sect193r2: /* sect193r2 (5) */
 267                 return 5;
 268         case NID_sect233k1: /* sect233k1 (6) */
 269                 return 6;
 270         case NID_sect233r1: /* sect233r1 (7) */
 271                 return 7;
 272         case NID_sect239k1: /* sect239k1 (8) */
 273                 return 8;
 274         case NID_sect283k1: /* sect283k1 (9) */
 275                 return 9;
 276         case NID_sect283r1: /* sect283r1 (10) */
 277                 return 10;
 278         case NID_sect409k1: /* sect409k1 (11) */
 279                 return 11;
 280         case NID_sect409r1: /* sect409r1 (12) */
 281                 return 12;
 282         case NID_sect571k1: /* sect571k1 (13) */
 283                 return 13;
 284         case NID_sect571r1: /* sect571r1 (14) */
 285                 return 14;
 286         case NID_secp160k1: /* secp160k1 (15) */
 287                 return 15;
 288         case NID_secp160r1: /* secp160r1 (16) */
 289                 return 16;
 290         case NID_secp160r2: /* secp160r2 (17) */
 291                 return 17;
 292         case NID_secp192k1: /* secp192k1 (18) */
 293                 return 18;
 294         case NID_X9_62_prime192v1: /* secp192r1 (19) */
 295                 return 19;
 296         case NID_secp224k1: /* secp224k1 (20) */
 297                 return 20;
 298         case NID_secp224r1: /* secp224r1 (21) */
 299                 return 21;
 300         case NID_secp256k1: /* secp256k1 (22) */
 301                 return 22;
 302         case NID_X9_62_prime256v1: /* secp256r1 (23) */
 303                 return 23;
 304         case NID_secp384r1: /* secp384r1 (24) */
 305                 return 24;
 306         case NID_secp521r1:  /* secp521r1 (25) */
 307                 return 25;
 308         default:
 309                 return 0;
 310                 }
 311         }
 312 /* Get curves list, if "sess" is set return client curves otherwise
 313  * preferred list
 314  */
 315 static void tls1_get_curvelist(SSL *s, int sess,
 316                                         const unsigned char **pcurves,
 317                                         size_t *pcurveslen)
 318         {
 319         if (sess)
 320                 {
 321                 *pcurves = s->session->tlsext_ellipticcurvelist;
 322                 *pcurveslen = s->session->tlsext_ellipticcurvelist_length;
 323                 }
 324         else
 325                 {
 326                 *pcurves = s->tlsext_ellipticcurvelist;
 327                 *pcurveslen = s->tlsext_ellipticcurvelist_length;
 328                 }
 329         /* If not set use default: for now static structure */
 330         if (!*pcurves)
 331                 {
 332                 *pcurves = eccurves_default;
 333                 *pcurveslen = sizeof(eccurves_default);
 334                 }
 335         }
 336 /* Check a curve is one of our preferences */
 337 int tls1_check_curve(SSL *s, const unsigned char *p, size_t len)
 338         {
 339         const unsigned char *curves;
 340         size_t curveslen, i;
 341         if (len != 3 || p[0] != NAMED_CURVE_TYPE)
 342                 return 0;
 343         tls1_get_curvelist(s, 0, &curves, &curveslen);
 344         for (i = 0; i < curveslen; i += 2, curves += 2)
 345                 {
 346                 if (p[1] == curves[0] && p[2] == curves[1])
 347                         return 1;
 348                 }
 349         return 0;
 350         }
 351
 352 /* Return nth shared curve. If nmatch == -1 return number of
 353  * matches.
 354  */
 355
 356 int tls1_shared_curve(SSL *s, int nmatch)
 357         {
 358         const unsigned char *pref, *supp;
 359         size_t preflen, supplen, i, j;
 360         int k;
 361         /* Can't do anything on client side */
 362         if (s->server == 0)
 363                 return -1;
 364         tls1_get_curvelist(s, !!(s->options & SSL_OP_CIPHER_SERVER_PREFERENCE),
 365                                 &supp, &supplen);
 366         tls1_get_curvelist(s, !(s->options & SSL_OP_CIPHER_SERVER_PREFERENCE),
 367                                 &pref, &preflen);
 368         preflen /= 2;
 369         supplen /= 2;
 370         k = 0;
 371         for (i = 0; i < preflen; i++, pref+=2)
 372                 {
 373                 const unsigned char *tsupp = supp;
 374                 for (j = 0; j < supplen; j++, tsupp+=2)
 375                         {
 376                         if (pref[0] == tsupp[0] && pref[1] == tsupp[1])
 377                                 {
 378                                 if (nmatch == k)
 379                                         {
 380                                         int id = (pref[0] << 8) | pref[1];
 381                                         return tls1_ec_curve_id2nid(id);
 382                                         }
 383                                 k++;
 384                                 }
 385                         }
 386                 }
 387         if (nmatch == -1)
 388                 return k;
 389         return 0;
 390         }
 391
 392 int tls1_set_curves(unsigned char **pext, size_t *pextlen,
 393                         int *curves, size_t ncurves)
 394         {
 395         unsigned char *clist, *p;
 396         size_t i;
 397         /* Bitmap of curves included to detect duplicates: only works
 398          * while curve ids < 32
 399          */
 400         unsigned long dup_list = 0;
 401         clist = OPENSSL_malloc(ncurves * 2);
 402         if (!clist)
 403                 return 0;
 404         for (i = 0, p = clist; i < ncurves; i++)
 405                 {
 406                 unsigned long idmask;
 407                 int id;
 408                 id = tls1_ec_nid2curve_id(curves[i]);
 409                 idmask = 1L << id;
 410                 if (!id || (dup_list & idmask))
 411                         {
 412                         OPENSSL_free(clist);
 413                         return 0;
 414                         }
 415                 dup_list |= idmask;
 416                 s2n(id, p);
 417                 }
 418         if (*pext)
 419                 OPENSSL_free(*pext);
 420         *pext = clist;
 421         *pextlen = ncurves * 2;
 422         return 1;
 423         }
 424
 425 #define MAX_CURVELIST   25
 426
 427 typedef struct
 428         {
 429         size_t nidcnt;
 430         int nid_arr[MAX_CURVELIST];
 431         } nid_cb_st;
 432
 433 static int nid_cb(const char *elem, int len, void *arg)
 434         {
 435         nid_cb_st *narg = arg;
 436         size_t i;
 437         int nid;
 438         char etmp[20];
 439         if (narg->nidcnt == MAX_CURVELIST)
 440                 return 0;
 441         if (len > (int)(sizeof(etmp) - 1))
 442                 return 0;
 443         memcpy(etmp, elem, len);
 444         etmp[len] = 0;
 445         nid = EC_curve_nist2nid(etmp);
 446         if (nid == NID_undef)
 447                 nid = OBJ_sn2nid(etmp);
 448         if (nid == NID_undef)
 449                 nid = OBJ_ln2nid(etmp);
 450         if (nid == NID_undef)
 451                 return 0;
 452         for (i = 0; i < narg->nidcnt; i++)
 453                 if (narg->nid_arr[i] == nid)
 454                         return 0;
 455         narg->nid_arr[narg->nidcnt++] = nid;
 456         return 1;
 457         }
 458 /* Set curves based on a colon separate list */
 459 int tls1_set_curves_list(unsigned char **pext, size_t *pextlen,
 460                                 const char *str)
 461         {
 462         nid_cb_st ncb;
 463         ncb.nidcnt = 0;
 464         if (!CONF_parse_list(str, ':', 1, nid_cb, &ncb))
 465                 return 0;
 466         return tls1_set_curves(pext, pextlen, ncb.nid_arr, ncb.nidcnt);
 467         }
 468 /* For an EC key set TLS id and required compression based on parameters */
 469 static int tls1_set_ec_id(unsigned char *curve_id, unsigned char *comp_id,
 470                                 EC_KEY *ec)
 471         {
 472         int is_prime, id;
 473         const EC_GROUP *grp;
 474         const EC_POINT *pt;
 475         const EC_METHOD *meth;
 476         if (!ec)
 477                 return 0;
 478         /* Determine if it is a prime field */
 479         grp = EC_KEY_get0_group(ec);
 480         pt = EC_KEY_get0_public_key(ec);
 481         if (!grp || !pt)
 482                 return 0;
 483         meth = EC_GROUP_method_of(grp);
 484         if (!meth)
 485                 return 0;
 486         if (EC_METHOD_get_field_type(meth) == NID_X9_62_prime_field)
 487                 is_prime = 1;
 488         else
 489                 is_prime = 0;
 490         /* Determine curve ID */
 491         id = EC_GROUP_get_curve_name(grp);
 492         id = tls1_ec_nid2curve_id(id);
 493         /* If we have an ID set it, otherwise set arbitrary explicit curve */
 494         if (id)
 495                 {
 496                 curve_id[0] = 0;
 497                 curve_id[1] = (unsigned char)id;
 498                 }
 499         else
 500                 {
 501                 curve_id[0] = 0xff;
 502                 if (is_prime)
 503                         curve_id[1] = 0x01;
 504                 else
 505                         curve_id[1] = 0x02;
 506                 }
 507         if (comp_id)
 508                 {
 509                 if (EC_KEY_get_conv_form(ec) == POINT_CONVERSION_COMPRESSED)
 510                         {
 511                         if (is_prime)
 512                                 *comp_id = TLSEXT_ECPOINTFORMAT_ansiX962_compressed_prime;
 513                         else
 514                                 *comp_id = TLSEXT_ECPOINTFORMAT_ansiX962_compressed_char2;
 515                         }
 516                 else
 517                         *comp_id = TLSEXT_ECPOINTFORMAT_uncompressed;
 518                 }
 519         return 1;
 520         }
 521 /* Check an EC key is compatible with extensions */
 522 static int tls1_check_ec_key(SSL *s,
 523                         unsigned char *curve_id, unsigned char *comp_id)
 524         {
 525         const unsigned char *p;
 526         size_t plen, i;
 527         int j;
 528         /* If point formats extension present check it, otherwise everything
 529          * is supported (see RFC4492).
 530          */
 531         if (comp_id && s->session->tlsext_ecpointformatlist)
 532                 {
 533                 p = s->session->tlsext_ecpointformatlist;
 534                 plen = s->session->tlsext_ecpointformatlist_length;
 535                 for (i = 0; i < plen; i++, p++)
 536                         {
 537                         if (*comp_id == *p)
 538                                 break;
 539                         }
 540                 if (i == plen)
 541                         return 0;
 542                 }
 543         /* Check curve is consistent with client and server preferences */
 544         for (j = 0; j <= 1; j++)
 545                 {
 546                 tls1_get_curvelist(s, j, &p, &plen);
 547                 for (i = 0; i < plen; i+=2, p+=2)
 548                         {
 549                         if (p[0] == curve_id[0] && p[1] == curve_id[1])
 550                                 break;
 551                         }
 552                 if (i == plen)
 553                         return 0;
 554                 }
 555         return 1;
 556         }
 557
 558 /* Check cert parameters compatible with extensions: currently just checks
 559  * EC certificates have compatible curves and compression.
 560  */
 561 static int tls1_check_cert_param(SSL *s, X509 *x)
 562         {
 563         unsigned char comp_id, curve_id[2];
 564         EVP_PKEY *pkey;
 565         int rv;
 566         pkey = X509_get_pubkey(x);
 567         if (!pkey)
 568                 return 0;
 569         /* If not EC nothing to do */
 570         if (pkey->type != EVP_PKEY_EC)
 571                 {
 572                 EVP_PKEY_free(pkey);
 573                 return 1;
 574                 }
 575         rv = tls1_set_ec_id(curve_id, &comp_id, pkey->pkey.ec);
 576         EVP_PKEY_free(pkey);
 577         if (!rv)
 578                 return 0;
 579         return tls1_check_ec_key(s, curve_id, &comp_id);
 580         }
 581 /* Check EC temporary key is compatible with client extensions */
 582 int tls1_check_ec_tmp_key(SSL *s)
 583         {
 584         unsigned char curve_id[2];
 585         EC_KEY *ec = s->cert->ecdh_tmp;
 586         if (s->cert->ecdh_tmp_auto)
 587                 {
 588                 /* Need a shared curve */
 589                 if (tls1_shared_curve(s, 0))
 590                         return 1;
 591                 else return 0;
 592                 }
 593         if (!ec)
 594                 {
 595                 if (s->cert->ecdh_tmp_cb)
 596                         return 1;
 597                 else
 598                         return 0;
 599                 }
 600         if (!tls1_set_ec_id(curve_id, NULL, ec))
 601                 return 0;
 602 /* Set this to allow use of invalid curves for testing */
 603 #if 0
 604         return 1;
 605 #else
 606         return tls1_check_ec_key(s, curve_id, NULL);
 607 #endif
 608         }
 609
 610 #endif /* OPENSSL_NO_EC */
 611
 612 #ifndef OPENSSL_NO_TLSEXT
 613
 614 /* List of supported signature algorithms and hashes. Should make this
 615  * customisable at some point, for now include everything we support.
 616  */
 617
 618 #ifdef OPENSSL_NO_RSA
 619 #define tlsext_sigalg_rsa(md) /* */
 620 #else
 621 #define tlsext_sigalg_rsa(md) md, TLSEXT_signature_rsa,
 622 #endif
 623
 624 #ifdef OPENSSL_NO_DSA
 625 #define tlsext_sigalg_dsa(md) /* */
 626 #else
 627 #define tlsext_sigalg_dsa(md) md, TLSEXT_signature_dsa,
 628 #endif
 629
 630 #ifdef OPENSSL_NO_ECDSA
 631 #define tlsext_sigalg_ecdsa(md) /* */
 632 #else
 633 #define tlsext_sigalg_ecdsa(md) md, TLSEXT_signature_ecdsa,
 634 #endif
 635
 636 #define tlsext_sigalg(md) \
 637                 tlsext_sigalg_rsa(md) \
 638                 tlsext_sigalg_dsa(md) \
 639                 tlsext_sigalg_ecdsa(md)
 640
 641 static unsigned char tls12_sigalgs[] = {
 642 #ifndef OPENSSL_NO_SHA512
 643         tlsext_sigalg(TLSEXT_hash_sha512)
 644         tlsext_sigalg(TLSEXT_hash_sha384)
 645 #endif
 646 #ifndef OPENSSL_NO_SHA256
 647         tlsext_sigalg(TLSEXT_hash_sha256)
 648         tlsext_sigalg(TLSEXT_hash_sha224)
 649 #endif
 650 #ifndef OPENSSL_NO_SHA
 651         tlsext_sigalg(TLSEXT_hash_sha1)
 652 #endif
 653 #ifndef OPENSSL_NO_MD5
 654         tlsext_sigalg_rsa(TLSEXT_hash_md5)
 655 #endif
 656 };
 657
 658 size_t tls12_get_psigalgs(SSL *s, const unsigned char **psigs)
 659         {
 660         /* If server use client authentication sigalgs if not NULL */
 661         if (s->server && s->cert->client_sigalgs)
 662                 {
 663                 *psigs = s->cert->client_sigalgs;
 664                 return s->cert->client_sigalgslen;
 665                 }
 666         else if (s->cert->conf_sigalgs)
 667                 {
 668                 *psigs = s->cert->conf_sigalgs;
 669                 return s->cert->conf_sigalgslen;
 670                 }
 671         else
 672                 {
 673                 *psigs = tls12_sigalgs;
 674 #ifdef OPENSSL_FIPS
 675                 /* If FIPS mode don't include MD5 which is last */
 676                 if (FIPS_mode())
 677                         return sizeof(tls12_sigalgs) - 2;
 678                 else
 679 #endif
 680                         return sizeof(tls12_sigalgs);
 681                 }
 682         }
 683 /* Check signature algorithm is consistent with sent supported signature
 684  * algorithms and if so return relevant digest.
 685  */
 686 int tls12_check_peer_sigalg(const EVP_MD **pmd, SSL *s,
 687                                 const unsigned char *sig, EVP_PKEY *pkey)
 688         {
 689         const unsigned char *sent_sigs;
 690         size_t sent_sigslen, i;
 691         int sigalg = tls12_get_sigid(pkey);
 692         /* Should never happen */
 693         if (sigalg == -1)
 694                 return -1;
 695         /* Check key type is consistent with signature */
 696         if (sigalg != (int)sig[1])
 697                 {
 698                 SSLerr(SSL_F_TLS12_CHECK_PEER_SIGALG,SSL_R_WRONG_SIGNATURE_TYPE);
 699                 return 0;
 700                 }
 701         /* Check signature matches a type we sent */
 702         sent_sigslen = tls12_get_psigalgs(s, &sent_sigs);
 703         for (i = 0; i < sent_sigslen; i+=2, sent_sigs+=2)
 704                 {
 705                 if (sig[0] == sent_sigs[0] && sig[1] == sent_sigs[1])
 706                         break;
 707                 }
 708         /* Allow fallback to SHA1 if not strict mode */
 709         if (i == sent_sigslen && (sig[0] != TLSEXT_hash_sha1 || s->cert->cert_flags & SSL_CERT_FLAG_TLS_STRICT))
 710                 {
 711                 SSLerr(SSL_F_TLS12_CHECK_PEER_SIGALG,SSL_R_WRONG_SIGNATURE_TYPE);
 712                 return 0;
 713                 }
 714         *pmd = tls12_get_hash(sig[0]);
 715         if (*pmd == NULL)
 716                 {
 717                 SSLerr(SSL_F_TLS12_CHECK_PEER_SIGALG,SSL_R_UNKNOWN_DIGEST);
 718                 return 0;
 719                 }
 720         return 1;
 721         }
 722 /* Get a mask of disabled algorithms: an algorithm is disabled
 723  * if it isn't supported or doesn't appear in supported signature
 724  * algorithms. Unlike ssl_cipher_get_disabled this applies to a specific
 725  * session and not global settings.
 726  *
 727  */
 728 void ssl_set_client_disabled(SSL *s)
 729         {
 730         CERT *c = s->cert;
 731         const unsigned char *sigalgs;
 732         size_t i, sigalgslen;
 733         int have_rsa = 0, have_dsa = 0, have_ecdsa = 0;
 734         c->mask_a = 0;
 735         c->mask_k = 0;
 736         /* If less than TLS 1.2 don't allow TLS 1.2 only ciphers */
 737         if (TLS1_get_version(s) < TLS1_2_VERSION)
 738                 c->mask_ssl = SSL_TLSV1_2;
 739         else
 740                 c->mask_ssl = 0;
 741         /* Now go through all signature algorithms seeing if we support
 742          * any for RSA, DSA, ECDSA. Do this for all versions not just
 743          * TLS 1.2.
