ssl/t1_lib.c

   1 /* ssl/t1_lib.c */
   2 /* Copyright (C) 1995-1998 Eric Young (eay@cryptsoft.com)
   3  * All rights reserved.
   4  *
   5  * This package is an SSL implementation written
   6  * by Eric Young (eay@cryptsoft.com).
   7  * The implementation was written so as to conform with Netscapes SSL.
   8  *
   9  * This library is free for commercial and non-commercial use as long as
  10  * the following conditions are aheared to.  The following conditions
  11  * apply to all code found in this distribution, be it the RC4, RSA,
  12  * lhash, DES, etc., code; not just the SSL code.  The SSL documentation
  13  * included with this distribution is covered by the same copyright terms
  14  * except that the holder is Tim Hudson (tjh@cryptsoft.com).
  15  *
  16  * Copyright remains Eric Young's, and as such any Copyright notices in
  17  * the code are not to be removed.
  18  * If this package is used in a product, Eric Young should be given attribution
  19  * as the author of the parts of the library used.
  20  * This can be in the form of a textual message at program startup or
  21  * in documentation (online or textual) provided with the package.
  22  *
  23  * Redistribution and use in source and binary forms, with or without
  24  * modification, are permitted provided that the following conditions
  25  * are met:
  26  * 1. Redistributions of source code must retain the copyright
  27  *    notice, this list of conditions and the following disclaimer.
  28  * 2. Redistributions in binary form must reproduce the above copyright
  29  *    notice, this list of conditions and the following disclaimer in the
  30  *    documentation and/or other materials provided with the distribution.
  31  * 3. All advertising materials mentioning features or use of this software
  32  *    must display the following acknowledgement:
  33  *    "This product includes cryptographic software written by
  34  *     Eric Young (eay@cryptsoft.com)"
  35  *    The word 'cryptographic' can be left out if the rouines from the library
  36  *    being used are not cryptographic related :-).
  37  * 4. If you include any Windows specific code (or a derivative thereof) from
  38  *    the apps directory (application code) you must include an acknowledgement:
  39  *    "This product includes software written by Tim Hudson (tjh@cryptsoft.com)"
  40  *
  41  * THIS SOFTWARE IS PROVIDED BY ERIC YOUNG ``AS IS'' AND
  42  * ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
  43  * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE
  44  * ARE DISCLAIMED.  IN NO EVENT SHALL THE AUTHOR OR CONTRIBUTORS BE LIABLE
  45  * FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL
  46  * DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS
  47  * OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION)
  48  * HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT
  49  * LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY
  50  * OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF
  51  * SUCH DAMAGE.
  52  *
  53  * The licence and distribution terms for any publically available version or
  54  * derivative of this code cannot be changed.  i.e. this code cannot simply be
  55  * copied and put under another distribution licence
  56  * [including the GNU Public Licence.]
  57  */
  58 /* ====================================================================
  59  * Copyright (c) 1998-2007 The OpenSSL Project.  All rights reserved.
  60  *
  61  * Redistribution and use in source and binary forms, with or without
  62  * modification, are permitted provided that the following conditions
  63  * are met:
  64  *
  65  * 1. Redistributions of source code must retain the above copyright
  66  *    notice, this list of conditions and the following disclaimer.
  67  *
  68  * 2. Redistributions in binary form must reproduce the above copyright
  69  *    notice, this list of conditions and the following disclaimer in
  70  *    the documentation and/or other materials provided with the
  71  *    distribution.
  72  *
  73  * 3. All advertising materials mentioning features or use of this
  74  *    software must display the following acknowledgment:
  75  *    "This product includes software developed by the OpenSSL Project
  76  *    for use in the OpenSSL Toolkit. (http://www.openssl.org/)"
  77  *
  78  * 4. The names "OpenSSL Toolkit" and "OpenSSL Project" must not be used to
  79  *    endorse or promote products derived from this software without
  80  *    prior written permission. For written permission, please contact
  81  *    openssl-core@openssl.org.
  82  *
  83  * 5. Products derived from this software may not be called "OpenSSL"
  84  *    nor may "OpenSSL" appear in their names without prior written
  85  *    permission of the OpenSSL Project.
  86  *
  87  * 6. Redistributions of any form whatsoever must retain the following
  88  *    acknowledgment:
  89  *    "This product includes software developed by the OpenSSL Project
  90  *    for use in the OpenSSL Toolkit (http://www.openssl.org/)"
  91  *
  92  * THIS SOFTWARE IS PROVIDED BY THE OpenSSL PROJECT ``AS IS'' AND ANY
  93  * EXPRESSED OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
  94  * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
  95  * PURPOSE ARE DISCLAIMED.  IN NO EVENT SHALL THE OpenSSL PROJECT OR
  96  * ITS CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL,
  97  * SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT
  98  * NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES;
  99  * LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION)
 100  * HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT,
 101  * STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE)
 102  * ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED
 103  * OF THE POSSIBILITY OF SUCH DAMAGE.
 104  * ====================================================================
 105  *
 106  * This product includes cryptographic software written by Eric Young
 107  * (eay@cryptsoft.com).  This product includes software written by Tim
 108  * Hudson (tjh@cryptsoft.com).
 109  *
 110  */
 111
 112 #include <stdio.h>
 113 #include <openssl/objects.h>
 114 #include <openssl/evp.h>
 115 #include <openssl/hmac.h>
 116 #include <openssl/ocsp.h>
 117 #include <openssl/rand.h>
 118 #include "ssl_locl.h"
 119
 120 const char tls1_version_str[]="TLSv1" OPENSSL_VERSION_PTEXT;
 121
 122 #ifndef OPENSSL_NO_TLSEXT
 123 static int tls_decrypt_ticket(SSL *s, const unsigned char *tick, int ticklen,
 124                                 const unsigned char *sess_id, int sesslen,
 125                                 SSL_SESSION **psess);
 126 static int ssl_check_clienthello_tlsext_early(SSL *s);
 127 int ssl_check_serverhello_tlsext(SSL *s);
 128 #endif
 129
 130 SSL3_ENC_METHOD TLSv1_enc_data={
 131         tls1_enc,
 132         tls1_mac,
 133         tls1_setup_key_block,
 134         tls1_generate_master_secret,
 135         tls1_change_cipher_state,
 136         tls1_final_finish_mac,
 137         TLS1_FINISH_MAC_LENGTH,
 138         tls1_cert_verify_mac,
 139         TLS_MD_CLIENT_FINISH_CONST,TLS_MD_CLIENT_FINISH_CONST_SIZE,
 140         TLS_MD_SERVER_FINISH_CONST,TLS_MD_SERVER_FINISH_CONST_SIZE,
 141         tls1_alert_code,
 142         tls1_export_keying_material,
 143         };
 144
 145 long tls1_default_timeout(void)
 146         {
 147         /* 2 hours, the 24 hours mentioned in the TLSv1 spec
 148          * is way too long for http, the cache would over fill */
 149         return(60*60*2);
 150         }
 151
 152 int tls1_new(SSL *s)
 153         {
 154         if (!ssl3_new(s)) return(0);
 155         s->method->ssl_clear(s);
 156         return(1);
 157         }
 158
 159 void tls1_free(SSL *s)
 160         {
 161 #ifndef OPENSSL_NO_TLSEXT
 162         if (s->tlsext_session_ticket)
 163                 {
 164                 OPENSSL_free(s->tlsext_session_ticket);
 165                 }
 166 #endif /* OPENSSL_NO_TLSEXT */
 167         ssl3_free(s);
 168         }
 169
 170 void tls1_clear(SSL *s)
 171         {
 172         ssl3_clear(s);
 173         s->version = s->method->version;
 174         }
 175
 176 #ifndef OPENSSL_NO_EC
 177
 178 static int nid_list[] =
 179         {
 180                 NID_sect163k1, /* sect163k1 (1) */
 181                 NID_sect163r1, /* sect163r1 (2) */
 182                 NID_sect163r2, /* sect163r2 (3) */
 183                 NID_sect193r1, /* sect193r1 (4) */
 184                 NID_sect193r2, /* sect193r2 (5) */
 185                 NID_sect233k1, /* sect233k1 (6) */
 186                 NID_sect233r1, /* sect233r1 (7) */
 187                 NID_sect239k1, /* sect239k1 (8) */
 188                 NID_sect283k1, /* sect283k1 (9) */
 189                 NID_sect283r1, /* sect283r1 (10) */
 190                 NID_sect409k1, /* sect409k1 (11) */
 191                 NID_sect409r1, /* sect409r1 (12) */
 192                 NID_sect571k1, /* sect571k1 (13) */
 193                 NID_sect571r1, /* sect571r1 (14) */
 194                 NID_secp160k1, /* secp160k1 (15) */
 195                 NID_secp160r1, /* secp160r1 (16) */
 196                 NID_secp160r2, /* secp160r2 (17) */
 197                 NID_secp192k1, /* secp192k1 (18) */
 198                 NID_X9_62_prime192v1, /* secp192r1 (19) */
 199                 NID_secp224k1, /* secp224k1 (20) */
 200                 NID_secp224r1, /* secp224r1 (21) */
 201                 NID_secp256k1, /* secp256k1 (22) */
 202                 NID_X9_62_prime256v1, /* secp256r1 (23) */
 203                 NID_secp384r1, /* secp384r1 (24) */
 204                 NID_secp521r1  /* secp521r1 (25) */
 205         };
 206
 207
 208 static const unsigned char ecformats_default[] =
 209         {
 210         TLSEXT_ECPOINTFORMAT_uncompressed,
 211         TLSEXT_ECPOINTFORMAT_ansiX962_compressed_prime,
 212         TLSEXT_ECPOINTFORMAT_ansiX962_compressed_char2
 213         };
 214
 215 static const unsigned char eccurves_default[] =
 216         {
 217                 0,14, /* sect571r1 (14) */
 218                 0,13, /* sect571k1 (13) */
 219                 0,25, /* secp521r1 (25) */
 220                 0,11, /* sect409k1 (11) */
 221                 0,12, /* sect409r1 (12) */
 222                 0,24, /* secp384r1 (24) */
 223                 0,9,  /* sect283k1 (9) */
 224                 0,10, /* sect283r1 (10) */
 225                 0,22, /* secp256k1 (22) */
 226                 0,23, /* secp256r1 (23) */
 227                 0,8,  /* sect239k1 (8) */
 228                 0,6,  /* sect233k1 (6) */
 229                 0,7,  /* sect233r1 (7) */
 230                 0,20, /* secp224k1 (20) */
 231                 0,21, /* secp224r1 (21) */
 232                 0,4,  /* sect193r1 (4) */
 233                 0,5,  /* sect193r2 (5) */
 234                 0,18, /* secp192k1 (18) */
 235                 0,19, /* secp192r1 (19) */
 236                 0,1,  /* sect163k1 (1) */
 237                 0,2,  /* sect163r1 (2) */
 238                 0,3,  /* sect163r2 (3) */
 239                 0,15, /* secp160k1 (15) */
 240                 0,16, /* secp160r1 (16) */
 241                 0,17, /* secp160r2 (17) */
 242         };
 243
 244 int tls1_ec_curve_id2nid(int curve_id)
 245         {
 246         /* ECC curves from draft-ietf-tls-ecc-12.txt (Oct. 17, 2005) */
 247         if ((curve_id < 1) || ((unsigned int)curve_id >
 248                                 sizeof(nid_list)/sizeof(nid_list[0])))
 249                 return 0;