 744          */
 745         sigalgslen = tls12_get_psigalgs(s, &sigalgs);
 746         for (i = 0; i < sigalgslen; i += 2, sigalgs += 2)
 747                 {
 748                 switch(sigalgs[1])
 749                         {
 750 #ifndef OPENSSL_NO_RSA
 751                 case TLSEXT_signature_rsa:
 752                         have_rsa = 1;
 753                         break;
 754 #endif
 755 #ifndef OPENSSL_NO_DSA
 756                 case TLSEXT_signature_dsa:
 757                         have_dsa = 1;
 758                         break;
 759 #endif
 760 #ifndef OPENSSL_NO_ECDSA
 761                 case TLSEXT_signature_ecdsa:
 762                         have_ecdsa = 1;
 763                         break;
 764 #endif
 765                         }
 766                 }
 767         /* Disable auth and static DH if we don't include any appropriate
 768          * signature algorithms.
 769          */
 770         if (!have_rsa)
 771                 {
 772                 c->mask_a |= SSL_aRSA;
 773                 c->mask_k |= SSL_kDHr|SSL_kECDHr;
 774                 }
 775         if (!have_dsa)
 776                 {
 777                 c->mask_a |= SSL_aDSS;
 778                 c->mask_k |= SSL_kDHd;
 779                 }
 780         if (!have_ecdsa)
 781                 {
 782                 c->mask_a |= SSL_aECDSA;
 783                 c->mask_k |= SSL_kECDHe;
 784                 }
 785 #ifndef OPENSSL_NO_KRB5
 786         if (!kssl_tgt_is_available(s->kssl_ctx))
 787                 {
 788                 c->mask_a |= SSL_aKRB5;
 789                 c->mask_k |= SSL_kKRB5;
 790                 }
 791 #endif
 792 #ifndef OPENSSL_NO_PSK
 793         /* with PSK there must be client callback set */
 794         if (!s->psk_client_callback)
 795                 {
 796                 c->mask_a |= SSL_aPSK;
 797                 c->mask_k |= SSL_kPSK;
 798                 }
 799 #endif /* OPENSSL_NO_PSK */
 800         c->valid = 1;
 801         }
 802
 803 /* byte_compare is a compare function for qsort(3) that compares bytes. */
 804 static int byte_compare(const void *in_a, const void *in_b)
 805         {
 806         unsigned char a = *((const unsigned char*) in_a);
 807         unsigned char b = *((const unsigned char*) in_b);
 808
 809         if (a > b)
 810                 return 1;
 811         else if (a < b)
 812                 return -1;
 813         return 0;
 814 }
 815
 816 unsigned char *ssl_add_clienthello_tlsext(SSL *s, unsigned char *p, unsigned char *limit)
 817         {
 818         int extdatalen=0;
 819         unsigned char *ret = p;
 820 #ifndef OPENSSL_NO_EC
 821         /* See if we support any ECC ciphersuites */
 822         int using_ecc = 0;
 823         if (s->version != DTLS1_VERSION && s->version >= TLS1_VERSION)
 824                 {
 825                 int i;
 826                 unsigned long alg_k, alg_a;
 827                 STACK_OF(SSL_CIPHER) *cipher_stack = SSL_get_ciphers(s);
 828
 829                 for (i = 0; i < sk_SSL_CIPHER_num(cipher_stack); i++)
 830                         {
 831                         SSL_CIPHER *c = sk_SSL_CIPHER_value(cipher_stack, i);
 832
 833                         alg_k = c->algorithm_mkey;
 834                         alg_a = c->algorithm_auth;
 835                         if ((alg_k & (SSL_kEECDH|SSL_kECDHr|SSL_kECDHe)
 836                                 || (alg_a & SSL_aECDSA)))
 837                                 {
 838                                 using_ecc = 1;
 839                                 break;
 840                                 }
 841                         }
 842                 }
 843 #endif
 844
 845         /* don't add extensions for SSLv3 unless doing secure renegotiation */
 846         if (s->client_version == SSL3_VERSION
 847                                         && !s->s3->send_connection_binding)
 848                 return p;
 849
 850         ret+=2;
 851
 852         if (ret>=limit) return NULL; /* this really never occurs, but ... */
 853
 854         if (s->tlsext_hostname != NULL)
 855                 {
 856                 /* Add TLS extension servername to the Client Hello message */
 857                 unsigned long size_str;
 858                 long lenmax;
 859
 860                 /* check for enough space.
 861                    4 for the servername type and entension length
 862                    2 for servernamelist length
 863                    1 for the hostname type
 864                    2 for hostname length
 865                    + hostname length
 866                 */
 867
 868                 if ((lenmax = limit - ret - 9) < 0
 869                     || (size_str = strlen(s->tlsext_hostname)) > (unsigned long)lenmax)
 870                         return NULL;
 871
 872                 /* extension type and length */
 873                 s2n(TLSEXT_TYPE_server_name,ret);
 874                 s2n(size_str+5,ret);
 875
 876                 /* length of servername list */
 877                 s2n(size_str+3,ret);
 878
 879                 /* hostname type, length and hostname */
 880                 *(ret++) = (unsigned char) TLSEXT_NAMETYPE_host_name;
 881                 s2n(size_str,ret);
 882                 memcpy(ret, s->tlsext_hostname, size_str);
 883                 ret+=size_str;
 884                 }
 885
 886         /* Add RI if renegotiating */
 887         if (s->renegotiate)
 888           {
 889           int el;
 890
 891           if(!ssl_add_clienthello_renegotiate_ext(s, 0, &el, 0))
 892               {
 893               SSLerr(SSL_F_SSL_ADD_CLIENTHELLO_TLSEXT, ERR_R_INTERNAL_ERROR);
 894               return NULL;
 895               }
 896
 897           if((limit - p - 4 - el) < 0) return NULL;
 898
 899           s2n(TLSEXT_TYPE_renegotiate,ret);
 900           s2n(el,ret);
 901
 902           if(!ssl_add_clienthello_renegotiate_ext(s, ret, &el, el))
 903               {
 904               SSLerr(SSL_F_SSL_ADD_CLIENTHELLO_TLSEXT, ERR_R_INTERNAL_ERROR);
 905               return NULL;
 906               }
 907
 908           ret += el;
 909         }
 910
 911 #ifndef OPENSSL_NO_SRP
 912         /* Add SRP username if there is one */
 913         if (s->srp_ctx.login != NULL)
 914                 { /* Add TLS extension SRP username to the Client Hello message */
 915
 916                 int login_len = strlen(s->srp_ctx.login);
 917                 if (login_len > 255 || login_len == 0)
 918                         {
 919                         SSLerr(SSL_F_SSL_ADD_CLIENTHELLO_TLSEXT, ERR_R_INTERNAL_ERROR);
 920                         return NULL;
 921                         }
 922
 923                 /* check for enough space.
 924                    4 for the srp type type and entension length
 925                    1 for the srp user identity
 926                    + srp user identity length
 927                 */
 928                 if ((limit - ret - 5 - login_len) < 0) return NULL;
 929
 930                 /* fill in the extension */
 931                 s2n(TLSEXT_TYPE_srp,ret);
 932                 s2n(login_len+1,ret);
 933                 (*ret++) = (unsigned char) login_len;
 934                 memcpy(ret, s->srp_ctx.login, login_len);
 935                 ret+=login_len;
 936                 }
 937 #endif
 938
 939 #ifndef OPENSSL_NO_EC
 940         if (using_ecc)
 941                 {
 942                 /* Add TLS extension ECPointFormats to the ClientHello message */
 943                 long lenmax;
 944                 const unsigned char *plist;
 945                 size_t plistlen;
 946                 /* If we have a custom point format list use it otherwise
 947                  * use default */
 948                 plist = s->tlsext_ecpointformatlist;
 949                 if (plist)
 950                         plistlen = s->tlsext_ecpointformatlist_length;
 951                 else
 952                         {
 953                         plist = ecformats_default;
 954                         plistlen = sizeof(ecformats_default);
 955                         }
 956
 957                 if ((lenmax = limit - ret - 5) < 0) return NULL;
 958                 if (plistlen > (size_t)lenmax) return NULL;
 959                 if (plistlen > 255)
 960                         {
 961                         SSLerr(SSL_F_SSL_ADD_CLIENTHELLO_TLSEXT, ERR_R_INTERNAL_ERROR);
 962                         return NULL;
 963                         }
 964
 965                 s2n(TLSEXT_TYPE_ec_point_formats,ret);
 966                 s2n(plistlen + 1,ret);
 967                 *(ret++) = (unsigned char)plistlen ;
 968                 memcpy(ret, plist, plistlen);
 969                 ret+=plistlen;
 970
 971                 /* Add TLS extension EllipticCurves to the ClientHello message */
 972                 plist = s->tlsext_ellipticcurvelist;
 973                 tls1_get_curvelist(s, 0, &plist, &plistlen);
 974
 975                 if ((lenmax = limit - ret - 6) < 0) return NULL;
 976                 if (plistlen > (size_t)lenmax) return NULL;
 977                 if (plistlen > 65532)
 978                         {
 979                         SSLerr(SSL_F_SSL_ADD_CLIENTHELLO_TLSEXT, ERR_R_INTERNAL_ERROR);
 980                         return NULL;
 981                         }
 982
 983                 s2n(TLSEXT_TYPE_elliptic_curves,ret);
 984                 s2n(plistlen + 2, ret);
 985
 986                 /* NB: draft-ietf-tls-ecc-12.txt uses a one-byte prefix for
 987                  * elliptic_curve_list, but the examples use two bytes.
 988                  * http://www1.ietf.org/mail-archive/web/tls/current/msg00538.html
 989                  * resolves this to two bytes.
 990                  */
 991                 s2n(plistlen, ret);
 992                 memcpy(ret, plist, plistlen);
 993                 ret+=plistlen;
 994                 }
 995 #endif /* OPENSSL_NO_EC */
 996
 997         if (!(SSL_get_options(s) & SSL_OP_NO_TICKET))
 998                 {
 999                 int ticklen;
1000                 if (!s->new_session && s->session && s->session->tlsext_tick)
1001                         ticklen = s->session->tlsext_ticklen;
1002                 else if (s->session && s->tlsext_session_ticket &&
1003                          s->tlsext_session_ticket->data)
1004                         {
1005                         ticklen = s->tlsext_session_ticket->length;
1006                         s->session->tlsext_tick = OPENSSL_malloc(ticklen);
1007                         if (!s->session->tlsext_tick)
1008                                 return NULL;
1009                         memcpy(s->session->tlsext_tick,
1010                                s->tlsext_session_ticket->data,
1011                                ticklen);
1012                         s->session->tlsext_ticklen = ticklen;
1013                         }
1014                 else
1015                         ticklen = 0;
1016                 if (ticklen == 0 && s->tlsext_session_ticket &&
1017                     s->tlsext_session_ticket->data == NULL)
1018                         goto skip_ext;
1019                 /* Check for enough room 2 for extension type, 2 for len
1020                  * rest for ticket
1021                  */
1022                 if ((long)(limit - ret - 4 - ticklen) < 0) return NULL;
1023                 s2n(TLSEXT_TYPE_session_ticket,ret);
1024                 s2n(ticklen,ret);
1025                 if (ticklen)
1026                         {
1027                         memcpy(ret, s->session->tlsext_tick, ticklen);
1028                         ret += ticklen;
1029                         }
1030                 }
1031                 skip_ext:
1032
1033         if (TLS1_get_client_version(s) >= TLS1_2_VERSION)
1034                 {
1035                 size_t salglen;
1036                 const unsigned char *salg;
1037                 salglen = tls12_get_psigalgs(s, &salg);
1038                 if ((size_t)(limit - ret) < salglen + 6)
1039                         return NULL;
1040                 s2n(TLSEXT_TYPE_signature_algorithms,ret);
1041                 s2n(salglen + 2, ret);
1042                 s2n(salglen, ret);
1043                 memcpy(ret, salg, salglen);
1044                 ret += salglen;
1045                 }
1046
1047 #ifdef TLSEXT_TYPE_opaque_prf_input
1048         if (s->s3->client_opaque_prf_input != NULL &&
1049             s->version != DTLS1_VERSION)
1050                 {
1051                 size_t col = s->s3->client_opaque_prf_input_len;
1052
1053                 if ((long)(limit - ret - 6 - col < 0))
1054                         return NULL;
1055                 if (col > 0xFFFD) /* can't happen */
1056                         return NULL;
1057
1058                 s2n(TLSEXT_TYPE_opaque_prf_input, ret);
1059                 s2n(col + 2, ret);
1060                 s2n(col, ret);
1061                 memcpy(ret, s->s3->client_opaque_prf_input, col);
1062                 ret += col;
1063                 }
1064 #endif
1065
1066         if (s->tlsext_status_type == TLSEXT_STATUSTYPE_ocsp &&
1067             s->version != DTLS1_VERSION)
1068                 {
1069                 int i;
1070                 long extlen, idlen, itmp;
1071                 OCSP_RESPID *id;
1072
1073                 idlen = 0;
1074                 for (i = 0; i < sk_OCSP_RESPID_num(s->tlsext_ocsp_ids); i++)
1075                         {
1076                         id = sk_OCSP_RESPID_value(s->tlsext_ocsp_ids, i);
1077                         itmp = i2d_OCSP_RESPID(id, NULL);
1078                         if (itmp <= 0)
1079                                 return NULL;
1080                         idlen += itmp + 2;
1081                         }
1082
1083                 if (s->tlsext_ocsp_exts)
1084                         {
1085                         extlen = i2d_X509_EXTENSIONS(s->tlsext_ocsp_exts, NULL);
1086                         if (extlen < 0)
1087                                 return NULL;
1088                         }
1089                 else
1090                         extlen = 0;
1091
1092                 if ((long)(limit - ret - 7 - extlen - idlen) < 0) return NULL;
1093                 s2n(TLSEXT_TYPE_status_request, ret);
1094                 if (extlen + idlen > 0xFFF0)
1095                         return NULL;
1096                 s2n(extlen + idlen + 5, ret);
1097                 *(ret++) = TLSEXT_STATUSTYPE_ocsp;
1098                 s2n(idlen, ret);
1099                 for (i = 0; i < sk_OCSP_RESPID_num(s->tlsext_ocsp_ids); i++)
1100                         {
1101                         /* save position of id len */
1102                         unsigned char *q = ret;
1103                         id = sk_OCSP_RESPID_value(s->tlsext_ocsp_ids, i);
1104                         /* skip over id len */
1105                         ret += 2;
1106                         itmp = i2d_OCSP_RESPID(id, &ret);
1107                         /* write id len */
1108                         s2n(itmp, q);
1109                         }
1110                 s2n(extlen, ret);
1111                 if (extlen > 0)
1112                         i2d_X509_EXTENSIONS(s->tlsext_ocsp_exts, &ret);
1113                 }
1114
1115 #ifndef OPENSSL_NO_HEARTBEATS
1116         /* Add Heartbeat extension */
1117         s2n(TLSEXT_TYPE_heartbeat,ret);
1118         s2n(1,ret);
1119         /* Set mode:
1120          * 1: peer may send requests
1121          * 2: peer not allowed to send requests
1122          */
1123         if (s->tlsext_heartbeat & SSL_TLSEXT_HB_DONT_RECV_REQUESTS)
1124                 *(ret++) = SSL_TLSEXT_HB_DONT_SEND_REQUESTS;
1125         else
1126                 *(ret++) = SSL_TLSEXT_HB_ENABLED;
1127 #endif
1128
1129 #ifndef OPENSSL_NO_NEXTPROTONEG
1130         if (s->ctx->next_proto_select_cb && !s->s3->tmp.finish_md_len)
1131                 {
1132                 /* The client advertises an emtpy extension to indicate its
1133                  * support for Next Protocol Negotiation */
1134                 if (limit - ret - 4 < 0)
1135                         return NULL;
1136                 s2n(TLSEXT_TYPE_next_proto_neg,ret);
1137                 s2n(0,ret);
1138                 }
1139 #endif
1140
1141         if(SSL_get_srtp_profiles(s))
1142                 {
1143                 int el;
1144
1145                 ssl_add_clienthello_use_srtp_ext(s, 0, &el, 0);
1146
1147                 if((limit - p - 4 - el) < 0) return NULL;
1148
1149                 s2n(TLSEXT_TYPE_use_srtp,ret);
1150                 s2n(el,ret);
1151
1152                 if(ssl_add_clienthello_use_srtp_ext(s, ret, &el, el))
1153                         {
1154                         SSLerr(SSL_F_SSL_ADD_CLIENTHELLO_TLSEXT, ERR_R_INTERNAL_ERROR);
1155                         return NULL;
1156                         }
1157                 ret += el;
1158                 }
1159
1160         /* Add TLS extension Server_Authz_DataFormats to the ClientHello */
1161         /* 2 bytes for extension type */
1162         /* 2 bytes for extension length */
1163         /* 1 byte for the list length */
1164         /* 1 byte for the list (we only support audit proofs) */
1165         if (s->ctx->tlsext_authz_server_audit_proof_cb != NULL)
1166                 {
1167                 size_t lenmax;
1168                 const unsigned short ext_len = 2;
1169                 const unsigned char list_len = 1;
1170
1171                 if ((lenmax = limit - ret - 6) < 0) return NULL;
1172
1173                 s2n(TLSEXT_TYPE_server_authz, ret);
1174                 /* Extension length: 2 bytes */
1175                 s2n(ext_len, ret);
1176                 *(ret++) = list_len;
1177                 *(ret++) = TLSEXT_AUTHZDATAFORMAT_audit_proof;
1178                 }
1179
1180         if ((extdatalen = ret-p-2) == 0)
1181                 return p;
1182
1183         s2n(extdatalen,p);
1184         return ret;
1185         }
1186
1187 unsigned char *ssl_add_serverhello_tlsext(SSL *s, unsigned char *p, unsigned char *limit)
1188         {
1189         int extdatalen=0;
1190         unsigned char *ret = p;
1191 #ifndef OPENSSL_NO_NEXTPROTONEG
1192         int next_proto_neg_seen;
1193 #endif
1194
1195         /* don't add extensions for SSLv3, unless doing secure renegotiation */
1196         if (s->version == SSL3_VERSION && !s->s3->send_connection_binding)
1197                 return p;
1198
1199         ret+=2;
1200         if (ret>=limit) return NULL; /* this really never occurs, but ... */
1201
1202         if (!s->hit && s->servername_done == 1 && s->session->tlsext_hostname != NULL)
1203                 {
1204                 if ((long)(limit - ret - 4) < 0) return NULL;
1205
1206                 s2n(TLSEXT_TYPE_server_name,ret);
1207                 s2n(0,ret);
1208                 }
1209
1210         if(s->s3->send_connection_binding)
1211         {
1212           int el;
1213
1214           if(!ssl_add_serverhello_renegotiate_ext(s, 0, &el, 0))
1215               {
1216               SSLerr(SSL_F_SSL_ADD_SERVERHELLO_TLSEXT, ERR_R_INTERNAL_ERROR);
1217               return NULL;
1218               }
1219
1220           if((limit - p - 4 - el) < 0) return NULL;
1221
1222           s2n(TLSEXT_TYPE_renegotiate,ret);
1223           s2n(el,ret);
1224
1225           if(!ssl_add_serverhello_renegotiate_ext(s, ret, &el, el))
1226               {
1227               SSLerr(SSL_F_SSL_ADD_SERVERHELLO_TLSEXT, ERR_R_INTERNAL_ERROR);
1228               return NULL;
1229               }
1230
1231           ret += el;
1232         }
1233
1234 #ifndef OPENSSL_NO_EC
1235         if (s->tlsext_ecpointformatlist != NULL &&
1236             s->version != DTLS1_VERSION)
1237                 {
1238                 /* Add TLS extension ECPointFormats to the ServerHello message */
1239                 long lenmax;
1240
1241                 if ((lenmax = limit - ret - 5) < 0) return NULL;
1242                 if (s->tlsext_ecpointformatlist_length > (unsigned long)lenmax) return NULL;
1243                 if (s->tlsext_ecpointformatlist_length > 255)
1244                         {
1245                         SSLerr(SSL_F_SSL_ADD_SERVERHELLO_TLSEXT, ERR_R_INTERNAL_ERROR);
1246                         return NULL;
1247                         }
1248
1249                 s2n(TLSEXT_TYPE_ec_point_formats,ret);
1250                 s2n(s->tlsext_ecpointformatlist_length + 1,ret);
1251                 *(ret++) = (unsigned char) s->tlsext_ecpointformatlist_length;
1252                 memcpy(ret, s->tlsext_ecpointformatlist, s->tlsext_ecpointformatlist_length);
1253                 ret+=s->tlsext_ecpointformatlist_length;
1254
1255                 }
1256         /* Currently the server should not respond with a SupportedCurves extension */
1257 #endif /* OPENSSL_NO_EC */
1258
1259         if (s->tlsext_ticket_expected
1260                 && !(SSL_get_options(s) & SSL_OP_NO_TICKET))
1261                 {
1262                 if ((long)(limit - ret - 4) < 0) return NULL;
1263                 s2n(TLSEXT_TYPE_session_ticket,ret);
1264                 s2n(0,ret);
1265                 }
1266
1267         if (s->tlsext_status_expected)
1268                 {
1269                 if ((long)(limit - ret - 4) < 0) return NULL;
1270                 s2n(TLSEXT_TYPE_status_request,ret);
1271                 s2n(0,ret);
1272                 }
1273
1274 #ifdef TLSEXT_TYPE_opaque_prf_input
1275         if (s->s3->server_opaque_prf_input != NULL &&
1276             s->version != DTLS1_VERSION)
1277                 {
1278                 size_t sol = s->s3->server_opaque_prf_input_len;
1279
1280                 if ((long)(limit - ret - 6 - sol) < 0)
1281                         return NULL;
1282                 if (sol > 0xFFFD) /* can't happen */
1283                         return NULL;
1284
1285                 s2n(TLSEXT_TYPE_opaque_prf_input, ret);
1286                 s2n(sol + 2, ret);
1287                 s2n(sol, ret);
1288                 memcpy(ret, s->s3->server_opaque_prf_input, sol);
1289                 ret += sol;
1290                 }
1291 #endif
1292
1293         if(s->srtp_profile)
1294                 {
1295                 int el;
1296
1297                 ssl_add_serverhello_use_srtp_ext(s, 0, &el, 0);
1298
1299                 if((limit - p - 4 - el) < 0) return NULL;
1300
1301                 s2n(TLSEXT_TYPE_use_srtp,ret);
1302                 s2n(el,ret);
1303
1304                 if(ssl_add_serverhello_use_srtp_ext(s, ret, &el, el))
1305                         {
1306                         SSLerr(SSL_F_SSL_ADD_SERVERHELLO_TLSEXT, ERR_R_INTERNAL_ERROR);
1307                         return NULL;
1308                         }
1309                 ret+=el;
1310                 }
1311
1312         if (((s->s3->tmp.new_cipher->id & 0xFFFF)==0x80 || (s->s3->tmp.new_cipher->id & 0xFFFF)==0x81)
1313                 && (SSL_get_options(s) & SSL_OP_CRYPTOPRO_TLSEXT_BUG))
1314                 { const unsigned char cryptopro_ext[36] = {
1315                         0xfd, 0xe8, /*65000*/
1316                         0x00, 0x20, /*32 bytes length*/
1317                         0x30, 0x1e, 0x30, 0x08, 0x06, 0x06, 0x2a, 0x85,
1318                         0x03,   0x02, 0x02, 0x09, 0x30, 0x08, 0x06, 0x06,
1319                         0x2a, 0x85, 0x03, 0x02, 0x02, 0x16, 0x30, 0x08,
1320                         0x06, 0x06, 0x2a, 0x85, 0x03, 0x02, 0x02, 0x17};
1321                         if (limit-ret<36) return NULL;
1322                         memcpy(ret,cryptopro_ext,36);
1323                         ret+=36;
1324
1325                 }
1326
1327 #ifndef OPENSSL_NO_HEARTBEATS
1328         /* Add Heartbeat extension if we've received one */
1329         if (s->tlsext_heartbeat & SSL_TLSEXT_HB_ENABLED)
1330                 {
1331                 s2n(TLSEXT_TYPE_heartbeat,ret);
1332                 s2n(1,ret);
1333                 /* Set mode:
1334                  * 1: peer may send requests
1335                  * 2: peer not allowed to send requests
1336                  */
1337                 if (s->tlsext_heartbeat & SSL_TLSEXT_HB_DONT_RECV_REQUESTS)
1338                         *(ret++) = SSL_TLSEXT_HB_DONT_SEND_REQUESTS;
1339                 else
1340                         *(ret++) = SSL_TLSEXT_HB_ENABLED;
1341
1342                 }
1343 #endif
1344
1345 #ifndef OPENSSL_NO_NEXTPROTONEG
1346         next_proto_neg_seen = s->s3->next_proto_neg_seen;
1347         s->s3->next_proto_neg_seen = 0;
1348         if (next_proto_neg_seen && s->ctx->next_protos_advertised_cb)
1349                 {
1350                 const unsigned char *npa;
1351                 unsigned int npalen;
1352                 int r;
1353
1354                 r = s->ctx->next_protos_advertised_cb(s, &npa, &npalen, s->ctx->next_protos_advertised_cb_arg);
1355                 if (r == SSL_TLSEXT_ERR_OK)
1356                         {
1357                         if ((long)(limit - ret - 4 - npalen) < 0) return NULL;
1358                         s2n(TLSEXT_TYPE_next_proto_neg,ret);
1359                         s2n(npalen,ret);
1360                         memcpy(ret, npa, npalen);
1361                         ret += npalen;
1362                         s->s3->next_proto_neg_seen = 1;
1363                         }
1364                 }
1365 #endif
1366
1367         /* If the client supports authz then see whether we have any to offer
1368          * to it. */
1369         if (s->s3->tlsext_authz_client_types_len)
1370                 {
1371                 size_t authz_length;
1372                 /* By now we already know the new cipher, so we can look ahead
1373                  * to see whether the cert we are going to send
1374                  * has any authz data attached to it. */
1375                 const unsigned char* authz = ssl_get_authz_data(s, &authz_length);
1376                 const unsigned char* const orig_authz = authz;
1377                 size_t i;
1378                 unsigned authz_count = 0;
1379
1380                 /* The authz data contains a number of the following structures:
1381                  *      uint8_t authz_type
1382                  *      uint16_t length
1383                  *      uint8_t data[length]
1384                  *
1385                  * First we walk over it to find the number of authz elements. */
1386                 for (i = 0; i < authz_length; i++)
1387                         {
1388                         unsigned short length;
1389                         unsigned char type;
1390
1391                         type = *(authz++);
1392                         if (memchr(s->s3->tlsext_authz_client_types,
1393                                    type,
1394                                    s->s3->tlsext_authz_client_types_len) != NULL)
1395                                 authz_count++;
1396
1397                         n2s(authz, length);
1398                         /* n2s increments authz by 2 */
1399                         i += 2;
1400                         authz += length;
1401                         i += length;
1402                         }
1403
1404                 if (authz_count)
1405                         {
1406                         /* Add TLS extension server_authz to the ServerHello message
1407                          * 2 bytes for extension type
1408                          * 2 bytes for extension length
1409                          * 1 byte for the list length
1410                          * n bytes for the list */
1411                         const unsigned short ext_len = 1 + authz_count;
1412
1413                         if ((long)(limit - ret - 4 - ext_len) < 0) return NULL;
1414                         s2n(TLSEXT_TYPE_server_authz, ret);
1415                         s2n(ext_len, ret);
1416                         *(ret++) = authz_count;
1417                         s->s3->tlsext_authz_promised_to_client = 1;
1418                         }
1419
1420                 authz = orig_authz;
1421                 for (i = 0; i < authz_length; i++)
1422                         {
1423                         unsigned short length;
1424                         unsigned char type;
1425
1426                         authz_count++;
1427                         type = *(authz++);
1428                         if (memchr(s->s3->tlsext_authz_client_types,
1429                                    type,
1430                                    s->s3->tlsext_authz_client_types_len) != NULL)
1431                                 *(ret++) = type;
1432                         n2s(authz, length);
1433                         /* n2s increments authz by 2 */
1434                         i += 2;
1435                         authz += length;
1436                         i += length;
1437                         }
1438                 }
1439
1440         if ((extdatalen = ret-p-2)== 0)
1441                 return p;
1442
1443         s2n(extdatalen,p);
1444         return ret;
1445         }
1446
1447 static int ssl_scan_clienthello_tlsext(SSL *s, unsigned char **p, unsigned char *d, int n, int *al)
1448         {
1449         unsigned short type;
1450         unsigned short size;
1451         unsigned short len;
1452         unsigned char *data = *p;
1453         int renegotiate_seen = 0;
1454         size_t i;
1455
1456         s->servername_done = 0;
1457         s->tlsext_status_type = -1;
1458 #ifndef OPENSSL_NO_NEXTPROTONEG
1459         s->s3->next_proto_neg_seen = 0;
1460 #endif
1461
1462 #ifndef OPENSSL_NO_HEARTBEATS
1463         s->tlsext_heartbeat &= ~(SSL_TLSEXT_HB_ENABLED |
1464                                SSL_TLSEXT_HB_DONT_SEND_REQUESTS);
1465 #endif
1466         /* Clear any signature algorithms extension received */
1467         if (s->cert->peer_sigalgs)
1468                 {
1469                 OPENSSL_free(s->cert->peer_sigalgs);
1470                 s->cert->peer_sigalgs = NULL;
1471                 }
1472         /* Clear any shared sigtnature algorithms */
1473         if (s->cert->shared_sigalgs)
1474                 {
1475                 OPENSSL_free(s->cert->shared_sigalgs);
1476                 s->cert->shared_sigalgs = NULL;
1477                 }
1478         /* Clear certificate digests and validity flags */
1479         for (i = 0; i < SSL_PKEY_NUM; i++)
1480                 {
1481                 s->cert->pkeys[i].digest = NULL;
1482                 s->cert->pkeys[i].valid_flags = 0;
1483                 }
1484
1485         if (data >= (d+n-2))
1486                 goto ri_check;
1487         n2s(data,len);
1488
1489         if (data > (d+n-len))
1490                 goto ri_check;
1491
1492         while (data <= (d+n-4))
1493                 {
1494                 n2s(data,type);
1495                 n2s(data,size);
1496
1497                 if (data+size > (d+n))
1498                         goto ri_check;
1499 #if 0
1500                 fprintf(stderr,"Received extension type %d size %d\n",type,size);
1501 #endif
1502                 if (s->tlsext_debug_cb)
1503                         s->tlsext_debug_cb(s, 0, type, data, size,
1504                                                 s->tlsext_debug_arg);
1505 /* The servername extension is treated as follows:
1506
1507    - Only the hostname type is supported with a maximum length of 255.
1508    - The servername is rejected if too long or if it contains zeros,
1509      in which case an fatal alert is generated.
1510    - The servername field is maintained together with the session cache.
1511    - When a session is resumed, the servername call back invoked in order
1512      to allow the application to position itself to the right context.
1513    - The servername is acknowledged if it is new for a session or when
1514      it is identical to a previously used for the same session.
1515      Applications can control the behaviour.  They can at any time
1516      set a 'desirable' servername for a new SSL object. This can be the
1517      case for example with HTTPS when a Host: header field is received and
1518      a renegotiation is requested. In this case, a possible servername
1519      presented in the new client hello is only acknowledged if it matches
1520      the value of the Host: field.
1521    - Applications must  use SSL_OP_NO_SESSION_RESUMPTION_ON_RENEGOTIATION
1522      if they provide for changing an explicit servername context for the session,
1523      i.e. when the session has been established with a servername extension.
1524    - On session reconnect, the servername extension may be absent.