 250         return nid_list[curve_id-1];
 251         }
 252
 253 int tls1_ec_nid2curve_id(int nid)
 254         {
 255         /* ECC curves from draft-ietf-tls-ecc-12.txt (Oct. 17, 2005) */
 256         switch (nid)
 257                 {
 258         case NID_sect163k1: /* sect163k1 (1) */
 259                 return 1;
 260         case NID_sect163r1: /* sect163r1 (2) */
 261                 return 2;
 262         case NID_sect163r2: /* sect163r2 (3) */
 263                 return 3;
 264         case NID_sect193r1: /* sect193r1 (4) */
 265                 return 4;
 266         case NID_sect193r2: /* sect193r2 (5) */
 267                 return 5;
 268         case NID_sect233k1: /* sect233k1 (6) */
 269                 return 6;
 270         case NID_sect233r1: /* sect233r1 (7) */
 271                 return 7;
 272         case NID_sect239k1: /* sect239k1 (8) */
 273                 return 8;
 274         case NID_sect283k1: /* sect283k1 (9) */
 275                 return 9;
 276         case NID_sect283r1: /* sect283r1 (10) */
 277                 return 10;
 278         case NID_sect409k1: /* sect409k1 (11) */
 279                 return 11;
 280         case NID_sect409r1: /* sect409r1 (12) */
 281                 return 12;
 282         case NID_sect571k1: /* sect571k1 (13) */
 283                 return 13;
 284         case NID_sect571r1: /* sect571r1 (14) */
 285                 return 14;
 286         case NID_secp160k1: /* secp160k1 (15) */
 287                 return 15;
 288         case NID_secp160r1: /* secp160r1 (16) */
 289                 return 16;
 290         case NID_secp160r2: /* secp160r2 (17) */
 291                 return 17;
 292         case NID_secp192k1: /* secp192k1 (18) */
 293                 return 18;
 294         case NID_X9_62_prime192v1: /* secp192r1 (19) */
 295                 return 19;
 296         case NID_secp224k1: /* secp224k1 (20) */
 297                 return 20;
 298         case NID_secp224r1: /* secp224r1 (21) */
 299                 return 21;
 300         case NID_secp256k1: /* secp256k1 (22) */
 301                 return 22;
 302         case NID_X9_62_prime256v1: /* secp256r1 (23) */
 303                 return 23;
 304         case NID_secp384r1: /* secp384r1 (24) */
 305                 return 24;
 306         case NID_secp521r1:  /* secp521r1 (25) */
 307                 return 25;
 308         default:
 309                 return 0;
 310                 }
 311         }
 312 /* Get curves list, if "sess" is set return client curves otherwise
 313  * preferred list
 314  */
 315 static void tls1_get_curvelist(SSL *s, int sess,
 316                                         const unsigned char **pcurves,
 317                                         size_t *pcurveslen)
 318         {
 319         if (sess)
 320                 {
 321                 *pcurves = s->session->tlsext_ellipticcurvelist;
 322                 *pcurveslen = s->session->tlsext_ellipticcurvelist_length;
 323                 }
 324         else
 325                 {
 326                 *pcurves = s->tlsext_ellipticcurvelist;
 327                 *pcurveslen = s->tlsext_ellipticcurvelist_length;
 328                 }
 329         /* If not set use default: for now static structure */
 330         if (!*pcurves)
 331                 {
 332                 *pcurves = eccurves_default;
 333                 *pcurveslen = sizeof(eccurves_default);
 334                 }
 335         }
 336
 337 /* Return nth shared curve. If nmatch == -1 return number of
 338  * matches.
 339  */
 340
 341 int tls1_shared_curve(SSL *s, int nmatch)
 342         {
 343         const unsigned char *pref, *supp;
 344         size_t preflen, supplen, i, j;
 345         int k;
 346         /* Can't do anything on client side */
 347         if (s->server == 0)
 348                 return -1;
 349         tls1_get_curvelist(s, !!(s->options & SSL_OP_CIPHER_SERVER_PREFERENCE),
 350                                 &supp, &supplen);
 351         tls1_get_curvelist(s, !(s->options & SSL_OP_CIPHER_SERVER_PREFERENCE),
 352                                 &pref, &preflen);
 353         preflen /= 2;
 354         supplen /= 2;
 355         k = 0;
 356         for (i = 0; i < preflen; i++, pref+=2)
 357                 {
 358                 const unsigned char *tsupp = supp;
 359                 for (j = 0; j < supplen; j++, tsupp+=2)
 360                         {
 361                         if (pref[0] == tsupp[0] && pref[1] == tsupp[1])
 362                                 {
 363                                 if (nmatch == k)
 364                                         {
 365                                         int id = (pref[0] << 8) | pref[1];
 366                                         return tls1_ec_curve_id2nid(id);
 367                                         }
 368                                 k++;
 369                                 }
 370                         }
 371                 }
 372         if (nmatch == -1)
 373                 return k;
 374         return 0;
 375         }
 376
 377 int tls1_set_curves(unsigned char **pext, size_t *pextlen,
 378                         int *curves, size_t ncurves)
 379         {
 380         unsigned char *clist, *p;
 381         size_t i;
 382         /* Bitmap of curves included to detect duplicates: only works
 383          * while curve ids < 32
 384          */
 385         unsigned long dup_list = 0;
 386         clist = OPENSSL_malloc(ncurves * 2);
 387         if (!clist)
 388                 return 0;
 389         for (i = 0, p = clist; i < ncurves; i++)
 390                 {
 391                 unsigned long idmask;
 392                 int id;
 393                 id = tls1_ec_nid2curve_id(curves[i]);
 394                 idmask = 1L << id;
 395                 if (!id || (dup_list & idmask))
 396                         {
 397                         OPENSSL_free(clist);
 398                         return 0;
 399                         }
 400                 dup_list |= idmask;
 401                 s2n(id, p);
 402                 }
 403         if (*pext)
 404                 OPENSSL_free(*pext);
 405         *pext = clist;
 406         *pextlen = ncurves * 2;
 407         return 1;
 408         }
 409
 410 #define MAX_CURVELIST   25
 411
 412 typedef struct
 413         {
 414         size_t nidcnt;
 415         int nid_arr[MAX_CURVELIST];
 416         } nid_cb_st;
 417
 418 static int nid_cb(const char *elem, int len, void *arg)
 419         {
 420         nid_cb_st *narg = arg;
 421         size_t i;
 422         int nid;
 423         char etmp[20];
 424         if (narg->nidcnt == MAX_CURVELIST)
 425                 return 0;
 426         if (len > (int)(sizeof(etmp) - 1))
 427                 return 0;
 428         memcpy(etmp, elem, len);
 429         etmp[len] = 0;
 430         nid = EC_curve_nist2nid(etmp);
 431         if (nid == NID_undef)
 432                 nid = OBJ_sn2nid(etmp);
 433         if (nid == NID_undef)
 434                 nid = OBJ_ln2nid(etmp);
 435         if (nid == NID_undef)
 436                 return 0;
 437         for (i = 0; i < narg->nidcnt; i++)
 438                 if (narg->nid_arr[i] == nid)
 439                         return 0;
 440         narg->nid_arr[narg->nidcnt++] = nid;
 441         return 1;
 442         }
 443 /* Set curves based on a colon separate list */
 444 int tls1_set_curves_list(unsigned char **pext, size_t *pextlen,
 445                                 const char *str)
 446         {
 447         nid_cb_st ncb;
 448         ncb.nidcnt = 0;
 449         if (!CONF_parse_list(str, ':', 1, nid_cb, &ncb))
 450                 return 0;
 451         return tls1_set_curves(pext, pextlen, ncb.nid_arr, ncb.nidcnt);
 452         }
 453 /* For an EC key set TLS id and required compression based on parameters */
 454 static int tls1_set_ec_id(unsigned char *curve_id, unsigned char *comp_id,
 455                                 EC_KEY *ec)
 456         {
 457         int is_prime, id;
 458         const EC_GROUP *grp;
 459         const EC_POINT *pt;
 460         const EC_METHOD *meth;
 461         if (!ec)
 462                 return 0;
 463         /* Determine if it is a prime field */
 464         grp = EC_KEY_get0_group(ec);
 465         pt = EC_KEY_get0_public_key(ec);
 466         if (!grp || !pt)
 467                 return 0;
 468         meth = EC_GROUP_method_of(grp);
 469         if (!meth)
 470                 return 0;
 471         if (EC_METHOD_get_field_type(meth) == NID_X9_62_prime_field)
 472                 is_prime = 1;
 473         else
 474                 is_prime = 0;
 475         /* Determine curve ID */
 476         id = EC_GROUP_get_curve_name(grp);
 477         id = tls1_ec_nid2curve_id(id);
 478         /* If we have an ID set it, otherwise set arbitrary explicit curve */
 479         if (id)
 480                 {
 481                 curve_id[0] = 0;
 482                 curve_id[1] = (unsigned char)id;
 483                 }
 484         else
 485                 {
 486                 curve_id[0] = 0xff;
 487                 if (is_prime)
 488                         curve_id[1] = 0x01;
 489                 else
 490                         curve_id[1] = 0x02;
 491                 }
 492         if (comp_id)
 493                 {
 494                 if (EC_KEY_get_conv_form(ec) == POINT_CONVERSION_COMPRESSED)
 495                         {
 496                         if (is_prime)
 497                                 *comp_id = TLSEXT_ECPOINTFORMAT_ansiX962_compressed_prime;
 498                         else
 499                                 *comp_id = TLSEXT_ECPOINTFORMAT_ansiX962_compressed_char2;
 500                         }
 501                 else
 502                         *comp_id = TLSEXT_ECPOINTFORMAT_uncompressed;
 503                 }
 504         return 1;
 505         }
 506 /* Check an EC key is compatible with extensions */
 507 static int tls1_check_ec_key(SSL *s,
 508                         unsigned char *curve_id, unsigned char *comp_id)
 509         {
 510         const unsigned char *p;
 511         size_t plen, i;
 512         int j;
 513         /* If point formats extension present check it, otherwise everything
 514          * is supported (see RFC4492).
 515          */
 516         if (comp_id && s->session->tlsext_ecpointformatlist)
 517                 {
 518                 p = s->session->tlsext_ecpointformatlist;
 519                 plen = s->session->tlsext_ecpointformatlist_length;
 520                 for (i = 0; i < plen; i++, p++)
 521                         {
 522                         if (*comp_id == *p)
 523                                 break;
 524                         }
 525                 if (i == plen)
 526                         return 0;
 527                 }
 528         /* Check curve is consistent with client and server preferences */
 529         for (j = 0; j <= 1; j++)
 530                 {
 531                 tls1_get_curvelist(s, j, &p, &plen);
 532                 for (i = 0; i < plen; i+=2, p+=2)
 533                         {
 534                         if (p[0] == curve_id[0] && p[1] == curve_id[1])
 535                                 break;
 536                         }
 537                 if (i == plen)
 538                         return 0;
 539                 }
 540         return 1;
 541         }
 542
 543 /* Check cert parameters compatible with extensions: currently just checks
 544  * EC certificates have compatible curves and compression.
 545  */
 546 static int tls1_check_cert_param(SSL *s, X509 *x)
 547         {
 548         unsigned char comp_id, curve_id[2];
 549         EVP_PKEY *pkey;
 550         int rv;
 551         pkey = X509_get_pubkey(x);
 552         if (!pkey)
 553                 return 0;
 554         /* If not EC nothing to do */
 555         if (pkey->type != EVP_PKEY_EC)
 556                 {
 557                 EVP_PKEY_free(pkey);
 558                 return 1;
 559                 }
 560         rv = tls1_set_ec_id(curve_id, &comp_id, pkey->pkey.ec);
 561         EVP_PKEY_free(pkey);
 562         if (!rv)
 563                 return 0;
 564         return tls1_check_ec_key(s, curve_id, &comp_id);
 565         }
 566 /* Check EC temporary key is compatible with client extensions */
 567 int tls1_check_ec_tmp_key(SSL *s)
 568         {
 569         unsigned char curve_id[2];
 570         EC_KEY *ec = s->cert->ecdh_tmp;
 571         if (s->cert->ecdh_tmp_auto)
 572                 {
 573                 /* Need a shared curve */
 574                 if (tls1_shared_curve(s, 0))
 575                         return 1;
 576                 else return 0;
 577                 }
 578         if (!ec)
 579                 {
 580                 if (s->cert->ecdh_tmp_cb)
 581                         return 1;
 582                 else
 583                         return 0;
 584                 }
 585         if (!tls1_set_ec_id(curve_id, NULL, ec))
 586                 return 1;
 587         return tls1_check_ec_key(s, curve_id, NULL);
 588         }
 589
 590 #endif /* OPENSSL_NO_EC */
 591
 592 #ifndef OPENSSL_NO_TLSEXT
 593
 594 /* List of supported signature algorithms and hashes. Should make this
 595  * customisable at some point, for now include everything we support.
 596  */
 597
 598 #ifdef OPENSSL_NO_RSA
 599 #define tlsext_sigalg_rsa(md) /* */
 600 #else
 601 #define tlsext_sigalg_rsa(md) md, TLSEXT_signature_rsa,
 602 #endif
 603
 604 #ifdef OPENSSL_NO_DSA
 605 #define tlsext_sigalg_dsa(md) /* */
 606 #else
 607 #define tlsext_sigalg_dsa(md) md, TLSEXT_signature_dsa,
 608 #endif
 609
 610 #ifdef OPENSSL_NO_ECDSA
 611 #define tlsext_sigalg_ecdsa(md) /* */
 612 #else
 613 #define tlsext_sigalg_ecdsa(md) md, TLSEXT_signature_ecdsa,
 614 #endif
 615
 616 #define tlsext_sigalg(md) \
 617                 tlsext_sigalg_rsa(md) \
 618                 tlsext_sigalg_dsa(md) \
 619                 tlsext_sigalg_ecdsa(md)
 620
 621 static unsigned char tls12_sigalgs[] = {
 622 #ifndef OPENSSL_NO_SHA512
 623         tlsext_sigalg(TLSEXT_hash_sha512)
 624         tlsext_sigalg(TLSEXT_hash_sha384)
 625 #endif
 626 #ifndef OPENSSL_NO_SHA256
 627         tlsext_sigalg(TLSEXT_hash_sha256)
 628         tlsext_sigalg(TLSEXT_hash_sha224)
 629 #endif
 630 #ifndef OPENSSL_NO_SHA
 631         tlsext_sigalg(TLSEXT_hash_sha1)
 632 #endif
 633 #ifndef OPENSSL_NO_MD5
 634         tlsext_sigalg_rsa(TLSEXT_hash_md5)
 635 #endif
 636 };
 637
 638 size_t tls12_get_psigalgs(SSL *s, const unsigned char **psigs)
 639         {
 640         /* If server use client authentication sigalgs if not NULL */
 641         if (s->server && s->cert->client_sigalgs)
 642                 {
 643                 *psigs = s->cert->client_sigalgs;
 644                 return s->cert->client_sigalgslen;
 645                 }
 646         else if (s->cert->conf_sigalgs)
 647                 {
 648                 *psigs = s->cert->conf_sigalgs;
 649                 return s->cert->conf_sigalgslen;
 650                 }
 651         else
 652                 {
 653                 *psigs = tls12_sigalgs;
 654 #ifdef OPENSSL_FIPS
 655                 /* If FIPS mode don't include MD5 which is last */
 656                 if (FIPS_mode())
 657                         return sizeof(tls12_sigalgs) - 2;
 658                 else
 659 #endif
 660                         return sizeof(tls12_sigalgs);
 661                 }
 662         }
 663 /* Get a mask of disabled algorithms: an algorithm is disabled
 664  * if it isn't supported or doesn't appear in supported signature
 665  * algorithms. Unlike ssl_cipher_get_disabled this applies to a specific
 666  * session and not global settings.
 667  *
 668  */
 669 void ssl_set_client_disabled(SSL *s)
 670         {
 671         CERT *c = s->cert;
 672         const unsigned char *sigalgs;
 673         size_t i, sigalgslen;
 674         int have_rsa = 0, have_dsa = 0, have_ecdsa = 0;
 675         c->mask_a = 0;
 676         c->mask_k = 0;
 677         /* If less than TLS 1.2 don't allow TLS 1.2 only ciphers */
 678         if (TLS1_get_version(s) < TLS1_2_VERSION)
 679                 c->mask_ssl = SSL_TLSV1_2;
 680         else
 681                 c->mask_ssl = 0;
 682         /* Now go through all signature algorithms seeing if we support
 683          * any for RSA, DSA, ECDSA. Do this for all versions not just
 684          * TLS 1.2.
 685          */
 686         sigalgslen = tls12_get_psigalgs(s, &sigalgs);
 687         for (i = 0; i < sigalgslen; i += 2, sigalgs += 2)
 688                 {
 689                 switch(sigalgs[1])
 690                         {
 691 #ifndef OPENSSL_NO_RSA
 692                 case TLSEXT_signature_rsa:
 693                         have_rsa = 1;
 694                         break;
 695 #endif
 696 #ifndef OPENSSL_NO_DSA
 697                 case TLSEXT_signature_dsa:
 698                         have_dsa = 1;
 699                         break;
 700 #endif
 701 #ifndef OPENSSL_NO_ECDSA
 702                 case TLSEXT_signature_ecdsa:
 703                         have_ecdsa = 1;
 704                         break;
 705 #endif
 706                         }
 707                 }
 708         /* Disable auth and static DH if we don't include any appropriate
 709          * signature algorithms.
 710          */
 711         if (!have_rsa)
 712                 {
 713                 c->mask_a |= SSL_aRSA;
 714                 c->mask_k |= SSL_kDHr|SSL_kECDHr;
 715                 }
 716         if (!have_dsa)
 717                 {
 718                 c->mask_a |= SSL_aDSS;
 719                 c->mask_k |= SSL_kDHd;
 720                 }
 721         if (!have_ecdsa)
 722                 {
 723                 c->mask_a |= SSL_aECDSA;
 724                 c->mask_k |= SSL_kECDHe;
 725                 }
 726 #ifndef OPENSSL_NO_KRB5
 727         if (!kssl_tgt_is_available(s->kssl_ctx))
 728                 {
 729                 c->mask_a |= SSL_aKRB5;
 730                 c->mask_k |= SSL_kKRB5;
 731                 }
 732 #endif
 733 #ifndef OPENSSL_NO_PSK
 734         /* with PSK there must be client callback set */
 735         if (!s->psk_client_callback)
 736                 {
 737                 c->mask_a |= SSL_aPSK;
 738                 c->mask_k |= SSL_kPSK;
 739                 }
 740 #endif /* OPENSSL_NO_PSK */
 741         c->valid = 1;
 742         }
 743
 744 /* byte_compare is a compare function for qsort(3) that compares bytes. */
 745 static int byte_compare(const void *in_a, const void *in_b)
 746         {
 747         unsigned char a = *((const unsigned char*) in_a);
 748         unsigned char b = *((const unsigned char*) in_b);
 749
 750         if (a > b)
 751                 return 1;
 752         else if (a < b)
 753                 return -1;
 754         return 0;
 755 }
 756
 757 unsigned char *ssl_add_clienthello_tlsext(SSL *s, unsigned char *p, unsigned char *limit)
 758         {
 759         int extdatalen=0;
 760         unsigned char *ret = p;
 761 #ifndef OPENSSL_NO_EC
 762         /* See if we support any ECC ciphersuites */
 763         int using_ecc = 0;
 764         if (s->version != DTLS1_VERSION && s->version >= TLS1_VERSION)
 765                 {
 766                 int i;
 767                 unsigned long alg_k, alg_a;
 768                 STACK_OF(SSL_CIPHER) *cipher_stack = SSL_get_ciphers(s);
 769
 770                 for (i = 0; i < sk_SSL_CIPHER_num(cipher_stack); i++)
 771                         {
 772                         SSL_CIPHER *c = sk_SSL_CIPHER_value(cipher_stack, i);
 773
 774                         alg_k = c->algorithm_mkey;
 775                         alg_a = c->algorithm_auth;
 776                         if ((alg_k & (SSL_kEECDH|SSL_kECDHr|SSL_kECDHe)
 777                                 || (alg_a & SSL_aECDSA)))
 778                                 {
 779                                 using_ecc = 1;
 780                                 break;
 781                                 }
 782                         }
 783                 }
 784 #endif
 785
 786         /* don't add extensions for SSLv3 unless doing secure renegotiation */
 787         if (s->client_version == SSL3_VERSION
 788                                         && !s->s3->send_connection_binding)
 789                 return p;
 790
 791         ret+=2;
 792
 793         if (ret>=limit) return NULL; /* this really never occurs, but ... */
 794
 795         if (s->tlsext_hostname != NULL)
 796                 {
 797                 /* Add TLS extension servername to the Client Hello message */
 798                 unsigned long size_str;
 799                 long lenmax;
 800
 801                 /* check for enough space.