1525
1526 */
1527
1528                 if (type == TLSEXT_TYPE_server_name)
1529                         {
1530                         unsigned char *sdata;
1531                         int servname_type;
1532                         int dsize;
1533
1534                         if (size < 2)
1535                                 {
1536                                 *al = SSL_AD_DECODE_ERROR;
1537                                 return 0;
1538                                 }
1539                         n2s(data,dsize);
1540                         size -= 2;
1541                         if (dsize > size  )
1542                                 {
1543                                 *al = SSL_AD_DECODE_ERROR;
1544                                 return 0;
1545                                 }
1546
1547                         sdata = data;
1548                         while (dsize > 3)
1549                                 {
1550                                 servname_type = *(sdata++);
1551                                 n2s(sdata,len);
1552                                 dsize -= 3;
1553
1554                                 if (len > dsize)
1555                                         {
1556                                         *al = SSL_AD_DECODE_ERROR;
1557                                         return 0;
1558                                         }
1559                                 if (s->servername_done == 0)
1560                                 switch (servname_type)
1561                                         {
1562                                 case TLSEXT_NAMETYPE_host_name:
1563                                         if (!s->hit)
1564                                                 {
1565                                                 if(s->session->tlsext_hostname)
1566                                                         {
1567                                                         *al = SSL_AD_DECODE_ERROR;
1568                                                         return 0;
1569                                                         }
1570                                                 if (len > TLSEXT_MAXLEN_host_name)
1571                                                         {
1572                                                         *al = TLS1_AD_UNRECOGNIZED_NAME;
1573                                                         return 0;
1574                                                         }
1575                                                 if ((s->session->tlsext_hostname = OPENSSL_malloc(len+1)) == NULL)
1576                                                         {
1577                                                         *al = TLS1_AD_INTERNAL_ERROR;
1578                                                         return 0;
1579                                                         }
1580                                                 memcpy(s->session->tlsext_hostname, sdata, len);
1581                                                 s->session->tlsext_hostname[len]='\0';
1582                                                 if (strlen(s->session->tlsext_hostname) != len) {
1583                                                         OPENSSL_free(s->session->tlsext_hostname);
1584                                                         s->session->tlsext_hostname = NULL;
1585                                                         *al = TLS1_AD_UNRECOGNIZED_NAME;
1586                                                         return 0;
1587                                                 }
1588                                                 s->servername_done = 1;
1589
1590                                                 }
1591                                         else
1592                                                 s->servername_done = s->session->tlsext_hostname
1593                                                         && strlen(s->session->tlsext_hostname) == len
1594                                                         && strncmp(s->session->tlsext_hostname, (char *)sdata, len) == 0;
1595
1596                                         break;
1597
1598                                 default:
1599                                         break;
1600                                         }
1601
1602                                 dsize -= len;
1603                                 }
1604                         if (dsize != 0)
1605                                 {
1606                                 *al = SSL_AD_DECODE_ERROR;
1607                                 return 0;
1608                                 }
1609
1610                         }
1611 #ifndef OPENSSL_NO_SRP
1612                 else if (type == TLSEXT_TYPE_srp)
1613                         {
1614                         if (size <= 0 || ((len = data[0])) != (size -1))
1615                                 {
1616                                 *al = SSL_AD_DECODE_ERROR;
1617                                 return 0;
1618                                 }
1619                         if (s->srp_ctx.login != NULL)
1620                                 {
1621                                 *al = SSL_AD_DECODE_ERROR;
1622                                 return 0;
1623                                 }
1624                         if ((s->srp_ctx.login = OPENSSL_malloc(len+1)) == NULL)
1625                                 return -1;
1626                         memcpy(s->srp_ctx.login, &data[1], len);
1627                         s->srp_ctx.login[len]='\0';
1628
1629                         if (strlen(s->srp_ctx.login) != len)
1630                                 {
1631                                 *al = SSL_AD_DECODE_ERROR;
1632                                 return 0;
1633                                 }
1634                         }
1635 #endif
1636
1637 #ifndef OPENSSL_NO_EC
1638                 else if (type == TLSEXT_TYPE_ec_point_formats &&
1639                      s->version != DTLS1_VERSION)
1640                         {
1641                         unsigned char *sdata = data;
1642                         int ecpointformatlist_length = *(sdata++);
1643
1644                         if (ecpointformatlist_length != size - 1)
1645                                 {
1646                                 *al = TLS1_AD_DECODE_ERROR;
1647                                 return 0;
1648                                 }
1649                         if (!s->hit)
1650                                 {
1651                                 if(s->session->tlsext_ecpointformatlist)
1652                                         {
1653                                         OPENSSL_free(s->session->tlsext_ecpointformatlist);
1654                                         s->session->tlsext_ecpointformatlist = NULL;
1655                                         }
1656                                 s->session->tlsext_ecpointformatlist_length = 0;
1657                                 if ((s->session->tlsext_ecpointformatlist = OPENSSL_malloc(ecpointformatlist_length)) == NULL)
1658                                         {
1659                                         *al = TLS1_AD_INTERNAL_ERROR;
1660                                         return 0;
1661                                         }
1662                                 s->session->tlsext_ecpointformatlist_length = ecpointformatlist_length;
1663                                 memcpy(s->session->tlsext_ecpointformatlist, sdata, ecpointformatlist_length);
1664                                 }
1665 #if 0
1666                         fprintf(stderr,"ssl_parse_clienthello_tlsext s->session->tlsext_ecpointformatlist (length=%i) ", s->session->tlsext_ecpointformatlist_length);
1667                         sdata = s->session->tlsext_ecpointformatlist;
1668                         for (i = 0; i < s->session->tlsext_ecpointformatlist_length; i++)
1669                                 fprintf(stderr,"%i ",*(sdata++));
1670                         fprintf(stderr,"\n");
1671 #endif
1672                         }
1673                 else if (type == TLSEXT_TYPE_elliptic_curves &&
1674                      s->version != DTLS1_VERSION)
1675                         {
1676                         unsigned char *sdata = data;
1677                         int ellipticcurvelist_length = (*(sdata++) << 8);
1678                         ellipticcurvelist_length += (*(sdata++));
1679
1680                         if (ellipticcurvelist_length != size - 2)
1681                                 {
1682                                 *al = TLS1_AD_DECODE_ERROR;
1683                                 return 0;
1684                                 }
1685                         if (!s->hit)
1686                                 {
1687                                 if(s->session->tlsext_ellipticcurvelist)
1688                                         {
1689                                         *al = TLS1_AD_DECODE_ERROR;
1690                                         return 0;
1691                                         }
1692                                 s->session->tlsext_ellipticcurvelist_length = 0;
1693                                 if ((s->session->tlsext_ellipticcurvelist = OPENSSL_malloc(ellipticcurvelist_length)) == NULL)
1694                                         {
1695                                         *al = TLS1_AD_INTERNAL_ERROR;
1696                                         return 0;
1697                                         }
1698                                 s->session->tlsext_ellipticcurvelist_length = ellipticcurvelist_length;
1699                                 memcpy(s->session->tlsext_ellipticcurvelist, sdata, ellipticcurvelist_length);
1700                                 }
1701 #if 0
1702                         fprintf(stderr,"ssl_parse_clienthello_tlsext s->session->tlsext_ellipticcurvelist (length=%i) ", s->session->tlsext_ellipticcurvelist_length);
1703                         sdata = s->session->tlsext_ellipticcurvelist;
1704                         for (i = 0; i < s->session->tlsext_ellipticcurvelist_length; i++)
1705                                 fprintf(stderr,"%i ",*(sdata++));
1706                         fprintf(stderr,"\n");
1707 #endif
1708                         }
1709 #endif /* OPENSSL_NO_EC */
1710 #ifdef TLSEXT_TYPE_opaque_prf_input
1711                 else if (type == TLSEXT_TYPE_opaque_prf_input &&
1712                      s->version != DTLS1_VERSION)
1713                         {
1714                         unsigned char *sdata = data;
1715
1716                         if (size < 2)
1717                                 {
1718                                 *al = SSL_AD_DECODE_ERROR;
1719                                 return 0;
1720                                 }
1721                         n2s(sdata, s->s3->client_opaque_prf_input_len);
1722                         if (s->s3->client_opaque_prf_input_len != size - 2)
1723                                 {
1724                                 *al = SSL_AD_DECODE_ERROR;
1725                                 return 0;
1726                                 }
1727
1728                         if (s->s3->client_opaque_prf_input != NULL) /* shouldn't really happen */
1729                                 OPENSSL_free(s->s3->client_opaque_prf_input);
1730                         if (s->s3->client_opaque_prf_input_len == 0)
1731                                 s->s3->client_opaque_prf_input = OPENSSL_malloc(1); /* dummy byte just to get non-NULL */
1732                         else
1733                                 s->s3->client_opaque_prf_input = BUF_memdup(sdata, s->s3->client_opaque_prf_input_len);
1734                         if (s->s3->client_opaque_prf_input == NULL)
1735                                 {
1736                                 *al = TLS1_AD_INTERNAL_ERROR;
1737                                 return 0;
1738                                 }
1739                         }
1740 #endif
1741                 else if (type == TLSEXT_TYPE_session_ticket)
1742                         {
1743                         if (s->tls_session_ticket_ext_cb &&
1744                             !s->tls_session_ticket_ext_cb(s, data, size, s->tls_session_ticket_ext_cb_arg))
1745                                 {
1746                                 *al = TLS1_AD_INTERNAL_ERROR;
1747                                 return 0;
1748                                 }
1749                         }
1750                 else if (type == TLSEXT_TYPE_renegotiate)
1751                         {
1752                         if(!ssl_parse_clienthello_renegotiate_ext(s, data, size, al))
1753                                 return 0;
1754                         renegotiate_seen = 1;
1755                         }
1756                 else if (type == TLSEXT_TYPE_signature_algorithms)
1757                         {
1758                         int dsize;
1759                         if (s->cert->peer_sigalgs || size < 2)
1760                                 {
1761                                 *al = SSL_AD_DECODE_ERROR;
1762                                 return 0;
1763                                 }
1764                         n2s(data,dsize);
1765                         size -= 2;
1766                         if (dsize != size || dsize & 1 || !dsize)
1767                                 {
1768                                 *al = SSL_AD_DECODE_ERROR;
1769                                 return 0;
1770                                 }
1771                         if (!tls1_process_sigalgs(s, data, dsize))
1772                                 {
1773                                 *al = SSL_AD_DECODE_ERROR;
1774                                 return 0;
1775                                 }
1776                         /* If sigalgs received and no shared algorithms fatal
1777                          * error.
1778                          */
1779                         if (s->cert->peer_sigalgs && !s->cert->shared_sigalgs)
1780                                 {
1781                                 SSLerr(SSL_F_SSL_SCAN_CLIENTHELLO_TLSEXT,
1782                                         SSL_R_NO_SHARED_SIGATURE_ALGORITHMS);
1783                                 *al = SSL_AD_ILLEGAL_PARAMETER;
1784                                 return 0;
1785                                 }
1786                         }
1787                 else if (type == TLSEXT_TYPE_status_request &&
1788                          s->version != DTLS1_VERSION && s->ctx->tlsext_status_cb)
1789                         {
1790
1791                         if (size < 5)
1792                                 {
1793                                 *al = SSL_AD_DECODE_ERROR;
1794                                 return 0;
1795                                 }
1796
1797                         s->tlsext_status_type = *data++;
1798                         size--;
1799                         if (s->tlsext_status_type == TLSEXT_STATUSTYPE_ocsp)
1800                                 {
1801                                 const unsigned char *sdata;
1802                                 int dsize;
1803                                 /* Read in responder_id_list */
1804                                 n2s(data,dsize);
1805                                 size -= 2;
1806                                 if (dsize > size  )
1807                                         {
1808                                         *al = SSL_AD_DECODE_ERROR;
1809                                         return 0;
1810                                         }
1811                                 while (dsize > 0)
1812                                         {
1813                                         OCSP_RESPID *id;
1814                                         int idsize;
1815                                         if (dsize < 4)
1816                                                 {
1817                                                 *al = SSL_AD_DECODE_ERROR;
1818                                                 return 0;
1819                                                 }
1820                                         n2s(data, idsize);
1821                                         dsize -= 2 + idsize;
1822                                         size -= 2 + idsize;
1823                                         if (dsize < 0)
1824                                                 {
1825                                                 *al = SSL_AD_DECODE_ERROR;
1826                                                 return 0;
1827                                                 }
1828                                         sdata = data;
1829                                         data += idsize;
1830                                         id = d2i_OCSP_RESPID(NULL,
1831                                                                 &sdata, idsize);
1832                                         if (!id)
1833                                                 {
1834                                                 *al = SSL_AD_DECODE_ERROR;
1835                                                 return 0;
1836                                                 }
1837                                         if (data != sdata)
1838                                                 {
1839                                                 OCSP_RESPID_free(id);
1840                                                 *al = SSL_AD_DECODE_ERROR;
1841                                                 return 0;
1842                                                 }
1843                                         if (!s->tlsext_ocsp_ids
1844                                                 && !(s->tlsext_ocsp_ids =
1845                                                 sk_OCSP_RESPID_new_null()))
1846                                                 {
1847                                                 OCSP_RESPID_free(id);
1848                                                 *al = SSL_AD_INTERNAL_ERROR;
1849                                                 return 0;
1850                                                 }
1851                                         if (!sk_OCSP_RESPID_push(
1852                                                         s->tlsext_ocsp_ids, id))
1853                                                 {
1854                                                 OCSP_RESPID_free(id);
1855                                                 *al = SSL_AD_INTERNAL_ERROR;
1856                                                 return 0;
1857                                                 }
1858                                         }
1859
1860                                 /* Read in request_extensions */
1861                                 if (size < 2)
1862                                         {
1863                                         *al = SSL_AD_DECODE_ERROR;
1864                                         return 0;
1865                                         }
1866                                 n2s(data,dsize);
1867                                 size -= 2;
1868                                 if (dsize != size)
1869                                         {
1870                                         *al = SSL_AD_DECODE_ERROR;
1871                                         return 0;
1872                                         }
1873                                 sdata = data;
1874                                 if (dsize > 0)
1875                                         {
1876                                         if (s->tlsext_ocsp_exts)
1877                                                 {
1878                                                 sk_X509_EXTENSION_pop_free(s->tlsext_ocsp_exts,
1879                                                                            X509_EXTENSION_free);
1880                                                 }
1881
1882                                         s->tlsext_ocsp_exts =
1883                                                 d2i_X509_EXTENSIONS(NULL,
1884                                                         &sdata, dsize);
1885                                         if (!s->tlsext_ocsp_exts
1886                                                 || (data + dsize != sdata))
1887                                                 {
1888                                                 *al = SSL_AD_DECODE_ERROR;
1889                                                 return 0;
1890                                                 }
1891                                         }
1892                                 }
1893                                 /* We don't know what to do with any other type
1894                                 * so ignore it.
1895                                 */
1896                                 else
1897                                         s->tlsext_status_type = -1;
1898                         }
1899 #ifndef OPENSSL_NO_HEARTBEATS
1900                 else if (type == TLSEXT_TYPE_heartbeat)
1901                         {
1902                         switch(data[0])
1903                                 {
1904                                 case 0x01:      /* Client allows us to send HB requests */
1905                                                         s->tlsext_heartbeat |= SSL_TLSEXT_HB_ENABLED;
1906                                                         break;
1907                                 case 0x02:      /* Client doesn't accept HB requests */
1908                                                         s->tlsext_heartbeat |= SSL_TLSEXT_HB_ENABLED;
1909                                                         s->tlsext_heartbeat |= SSL_TLSEXT_HB_DONT_SEND_REQUESTS;
1910                                                         break;
1911                                 default:        *al = SSL_AD_ILLEGAL_PARAMETER;
1912                                                         return 0;
1913                                 }
1914                         }
1915 #endif
1916 #ifndef OPENSSL_NO_NEXTPROTONEG
1917                 else if (type == TLSEXT_TYPE_next_proto_neg &&
1918                          s->s3->tmp.finish_md_len == 0)
1919                         {
1920                         /* We shouldn't accept this extension on a
1921                          * renegotiation.
1922                          *
1923                          * s->new_session will be set on renegotiation, but we
1924                          * probably shouldn't rely that it couldn't be set on
1925                          * the initial renegotation too in certain cases (when
1926                          * there's some other reason to disallow resuming an
1927                          * earlier session -- the current code won't be doing
1928                          * anything like that, but this might change).
1929
1930                          * A valid sign that there's been a previous handshake
1931                          * in this connection is if s->s3->tmp.finish_md_len >
1932                          * 0.  (We are talking about a check that will happen
1933                          * in the Hello protocol round, well before a new
1934                          * Finished message could have been computed.) */
1935                         s->s3->next_proto_neg_seen = 1;
1936                         }
1937 #endif
1938
1939                 /* session ticket processed earlier */
1940                 else if (type == TLSEXT_TYPE_use_srtp)
1941                         {
1942                         if(ssl_parse_clienthello_use_srtp_ext(s, data, size,
1943                                                               al))
1944                                 return 0;
1945                         }
1946
1947                 else if (type == TLSEXT_TYPE_server_authz)
1948                         {
1949                         unsigned char *sdata = data;
1950                         unsigned char server_authz_dataformatlist_length;
1951
1952                         if (size == 0)
1953                                 {
1954                                 *al = TLS1_AD_DECODE_ERROR;
1955                                 return 0;
1956                                 }
1957
1958                         server_authz_dataformatlist_length = *(sdata++);
1959
1960                         if (server_authz_dataformatlist_length != size - 1)
1961                                 {
1962                                 *al = TLS1_AD_DECODE_ERROR;
1963                                 return 0;
1964                                 }
1965
1966                         /* Successful session resumption uses the same authz
1967                          * information as the original session so we ignore this
1968                          * in the case of a session resumption. */
1969                         if (!s->hit)
1970                                 {
1971                                 if (s->s3->tlsext_authz_client_types != NULL)
1972                                         OPENSSL_free(s->s3->tlsext_authz_client_types);
1973                                 s->s3->tlsext_authz_client_types =
1974                                         OPENSSL_malloc(server_authz_dataformatlist_length);
1975                                 if (!s->s3->tlsext_authz_client_types)
1976                                         {
1977                                         *al = TLS1_AD_INTERNAL_ERROR;
1978                                         return 0;
1979                                         }
1980
1981                                 s->s3->tlsext_authz_client_types_len =
1982                                         server_authz_dataformatlist_length;
1983                                 memcpy(s->s3->tlsext_authz_client_types,
1984                                        sdata,
1985                                        server_authz_dataformatlist_length);
1986
1987                                 /* Sort the types in order to check for duplicates. */
1988                                 qsort(s->s3->tlsext_authz_client_types,
1989                                       server_authz_dataformatlist_length,
1990                                       1 /* element size */,
1991                                       byte_compare);
1992
1993                                 for (i = 0; i < server_authz_dataformatlist_length; i++)
1994                                         {
1995                                         if (i > 0 &&
1996                                             s->s3->tlsext_authz_client_types[i] ==
1997                                               s->s3->tlsext_authz_client_types[i-1])
1998                                                 {
1999                                                 *al = TLS1_AD_DECODE_ERROR;
2000                                                 return 0;
2001                                                 }
2002                                         }
2003                                 }
2004                         }
2005
2006                 data+=size;
2007                 }
2008
2009         *p = data;
2010
2011         ri_check:
2012
2013         /* Need RI if renegotiating */
2014
2015         if (!renegotiate_seen && s->renegotiate &&
2016                 !(s->options & SSL_OP_ALLOW_UNSAFE_LEGACY_RENEGOTIATION))
2017                 {
2018                 *al = SSL_AD_HANDSHAKE_FAILURE;
2019                 SSLerr(SSL_F_SSL_SCAN_CLIENTHELLO_TLSEXT,
2020                                 SSL_R_UNSAFE_LEGACY_RENEGOTIATION_DISABLED);
2021                 return 0;
2022                 }
2023         /* If no signature algorithms extension set default values */
2024         if (!s->cert->peer_sigalgs)
2025                 ssl_cert_set_default_md(s->cert);
2026
2027         return 1;
2028         }
2029
2030 int ssl_parse_clienthello_tlsext(SSL *s, unsigned char **p, unsigned char *d, int n)
2031         {
2032         int al = -1;
2033         if (ssl_scan_clienthello_tlsext(s, p, d, n, &al) <= 0)
2034                 {
2035                 ssl3_send_alert(s,SSL3_AL_FATAL,al);
2036                 return 0;
2037                 }
2038
2039         if (ssl_check_clienthello_tlsext(s) <= 0)
2040                 {
2041                 SSLerr(SSL_F_SSL_PARSE_CLIENTHELLO_TLSEXT,SSL_R_CLIENTHELLO_TLSEXT);
2042                 return 0;
2043                 }
2044         return 1;
2045 }
2046
2047 #ifndef OPENSSL_NO_NEXTPROTONEG
2048 /* ssl_next_proto_validate validates a Next Protocol Negotiation block. No
2049  * elements of zero length are allowed and the set of elements must exactly fill
2050  * the length of the block. */
2051 static char ssl_next_proto_validate(unsigned char *d, unsigned len)
2052         {
2053         unsigned int off = 0;
2054
2055         while (off < len)
2056                 {
2057                 if (d[off] == 0)
2058                         return 0;
2059                 off += d[off];
2060                 off++;
2061                 }
2062
2063         return off == len;
2064         }
2065 #endif
2066
2067 static int ssl_scan_serverhello_tlsext(SSL *s, unsigned char **p, unsigned char *d, int n, int *al)
2068         {
2069         unsigned short length;
2070         unsigned short type;
2071         unsigned short size;
2072         unsigned char *data = *p;
2073         int tlsext_servername = 0;
2074         int renegotiate_seen = 0;
2075
2076 #ifndef OPENSSL_NO_NEXTPROTONEG
2077         s->s3->next_proto_neg_seen = 0;
2078 #endif
2079
2080 #ifndef OPENSSL_NO_HEARTBEATS
2081         s->tlsext_heartbeat &= ~(SSL_TLSEXT_HB_ENABLED |
2082                                SSL_TLSEXT_HB_DONT_SEND_REQUESTS);
2083 #endif
2084
2085         if (data >= (d+n-2))
2086                 goto ri_check;
2087
2088         n2s(data,length);
2089         if (data+length != d+n)
2090                 {
2091                 *al = SSL_AD_DECODE_ERROR;
2092                 return 0;
2093                 }
2094
2095         while(data <= (d+n-4))
2096                 {
2097                 n2s(data,type);
2098                 n2s(data,size);
2099
2100                 if (data+size > (d+n))
2101                         goto ri_check;
2102
2103                 if (s->tlsext_debug_cb)
2104                         s->tlsext_debug_cb(s, 1, type, data, size,
2105                                                 s->tlsext_debug_arg);
2106
2107                 if (type == TLSEXT_TYPE_server_name)
2108                         {
2109                         if (s->tlsext_hostname == NULL || size > 0)
2110                                 {
2111                                 *al = TLS1_AD_UNRECOGNIZED_NAME;
2112                                 return 0;
2113                                 }
2114                         tlsext_servername = 1;
2115                         }
2116
2117 #ifndef OPENSSL_NO_EC
2118                 else if (type == TLSEXT_TYPE_ec_point_formats &&
2119                      s->version != DTLS1_VERSION)
2120                         {
2121                         unsigned char *sdata = data;
2122                         int ecpointformatlist_length = *(sdata++);
2123
2124                         if (ecpointformatlist_length != size - 1)
2125                                 {
2126                                 *al = TLS1_AD_DECODE_ERROR;
2127                                 return 0;
2128                                 }
2129                         s->session->tlsext_ecpointformatlist_length = 0;
2130                         if (s->session->tlsext_ecpointformatlist != NULL) OPENSSL_free(s->session->tlsext_ecpointformatlist);
2131                         if ((s->session->tlsext_ecpointformatlist = OPENSSL_malloc(ecpointformatlist_length)) == NULL)
2132                                 {
2133                                 *al = TLS1_AD_INTERNAL_ERROR;
2134                                 return 0;
2135                                 }
2136                         s->session->tlsext_ecpointformatlist_length = ecpointformatlist_length;
2137                         memcpy(s->session->tlsext_ecpointformatlist, sdata, ecpointformatlist_length);
2138 #if 0
2139                         fprintf(stderr,"ssl_parse_serverhello_tlsext s->session->tlsext_ecpointformatlist ");
2140                         sdata = s->session->tlsext_ecpointformatlist;
2141                         for (i = 0; i < s->session->tlsext_ecpointformatlist_length; i++)
2142                                 fprintf(stderr,"%i ",*(sdata++));
2143                         fprintf(stderr,"\n");
2144 #endif
2145                         }
2146 #endif /* OPENSSL_NO_EC */
2147
2148                 else if (type == TLSEXT_TYPE_session_ticket)
2149                         {
2150                         if (s->tls_session_ticket_ext_cb &&
2151                             !s->tls_session_ticket_ext_cb(s, data, size, s->tls_session_ticket_ext_cb_arg))
2152                                 {
2153                                 *al = TLS1_AD_INTERNAL_ERROR;
2154                                 return 0;
2155                                 }
2156                         if ((SSL_get_options(s) & SSL_OP_NO_TICKET)
2157                                 || (size > 0))
2158                                 {
2159                                 *al = TLS1_AD_UNSUPPORTED_EXTENSION;
2160                                 return 0;
2161                                 }
2162                         s->tlsext_ticket_expected = 1;
2163                         }
2164 #ifdef TLSEXT_TYPE_opaque_prf_input
2165                 else if (type == TLSEXT_TYPE_opaque_prf_input &&
2166                      s->version != DTLS1_VERSION)
2167                         {
2168                         unsigned char *sdata = data;
2169
2170                         if (size < 2)
2171                                 {
2172                                 *al = SSL_AD_DECODE_ERROR;
2173                                 return 0;
2174                                 }
2175                         n2s(sdata, s->s3->server_opaque_prf_input_len);
2176                         if (s->s3->server_opaque_prf_input_len != size - 2)
2177                                 {
2178                                 *al = SSL_AD_DECODE_ERROR;
2179                                 return 0;
2180                                 }
2181
2182                         if (s->s3->server_opaque_prf_input != NULL) /* shouldn't really happen */
2183                                 OPENSSL_free(s->s3->server_opaque_prf_input);
2184                         if (s->s3->server_opaque_prf_input_len == 0)
2185                                 s->s3->server_opaque_prf_input = OPENSSL_malloc(1); /* dummy byte just to get non-NULL */
2186                         else
2187                                 s->s3->server_opaque_prf_input = BUF_memdup(sdata, s->s3->server_opaque_prf_input_len);
2188
2189                         if (s->s3->server_opaque_prf_input == NULL)
2190                                 {
2191                                 *al = TLS1_AD_INTERNAL_ERROR;
2192                                 return 0;
2193                                 }
2194                         }
2195 #endif
2196                 else if (type == TLSEXT_TYPE_status_request &&
2197                          s->version != DTLS1_VERSION)
2198                         {
2199                         /* MUST be empty and only sent if we've requested
2200                          * a status request message.