 802                    4 for the servername type and entension length
 803                    2 for servernamelist length
 804                    1 for the hostname type
 805                    2 for hostname length
 806                    + hostname length
 807                 */
 808
 809                 if ((lenmax = limit - ret - 9) < 0
 810                     || (size_str = strlen(s->tlsext_hostname)) > (unsigned long)lenmax)
 811                         return NULL;
 812
 813                 /* extension type and length */
 814                 s2n(TLSEXT_TYPE_server_name,ret);
 815                 s2n(size_str+5,ret);
 816
 817                 /* length of servername list */
 818                 s2n(size_str+3,ret);
 819
 820                 /* hostname type, length and hostname */
 821                 *(ret++) = (unsigned char) TLSEXT_NAMETYPE_host_name;
 822                 s2n(size_str,ret);
 823                 memcpy(ret, s->tlsext_hostname, size_str);
 824                 ret+=size_str;
 825                 }
 826
 827         /* Add RI if renegotiating */
 828         if (s->renegotiate)
 829           {
 830           int el;
 831
 832           if(!ssl_add_clienthello_renegotiate_ext(s, 0, &el, 0))
 833               {
 834               SSLerr(SSL_F_SSL_ADD_CLIENTHELLO_TLSEXT, ERR_R_INTERNAL_ERROR);
 835               return NULL;
 836               }
 837
 838           if((limit - p - 4 - el) < 0) return NULL;
 839
 840           s2n(TLSEXT_TYPE_renegotiate,ret);
 841           s2n(el,ret);
 842
 843           if(!ssl_add_clienthello_renegotiate_ext(s, ret, &el, el))
 844               {
 845               SSLerr(SSL_F_SSL_ADD_CLIENTHELLO_TLSEXT, ERR_R_INTERNAL_ERROR);
 846               return NULL;
 847               }
 848
 849           ret += el;
 850         }
 851
 852 #ifndef OPENSSL_NO_SRP
 853         /* Add SRP username if there is one */
 854         if (s->srp_ctx.login != NULL)
 855                 { /* Add TLS extension SRP username to the Client Hello message */
 856
 857                 int login_len = strlen(s->srp_ctx.login);
 858                 if (login_len > 255 || login_len == 0)
 859                         {
 860                         SSLerr(SSL_F_SSL_ADD_CLIENTHELLO_TLSEXT, ERR_R_INTERNAL_ERROR);
 861                         return NULL;
 862                         }
 863
 864                 /* check for enough space.
 865                    4 for the srp type type and entension length
 866                    1 for the srp user identity
 867                    + srp user identity length
 868                 */
 869                 if ((limit - ret - 5 - login_len) < 0) return NULL;
 870
 871                 /* fill in the extension */
 872                 s2n(TLSEXT_TYPE_srp,ret);
 873                 s2n(login_len+1,ret);
 874                 (*ret++) = (unsigned char) login_len;
 875                 memcpy(ret, s->srp_ctx.login, login_len);
 876                 ret+=login_len;
 877                 }
 878 #endif
 879
 880 #ifndef OPENSSL_NO_EC
 881         if (using_ecc)
 882                 {
 883                 /* Add TLS extension ECPointFormats to the ClientHello message */
 884                 long lenmax;
 885                 const unsigned char *plist;
 886                 size_t plistlen;
 887                 /* If we have a custom point format list use it otherwise
 888                  * use default */
 889                 plist = s->tlsext_ecpointformatlist;
 890                 if (plist)
 891                         plistlen = s->tlsext_ecpointformatlist_length;
 892                 else
 893                         {
 894                         plist = ecformats_default;
 895                         plistlen = sizeof(ecformats_default);
 896                         }
 897
 898                 if ((lenmax = limit - ret - 5) < 0) return NULL;
 899                 if (plistlen > (size_t)lenmax) return NULL;
 900                 if (plistlen > 255)
 901                         {
 902                         SSLerr(SSL_F_SSL_ADD_CLIENTHELLO_TLSEXT, ERR_R_INTERNAL_ERROR);
 903                         return NULL;
 904                         }
 905
 906                 s2n(TLSEXT_TYPE_ec_point_formats,ret);
 907                 s2n(plistlen + 1,ret);
 908                 *(ret++) = (unsigned char)plistlen ;
 909                 memcpy(ret, plist, plistlen);
 910                 ret+=plistlen;
 911
 912                 /* Add TLS extension EllipticCurves to the ClientHello message */
 913                 plist = s->tlsext_ellipticcurvelist;
 914                 tls1_get_curvelist(s, 0, &plist, &plistlen);
 915
 916                 if ((lenmax = limit - ret - 6) < 0) return NULL;
 917                 if (plistlen > (size_t)lenmax) return NULL;
 918                 if (plistlen > 65532)
 919                         {
 920                         SSLerr(SSL_F_SSL_ADD_CLIENTHELLO_TLSEXT, ERR_R_INTERNAL_ERROR);
 921                         return NULL;
 922                         }
 923
 924                 s2n(TLSEXT_TYPE_elliptic_curves,ret);
 925                 s2n(plistlen + 2, ret);
 926
 927                 /* NB: draft-ietf-tls-ecc-12.txt uses a one-byte prefix for
 928                  * elliptic_curve_list, but the examples use two bytes.
 929                  * http://www1.ietf.org/mail-archive/web/tls/current/msg00538.html
 930                  * resolves this to two bytes.
 931                  */
 932                 s2n(plistlen, ret);
 933                 memcpy(ret, plist, plistlen);
 934                 ret+=plistlen;
 935                 }
 936 #endif /* OPENSSL_NO_EC */
 937
 938         if (!(SSL_get_options(s) & SSL_OP_NO_TICKET))
 939                 {
 940                 int ticklen;
 941                 if (!s->new_session && s->session && s->session->tlsext_tick)
 942                         ticklen = s->session->tlsext_ticklen;
 943                 else if (s->session && s->tlsext_session_ticket &&
 944                          s->tlsext_session_ticket->data)
 945                         {
 946                         ticklen = s->tlsext_session_ticket->length;
 947                         s->session->tlsext_tick = OPENSSL_malloc(ticklen);
 948                         if (!s->session->tlsext_tick)
 949                                 return NULL;
 950                         memcpy(s->session->tlsext_tick,
 951                                s->tlsext_session_ticket->data,
 952                                ticklen);
 953                         s->session->tlsext_ticklen = ticklen;
 954                         }
 955                 else
 956                         ticklen = 0;
 957                 if (ticklen == 0 && s->tlsext_session_ticket &&
 958                     s->tlsext_session_ticket->data == NULL)
 959                         goto skip_ext;
 960                 /* Check for enough room 2 for extension type, 2 for len
 961                  * rest for ticket
 962                  */
 963                 if ((long)(limit - ret - 4 - ticklen) < 0) return NULL;
 964                 s2n(TLSEXT_TYPE_session_ticket,ret);
 965                 s2n(ticklen,ret);
 966                 if (ticklen)
 967                         {
 968                         memcpy(ret, s->session->tlsext_tick, ticklen);
 969                         ret += ticklen;
 970                         }
 971                 }
 972                 skip_ext:
 973
 974         if (TLS1_get_client_version(s) >= TLS1_2_VERSION)
 975                 {
 976                 size_t salglen;
 977                 const unsigned char *salg;
 978                 salglen = tls12_get_psigalgs(s, &salg);
 979                 if ((size_t)(limit - ret) < salglen + 6)
 980                         return NULL;
 981                 s2n(TLSEXT_TYPE_signature_algorithms,ret);
 982                 s2n(salglen + 2, ret);
 983                 s2n(salglen, ret);
 984                 memcpy(ret, salg, salglen);
 985                 ret += salglen;
 986                 }
 987
 988 #ifdef TLSEXT_TYPE_opaque_prf_input
 989         if (s->s3->client_opaque_prf_input != NULL &&
 990             s->version != DTLS1_VERSION)
 991                 {
 992                 size_t col = s->s3->client_opaque_prf_input_len;
 993
 994                 if ((long)(limit - ret - 6 - col < 0))
 995                         return NULL;
 996                 if (col > 0xFFFD) /* can't happen */
 997                         return NULL;
 998
 999                 s2n(TLSEXT_TYPE_opaque_prf_input, ret);
1000                 s2n(col + 2, ret);
1001                 s2n(col, ret);
1002                 memcpy(ret, s->s3->client_opaque_prf_input, col);
1003                 ret += col;
1004                 }
1005 #endif
1006
1007         if (s->tlsext_status_type == TLSEXT_STATUSTYPE_ocsp &&
1008             s->version != DTLS1_VERSION)
1009                 {
1010                 int i;
1011                 long extlen, idlen, itmp;
1012                 OCSP_RESPID *id;
1013
1014                 idlen = 0;
1015                 for (i = 0; i < sk_OCSP_RESPID_num(s->tlsext_ocsp_ids); i++)
1016                         {
1017                         id = sk_OCSP_RESPID_value(s->tlsext_ocsp_ids, i);
1018                         itmp = i2d_OCSP_RESPID(id, NULL);
1019                         if (itmp <= 0)
1020                                 return NULL;
1021                         idlen += itmp + 2;
1022                         }
1023
1024                 if (s->tlsext_ocsp_exts)
1025                         {
1026                         extlen = i2d_X509_EXTENSIONS(s->tlsext_ocsp_exts, NULL);
1027                         if (extlen < 0)
1028                                 return NULL;
1029                         }
1030                 else
1031                         extlen = 0;
1032
1033                 if ((long)(limit - ret - 7 - extlen - idlen) < 0) return NULL;
1034                 s2n(TLSEXT_TYPE_status_request, ret);
1035                 if (extlen + idlen > 0xFFF0)
1036                         return NULL;
1037                 s2n(extlen + idlen + 5, ret);
1038                 *(ret++) = TLSEXT_STATUSTYPE_ocsp;
1039                 s2n(idlen, ret);
1040                 for (i = 0; i < sk_OCSP_RESPID_num(s->tlsext_ocsp_ids); i++)
1041                         {
1042                         /* save position of id len */
1043                         unsigned char *q = ret;
1044                         id = sk_OCSP_RESPID_value(s->tlsext_ocsp_ids, i);
1045                         /* skip over id len */
1046                         ret += 2;
1047                         itmp = i2d_OCSP_RESPID(id, &ret);
1048                         /* write id len */
1049                         s2n(itmp, q);
1050                         }
1051                 s2n(extlen, ret);
1052                 if (extlen > 0)
1053                         i2d_X509_EXTENSIONS(s->tlsext_ocsp_exts, &ret);
1054                 }
1055
1056 #ifndef OPENSSL_NO_HEARTBEATS
1057         /* Add Heartbeat extension */
1058         s2n(TLSEXT_TYPE_heartbeat,ret);
1059         s2n(1,ret);
1060         /* Set mode:
1061          * 1: peer may send requests
1062          * 2: peer not allowed to send requests
1063          */
1064         if (s->tlsext_heartbeat & SSL_TLSEXT_HB_DONT_RECV_REQUESTS)
1065                 *(ret++) = SSL_TLSEXT_HB_DONT_SEND_REQUESTS;
1066         else
1067                 *(ret++) = SSL_TLSEXT_HB_ENABLED;
1068 #endif
1069
1070 #ifndef OPENSSL_NO_NEXTPROTONEG
1071         if (s->ctx->next_proto_select_cb && !s->s3->tmp.finish_md_len)
1072                 {
1073                 /* The client advertises an emtpy extension to indicate its
1074                  * support for Next Protocol Negotiation */
1075                 if (limit - ret - 4 < 0)
1076                         return NULL;
1077                 s2n(TLSEXT_TYPE_next_proto_neg,ret);
1078                 s2n(0,ret);
1079                 }
1080 #endif
1081
1082         if(SSL_get_srtp_profiles(s))
1083                 {
1084                 int el;
1085
1086                 ssl_add_clienthello_use_srtp_ext(s, 0, &el, 0);
1087
1088                 if((limit - p - 4 - el) < 0) return NULL;
1089
1090                 s2n(TLSEXT_TYPE_use_srtp,ret);
1091                 s2n(el,ret);
1092
1093                 if(ssl_add_clienthello_use_srtp_ext(s, ret, &el, el))
1094                         {
1095                         SSLerr(SSL_F_SSL_ADD_CLIENTHELLO_TLSEXT, ERR_R_INTERNAL_ERROR);
1096                         return NULL;
1097                         }
1098                 ret += el;
1099                 }
1100
1101         /* Add TLS extension Server_Authz_DataFormats to the ClientHello */
1102         /* 2 bytes for extension type */
1103         /* 2 bytes for extension length */
1104         /* 1 byte for the list length */
1105         /* 1 byte for the list (we only support audit proofs) */
1106         if (s->ctx->tlsext_authz_server_audit_proof_cb != NULL)
1107                 {
1108                 size_t lenmax;
1109                 const unsigned short ext_len = 2;
1110                 const unsigned char list_len = 1;
1111
1112                 if ((lenmax = limit - ret - 6) < 0) return NULL;
1113
1114                 s2n(TLSEXT_TYPE_server_authz, ret);
1115                 /* Extension length: 2 bytes */
1116                 s2n(ext_len, ret);
1117                 *(ret++) = list_len;
1118                 *(ret++) = TLSEXT_AUTHZDATAFORMAT_audit_proof;
1119                 }
1120
1121         if ((extdatalen = ret-p-2) == 0)
1122                 return p;
1123
1124         s2n(extdatalen,p);
1125         return ret;
1126         }
1127
1128 unsigned char *ssl_add_serverhello_tlsext(SSL *s, unsigned char *p, unsigned char *limit)
1129         {
1130         int extdatalen=0;
1131         unsigned char *ret = p;
1132 #ifndef OPENSSL_NO_NEXTPROTONEG
1133         int next_proto_neg_seen;
1134 #endif
1135
1136         /* don't add extensions for SSLv3, unless doing secure renegotiation */
1137         if (s->version == SSL3_VERSION && !s->s3->send_connection_binding)
1138                 return p;
1139
1140         ret+=2;
1141         if (ret>=limit) return NULL; /* this really never occurs, but ... */
1142
1143         if (!s->hit && s->servername_done == 1 && s->session->tlsext_hostname != NULL)
1144                 {
1145                 if ((long)(limit - ret - 4) < 0) return NULL;
1146
1147                 s2n(TLSEXT_TYPE_server_name,ret);
1148                 s2n(0,ret);
1149                 }
1150
1151         if(s->s3->send_connection_binding)
1152         {
1153           int el;
1154
1155           if(!ssl_add_serverhello_renegotiate_ext(s, 0, &el, 0))
1156               {
1157               SSLerr(SSL_F_SSL_ADD_SERVERHELLO_TLSEXT, ERR_R_INTERNAL_ERROR);
1158               return NULL;
1159               }
1160
1161           if((limit - p - 4 - el) < 0) return NULL;
1162
1163           s2n(TLSEXT_TYPE_renegotiate,ret);
1164           s2n(el,ret);
1165
1166           if(!ssl_add_serverhello_renegotiate_ext(s, ret, &el, el))
1167               {
1168               SSLerr(SSL_F_SSL_ADD_SERVERHELLO_TLSEXT, ERR_R_INTERNAL_ERROR);
1169               return NULL;
1170               }
1171
1172           ret += el;
1173         }
1174
1175 #ifndef OPENSSL_NO_EC
1176         if (s->tlsext_ecpointformatlist != NULL &&
1177             s->version != DTLS1_VERSION)
1178                 {
1179                 /* Add TLS extension ECPointFormats to the ServerHello message */
1180                 long lenmax;
1181
1182                 if ((lenmax = limit - ret - 5) < 0) return NULL;
1183                 if (s->tlsext_ecpointformatlist_length > (unsigned long)lenmax) return NULL;
1184                 if (s->tlsext_ecpointformatlist_length > 255)
1185                         {
1186                         SSLerr(SSL_F_SSL_ADD_SERVERHELLO_TLSEXT, ERR_R_INTERNAL_ERROR);
1187                         return NULL;
1188                         }
1189
1190                 s2n(TLSEXT_TYPE_ec_point_formats,ret);
1191                 s2n(s->tlsext_ecpointformatlist_length + 1,ret);
1192                 *(ret++) = (unsigned char) s->tlsext_ecpointformatlist_length;
1193                 memcpy(ret, s->tlsext_ecpointformatlist, s->tlsext_ecpointformatlist_length);
1194                 ret+=s->tlsext_ecpointformatlist_length;
1195
1196                 }
1197         /* Currently the server should not respond with a SupportedCurves extension */
1198 #endif /* OPENSSL_NO_EC */
1199
1200         if (s->tlsext_ticket_expected
1201                 && !(SSL_get_options(s) & SSL_OP_NO_TICKET))
1202                 {
1203                 if ((long)(limit - ret - 4) < 0) return NULL;
1204                 s2n(TLSEXT_TYPE_session_ticket,ret);
1205                 s2n(0,ret);
1206                 }
1207
1208         if (s->tlsext_status_expected)
1209                 {
1210                 if ((long)(limit - ret - 4) < 0) return NULL;
1211                 s2n(TLSEXT_TYPE_status_request,ret);
1212                 s2n(0,ret);
1213                 }
1214
1215 #ifdef TLSEXT_TYPE_opaque_prf_input
1216         if (s->s3->server_opaque_prf_input != NULL &&
1217             s->version != DTLS1_VERSION)
1218                 {
1219                 size_t sol = s->s3->server_opaque_prf_input_len;
1220
1221                 if ((long)(limit - ret - 6 - sol) < 0)
1222                         return NULL;
1223                 if (sol > 0xFFFD) /* can't happen */
1224                         return NULL;
1225
1226                 s2n(TLSEXT_TYPE_opaque_prf_input, ret);
1227                 s2n(sol + 2, ret);
1228                 s2n(sol, ret);
1229                 memcpy(ret, s->s3->server_opaque_prf_input, sol);
1230                 ret += sol;
1231                 }
1232 #endif
1233
1234         if(s->srtp_profile)
1235                 {
1236                 int el;
1237
1238                 ssl_add_serverhello_use_srtp_ext(s, 0, &el, 0);
1239
1240                 if((limit - p - 4 - el) < 0) return NULL;
1241
1242                 s2n(TLSEXT_TYPE_use_srtp,ret);
1243                 s2n(el,ret);
1244
1245                 if(ssl_add_serverhello_use_srtp_ext(s, ret, &el, el))
1246                         {
1247                         SSLerr(SSL_F_SSL_ADD_SERVERHELLO_TLSEXT, ERR_R_INTERNAL_ERROR);
1248                         return NULL;
1249                         }
1250                 ret+=el;
1251                 }
1252
1253         if (((s->s3->tmp.new_cipher->id & 0xFFFF)==0x80 || (s->s3->tmp.new_cipher->id & 0xFFFF)==0x81)
1254                 && (SSL_get_options(s) & SSL_OP_CRYPTOPRO_TLSEXT_BUG))
1255                 { const unsigned char cryptopro_ext[36] = {
1256                         0xfd, 0xe8, /*65000*/
1257                         0x00, 0x20, /*32 bytes length*/
1258                         0x30, 0x1e, 0x30, 0x08, 0x06, 0x06, 0x2a, 0x85,
1259                         0x03,   0x02, 0x02, 0x09, 0x30, 0x08, 0x06, 0x06,
1260                         0x2a, 0x85, 0x03, 0x02, 0x02, 0x16, 0x30, 0x08,
1261                         0x06, 0x06, 0x2a, 0x85, 0x03, 0x02, 0x02, 0x17};
1262                         if (limit-ret<36) return NULL;
1263                         memcpy(ret,cryptopro_ext,36);
1264                         ret+=36;
1265
1266                 }
1267
1268 #ifndef OPENSSL_NO_HEARTBEATS
1269         /* Add Heartbeat extension if we've received one */
1270         if (s->tlsext_heartbeat & SSL_TLSEXT_HB_ENABLED)
1271                 {
1272                 s2n(TLSEXT_TYPE_heartbeat,ret);
1273                 s2n(1,ret);
1274                 /* Set mode:
1275                  * 1: peer may send requests
1276                  * 2: peer not allowed to send requests
1277                  */
1278                 if (s->tlsext_heartbeat & SSL_TLSEXT_HB_DONT_RECV_REQUESTS)
1279                         *(ret++) = SSL_TLSEXT_HB_DONT_SEND_REQUESTS;
1280                 else
1281                         *(ret++) = SSL_TLSEXT_HB_ENABLED;
1282
1283                 }
1284 #endif
1285
1286 #ifndef OPENSSL_NO_NEXTPROTONEG
1287         next_proto_neg_seen = s->s3->next_proto_neg_seen;
1288         s->s3->next_proto_neg_seen = 0;
1289         if (next_proto_neg_seen && s->ctx->next_protos_advertised_cb)
1290                 {
1291                 const unsigned char *npa;
1292                 unsigned int npalen;
1293                 int r;
1294
1295                 r = s->ctx->next_protos_advertised_cb(s, &npa, &npalen, s->ctx->next_protos_advertised_cb_arg);
1296                 if (r == SSL_TLSEXT_ERR_OK)
1297                         {
1298                         if ((long)(limit - ret - 4 - npalen) < 0) return NULL;
1299                         s2n(TLSEXT_TYPE_next_proto_neg,ret);
1300                         s2n(npalen,ret);
1301                         memcpy(ret, npa, npalen);
1302                         ret += npalen;
1303                         s->s3->next_proto_neg_seen = 1;
1304                         }
1305                 }
1306 #endif
1307
1308         /* If the client supports authz then see whether we have any to offer
1309          * to it. */
1310         if (s->s3->tlsext_authz_client_types_len)
1311                 {
1312                 size_t authz_length;
1313                 /* By now we already know the new cipher, so we can look ahead
1314                  * to see whether the cert we are going to send
1315                  * has any authz data attached to it. */
1316                 const unsigned char* authz = ssl_get_authz_data(s, &authz_length);
1317                 const unsigned char* const orig_authz = authz;
1318                 size_t i;
1319                 unsigned authz_count = 0;
1320
1321                 /* The authz data contains a number of the following structures:
1322                  *      uint8_t authz_type
1323                  *      uint16_t length
1324                  *      uint8_t data[length]
1325                  *
1326                  * First we walk over it to find the number of authz elements. */
1327                 for (i = 0; i < authz_length; i++)
1328                         {
1329                         unsigned short length;
1330                         unsigned char type;
1331
1332                         type = *(authz++);
1333                         if (memchr(s->s3->tlsext_authz_client_types,
1334                                    type,
1335                                    s->s3->tlsext_authz_client_types_len) != NULL)
1336                                 authz_count++;
1337
1338                         n2s(authz, length);
1339                         /* n2s increments authz by 2 */
1340                         i += 2;
1341                         authz += length;
1342                         i += length;
1343                         }
1344
1345                 if (authz_count)
1346                         {
1347                         /* Add TLS extension server_authz to the ServerHello message
1348                          * 2 bytes for extension type
1349                          * 2 bytes for extension length
1350                          * 1 byte for the list length
1351                          * n bytes for the list */
1352                         const unsigned short ext_len = 1 + authz_count;
1353
1354                         if ((long)(limit - ret - 4 - ext_len) < 0) return NULL;
1355                         s2n(TLSEXT_TYPE_server_authz, ret);
1356                         s2n(ext_len, ret);
1357                         *(ret++) = authz_count;
1358                         s->s3->tlsext_authz_promised_to_client = 1;
1359                         }
1360
1361                 authz = orig_authz;
1362                 for (i = 0; i < authz_length; i++)
1363                         {
1364                         unsigned short length;
1365                         unsigned char type;
1366
1367                         authz_count++;
1368                         type = *(authz++);
1369                         if (memchr(s->s3->tlsext_authz_client_types,
1370                                    type,
1371                                    s->s3->tlsext_authz_client_types_len) != NULL)
1372                                 *(ret++) = type;
1373                         n2s(authz, length);
1374                         /* n2s increments authz by 2 */
1375                         i += 2;
1376                         authz += length;
1377                         i += length;
1378                         }
1379                 }
1380
1381         if ((extdatalen = ret-p-2)== 0)
1382                 return p;
1383
1384         s2n(extdatalen,p);
1385         return ret;
1386         }
1387
1388 static int ssl_scan_clienthello_tlsext(SSL *s, unsigned char **p, unsigned char *d, int n, int *al)
1389         {
1390         unsigned short type;
1391         unsigned short size;
1392         unsigned short len;
1393         unsigned char *data = *p;
1394         int renegotiate_seen = 0;
1395
1396         s->servername_done = 0;
1397         s->tlsext_status_type = -1;
1398 #ifndef OPENSSL_NO_NEXTPROTONEG
1399         s->s3->next_proto_neg_seen = 0;
1400 #endif
1401
1402 #ifndef OPENSSL_NO_HEARTBEATS
1403         s->tlsext_heartbeat &= ~(SSL_TLSEXT_HB_ENABLED |
1404                                SSL_TLSEXT_HB_DONT_SEND_REQUESTS);
1405 #endif
1406         /* Clear any signature algorithms extension received */
1407         if (s->cert->peer_sigalgs)
1408                 {
1409                 OPENSSL_free(s->cert->peer_sigalgs);