2201                          */
2202                         if ((s->tlsext_status_type == -1) || (size > 0))
2203                                 {
2204                                 *al = TLS1_AD_UNSUPPORTED_EXTENSION;
2205                                 return 0;
2206                                 }
2207                         /* Set flag to expect CertificateStatus message */
2208                         s->tlsext_status_expected = 1;
2209                         }
2210 #ifndef OPENSSL_NO_NEXTPROTONEG
2211                 else if (type == TLSEXT_TYPE_next_proto_neg &&
2212                          s->s3->tmp.finish_md_len == 0)
2213                         {
2214                         unsigned char *selected;
2215                         unsigned char selected_len;
2216
2217                         /* We must have requested it. */
2218                         if ((s->ctx->next_proto_select_cb == NULL))
2219                                 {
2220                                 *al = TLS1_AD_UNSUPPORTED_EXTENSION;
2221                                 return 0;
2222                                 }
2223                         /* The data must be valid */
2224                         if (!ssl_next_proto_validate(data, size))
2225                                 {
2226                                 *al = TLS1_AD_DECODE_ERROR;
2227                                 return 0;
2228                                 }
2229                         if (s->ctx->next_proto_select_cb(s, &selected, &selected_len, data, size, s->ctx->next_proto_select_cb_arg) != SSL_TLSEXT_ERR_OK)
2230                                 {
2231                                 *al = TLS1_AD_INTERNAL_ERROR;
2232                                 return 0;
2233                                 }
2234                         s->next_proto_negotiated = OPENSSL_malloc(selected_len);
2235                         if (!s->next_proto_negotiated)
2236                                 {
2237                                 *al = TLS1_AD_INTERNAL_ERROR;
2238                                 return 0;
2239                                 }
2240                         memcpy(s->next_proto_negotiated, selected, selected_len);
2241                         s->next_proto_negotiated_len = selected_len;
2242                         s->s3->next_proto_neg_seen = 1;
2243                         }
2244 #endif
2245                 else if (type == TLSEXT_TYPE_renegotiate)
2246                         {
2247                         if(!ssl_parse_serverhello_renegotiate_ext(s, data, size, al))
2248                                 return 0;
2249                         renegotiate_seen = 1;
2250                         }
2251 #ifndef OPENSSL_NO_HEARTBEATS
2252                 else if (type == TLSEXT_TYPE_heartbeat)
2253                         {
2254                         switch(data[0])
2255                                 {
2256                                 case 0x01:      /* Server allows us to send HB requests */
2257                                                         s->tlsext_heartbeat |= SSL_TLSEXT_HB_ENABLED;
2258                                                         break;
2259                                 case 0x02:      /* Server doesn't accept HB requests */
2260                                                         s->tlsext_heartbeat |= SSL_TLSEXT_HB_ENABLED;
2261                                                         s->tlsext_heartbeat |= SSL_TLSEXT_HB_DONT_SEND_REQUESTS;
2262                                                         break;
2263                                 default:        *al = SSL_AD_ILLEGAL_PARAMETER;
2264                                                         return 0;
2265                                 }
2266                         }
2267 #endif
2268                 else if (type == TLSEXT_TYPE_use_srtp)
2269                         {
2270                         if(ssl_parse_serverhello_use_srtp_ext(s, data, size,
2271                                                               al))
2272                                 return 0;
2273                         }
2274
2275                 else if (type == TLSEXT_TYPE_server_authz)
2276                         {
2277                         /* We only support audit proofs. It's an error to send
2278                          * an authz hello extension if the client
2279                          * didn't request a proof. */
2280                         unsigned char *sdata = data;
2281                         unsigned char server_authz_dataformatlist_length;
2282
2283                         if (!s->ctx->tlsext_authz_server_audit_proof_cb)
2284                                 {
2285                                 *al = TLS1_AD_UNSUPPORTED_EXTENSION;
2286                                 return 0;
2287                                 }
2288
2289                         if (!size)
2290                                 {
2291                                 *al = TLS1_AD_DECODE_ERROR;
2292                                 return 0;
2293                                 }
2294
2295                         server_authz_dataformatlist_length = *(sdata++);
2296                         if (server_authz_dataformatlist_length != size - 1)
2297                                 {
2298                                 *al = TLS1_AD_DECODE_ERROR;
2299                                 return 0;
2300                                 }
2301
2302                         /* We only support audit proofs, so a legal ServerHello
2303                          * authz list contains exactly one entry. */
2304                         if (server_authz_dataformatlist_length != 1 ||
2305                                 sdata[0] != TLSEXT_AUTHZDATAFORMAT_audit_proof)
2306                                 {
2307                                 *al = TLS1_AD_UNSUPPORTED_EXTENSION;
2308                                 return 0;
2309                                 }
2310
2311                         s->s3->tlsext_authz_server_promised = 1;
2312                         }
2313
2314                 data += size;
2315                 }
2316
2317         if (data != d+n)
2318                 {
2319                 *al = SSL_AD_DECODE_ERROR;
2320                 return 0;
2321                 }
2322
2323         if (!s->hit && tlsext_servername == 1)
2324                 {
2325                 if (s->tlsext_hostname)
2326                         {
2327                         if (s->session->tlsext_hostname == NULL)
2328                                 {
2329                                 s->session->tlsext_hostname = BUF_strdup(s->tlsext_hostname);
2330                                 if (!s->session->tlsext_hostname)
2331                                         {
2332                                         *al = SSL_AD_UNRECOGNIZED_NAME;
2333                                         return 0;
2334                                         }
2335                                 }
2336                         else
2337                                 {
2338                                 *al = SSL_AD_DECODE_ERROR;
2339                                 return 0;
2340                                 }
2341                         }
2342                 }
2343
2344         *p = data;
2345
2346         ri_check:
2347
2348         /* Determine if we need to see RI. Strictly speaking if we want to
2349          * avoid an attack we should *always* see RI even on initial server
2350          * hello because the client doesn't see any renegotiation during an
2351          * attack. However this would mean we could not connect to any server
2352          * which doesn't support RI so for the immediate future tolerate RI
2353          * absence on initial connect only.
2354          */
2355         if (!renegotiate_seen
2356                 && !(s->options & SSL_OP_LEGACY_SERVER_CONNECT)
2357                 && !(s->options & SSL_OP_ALLOW_UNSAFE_LEGACY_RENEGOTIATION))
2358                 {
2359                 *al = SSL_AD_HANDSHAKE_FAILURE;
2360                 SSLerr(SSL_F_SSL_SCAN_SERVERHELLO_TLSEXT,
2361                                 SSL_R_UNSAFE_LEGACY_RENEGOTIATION_DISABLED);
2362                 return 0;
2363                 }
2364
2365         return 1;
2366         }
2367
2368
2369 int ssl_prepare_clienthello_tlsext(SSL *s)
2370         {
2371
2372 #ifdef TLSEXT_TYPE_opaque_prf_input
2373         {
2374                 int r = 1;
2375
2376                 if (s->ctx->tlsext_opaque_prf_input_callback != 0)
2377                         {
2378                         r = s->ctx->tlsext_opaque_prf_input_callback(s, NULL, 0, s->ctx->tlsext_opaque_prf_input_callback_arg);
2379                         if (!r)
2380                                 return -1;
2381                         }
2382
2383                 if (s->tlsext_opaque_prf_input != NULL)
2384                         {
2385                         if (s->s3->client_opaque_prf_input != NULL) /* shouldn't really happen */
2386                                 OPENSSL_free(s->s3->client_opaque_prf_input);
2387
2388                         if (s->tlsext_opaque_prf_input_len == 0)
2389                                 s->s3->client_opaque_prf_input = OPENSSL_malloc(1); /* dummy byte just to get non-NULL */
2390                         else
2391                                 s->s3->client_opaque_prf_input = BUF_memdup(s->tlsext_opaque_prf_input, s->tlsext_opaque_prf_input_len);
2392                         if (s->s3->client_opaque_prf_input == NULL)
2393                                 {
2394                                 SSLerr(SSL_F_SSL_PREPARE_CLIENTHELLO_TLSEXT,ERR_R_MALLOC_FAILURE);
2395                                 return -1;
2396                                 }
2397                         s->s3->client_opaque_prf_input_len = s->tlsext_opaque_prf_input_len;
2398                         }
2399
2400                 if (r == 2)
2401                         /* at callback's request, insist on receiving an appropriate server opaque PRF input */
2402                         s->s3->server_opaque_prf_input_len = s->tlsext_opaque_prf_input_len;
2403         }
2404 #endif
2405
2406         return 1;
2407         }
2408
2409 int ssl_prepare_serverhello_tlsext(SSL *s)
2410         {
2411 #ifndef OPENSSL_NO_EC
2412         /* If we are server and using an ECC cipher suite, send the point formats we support
2413          * if the client sent us an ECPointsFormat extension.  Note that the server is not
2414          * supposed to send an EllipticCurves extension.
2415          */
2416
2417         unsigned long alg_k = s->s3->tmp.new_cipher->algorithm_mkey;
2418         unsigned long alg_a = s->s3->tmp.new_cipher->algorithm_auth;
2419         int using_ecc = (alg_k & (SSL_kEECDH|SSL_kECDHr|SSL_kECDHe)) || (alg_a & SSL_aECDSA);
2420         using_ecc = using_ecc && (s->session->tlsext_ecpointformatlist != NULL);
2421
2422         if (using_ecc)
2423                 {
2424                 if (s->tlsext_ecpointformatlist != NULL) OPENSSL_free(s->tlsext_ecpointformatlist);
2425                 if ((s->tlsext_ecpointformatlist = OPENSSL_malloc(3)) == NULL)
2426                         {
2427                         SSLerr(SSL_F_SSL_PREPARE_SERVERHELLO_TLSEXT,ERR_R_MALLOC_FAILURE);
2428                         return -1;
2429                         }
2430                 s->tlsext_ecpointformatlist_length = 3;
2431                 s->tlsext_ecpointformatlist[0] = TLSEXT_ECPOINTFORMAT_uncompressed;
2432                 s->tlsext_ecpointformatlist[1] = TLSEXT_ECPOINTFORMAT_ansiX962_compressed_prime;
2433                 s->tlsext_ecpointformatlist[2] = TLSEXT_ECPOINTFORMAT_ansiX962_compressed_char2;
2434                 }
2435 #endif /* OPENSSL_NO_EC */
2436
2437         return 1;
2438         }
2439
2440 static int ssl_check_clienthello_tlsext(SSL *s)
2441         {
2442         int ret=SSL_TLSEXT_ERR_NOACK;
2443         int al = SSL_AD_UNRECOGNIZED_NAME;
2444
2445 #ifndef OPENSSL_NO_EC
2446         /* The handling of the ECPointFormats extension is done elsewhere, namely in
2447          * ssl3_choose_cipher in s3_lib.c.
2448          */
2449         /* The handling of the EllipticCurves extension is done elsewhere, namely in
2450          * ssl3_choose_cipher in s3_lib.c.
2451          */
2452 #endif
2453
2454         if (s->ctx != NULL && s->ctx->tlsext_servername_callback != 0)
2455                 ret = s->ctx->tlsext_servername_callback(s, &al, s->ctx->tlsext_servername_arg);
2456         else if (s->initial_ctx != NULL && s->initial_ctx->tlsext_servername_callback != 0)
2457                 ret = s->initial_ctx->tlsext_servername_callback(s, &al, s->initial_ctx->tlsext_servername_arg);
2458
2459         /* If status request then ask callback what to do.
2460          * Note: this must be called after servername callbacks in case
2461          * the certificate has changed.
2462          */
2463         if ((s->tlsext_status_type != -1) && s->ctx && s->ctx->tlsext_status_cb)
2464                 {
2465                 int r;
2466                 r = s->ctx->tlsext_status_cb(s, s->ctx->tlsext_status_arg);
2467                 switch (r)
2468                         {
2469                         /* We don't want to send a status request response */
2470                         case SSL_TLSEXT_ERR_NOACK:
2471                                 s->tlsext_status_expected = 0;
2472                                 break;
2473                         /* status request response should be sent */
2474                         case SSL_TLSEXT_ERR_OK:
2475                                 if (s->tlsext_ocsp_resp)
2476                                         s->tlsext_status_expected = 1;
2477                                 else
2478                                         s->tlsext_status_expected = 0;
2479                                 break;
2480                         /* something bad happened */
2481                         case SSL_TLSEXT_ERR_ALERT_FATAL:
2482                                 ret = SSL_TLSEXT_ERR_ALERT_FATAL;
2483                                 al = SSL_AD_INTERNAL_ERROR;
2484                                 goto err;
2485                         }
2486                 }
2487         else
2488                 s->tlsext_status_expected = 0;
2489
2490 #ifdef TLSEXT_TYPE_opaque_prf_input
2491         {
2492                 /* This sort of belongs into ssl_prepare_serverhello_tlsext(),
2493                  * but we might be sending an alert in response to the client hello,
2494                  * so this has to happen here in ssl_check_clienthello_tlsext(). */
2495
2496                 int r = 1;
2497
2498                 if (s->ctx->tlsext_opaque_prf_input_callback != 0)
2499                         {
2500                         r = s->ctx->tlsext_opaque_prf_input_callback(s, NULL, 0, s->ctx->tlsext_opaque_prf_input_callback_arg);
2501                         if (!r)
2502                                 {
2503                                 ret = SSL_TLSEXT_ERR_ALERT_FATAL;
2504                                 al = SSL_AD_INTERNAL_ERROR;
2505                                 goto err;
2506                                 }
2507                         }
2508
2509                 if (s->s3->server_opaque_prf_input != NULL) /* shouldn't really happen */
2510                         OPENSSL_free(s->s3->server_opaque_prf_input);
2511                 s->s3->server_opaque_prf_input = NULL;
2512
2513                 if (s->tlsext_opaque_prf_input != NULL)
2514                         {
2515                         if (s->s3->client_opaque_prf_input != NULL &&
2516                                 s->s3->client_opaque_prf_input_len == s->tlsext_opaque_prf_input_len)
2517                                 {
2518                                 /* can only use this extension if we have a server opaque PRF input
2519                                  * of the same length as the client opaque PRF input! */
2520
2521                                 if (s->tlsext_opaque_prf_input_len == 0)
2522                                         s->s3->server_opaque_prf_input = OPENSSL_malloc(1); /* dummy byte just to get non-NULL */
2523                                 else
2524                                         s->s3->server_opaque_prf_input = BUF_memdup(s->tlsext_opaque_prf_input, s->tlsext_opaque_prf_input_len);
2525                                 if (s->s3->server_opaque_prf_input == NULL)
2526                                         {
2527                                         ret = SSL_TLSEXT_ERR_ALERT_FATAL;
2528                                         al = SSL_AD_INTERNAL_ERROR;
2529                                         goto err;
2530                                         }
2531                                 s->s3->server_opaque_prf_input_len = s->tlsext_opaque_prf_input_len;
2532                                 }
2533                         }
2534
2535                 if (r == 2 && s->s3->server_opaque_prf_input == NULL)
2536                         {
2537                         /* The callback wants to enforce use of the extension,
2538                          * but we can't do that with the client opaque PRF input;
2539                          * abort the handshake.