1410                 s->cert->peer_sigalgs = NULL;
1411                 }
1412         /* Clear any shared sigtnature algorithms */
1413         if (s->cert->shared_sigalgs)
1414                 {
1415                 OPENSSL_free(s->cert->shared_sigalgs);
1416                 s->cert->shared_sigalgs = NULL;
1417                 }
1418
1419         if (data >= (d+n-2))
1420                 goto ri_check;
1421         n2s(data,len);
1422
1423         if (data > (d+n-len))
1424                 goto ri_check;
1425
1426         while (data <= (d+n-4))
1427                 {
1428                 n2s(data,type);
1429                 n2s(data,size);
1430
1431                 if (data+size > (d+n))
1432                         goto ri_check;
1433 #if 0
1434                 fprintf(stderr,"Received extension type %d size %d\n",type,size);
1435 #endif
1436                 if (s->tlsext_debug_cb)
1437                         s->tlsext_debug_cb(s, 0, type, data, size,
1438                                                 s->tlsext_debug_arg);
1439 /* The servername extension is treated as follows:
1440
1441    - Only the hostname type is supported with a maximum length of 255.
1442    - The servername is rejected if too long or if it contains zeros,
1443      in which case an fatal alert is generated.
1444    - The servername field is maintained together with the session cache.
1445    - When a session is resumed, the servername call back invoked in order
1446      to allow the application to position itself to the right context.
1447    - The servername is acknowledged if it is new for a session or when
1448      it is identical to a previously used for the same session.
1449      Applications can control the behaviour.  They can at any time
1450      set a 'desirable' servername for a new SSL object. This can be the
1451      case for example with HTTPS when a Host: header field is received and
1452      a renegotiation is requested. In this case, a possible servername
1453      presented in the new client hello is only acknowledged if it matches
1454      the value of the Host: field.
1455    - Applications must  use SSL_OP_NO_SESSION_RESUMPTION_ON_RENEGOTIATION
1456      if they provide for changing an explicit servername context for the session,
1457      i.e. when the session has been established with a servername extension.
1458    - On session reconnect, the servername extension may be absent.
1459
1460 */
1461
1462                 if (type == TLSEXT_TYPE_server_name)
1463                         {
1464                         unsigned char *sdata;
1465                         int servname_type;
1466                         int dsize;
1467
1468                         if (size < 2)
1469                                 {
1470                                 *al = SSL_AD_DECODE_ERROR;
1471                                 return 0;
1472                                 }
1473                         n2s(data,dsize);
1474                         size -= 2;
1475                         if (dsize > size  )
1476                                 {
1477                                 *al = SSL_AD_DECODE_ERROR;
1478                                 return 0;
1479                                 }
1480
1481                         sdata = data;
1482                         while (dsize > 3)
1483                                 {
1484                                 servname_type = *(sdata++);
1485                                 n2s(sdata,len);
1486                                 dsize -= 3;
1487
1488                                 if (len > dsize)
1489                                         {
1490                                         *al = SSL_AD_DECODE_ERROR;
1491                                         return 0;
1492                                         }
1493                                 if (s->servername_done == 0)
1494                                 switch (servname_type)
1495                                         {
1496                                 case TLSEXT_NAMETYPE_host_name:
1497                                         if (!s->hit)
1498                                                 {
1499                                                 if(s->session->tlsext_hostname)
1500                                                         {
1501                                                         *al = SSL_AD_DECODE_ERROR;
1502                                                         return 0;
1503                                                         }
1504                                                 if (len > TLSEXT_MAXLEN_host_name)
1505                                                         {
1506                                                         *al = TLS1_AD_UNRECOGNIZED_NAME;
1507                                                         return 0;
1508                                                         }
1509                                                 if ((s->session->tlsext_hostname = OPENSSL_malloc(len+1)) == NULL)
1510                                                         {
1511                                                         *al = TLS1_AD_INTERNAL_ERROR;
1512                                                         return 0;
1513                                                         }
1514                                                 memcpy(s->session->tlsext_hostname, sdata, len);
1515                                                 s->session->tlsext_hostname[len]='\0';
1516                                                 if (strlen(s->session->tlsext_hostname) != len) {
1517                                                         OPENSSL_free(s->session->tlsext_hostname);
1518                                                         s->session->tlsext_hostname = NULL;
1519                                                         *al = TLS1_AD_UNRECOGNIZED_NAME;
1520                                                         return 0;
1521                                                 }
1522                                                 s->servername_done = 1;
1523
1524                                                 }
1525                                         else
1526                                                 s->servername_done = s->session->tlsext_hostname
1527                                                         && strlen(s->session->tlsext_hostname) == len
1528                                                         && strncmp(s->session->tlsext_hostname, (char *)sdata, len) == 0;
1529
1530                                         break;
1531
1532                                 default:
1533                                         break;
1534                                         }
1535
1536                                 dsize -= len;
1537                                 }
1538                         if (dsize != 0)
1539                                 {
1540                                 *al = SSL_AD_DECODE_ERROR;
1541                                 return 0;
1542                                 }
1543
1544                         }
1545 #ifndef OPENSSL_NO_SRP
1546                 else if (type == TLSEXT_TYPE_srp)
1547                         {
1548                         if (size <= 0 || ((len = data[0])) != (size -1))
1549                                 {
1550                                 *al = SSL_AD_DECODE_ERROR;
1551                                 return 0;
1552                                 }
1553                         if (s->srp_ctx.login != NULL)
1554                                 {
1555                                 *al = SSL_AD_DECODE_ERROR;
1556                                 return 0;
1557                                 }
1558                         if ((s->srp_ctx.login = OPENSSL_malloc(len+1)) == NULL)
1559                                 return -1;
1560                         memcpy(s->srp_ctx.login, &data[1], len);
1561                         s->srp_ctx.login[len]='\0';
1562
1563                         if (strlen(s->srp_ctx.login) != len)
1564                                 {
1565                                 *al = SSL_AD_DECODE_ERROR;
1566                                 return 0;
1567                                 }
1568                         }
1569 #endif
1570
1571 #ifndef OPENSSL_NO_EC
1572                 else if (type == TLSEXT_TYPE_ec_point_formats &&
1573                      s->version != DTLS1_VERSION)
1574                         {
1575                         unsigned char *sdata = data;
1576                         int ecpointformatlist_length = *(sdata++);
1577
1578                         if (ecpointformatlist_length != size - 1)
1579                                 {
1580                                 *al = TLS1_AD_DECODE_ERROR;
1581                                 return 0;
1582                                 }
1583                         if (!s->hit)
1584                                 {
1585                                 if(s->session->tlsext_ecpointformatlist)
1586                                         {
1587                                         OPENSSL_free(s->session->tlsext_ecpointformatlist);
1588                                         s->session->tlsext_ecpointformatlist = NULL;
1589                                         }
1590                                 s->session->tlsext_ecpointformatlist_length = 0;
1591                                 if ((s->session->tlsext_ecpointformatlist = OPENSSL_malloc(ecpointformatlist_length)) == NULL)
1592                                         {
1593                                         *al = TLS1_AD_INTERNAL_ERROR;
1594                                         return 0;
1595                                         }
1596                                 s->session->tlsext_ecpointformatlist_length = ecpointformatlist_length;
1597                                 memcpy(s->session->tlsext_ecpointformatlist, sdata, ecpointformatlist_length);
1598                                 }
1599 #if 0
1600                         fprintf(stderr,"ssl_parse_clienthello_tlsext s->session->tlsext_ecpointformatlist (length=%i) ", s->session->tlsext_ecpointformatlist_length);
1601                         sdata = s->session->tlsext_ecpointformatlist;
1602                         for (i = 0; i < s->session->tlsext_ecpointformatlist_length; i++)
1603                                 fprintf(stderr,"%i ",*(sdata++));
1604                         fprintf(stderr,"\n");
1605 #endif
1606                         }
1607                 else if (type == TLSEXT_TYPE_elliptic_curves &&
1608                      s->version != DTLS1_VERSION)
1609                         {
1610                         unsigned char *sdata = data;
1611                         int ellipticcurvelist_length = (*(sdata++) << 8);
1612                         ellipticcurvelist_length += (*(sdata++));
1613
1614                         if (ellipticcurvelist_length != size - 2 ||
1615                                 ellipticcurvelist_length < 1)
1616                                 {
1617                                 *al = TLS1_AD_DECODE_ERROR;
1618                                 return 0;
1619                                 }
1620                         if (!s->hit)
1621                                 {
1622                                 if(s->session->tlsext_ellipticcurvelist)
1623                                         {
1624                                         *al = TLS1_AD_DECODE_ERROR;
1625                                         return 0;
1626                                         }
1627                                 s->session->tlsext_ellipticcurvelist_length = 0;
1628                                 if ((s->session->tlsext_ellipticcurvelist = OPENSSL_malloc(ellipticcurvelist_length)) == NULL)
1629                                         {
1630                                         *al = TLS1_AD_INTERNAL_ERROR;
1631                                         return 0;
1632                                         }
1633                                 s->session->tlsext_ellipticcurvelist_length = ellipticcurvelist_length;
1634                                 memcpy(s->session->tlsext_ellipticcurvelist, sdata, ellipticcurvelist_length);
1635                                 }
1636 #if 0
1637                         fprintf(stderr,"ssl_parse_clienthello_tlsext s->session->tlsext_ellipticcurvelist (length=%i) ", s->session->tlsext_ellipticcurvelist_length);
1638                         sdata = s->session->tlsext_ellipticcurvelist;
1639                         for (i = 0; i < s->session->tlsext_ellipticcurvelist_length; i++)
1640                                 fprintf(stderr,"%i ",*(sdata++));