2540                          */
2541                         ret = SSL_TLSEXT_ERR_ALERT_FATAL;
2542                         al = SSL_AD_HANDSHAKE_FAILURE;
2543                         }
2544         }
2545
2546 #endif
2547  err:
2548         switch (ret)
2549                 {
2550                 case SSL_TLSEXT_ERR_ALERT_FATAL:
2551                         ssl3_send_alert(s,SSL3_AL_FATAL,al);
2552                         return -1;
2553
2554                 case SSL_TLSEXT_ERR_ALERT_WARNING:
2555                         ssl3_send_alert(s,SSL3_AL_WARNING,al);
2556                         return 1;
2557
2558                 case SSL_TLSEXT_ERR_NOACK:
2559                         s->servername_done=0;
2560                         default:
2561                 return 1;
2562                 }
2563         }
2564
2565 int ssl_check_serverhello_tlsext(SSL *s)
2566         {
2567         int ret=SSL_TLSEXT_ERR_NOACK;
2568         int al = SSL_AD_UNRECOGNIZED_NAME;
2569
2570 #ifndef OPENSSL_NO_EC
2571         /* If we are client and using an elliptic curve cryptography cipher
2572          * suite, then if server returns an EC point formats lists extension
2573          * it must contain uncompressed.
2574          */
2575         unsigned long alg_k = s->s3->tmp.new_cipher->algorithm_mkey;
2576         unsigned long alg_a = s->s3->tmp.new_cipher->algorithm_auth;
2577         if ((s->tlsext_ecpointformatlist != NULL) && (s->tlsext_ecpointformatlist_length > 0) &&
2578             (s->session->tlsext_ecpointformatlist != NULL) && (s->session->tlsext_ecpointformatlist_length > 0) &&
2579             ((alg_k & (SSL_kEECDH|SSL_kECDHr|SSL_kECDHe)) || (alg_a & SSL_aECDSA)))
2580                 {
2581                 /* we are using an ECC cipher */
2582                 size_t i;
2583                 unsigned char *list;
2584                 int found_uncompressed = 0;
2585                 list = s->session->tlsext_ecpointformatlist;
2586                 for (i = 0; i < s->session->tlsext_ecpointformatlist_length; i++)
2587                         {
2588                         if (*(list++) == TLSEXT_ECPOINTFORMAT_uncompressed)
2589                                 {
2590                                 found_uncompressed = 1;
2591                                 break;
2592                                 }
2593                         }
2594                 if (!found_uncompressed)
2595                         {
2596                         SSLerr(SSL_F_SSL_CHECK_SERVERHELLO_TLSEXT,SSL_R_TLS_INVALID_ECPOINTFORMAT_LIST);
2597                         return -1;
2598                         }
2599                 }
2600         ret = SSL_TLSEXT_ERR_OK;
2601 #endif /* OPENSSL_NO_EC */
2602
2603         if (s->ctx != NULL && s->ctx->tlsext_servername_callback != 0)
2604                 ret = s->ctx->tlsext_servername_callback(s, &al, s->ctx->tlsext_servername_arg);
2605         else if (s->initial_ctx != NULL && s->initial_ctx->tlsext_servername_callback != 0)
2606                 ret = s->initial_ctx->tlsext_servername_callback(s, &al, s->initial_ctx->tlsext_servername_arg);
2607
2608 #ifdef TLSEXT_TYPE_opaque_prf_input
2609         if (s->s3->server_opaque_prf_input_len > 0)
2610                 {
2611                 /* This case may indicate that we, as a client, want to insist on using opaque PRF inputs.
2612                  * So first verify that we really have a value from the server too. */
2613
2614                 if (s->s3->server_opaque_prf_input == NULL)
2615                         {
2616                         ret = SSL_TLSEXT_ERR_ALERT_FATAL;
2617                         al = SSL_AD_HANDSHAKE_FAILURE;
2618                         }
2619
2620                 /* Anytime the server *has* sent an opaque PRF input, we need to check
2621                  * that we have a client opaque PRF input of the same size. */
2622                 if (s->s3->client_opaque_prf_input == NULL ||
2623                     s->s3->client_opaque_prf_input_len != s->s3->server_opaque_prf_input_len)
2624                         {
2625                         ret = SSL_TLSEXT_ERR_ALERT_FATAL;
2626                         al = SSL_AD_ILLEGAL_PARAMETER;
2627                         }
2628                 }
2629 #endif
2630
2631         /* If we've requested certificate status and we wont get one
2632          * tell the callback
2633          */
2634         if ((s->tlsext_status_type != -1) && !(s->tlsext_status_expected)
2635                         && s->ctx && s->ctx->tlsext_status_cb)
2636                 {
2637                 int r;
2638                 /* Set resp to NULL, resplen to -1 so callback knows
2639                  * there is no response.
2640                  */
2641                 if (s->tlsext_ocsp_resp)
2642                         {
2643                         OPENSSL_free(s->tlsext_ocsp_resp);
2644                         s->tlsext_ocsp_resp = NULL;
2645                         }
2646                 s->tlsext_ocsp_resplen = -1;
2647                 r = s->ctx->tlsext_status_cb(s, s->ctx->tlsext_status_arg);
2648                 if (r == 0)
2649                         {
2650                         al = SSL_AD_BAD_CERTIFICATE_STATUS_RESPONSE;
2651                         ret = SSL_TLSEXT_ERR_ALERT_FATAL;
2652                         }
2653                 if (r < 0)
2654                         {
2655                         al = SSL_AD_INTERNAL_ERROR;
2656                         ret = SSL_TLSEXT_ERR_ALERT_FATAL;
2657                         }
2658                 }
2659
2660         switch (ret)
2661                 {
2662                 case SSL_TLSEXT_ERR_ALERT_FATAL:
2663                         ssl3_send_alert(s,SSL3_AL_FATAL,al);
2664                         return -1;
2665
2666                 case SSL_TLSEXT_ERR_ALERT_WARNING:
2667                         ssl3_send_alert(s,SSL3_AL_WARNING,al);
2668                         return 1;
2669
2670                 case SSL_TLSEXT_ERR_NOACK:
2671                         s->servername_done=0;
2672                         default:
2673                 return 1;
2674                 }
2675         }
2676
2677 int ssl_parse_serverhello_tlsext(SSL *s, unsigned char **p, unsigned char *d, int n)
2678         {
2679         int al = -1;
2680         if (s->version < SSL3_VERSION)
2681                 return 1;
2682         if (ssl_scan_serverhello_tlsext(s, p, d, n, &al) <= 0)
2683                 {
2684                 ssl3_send_alert(s,SSL3_AL_FATAL,al);
2685                 return 0;
2686                 }
2687
2688         if (ssl_check_serverhello_tlsext(s) <= 0)
2689                 {
2690                 SSLerr(SSL_F_SSL_PARSE_SERVERHELLO_TLSEXT,SSL_R_SERVERHELLO_TLSEXT);
2691                 return 0;
2692                 }
2693         return 1;
2694 }
2695
2696 /* Since the server cache lookup is done early on in the processing of the
2697  * ClientHello, and other operations depend on the result, we need to handle
2698  * any TLS session ticket extension at the same time.
2699  *
2700  *   session_id: points at the session ID in the ClientHello. This code will
2701  *       read past the end of this in order to parse out the session ticket
2702  *       extension, if any.
2703  *   len: the length of the session ID.
2704  *   limit: a pointer to the first byte after the ClientHello.
2705  *   ret: (output) on return, if a ticket was decrypted, then this is set to
2706  *       point to the resulting session.
2707  *
2708  * If s->tls_session_secret_cb is set then we are expecting a pre-shared key
2709  * ciphersuite, in which case we have no use for session tickets and one will
2710  * never be decrypted, nor will s->tlsext_ticket_expected be set to 1.
2711  *
2712  * Returns:
2713  *   -1: fatal error, either from parsing or decrypting the ticket.
2714  *    0: no ticket was found (or was ignored, based on settings).
2715  *    1: a zero length extension was found, indicating that the client supports
2716  *       session tickets but doesn't currently have one to offer.
2717  *    2: either s->tls_session_secret_cb was set, or a ticket was offered but
2718  *       couldn't be decrypted because of a non-fatal error.
2719  *    3: a ticket was successfully decrypted and *ret was set.
2720  *
2721  * Side effects:
2722  *   Sets s->tlsext_ticket_expected to 1 if the server will have to issue
2723  *   a new session ticket to the client because the client indicated support
2724  *   (and s->tls_session_secret_cb is NULL) but the client either doesn't have
2725  *   a session ticket or we couldn't use the one it gave us, or if
2726  *   s->ctx->tlsext_ticket_key_cb asked to renew the client's ticket.
2727  *   Otherwise, s->tlsext_ticket_expected is set to 0.
2728  */
2729 int tls1_process_ticket(SSL *s, unsigned char *session_id, int len,
2730                         const unsigned char *limit, SSL_SESSION **ret)
2731         {
2732         /* Point after session ID in client hello */
2733         const unsigned char *p = session_id + len;
2734         unsigned short i;
2735
2736         *ret = NULL;
2737         s->tlsext_ticket_expected = 0;
2738
2739         /* If tickets disabled behave as if no ticket present
2740          * to permit stateful resumption.
2741          */
2742         if (SSL_get_options(s) & SSL_OP_NO_TICKET)
2743                 return 0;
2744         if ((s->version <= SSL3_VERSION) || !limit)
2745                 return 0;
2746         if (p >= limit)
2747                 return -1;
2748         /* Skip past DTLS cookie */
2749         if (s->version == DTLS1_VERSION || s->version == DTLS1_BAD_VER)
2750                 {
2751                 i = *(p++);
2752                 p+= i;
2753                 if (p >= limit)
2754                         return -1;
2755                 }
2756         /* Skip past cipher list */
2757         n2s(p, i);
2758         p+= i;
2759         if (p >= limit)
2760                 return -1;
2761         /* Skip past compression algorithm list */
2762         i = *(p++);
2763         p += i;
2764         if (p > limit)
2765                 return -1;
2766         /* Now at start of extensions */
2767         if ((p + 2) >= limit)
2768                 return 0;
2769         n2s(p, i);
2770         while ((p + 4) <= limit)
2771                 {
2772                 unsigned short type, size;
2773                 n2s(p, type);
2774                 n2s(p, size);
2775                 if (p + size > limit)
2776                         return 0;
2777                 if (type == TLSEXT_TYPE_session_ticket)
2778                         {
2779                         int r;
2780                         if (size == 0)
2781                                 {
2782                                 /* The client will accept a ticket but doesn't
2783                                  * currently have one. */
2784                                 s->tlsext_ticket_expected = 1;
2785                                 return 1;
2786                                 }
2787                         if (s->tls_session_secret_cb)
2788                                 {
2789                                 /* Indicate that the ticket couldn't be
2790                                  * decrypted rather than generating the session
2791                                  * from ticket now, trigger abbreviated
2792                                  * handshake based on external mechanism to
2793                                  * calculate the master secret later. */
2794                                 return 2;
2795                                 }
2796                         r = tls_decrypt_ticket(s, p, size, session_id, len, ret);
2797                         switch (r)
2798                                 {
2799                                 case 2: /* ticket couldn't be decrypted */
2800                                         s->tlsext_ticket_expected = 1;
2801                                         return 2;
2802                                 case 3: /* ticket was decrypted */
2803                                         return r;
2804                                 case 4: /* ticket decrypted but need to renew */
2805                                         s->tlsext_ticket_expected = 1;
2806                                         return 3;
2807                                 default: /* fatal error */
2808                                         return -1;
2809                                 }
2810                         }
2811                 p += size;
2812                 }
2813         return 0;
2814         }
2815
2816 /* tls_decrypt_ticket attempts to decrypt a session ticket.
2817  *
2818  *   etick: points to the body of the session ticket extension.
2819  *   eticklen: the length of the session tickets extenion.
2820  *   sess_id: points at the session ID.
2821  *   sesslen: the length of the session ID.
2822  *   psess: (output) on return, if a ticket was decrypted, then this is set to
2823  *       point to the resulting session.
2824  *
2825  * Returns:
2826  *   -1: fatal error, either from parsing or decrypting the ticket.
2827  *    2: the ticket couldn't be decrypted.
2828  *    3: a ticket was successfully decrypted and *psess was set.
2829  *    4: same as 3, but the ticket needs to be renewed.
2830  */
2831 static int tls_decrypt_ticket(SSL *s, const unsigned char *etick, int eticklen,
2832                                 const unsigned char *sess_id, int sesslen,
2833                                 SSL_SESSION **psess)
2834         {
2835         SSL_SESSION *sess;
2836         unsigned char *sdec;
2837         const unsigned char *p;
2838         int slen, mlen, renew_ticket = 0;
2839         unsigned char tick_hmac[EVP_MAX_MD_SIZE];
2840         HMAC_CTX hctx;
2841         EVP_CIPHER_CTX ctx;
2842         SSL_CTX *tctx = s->initial_ctx;
2843         /* Need at least keyname + iv + some encrypted data */
2844         if (eticklen < 48)
2845                 return 2;
2846         /* Initialize session ticket encryption and HMAC contexts */
2847         HMAC_CTX_init(&hctx);
2848         EVP_CIPHER_CTX_init(&ctx);
2849         if (tctx->tlsext_ticket_key_cb)
2850                 {
2851                 unsigned char *nctick = (unsigned char *)etick;
2852                 int rv = tctx->tlsext_ticket_key_cb(s, nctick, nctick + 16,
2853                                                         &ctx, &hctx, 0);
2854                 if (rv < 0)
2855                         return -1;
2856                 if (rv == 0)
2857                         return 2;
2858                 if (rv == 2)
2859                         renew_ticket = 1;
2860                 }
2861         else
2862                 {
2863                 /* Check key name matches */
2864                 if (memcmp(etick, tctx->tlsext_tick_key_name, 16))
2865                         return 2;
2866                 HMAC_Init_ex(&hctx, tctx->tlsext_tick_hmac_key, 16,
2867                                         tlsext_tick_md(), NULL);
2868                 EVP_DecryptInit_ex(&ctx, EVP_aes_128_cbc(), NULL,
2869                                 tctx->tlsext_tick_aes_key, etick + 16);
2870                 }
2871         /* Attempt to process session ticket, first conduct sanity and
2872          * integrity checks on ticket.
2873          */
2874         mlen = HMAC_size(&hctx);
2875         if (mlen < 0)
2876                 {
2877                 EVP_CIPHER_CTX_cleanup(&ctx);
2878                 return -1;
2879                 }
2880         eticklen -= mlen;
2881         /* Check HMAC of encrypted ticket */
2882         HMAC_Update(&hctx, etick, eticklen);
2883         HMAC_Final(&hctx, tick_hmac, NULL);
2884         HMAC_CTX_cleanup(&hctx);
2885         if (memcmp(tick_hmac, etick + eticklen, mlen))
2886                 return 2;
2887         /* Attempt to decrypt session data */
2888         /* Move p after IV to start of encrypted ticket, update length */
2889         p = etick + 16 + EVP_CIPHER_CTX_iv_length(&ctx);
2890         eticklen -= 16 + EVP_CIPHER_CTX_iv_length(&ctx);
2891         sdec = OPENSSL_malloc(eticklen);
2892         if (!sdec)
2893                 {
2894                 EVP_CIPHER_CTX_cleanup(&ctx);
2895                 return -1;
2896                 }
2897         EVP_DecryptUpdate(&ctx, sdec, &slen, p, eticklen);
2898         if (EVP_DecryptFinal(&ctx, sdec + slen, &mlen) <= 0)
2899                 return 2;
2900         slen += mlen;
2901         EVP_CIPHER_CTX_cleanup(&ctx);
2902         p = sdec;
2903
2904         sess = d2i_SSL_SESSION(NULL, &p, slen);
2905         OPENSSL_free(sdec);
2906         if (sess)
2907                 {
2908                 /* The session ID, if non-empty, is used by some clients to
2909                  * detect that the ticket has been accepted. So we copy it to
2910                  * the session structure. If it is empty set length to zero
2911                  * as required by standard.
2912                  */
2913                 if (sesslen)
2914                         memcpy(sess->session_id, sess_id, sesslen);
2915                 sess->session_id_length = sesslen;
2916                 *psess = sess;
2917                 if (renew_ticket)
2918                         return 4;
2919                 else
2920                         return 3;
2921                 }
2922         ERR_clear_error();
2923         /* For session parse failure, indicate that we need to send a new
2924          * ticket. */
2925         return 2;
2926         }
2927
2928 /* Tables to translate from NIDs to TLS v1.2 ids */
2929
2930 typedef struct
2931         {
2932         int nid;
2933         int id;
2934         } tls12_lookup;
2935
2936 static tls12_lookup tls12_md[] = {
2937         {NID_md5, TLSEXT_hash_md5},
2938         {NID_sha1, TLSEXT_hash_sha1},
2939         {NID_sha224, TLSEXT_hash_sha224},
2940         {NID_sha256, TLSEXT_hash_sha256},
2941         {NID_sha384, TLSEXT_hash_sha384},
2942         {NID_sha512, TLSEXT_hash_sha512}
2943 };
2944
2945 static tls12_lookup tls12_sig[] = {
2946         {EVP_PKEY_RSA, TLSEXT_signature_rsa},
2947         {EVP_PKEY_DSA, TLSEXT_signature_dsa},
2948         {EVP_PKEY_EC, TLSEXT_signature_ecdsa}
2949 };
2950
2951 static int tls12_find_id(int nid, tls12_lookup *table, size_t tlen)
2952         {
2953         size_t i;
2954         for (i = 0; i < tlen; i++)
2955                 {
2956                 if (table[i].nid == nid)
2957                         return table[i].id;
2958                 }
2959         return -1;
2960         }
2961
2962 static int tls12_find_nid(int id, tls12_lookup *table, size_t tlen)
2963         {
2964         size_t i;
2965         for (i = 0; i < tlen; i++)
2966                 {
2967                 if ((table[i].id) == id)
2968                         return table[i].nid;
2969                 }
2970         return NID_undef;
2971         }
2972
2973 int tls12_get_sigandhash(unsigned char *p, const EVP_PKEY *pk, const EVP_MD *md)
2974         {
2975         int sig_id, md_id;
2976         if (!md)
2977                 return 0;
2978         md_id = tls12_find_id(EVP_MD_type(md), tls12_md,
2979                                 sizeof(tls12_md)/sizeof(tls12_lookup));
2980         if (md_id == -1)
2981                 return 0;
2982         sig_id = tls12_get_sigid(pk);
2983         if (sig_id == -1)
2984                 return 0;
2985         p[0] = (unsigned char)md_id;
2986         p[1] = (unsigned char)sig_id;
2987         return 1;
2988         }
2989
2990 int tls12_get_sigid(const EVP_PKEY *pk)
2991         {
2992         return tls12_find_id(pk->type, tls12_sig,
2993                                 sizeof(tls12_sig)/sizeof(tls12_lookup));
2994         }
2995
2996 const EVP_MD *tls12_get_hash(unsigned char hash_alg)
2997         {
2998         switch(hash_alg)
2999                 {
3000 #ifndef OPENSSL_NO_MD5
3001                 case TLSEXT_hash_md5:
3002 #ifdef OPENSSL_FIPS
3003                 if (FIPS_mode())
3004                         return NULL;
3005 #endif
3006                 return EVP_md5();
3007 #endif
3008 #ifndef OPENSSL_NO_SHA
3009                 case TLSEXT_hash_sha1:
3010                 return EVP_sha1();
3011 #endif
3012 #ifndef OPENSSL_NO_SHA256
3013                 case TLSEXT_hash_sha224:
3014                 return EVP_sha224();
3015
3016                 case TLSEXT_hash_sha256:
3017                 return EVP_sha256();
3018 #endif
3019 #ifndef OPENSSL_NO_SHA512
3020                 case TLSEXT_hash_sha384:
3021                 return EVP_sha384();
3022
3023                 case TLSEXT_hash_sha512:
3024                 return EVP_sha512();
3025 #endif
3026                 default:
3027                 return NULL;
3028
3029                 }
3030         }
3031
3032 static int tls12_get_pkey_idx(unsigned char sig_alg)
3033         {
3034         switch(sig_alg)
3035                 {
3036 #ifndef OPENSSL_NO_RSA
3037         case TLSEXT_signature_rsa:
3038                 return SSL_PKEY_RSA_SIGN;
3039 #endif
3040 #ifndef OPENSSL_NO_DSA
3041         case TLSEXT_signature_dsa:
3042                 return SSL_PKEY_DSA_SIGN;
3043 #endif
3044 #ifndef OPENSSL_NO_ECDSA
3045         case TLSEXT_signature_ecdsa:
3046                 return SSL_PKEY_ECC;
3047 #endif
3048                 }
3049         return -1;
3050         }
3051
3052 /* Convert TLS 1.2 signature algorithm extension values into NIDs */
3053 static void tls1_lookup_sigalg(int *phash_nid, int *psign_nid,
3054                         int *psignhash_nid, const unsigned char *data)
3055         {
3056         int sign_nid = 0, hash_nid = 0;
3057         if (!phash_nid && !psign_nid && !psignhash_nid)
3058                 return;
3059         if (phash_nid || psignhash_nid)
3060                 {
3061                 hash_nid = tls12_find_nid(data[0], tls12_md,
3062                                         sizeof(tls12_md)/sizeof(tls12_lookup));
3063                 if (phash_nid)
3064                         *phash_nid = hash_nid;
3065                 }
3066         if (psign_nid || psignhash_nid)
3067                 {
3068                 sign_nid = tls12_find_nid(data[1], tls12_sig,
3069                                         sizeof(tls12_sig)/sizeof(tls12_lookup));
3070                 if (psign_nid)
3071                         *psign_nid = sign_nid;
3072                 }
3073         if (psignhash_nid)
3074                 {
3075                 if (sign_nid && hash_nid)
3076                         OBJ_find_sigid_by_algs(psignhash_nid,
3077                                                         hash_nid, sign_nid);
3078                 else
3079                         *psignhash_nid = NID_undef;
3080                 }
3081         }
3082 /* Given preference and allowed sigalgs set shared sigalgs */
3083 static int tls12_do_shared_sigalgs(TLS_SIGALGS *shsig,
3084                                 const unsigned char *pref, size_t preflen,
3085                                 const unsigned char *allow, size_t allowlen)
3086         {
3087         const unsigned char *ptmp, *atmp;
3088         size_t i, j, nmatch = 0;
3089         for (i = 0, ptmp = pref; i < preflen; i+=2, ptmp+=2)
3090                 {
3091                 /* Skip disabled hashes or signature algorithms */
3092                 if (tls12_get_hash(ptmp[0]) == NULL)
3093                         continue;
3094                 if (tls12_get_pkey_idx(ptmp[1]) == -1)
3095                         continue;
3096                 for (j = 0, atmp = allow; j < allowlen; j+=2, atmp+=2)
3097                         {
3098                         if (ptmp[0] == atmp[0] && ptmp[1] == atmp[1])
3099                                 {
3100                                 nmatch++;
3101                                 if (shsig)
3102                                         {
3103                                         shsig->rhash = ptmp[0];
3104                                         shsig->rsign = ptmp[1];
3105                                         tls1_lookup_sigalg(&shsig->hash_nid,
3106                                                 &shsig->sign_nid,
3107                                                 &shsig->signandhash_nid,
3108                                                 ptmp);
3109                                         shsig++;
3110                                         }
3111                                 break;
3112                                 }
3113                         }
3114                 }
3115         return nmatch;
3116         }
3117
3118 /* Set shared signature algorithms for SSL structures */
3119 static int tls1_set_shared_sigalgs(SSL *s)
3120         {
3121         const unsigned char *pref, *allow, *conf;
3122         size_t preflen, allowlen, conflen;
3123         size_t nmatch;
3124         TLS_SIGALGS *salgs = NULL;
3125         CERT *c = s->cert;
3126         /* If client use client signature algorithms if not NULL */
3127         if (!s->server && c->client_sigalgs)
3128                 {
3129                 conf = c->client_sigalgs;
3130                 conflen = c->client_sigalgslen;
3131                 }
3132         else if (c->conf_sigalgs)
3133                 {
3134                 conf = c->conf_sigalgs;
3135                 conflen = c->conf_sigalgslen;
3136                 }
3137         else
3138                 {
3139                 conf = tls12_sigalgs;
3140                 conflen = sizeof(tls12_sigalgs);
3141 #ifdef OPENSSL_FIPS
3142                 if (FIPS_mode())
3143                         conflen -= 2;
3144 #endif
3145                 }
3146         if(s->options & SSL_OP_CIPHER_SERVER_PREFERENCE)
3147                 {
3148                 pref = conf;
3149                 preflen = conflen;
3150                 allow = c->peer_sigalgs;
3151                 allowlen = c->peer_sigalgslen;
3152                 }
3153         else
3154                 {
3155                 allow = conf;
3156                 allowlen = conflen;
3157                 pref = c->peer_sigalgs;
3158                 preflen = c->peer_sigalgslen;
3159                 }
3160         nmatch = tls12_do_shared_sigalgs(NULL, pref, preflen, allow, allowlen);
3161         if (!nmatch)
3162                 return 1;
3163         salgs = OPENSSL_malloc(nmatch * sizeof(TLS_SIGALGS));
3164         if (!salgs)
3165                 return 0;
3166         nmatch = tls12_do_shared_sigalgs(salgs, pref, preflen, allow, allowlen);
3167         c->shared_sigalgs = salgs;
3168         c->shared_sigalgslen = nmatch;
3169         return 1;
3170         }
3171
3172
3173 /* Set preferred digest for each key type */
3174
3175 int tls1_process_sigalgs(SSL *s, const unsigned char *data, int dsize)
3176         {
3177         int idx;
3178         size_t i;
3179         const EVP_MD *md;
3180         CERT *c = s->cert;
3181         TLS_SIGALGS *sigptr;
3182         /* Extension ignored for TLS versions below 1.2 */
3183         if (TLS1_get_version(s) < TLS1_2_VERSION)
3184                 return 1;
3185         /* Should never happen */
3186         if (!c)
3187                 return 0;
3188
3189         c->peer_sigalgs = OPENSSL_malloc(dsize);
3190         if (!c->peer_sigalgs)
3191                 return 0;
3192         c->peer_sigalgslen = dsize;
3193         memcpy(c->peer_sigalgs, data, dsize);
3194
3195         tls1_set_shared_sigalgs(s);
3196
3197         for (i = 0, sigptr = c->shared_sigalgs;
3198                         i < c->shared_sigalgslen; i++, sigptr++)
3199                 {
3200                 idx = tls12_get_pkey_idx(sigptr->rsign);
3201                 if (idx > 0 && c->pkeys[idx].digest == NULL)
3202                         {
3203                         md = tls12_get_hash(sigptr->rhash);
3204                         c->pkeys[idx].digest = md;
3205                         c->pkeys[idx].valid_flags = CERT_PKEY_EXPLICIT_SIGN;
3206                         if (idx == SSL_PKEY_RSA_SIGN)
3207                                 {
3208                                 c->pkeys[SSL_PKEY_RSA_ENC].valid_flags = CERT_PKEY_EXPLICIT_SIGN;
3209                                 c->pkeys[SSL_PKEY_RSA_ENC].digest = md;
3210                                 }
3211                         }
3212
3213                 }
3214         /* In strict mode leave unset digests as NULL to indicate we can't
3215          * use the certificate for signing.
3216          */
3217         if (!(s->cert->cert_flags & SSL_CERT_FLAG_TLS_STRICT))
3218                 {
3219                 /* Set any remaining keys to default values. NOTE: if alg is
3220                  * not supported it stays as NULL.
3221                  */
3222 #ifndef OPENSSL_NO_DSA
3223                 if (!c->pkeys[SSL_PKEY_DSA_SIGN].digest)
3224                         c->pkeys[SSL_PKEY_DSA_SIGN].digest = EVP_sha1();
3225 #endif
3226 #ifndef OPENSSL_NO_RSA
3227                 if (!c->pkeys[SSL_PKEY_RSA_SIGN].digest)
3228                         {
3229                         c->pkeys[SSL_PKEY_RSA_SIGN].digest = EVP_sha1();
3230                         c->pkeys[SSL_PKEY_RSA_ENC].digest = EVP_sha1();
3231                         }
3232 #endif
3233 #ifndef OPENSSL_NO_ECDSA
3234                 if (!c->pkeys[SSL_PKEY_ECC].digest)
3235                         c->pkeys[SSL_PKEY_ECC].digest = EVP_sha1();
3236 #endif
3237                 }
3238         return 1;
3239         }
3240
3241
3242 int SSL_get_sigalgs(SSL *s, int idx,
3243                         int *psign, int *phash, int *psignhash,
3244                         unsigned char *rsig, unsigned char *rhash)
3245         {
3246         const unsigned char *psig = s->cert->peer_sigalgs;
3247         if (psig == NULL)
3248                 return 0;
3249         if (idx >= 0)
3250                 {
3251                 idx <<= 1;
3252                 if (idx >= (int)s->cert->peer_sigalgslen)
3253                         return 0;
3254                 psig += idx;
3255                 if (rhash)
3256                         *rhash = psig[0];
3257                 if (rsig)
3258                         *rsig = psig[1];
3259                 tls1_lookup_sigalg(phash, psign, psignhash, psig);
3260                 }
3261         return s->cert->peer_sigalgslen / 2;
3262         }
3263
3264 int SSL_get_shared_sigalgs(SSL *s, int idx,
3265                         int *psign, int *phash, int *psignhash,
3266                         unsigned char *rsig, unsigned char *rhash)
3267         {
3268         TLS_SIGALGS *shsigalgs = s->cert->shared_sigalgs;
3269         if (!shsigalgs || idx >= (int)s->cert->shared_sigalgslen)
3270                 return 0;
3271         shsigalgs += idx;
3272         if (phash)
3273                 *phash = shsigalgs->hash_nid;
3274         if (psign)
3275                 *psign = shsigalgs->sign_nid;
3276         if (psignhash)
3277                 *psignhash = shsigalgs->signandhash_nid;
3278         if (rsig)
3279                 *rsig = shsigalgs->rsign;
3280         if (rhash)
3281                 *rhash = shsigalgs->rhash;
3282         return s->cert->shared_sigalgslen;
3283         }
3284
3285
3286 #ifndef OPENSSL_NO_HEARTBEATS
3287 int
3288 tls1_process_heartbeat(SSL *s)
3289         {
3290         unsigned char *p = &s->s3->rrec.data[0], *pl;
3291         unsigned short hbtype;
3292         unsigned int payload;
3293         unsigned int padding = 16; /* Use minimum padding */
3294
3295         /* Read type and payload length first */
3296         hbtype = *p++;
3297         n2s(p, payload);
3298         pl = p;
3299
3300         if (s->msg_callback)
3301                 s->msg_callback(0, s->version, TLS1_RT_HEARTBEAT,
3302                         &s->s3->rrec.data[0], s->s3->rrec.length,
3303                         s, s->msg_callback_arg);
3304
3305         if (hbtype == TLS1_HB_REQUEST)
3306                 {
3307                 unsigned char *buffer, *bp;
3308                 int r;
3309
3310                 /* Allocate memory for the response, size is 1 bytes
3311                  * message type, plus 2 bytes payload length, plus
3312                  * payload, plus padding
3313                  */
3314                 buffer = OPENSSL_malloc(1 + 2 + payload + padding);
3315                 bp = buffer;
3316
3317                 /* Enter response type, length and copy payload */
3318                 *bp++ = TLS1_HB_RESPONSE;
3319                 s2n(payload, bp);
3320                 memcpy(bp, pl, payload);
3321                 bp += payload;
3322                 /* Random padding */
3323                 RAND_pseudo_bytes(bp, padding);
3324
3325                 r = ssl3_write_bytes(s, TLS1_RT_HEARTBEAT, buffer, 3 + payload + padding);
3326
3327                 if (r >= 0 && s->msg_callback)
3328                         s->msg_callback(1, s->version, TLS1_RT_HEARTBEAT,
3329                                 buffer, 3 + payload + padding,
3330                                 s, s->msg_callback_arg);
3331
3332                 OPENSSL_free(buffer);
3333
3334                 if (r < 0)
3335                         return r;
3336                 }
3337         else if (hbtype == TLS1_HB_RESPONSE)
3338                 {
3339                 unsigned int seq;
3340
3341                 /* We only send sequence numbers (2 bytes unsigned int),
3342                  * and 16 random bytes, so we just try to read the
3343                  * sequence number */
3344                 n2s(pl, seq);
3345
3346                 if (payload == 18 && seq == s->tlsext_hb_seq)
3347                         {
3348                         s->tlsext_hb_seq++;
3349                         s->tlsext_hb_pending = 0;
3350                         }
3351                 }
3352
3353         return 0;
3354         }
3355
3356 int
3357 tls1_heartbeat(SSL *s)
3358         {
3359         unsigned char *buf, *p;
3360         int ret;
3361         unsigned int payload = 18; /* Sequence number + random bytes */
3362         unsigned int padding = 16; /* Use minimum padding */
3363
3364         /* Only send if peer supports and accepts HB requests... */
3365         if (!(s->tlsext_heartbeat & SSL_TLSEXT_HB_ENABLED) ||
3366             s->tlsext_heartbeat & SSL_TLSEXT_HB_DONT_SEND_REQUESTS)
3367                 {
3368                 SSLerr(SSL_F_TLS1_HEARTBEAT,SSL_R_TLS_HEARTBEAT_PEER_DOESNT_ACCEPT);
3369                 return -1;
3370                 }
3371
3372         /* ...and there is none in flight yet... */
3373         if (s->tlsext_hb_pending)
3374                 {
3375                 SSLerr(SSL_F_TLS1_HEARTBEAT,SSL_R_TLS_HEARTBEAT_PENDING);
3376                 return -1;
3377                 }
3378
3379         /* ...and no handshake in progress. */
3380         if (SSL_in_init(s) || s->in_handshake)
3381                 {
3382                 SSLerr(SSL_F_TLS1_HEARTBEAT,SSL_R_UNEXPECTED_MESSAGE);
3383                 return -1;
3384                 }
3385
3386         /* Check if padding is too long, payload and padding
3387          * must not exceed 2^14 - 3 = 16381 bytes in total.
3388          */
3389         OPENSSL_assert(payload + padding <= 16381);
3390
3391         /* Create HeartBeat message, we just use a sequence number
3392          * as payload to distuingish different messages and add
3393          * some random stuff.