1641                         fprintf(stderr,"\n");
1642 #endif
1643                         }
1644 #endif /* OPENSSL_NO_EC */
1645 #ifdef TLSEXT_TYPE_opaque_prf_input
1646                 else if (type == TLSEXT_TYPE_opaque_prf_input &&
1647                      s->version != DTLS1_VERSION)
1648                         {
1649                         unsigned char *sdata = data;
1650
1651                         if (size < 2)
1652                                 {
1653                                 *al = SSL_AD_DECODE_ERROR;
1654                                 return 0;
1655                                 }
1656                         n2s(sdata, s->s3->client_opaque_prf_input_len);
1657                         if (s->s3->client_opaque_prf_input_len != size - 2)
1658                                 {
1659                                 *al = SSL_AD_DECODE_ERROR;
1660                                 return 0;
1661                                 }
1662
1663                         if (s->s3->client_opaque_prf_input != NULL) /* shouldn't really happen */
1664                                 OPENSSL_free(s->s3->client_opaque_prf_input);
1665                         if (s->s3->client_opaque_prf_input_len == 0)
1666                                 s->s3->client_opaque_prf_input = OPENSSL_malloc(1); /* dummy byte just to get non-NULL */
1667                         else
1668                                 s->s3->client_opaque_prf_input = BUF_memdup(sdata, s->s3->client_opaque_prf_input_len);
1669                         if (s->s3->client_opaque_prf_input == NULL)
1670                                 {
1671                                 *al = TLS1_AD_INTERNAL_ERROR;
1672                                 return 0;
1673                                 }
1674                         }
1675 #endif
1676                 else if (type == TLSEXT_TYPE_session_ticket)
1677                         {
1678                         if (s->tls_session_ticket_ext_cb &&
1679                             !s->tls_session_ticket_ext_cb(s, data, size, s->tls_session_ticket_ext_cb_arg))
1680                                 {
1681                                 *al = TLS1_AD_INTERNAL_ERROR;
1682                                 return 0;
1683                                 }
1684                         }
1685                 else if (type == TLSEXT_TYPE_renegotiate)
1686                         {
1687                         if(!ssl_parse_clienthello_renegotiate_ext(s, data, size, al))
1688                                 return 0;
1689                         renegotiate_seen = 1;
1690                         }
1691                 else if (type == TLSEXT_TYPE_signature_algorithms)
1692                         {
1693                         int dsize;
1694                         if (s->cert->peer_sigalgs || size < 2)
1695                                 {
1696                                 *al = SSL_AD_DECODE_ERROR;
1697                                 return 0;
1698                                 }
1699                         n2s(data,dsize);
1700                         size -= 2;
1701                         if (dsize != size || dsize & 1 || !dsize)
1702                                 {
1703                                 *al = SSL_AD_DECODE_ERROR;
1704                                 return 0;
1705                                 }
1706                         if (!tls1_process_sigalgs(s, data, dsize))
1707                                 {
1708                                 *al = SSL_AD_DECODE_ERROR;
1709                                 return 0;
1710                                 }
1711                         /* If sigalgs received and no shared algorithms fatal
1712                          * error.
1713                          */
1714                         if (s->cert->peer_sigalgs && !s->cert->shared_sigalgs)
1715                                 {
1716                                 SSLerr(SSL_F_SSL_SCAN_CLIENTHELLO_TLSEXT,
1717                                         SSL_R_NO_SHARED_SIGATURE_ALGORITHMS);
1718                                 *al = SSL_AD_ILLEGAL_PARAMETER;
1719                                 return 0;
1720                                 }
1721                         }
1722                 else if (type == TLSEXT_TYPE_status_request &&
1723                          s->version != DTLS1_VERSION && s->ctx->tlsext_status_cb)
1724                         {
1725
1726                         if (size < 5)
1727                                 {
1728                                 *al = SSL_AD_DECODE_ERROR;
1729                                 return 0;
1730                                 }
1731
1732                         s->tlsext_status_type = *data++;
1733                         size--;
1734                         if (s->tlsext_status_type == TLSEXT_STATUSTYPE_ocsp)
1735                                 {
1736                                 const unsigned char *sdata;
1737                                 int dsize;
1738                                 /* Read in responder_id_list */
1739                                 n2s(data,dsize);
1740                                 size -= 2;
1741                                 if (dsize > size  )
1742                                         {
1743                                         *al = SSL_AD_DECODE_ERROR;
1744                                         return 0;
1745                                         }
1746                                 while (dsize > 0)
1747                                         {
1748                                         OCSP_RESPID *id;
1749                                         int idsize;
1750                                         if (dsize < 4)
1751                                                 {
1752                                                 *al = SSL_AD_DECODE_ERROR;
1753                                                 return 0;
1754                                                 }
1755                                         n2s(data, idsize);
1756                                         dsize -= 2 + idsize;
1757                                         size -= 2 + idsize;
1758                                         if (dsize < 0)
1759                                                 {
1760                                                 *al = SSL_AD_DECODE_ERROR;
1761                                                 return 0;
1762                                                 }
1763                                         sdata = data;
1764                                         data += idsize;
1765                                         id = d2i_OCSP_RESPID(NULL,
1766                                                                 &sdata, idsize);
1767                                         if (!id)
1768                                                 {
1769                                                 *al = SSL_AD_DECODE_ERROR;
1770                                                 return 0;
1771                                                 }
1772                                         if (data != sdata)
1773                                                 {
1774                                                 OCSP_RESPID_free(id);
1775                                                 *al = SSL_AD_DECODE_ERROR;
1776                                                 return 0;
1777                                                 }
1778                                         if (!s->tlsext_ocsp_ids
1779                                                 && !(s->tlsext_ocsp_ids =
1780                                                 sk_OCSP_RESPID_new_null()))
1781                                                 {
1782                                                 OCSP_RESPID_free(id);
1783                                                 *al = SSL_AD_INTERNAL_ERROR;
1784                                                 return 0;
1785                                                 }
1786                                         if (!sk_OCSP_RESPID_push(
1787                                                         s->tlsext_ocsp_ids, id))
1788                                                 {
1789                                                 OCSP_RESPID_free(id);
1790                                                 *al = SSL_AD_INTERNAL_ERROR;
1791                                                 return 0;
1792                                                 }
1793                                         }
1794
1795                                 /* Read in request_extensions */
1796                                 if (size < 2)
1797                                         {
1798                                         *al = SSL_AD_DECODE_ERROR;
1799                                         return 0;
1800                                         }
1801                                 n2s(data,dsize);
1802                                 size -= 2;
1803                                 if (dsize != size)
1804                                         {
1805                                         *al = SSL_AD_DECODE_ERROR;
1806                                         return 0;
1807                                         }
1808                                 sdata = data;
1809                                 if (dsize > 0)
1810                                         {
1811                                         if (s->tlsext_ocsp_exts)
1812                                                 {
1813                                                 sk_X509_EXTENSION_pop_free(s->tlsext_ocsp_exts,
1814                                                                            X509_EXTENSION_free);
1815                                                 }
1816
1817                                         s->tlsext_ocsp_exts =
1818                                                 d2i_X509_EXTENSIONS(NULL,
1819                                                         &sdata, dsize);
1820                                         if (!s->tlsext_ocsp_exts
1821                                                 || (data + dsize != sdata))
1822                                                 {
1823                                                 *al = SSL_AD_DECODE_ERROR;
1824                                                 return 0;
1825                                                 }
1826                                         }
1827                                 }
1828                                 /* We don't know what to do with any other type
1829                                 * so ignore it.
1830                                 */
1831                                 else
1832                                         s->tlsext_status_type = -1;
1833                         }
1834 #ifndef OPENSSL_NO_HEARTBEATS
1835                 else if (type == TLSEXT_TYPE_heartbeat)
1836                         {
1837                         switch(data[0])
1838                                 {
1839                                 case 0x01:      /* Client allows us to send HB requests */
1840                                                         s->tlsext_heartbeat |= SSL_TLSEXT_HB_ENABLED;
1841                                                         break;
1842                                 case 0x02:      /* Client doesn't accept HB requests */
1843                                                         s->tlsext_heartbeat |= SSL_TLSEXT_HB_ENABLED;
1844                                                         s->tlsext_heartbeat |= SSL_TLSEXT_HB_DONT_SEND_REQUESTS;
1845                                                         break;
1846                                 default:        *al = SSL_AD_ILLEGAL_PARAMETER;
1847                                                         return 0;
1848                                 }
1849                         }
1850 #endif
1851 #ifndef OPENSSL_NO_NEXTPROTONEG
1852                 else if (type == TLSEXT_TYPE_next_proto_neg &&
1853                          s->s3->tmp.finish_md_len == 0)
1854                         {
1855                         /* We shouldn't accept this extension on a
1856                          * renegotiation.
1857                          *
1858                          * s->new_session will be set on renegotiation, but we
1859                          * probably shouldn't rely that it couldn't be set on
1860                          * the initial renegotation too in certain cases (when
1861                          * there's some other reason to disallow resuming an
1862                          * earlier session -- the current code won't be doing
1863                          * anything like that, but this might change).