3394          *  - Message Type, 1 byte
3395          *  - Payload Length, 2 bytes (unsigned int)
3396          *  - Payload, the sequence number (2 bytes uint)
3397          *  - Payload, random bytes (16 bytes uint)
3398          *  - Padding
3399          */
3400         buf = OPENSSL_malloc(1 + 2 + payload + padding);
3401         p = buf;
3402         /* Message Type */
3403         *p++ = TLS1_HB_REQUEST;
3404         /* Payload length (18 bytes here) */
3405         s2n(payload, p);
3406         /* Sequence number */
3407         s2n(s->tlsext_hb_seq, p);
3408         /* 16 random bytes */
3409         RAND_pseudo_bytes(p, 16);
3410         p += 16;
3411         /* Random padding */
3412         RAND_pseudo_bytes(p, padding);
3413
3414         ret = ssl3_write_bytes(s, TLS1_RT_HEARTBEAT, buf, 3 + payload + padding);
3415         if (ret >= 0)
3416                 {
3417                 if (s->msg_callback)
3418                         s->msg_callback(1, s->version, TLS1_RT_HEARTBEAT,
3419                                 buf, 3 + payload + padding,
3420                                 s, s->msg_callback_arg);
3421
3422                 s->tlsext_hb_pending = 1;
3423                 }
3424
3425         OPENSSL_free(buf);
3426
3427         return ret;
3428         }
3429 #endif
3430
3431 #define MAX_SIGALGLEN   (TLSEXT_hash_num * TLSEXT_signature_num * 2)
3432
3433 typedef struct
3434         {
3435         size_t sigalgcnt;
3436         int sigalgs[MAX_SIGALGLEN];
3437         } sig_cb_st;
3438
3439 static int sig_cb(const char *elem, int len, void *arg)
3440         {
3441         sig_cb_st *sarg = arg;
3442         size_t i;
3443         char etmp[20], *p;
3444         int sig_alg, hash_alg;
3445         if (sarg->sigalgcnt == MAX_SIGALGLEN)
3446                 return 0;
3447         if (len > (int)(sizeof(etmp) - 1))
3448                 return 0;
3449         memcpy(etmp, elem, len);
3450         etmp[len] = 0;
3451         p = strchr(etmp, '+');
3452         if (!p)
3453                 return 0;
3454         *p = 0;
3455         p++;
3456         if (!*p)
3457                 return 0;
3458
3459         if (!strcmp(etmp, "RSA"))
3460                 sig_alg = EVP_PKEY_RSA;
3461         else if (!strcmp(etmp, "DSA"))
3462                 sig_alg = EVP_PKEY_DSA;
3463         else if (!strcmp(etmp, "ECDSA"))
3464                 sig_alg = EVP_PKEY_EC;
3465         else return 0;
3466
3467         hash_alg = OBJ_sn2nid(p);
3468         if (hash_alg == NID_undef)
3469                 hash_alg = OBJ_ln2nid(p);
3470         if (hash_alg == NID_undef)
3471                 return 0;
3472
3473         for (i = 0; i < sarg->sigalgcnt; i+=2)
3474                 {
3475                 if (sarg->sigalgs[i] == sig_alg
3476                         && sarg->sigalgs[i + 1] == hash_alg)
3477                         return 0;
3478                 }
3479         sarg->sigalgs[sarg->sigalgcnt++] = hash_alg;
3480         sarg->sigalgs[sarg->sigalgcnt++] = sig_alg;
3481         return 1;
3482         }
3483
3484 /* Set suppored signature algorithms based on a colon separated list
3485  * of the form sig+hash e.g. RSA+SHA512:DSA+SHA512 */
3486 int tls1_set_sigalgs_list(CERT *c, const char *str, int client)
3487         {
3488         sig_cb_st sig;
3489         sig.sigalgcnt = 0;
3490         if (!CONF_parse_list(str, ':', 1, sig_cb, &sig))
3491                 return 0;
3492         return tls1_set_sigalgs(c, sig.sigalgs, sig.sigalgcnt, client);
3493         }
3494
3495 int tls1_set_sigalgs(CERT *c, const int *psig_nids, size_t salglen, int client)
3496         {
3497         unsigned char *sigalgs, *sptr;
3498         int rhash, rsign;
3499         size_t i;
3500         if (salglen & 1)
3501                 return 0;
3502         sigalgs = OPENSSL_malloc(salglen);
3503         if (sigalgs == NULL)
3504                 return 0;
3505         for (i = 0, sptr = sigalgs; i < salglen; i+=2)
3506                 {
3507                 rhash = tls12_find_id(*psig_nids++, tls12_md,
3508                                         sizeof(tls12_md)/sizeof(tls12_lookup));
3509                 rsign = tls12_find_id(*psig_nids++, tls12_sig,
3510                                 sizeof(tls12_sig)/sizeof(tls12_lookup));
3511
3512                 if (rhash == -1 || rsign == -1)
3513                         goto err;
3514                 *sptr++ = rhash;
3515                 *sptr++ = rsign;
3516                 }
3517
3518         if (client)
3519                 {
3520                 if (c->client_sigalgs)
3521                         OPENSSL_free(c->client_sigalgs);
3522                 c->client_sigalgs = sigalgs;
3523                 c->client_sigalgslen = salglen;
3524                 }
3525         else
3526                 {
3527                 if (c->conf_sigalgs)
3528                         OPENSSL_free(c->conf_sigalgs);
3529                 c->conf_sigalgs = sigalgs;
3530                 c->conf_sigalgslen = salglen;
3531                 }
3532
3533         return 1;
3534
3535         err:
3536         OPENSSL_free(sigalgs);
3537         return 0;
3538         }
3539
3540 static int tls1_check_sig_alg(CERT *c, X509 *x, int default_nid)
3541         {
3542         int sig_nid;
3543         size_t i;
3544         if (default_nid == -1)
3545                 return 1;
3546         sig_nid = X509_get_signature_nid(x);
3547         if (default_nid)
3548                 return sig_nid == default_nid ? 1 : 0;
3549         for (i = 0; i < c->shared_sigalgslen; i++)
3550                 if (sig_nid == c->shared_sigalgs[i].signandhash_nid)
3551                         return 1;
3552         return 0;
3553         }
3554 /* Check to see if a certificate issuer name matches list of CA names */
3555 static int ssl_check_ca_name(STACK_OF(X509_NAME) *names, X509 *x)
3556         {
3557         X509_NAME *nm;
3558         int i;
3559         nm = X509_get_issuer_name(x);
3560         for (i = 0; i < sk_X509_NAME_num(names); i++)
3561                 {
3562                 if(!X509_NAME_cmp(nm, sk_X509_NAME_value(names, i)))
3563                         return 1;
3564                 }
3565         return 0;
3566         }
3567
3568 /* Check certificate chain is consistent with TLS extensions and is
3569  * usable by server. This servers two purposes: it allows users to
3570  * check chains before passing them to the server and it allows the
3571  * server to check chains before attempting to use them.
3572  */
3573
3574 /* Flags which need to be set for a certificate when stict mode not set */
3575
3576 #define CERT_PKEY_VALID_FLAGS \
3577         (CERT_PKEY_EE_SIGNATURE|CERT_PKEY_EE_PARAM)
3578 /* Strict mode flags */
3579 #define CERT_PKEY_STRICT_FLAGS \
3580          (CERT_PKEY_VALID_FLAGS|CERT_PKEY_CA_SIGNATURE|CERT_PKEY_CA_PARAM \
3581          | CERT_PKEY_ISSUER_NAME|CERT_PKEY_CERT_TYPE)
3582
3583 int tls1_check_chain(SSL *s, X509 *x, EVP_PKEY *pk, STACK_OF(X509) *chain,
3584                                                                         int idx)
3585         {
3586         int i;
3587         int rv = 0;
3588         int check_flags = 0, strict_mode;
3589         CERT_PKEY *cpk = NULL;
3590         CERT *c = s->cert;
3591         /* idx != -1 means checking server chains */
3592         if (idx != -1)
3593                 {
3594                 cpk = c->pkeys + idx;
3595                 x = cpk->x509;
3596                 pk = cpk->privatekey;
3597                 chain = cpk->chain;
3598                 strict_mode = c->cert_flags & SSL_CERT_FLAG_TLS_STRICT;
3599                 /* If no cert or key, forget it */
3600                 if (!x || !pk)
3601                         goto end;
3602                 }
3603         else
3604                 {
3605                 if (!x || !pk)
3606                         goto end;
3607                 idx = ssl_cert_type(x, pk);
3608                 if (idx == -1)
3609                         goto end;
3610                 cpk = c->pkeys + idx;
3611                 if (c->cert_flags & SSL_CERT_FLAG_TLS_STRICT)
3612                         check_flags = CERT_PKEY_STRICT_FLAGS;
3613                 else
3614                         check_flags = CERT_PKEY_VALID_FLAGS;
3615                 strict_mode = 1;
3616                 }
3617
3618
3619         /* Check all signature algorithms are consistent with
3620          * signature algorithms extension if TLS 1.2 or later
3621          * and strict mode.
3622          */
3623         if (TLS1_get_version(s) >= TLS1_2_VERSION && strict_mode)
3624                 {
3625                 int default_nid;
3626                 unsigned char rsign = 0;
3627                 if (c->peer_sigalgs)
3628                         default_nid = 0;
3629                 /* If no sigalgs extension use defaults from RFC5246 */
3630                 else
3631                         {
3632                         switch(idx)
3633                                 {
3634                         case SSL_PKEY_RSA_ENC:
3635                         case SSL_PKEY_RSA_SIGN:
3636                         case SSL_PKEY_DH_RSA:
3637                                 rsign = TLSEXT_signature_rsa;
3638                                 default_nid = NID_sha1WithRSAEncryption;
3639                                 break;
3640
3641                         case SSL_PKEY_DSA_SIGN:
3642                         case SSL_PKEY_DH_DSA:
3643                                 rsign = TLSEXT_signature_dsa;
3644                                 default_nid = NID_dsaWithSHA1;
3645                                 break;
3646
3647                         case SSL_PKEY_ECC:
3648                                 rsign = TLSEXT_signature_ecdsa;
3649                                 default_nid = NID_ecdsa_with_SHA1;
3650                                 break;
3651
3652                         default:
3653                                 default_nid = -1;
3654                                 break;
3655                                 }
3656                         }
3657                 /* If peer sent no signature algorithms extension and we
3658                  * have set preferred signature algorithms check we support
3659                  * sha1.
3660                  */
3661                 if (default_nid > 0 && c->conf_sigalgs)
3662                         {
3663                         size_t j;
3664                         const unsigned char *p = c->conf_sigalgs;
3665                         for (j = 0; j < c->conf_sigalgslen; j += 2, p += 2)
3666                                 {
3667                                 if (p[0] == TLSEXT_hash_sha1 && p[1] == rsign)
3668                                         break;
3669                                 }
3670                         if (j == c->conf_sigalgslen)
3671                                 {
3672                                 if (check_flags)
3673                                         goto skip_sigs;
3674                                 else
3675                                         goto end;
3676                                 }
3677                         }
3678                 /* Check signature algorithm of each cert in chain */
3679                 if (!tls1_check_sig_alg(c, x, default_nid))
3680                         {
3681                         if (!check_flags) goto end;
3682                         }
3683                 else
3684                         rv |= CERT_PKEY_EE_SIGNATURE;
3685                 rv |= CERT_PKEY_CA_SIGNATURE;
3686                 for (i = 0; i < sk_X509_num(chain); i++)
3687                         {
3688                         if (!tls1_check_sig_alg(c, sk_X509_value(chain, i),
3689                                                         default_nid))
3690                                 {
3691                                 if (check_flags)
3692                                         {
3693                                         rv &= ~CERT_PKEY_CA_SIGNATURE;
3694                                         break;
3695                                         }
3696                                 else
3697                                         goto end;
3698                                 }
3699                         }
3700                 }
3701         /* Else not TLS 1.2, so mark EE and CA signing algorithms OK */
3702         else if(check_flags)
3703                 rv |= CERT_PKEY_EE_SIGNATURE|CERT_PKEY_CA_SIGNATURE;
3704         skip_sigs:
3705         /* Check cert parameters are consistent: server certs only */
3706         if (!s->server || tls1_check_cert_param(s, x))
3707                 rv |= CERT_PKEY_EE_PARAM;
3708         else if (!check_flags)
3709                 goto end;
3710         if (!s->server)
3711                 rv |= CERT_PKEY_CA_PARAM;
3712         /* In strict mode check rest of chain too */
3713         else if (strict_mode)
3714                 {
3715                 rv |= CERT_PKEY_CA_PARAM;
3716                 for (i = 0; i < sk_X509_num(chain); i++)
3717                         {
3718                         if (!tls1_check_cert_param(s, sk_X509_value(chain, i)))
3719                                 {
3720                                 if (check_flags)
3721                                         {
3722                                         rv &= ~CERT_PKEY_CA_PARAM;
3723                                         break;
3724                                         }
3725                                 else
3726                                         goto end;
3727                                 }
3728                         }
3729                 }
3730         if (!s->server && strict_mode)
3731                 {
3732                 STACK_OF(X509_NAME) *ca_dn;
3733                 int check_type = 0;
3734                 switch (pk->type)
3735                         {
3736                 case EVP_PKEY_RSA:
3737                         check_type = TLS_CT_RSA_SIGN;
3738                         break;
3739                 case EVP_PKEY_DSA:
3740                         check_type = TLS_CT_DSS_SIGN;
3741                         break;
3742                 case EVP_PKEY_EC:
3743                         check_type = TLS_CT_ECDSA_SIGN;
3744                         break;
3745                 case EVP_PKEY_DH:
3746                 case EVP_PKEY_DHX:
3747                                 {
3748                                 int cert_type = X509_certificate_type(x, pk);
3749                                 if (cert_type & EVP_PKS_RSA)
3750                                         check_type = TLS_CT_RSA_FIXED_DH;
3751                                 if (cert_type & EVP_PKS_DSA)
3752                                         check_type = TLS_CT_DSS_FIXED_DH;
3753                                 }
3754                         }
3755                 if (check_type)
3756                         {
3757                         const unsigned char *ctypes;
3758                         int ctypelen;
3759                         if (c->ctypes)
3760                                 {
3761                                 ctypes = c->ctypes;
3762                                 ctypelen = (int)c->ctype_num;
3763                                 }
3764                         else
3765                                 {
3766                                 ctypes = (unsigned char *)s->s3->tmp.ctype;
3767                                 ctypelen = s->s3->tmp.ctype_num;
3768                                 }
3769                         for (i = 0; i < ctypelen; i++)
3770                                 {
3771                                 if (ctypes[i] == check_type)
3772                                         {
3773                                         rv |= CERT_PKEY_CERT_TYPE;
3774                                         break;
3775                                         }
3776                                 }
3777                         if (!(rv & CERT_PKEY_CERT_TYPE) && !check_flags)
3778                                 goto end;
3779                         }
3780                 else
3781                         rv |= CERT_PKEY_CERT_TYPE;
3782
3783
3784                 ca_dn = s->s3->tmp.ca_names;
3785
3786                 if (!sk_X509_NAME_num(ca_dn))
3787                         rv |= CERT_PKEY_ISSUER_NAME;
3788
3789                 if (!(rv & CERT_PKEY_ISSUER_NAME))
3790                         {
3791                         if (ssl_check_ca_name(ca_dn, x))
3792                                 rv |= CERT_PKEY_ISSUER_NAME;
3793                         }
3794                 if (!(rv & CERT_PKEY_ISSUER_NAME))
3795                         {
3796                         for (i = 0; i < sk_X509_num(chain); i++)
3797                                 {
3798                                 X509 *xtmp = sk_X509_value(chain, i);
3799                                 if (ssl_check_ca_name(ca_dn, xtmp))
3800                                         {
3801                                         rv |= CERT_PKEY_ISSUER_NAME;
3802                                         break;
3803                                         }
3804                                 }
3805                         }
3806                 if (!check_flags && !(rv & CERT_PKEY_ISSUER_NAME))
3807                         goto end;
3808                 }
3809         else
3810                 rv |= CERT_PKEY_ISSUER_NAME|CERT_PKEY_CERT_TYPE;
3811
3812         if (!check_flags || (rv & check_flags) == check_flags)
3813                 rv |= CERT_PKEY_VALID;
3814
3815         end:
3816
3817         if (TLS1_get_version(s) >= TLS1_2_VERSION)
3818                 {
3819                 if (cpk->valid_flags & CERT_PKEY_EXPLICIT_SIGN)
3820                         rv |= CERT_PKEY_EXPLICIT_SIGN|CERT_PKEY_SIGN;
3821                 else if (cpk->digest)
3822                         rv |= CERT_PKEY_SIGN;
3823                 }
3824         else
3825                 rv |= CERT_PKEY_SIGN|CERT_PKEY_EXPLICIT_SIGN;
3826
3827         /* When checking a CERT_PKEY structure all flags are irrelevant
3828          * if the chain is invalid.
3829          */
3830         if (!check_flags)
3831                 {
3832                 if (rv & CERT_PKEY_VALID)
3833                         cpk->valid_flags = rv;
3834                 else
3835                         cpk->valid_flags = 0;
3836                 }
3837         return rv;
3838         }
3839
3840 /* Set validity of certificates in an SSL structure */
3841 void tls1_set_cert_validity(SSL *s)
3842         {
3843         tls1_check_chain(s, NULL, NULL, NULL, SSL_PKEY_RSA_ENC);
3844         tls1_check_chain(s, NULL, NULL, NULL, SSL_PKEY_RSA_SIGN);
3845         tls1_check_chain(s, NULL, NULL, NULL, SSL_PKEY_DSA_SIGN);
3846         tls1_check_chain(s, NULL, NULL, NULL, SSL_PKEY_DH_RSA);
3847         tls1_check_chain(s, NULL, NULL, NULL, SSL_PKEY_DH_DSA);
3848         tls1_check_chain(s, NULL, NULL, NULL, SSL_PKEY_ECC);
3849         }
3850 /* User level utiity function to check a chain is suitable */
3851 int SSL_check_chain(SSL *s, X509 *x, EVP_PKEY *pk, STACK_OF(X509) *chain)
3852         {
3853         return tls1_check_chain(s, x, pk, chain, -1);
3854         }
3855
3856 #endif