1864
1865                          * A valid sign that there's been a previous handshake
1866                          * in this connection is if s->s3->tmp.finish_md_len >
1867                          * 0.  (We are talking about a check that will happen
1868                          * in the Hello protocol round, well before a new
1869                          * Finished message could have been computed.) */
1870                         s->s3->next_proto_neg_seen = 1;
1871                         }
1872 #endif
1873
1874                 /* session ticket processed earlier */
1875                 else if (type == TLSEXT_TYPE_use_srtp)
1876                         {
1877                         if(ssl_parse_clienthello_use_srtp_ext(s, data, size,
1878                                                               al))
1879                                 return 0;
1880                         }
1881
1882                 else if (type == TLSEXT_TYPE_server_authz)
1883                         {
1884                         unsigned char *sdata = data;
1885                         unsigned char server_authz_dataformatlist_length;
1886
1887                         if (size == 0)
1888                                 {
1889                                 *al = TLS1_AD_DECODE_ERROR;
1890                                 return 0;
1891                                 }
1892
1893                         server_authz_dataformatlist_length = *(sdata++);
1894
1895                         if (server_authz_dataformatlist_length != size - 1)
1896                                 {
1897                                 *al = TLS1_AD_DECODE_ERROR;
1898                                 return 0;
1899                                 }
1900
1901                         /* Successful session resumption uses the same authz
1902                          * information as the original session so we ignore this
1903                          * in the case of a session resumption. */
1904                         if (!s->hit)
1905                                 {
1906                                 size_t i;
1907                                 if (s->s3->tlsext_authz_client_types != NULL)
1908                                         OPENSSL_free(s->s3->tlsext_authz_client_types);
1909                                 s->s3->tlsext_authz_client_types =
1910                                         OPENSSL_malloc(server_authz_dataformatlist_length);
1911                                 if (!s->s3->tlsext_authz_client_types)
1912                                         {
1913                                         *al = TLS1_AD_INTERNAL_ERROR;
1914                                         return 0;
1915                                         }
1916
1917                                 s->s3->tlsext_authz_client_types_len =
1918                                         server_authz_dataformatlist_length;
1919                                 memcpy(s->s3->tlsext_authz_client_types,
1920                                        sdata,
1921                                        server_authz_dataformatlist_length);
1922
1923                                 /* Sort the types in order to check for duplicates. */
1924                                 qsort(s->s3->tlsext_authz_client_types,
1925                                       server_authz_dataformatlist_length,
1926                                       1 /* element size */,
1927                                       byte_compare);
1928
1929                                 for (i = 0; i < server_authz_dataformatlist_length; i++)
1930                                         {
1931                                         if (i > 0 &&
1932                                             s->s3->tlsext_authz_client_types[i] ==
1933                                               s->s3->tlsext_authz_client_types[i-1])
1934                                                 {
1935                                                 *al = TLS1_AD_DECODE_ERROR;
1936                                                 return 0;
1937                                                 }
1938                                         }
1939                                 }
1940                         }
1941
1942                 data+=size;
1943                 }
1944
1945         *p = data;
1946
1947         ri_check:
1948
1949         /* Need RI if renegotiating */
1950
1951         if (!renegotiate_seen && s->renegotiate &&
1952                 !(s->options & SSL_OP_ALLOW_UNSAFE_LEGACY_RENEGOTIATION))
1953                 {
1954                 *al = SSL_AD_HANDSHAKE_FAILURE;
1955                 SSLerr(SSL_F_SSL_SCAN_CLIENTHELLO_TLSEXT,
1956                                 SSL_R_UNSAFE_LEGACY_RENEGOTIATION_DISABLED);
1957                 return 0;
1958                 }
1959         /* If no signature algorithms extension set default values */
1960         if (!s->cert->peer_sigalgs)
1961                 ssl_cert_set_default_md(s->cert);
1962
1963         return 1;
1964         }
1965
1966 int ssl_parse_clienthello_tlsext(SSL *s, unsigned char **p, unsigned char *d, int n)
1967         {
1968         int al = -1;
1969         if (ssl_scan_clienthello_tlsext(s, p, d, n, &al) <= 0)
1970                 {
1971                 ssl3_send_alert(s,SSL3_AL_FATAL,al);
1972                 return 0;
1973                 }
1974
1975         if (ssl_check_clienthello_tlsext_early(s) <= 0)
1976                 {
1977                 SSLerr(SSL_F_SSL_PARSE_CLIENTHELLO_TLSEXT,SSL_R_CLIENTHELLO_TLSEXT);
1978                 return 0;
1979                 }
1980         return 1;
1981 }
1982
1983 #ifndef OPENSSL_NO_NEXTPROTONEG
1984 /* ssl_next_proto_validate validates a Next Protocol Negotiation block. No
1985  * elements of zero length are allowed and the set of elements must exactly fill
1986  * the length of the block. */
1987 static char ssl_next_proto_validate(unsigned char *d, unsigned len)
1988         {
1989         unsigned int off = 0;
1990
1991         while (off < len)
1992                 {
1993                 if (d[off] == 0)
1994                         return 0;
1995                 off += d[off];
1996                 off++;
1997                 }
1998
1999         return off == len;
2000         }
2001 #endif
2002
2003 static int ssl_scan_serverhello_tlsext(SSL *s, unsigned char **p, unsigned char *d, int n, int *al)
2004         {
2005         unsigned short length;
2006         unsigned short type;
2007         unsigned short size;
2008         unsigned char *data = *p;
2009         int tlsext_servername = 0;
2010         int renegotiate_seen = 0;
2011
2012 #ifndef OPENSSL_NO_NEXTPROTONEG
2013         s->s3->next_proto_neg_seen = 0;
2014 #endif
2015
2016 #ifndef OPENSSL_NO_HEARTBEATS
2017         s->tlsext_heartbeat &= ~(SSL_TLSEXT_HB_ENABLED |
2018                                SSL_TLSEXT_HB_DONT_SEND_REQUESTS);
2019 #endif
2020
2021         if (data >= (d+n-2))
2022                 goto ri_check;
2023
2024         n2s(data,length);
2025         if (data+length != d+n)
2026                 {
2027                 *al = SSL_AD_DECODE_ERROR;
2028                 return 0;
2029                 }
2030
2031         while(data <= (d+n-4))
2032                 {
2033                 n2s(data,type);
2034                 n2s(data,size);
2035
2036                 if (data+size > (d+n))
2037                         goto ri_check;
2038
2039                 if (s->tlsext_debug_cb)
2040                         s->tlsext_debug_cb(s, 1, type, data, size,
2041                                                 s->tlsext_debug_arg);
2042
2043                 if (type == TLSEXT_TYPE_server_name)
2044                         {
2045                         if (s->tlsext_hostname == NULL || size > 0)
2046                                 {
2047                                 *al = TLS1_AD_UNRECOGNIZED_NAME;
2048                                 return 0;
2049                                 }
2050                         tlsext_servername = 1;
2051                         }
2052
2053 #ifndef OPENSSL_NO_EC
2054                 else if (type == TLSEXT_TYPE_ec_point_formats &&
2055                      s->version != DTLS1_VERSION)
2056                         {
2057                         unsigned char *sdata = data;
2058                         int ecpointformatlist_length = *(sdata++);
2059
2060                         if (ecpointformatlist_length != size - 1 ||
2061                                 ecpointformatlist_length < 1)
2062                                 {
2063                                 *al = TLS1_AD_DECODE_ERROR;
2064                                 return 0;
2065                                 }
2066                         s->session->tlsext_ecpointformatlist_length = 0;
2067                         if (s->session->tlsext_ecpointformatlist != NULL) OPENSSL_free(s->session->tlsext_ecpointformatlist);
2068                         if ((s->session->tlsext_ecpointformatlist = OPENSSL_malloc(ecpointformatlist_length)) == NULL)
2069                                 {
2070                                 *al = TLS1_AD_INTERNAL_ERROR;
2071                                 return 0;
2072                                 }
2073                         s->session->tlsext_ecpointformatlist_length = ecpointformatlist_length;
2074                         memcpy(s->session->tlsext_ecpointformatlist, sdata, ecpointformatlist_length);
2075 #if 0
2076                         fprintf(stderr,"ssl_parse_serverhello_tlsext s->session->tlsext_ecpointformatlist ");
2077                         sdata = s->session->tlsext_ecpointformatlist;
2078                         for (i = 0; i < s->session->tlsext_ecpointformatlist_length; i++)
2079                                 fprintf(stderr,"%i ",*(sdata++));
2080                         fprintf(stderr,"\n");
2081 #endif
2082                         }
2083 #endif /* OPENSSL_NO_EC */
2084
2085                 else if (type == TLSEXT_TYPE_session_ticket)
2086                         {
2087                         if (s->tls_session_ticket_ext_cb &&
2088                             !s->tls_session_ticket_ext_cb(s, data, size, s->tls_session_ticket_ext_cb_arg))
2089                                 {
2090                                 *al = TLS1_AD_INTERNAL_ERROR;
2091                                 return 0;
2092                                 }
2093                         if ((SSL_get_options(s) & SSL_OP_NO_TICKET)
2094                                 || (size > 0))
2095                                 {
2096                                 *al = TLS1_AD_UNSUPPORTED_EXTENSION;
2097                                 return 0;
2098                                 }
2099                         s->tlsext_ticket_expected = 1;
2100                         }
2101 #ifdef TLSEXT_TYPE_opaque_prf_input
2102                 else if (type == TLSEXT_TYPE_opaque_prf_input &&
2103                      s->version != DTLS1_VERSION)
2104                         {
2105                         unsigned char *sdata = data;
2106
2107                         if (size < 2)
2108                                 {
2109                                 *al = SSL_AD_DECODE_ERROR;
2110                                 return 0;
2111                                 }
2112                         n2s(sdata, s->s3->server_opaque_prf_input_len);
2113                         if (s->s3->server_opaque_prf_input_len != size - 2)
2114                                 {
2115                                 *al = SSL_AD_DECODE_ERROR;
2116                                 return 0;
2117                                 }
2118
2119                         if (s->s3->server_opaque_prf_input != NULL) /* shouldn't really happen */
2120                                 OPENSSL_free(s->s3->server_opaque_prf_input);
2121                         if (s->s3->server_opaque_prf_input_len == 0)
2122                                 s->s3->server_opaque_prf_input = OPENSSL_malloc(1); /* dummy byte just to get non-NULL */
2123                         else
2124                                 s->s3->server_opaque_prf_input = BUF_memdup(sdata, s->s3->server_opaque_prf_input_len);
2125
2126                         if (s->s3->server_opaque_prf_input == NULL)
2127                                 {
2128                                 *al = TLS1_AD_INTERNAL_ERROR;
2129                                 return 0;
2130                                 }
2131                         }
2132 #endif
2133                 else if (type == TLSEXT_TYPE_status_request &&
2134                          s->version != DTLS1_VERSION)
2135                         {
2136                         /* MUST be empty and only sent if we've requested
2137                          * a status request message.
2138                          */
2139                         if ((s->tlsext_status_type == -1) || (size > 0))
2140                                 {
2141                                 *al = TLS1_AD_UNSUPPORTED_EXTENSION;
2142                                 return 0;
2143                                 }
2144                         /* Set flag to expect CertificateStatus message */
2145                         s->tlsext_status_expected = 1;
2146                         }
2147 #ifndef OPENSSL_NO_NEXTPROTONEG
2148                 else if (type == TLSEXT_TYPE_next_proto_neg &&
2149                          s->s3->tmp.finish_md_len == 0)
2150                         {
2151                         unsigned char *selected;
2152                         unsigned char selected_len;
2153
2154                         /* We must have requested it. */
2155                         if ((s->ctx->next_proto_select_cb == NULL))
2156                                 {
2157                                 *al = TLS1_AD_UNSUPPORTED_EXTENSION;
2158                                 return 0;
2159                                 }
2160                         /* The data must be valid */
2161                         if (!ssl_next_proto_validate(data, size))
2162                                 {
2163                                 *al = TLS1_AD_DECODE_ERROR;
2164                                 return 0;
2165                                 }
2166                         if (s->ctx->next_proto_select_cb(s, &selected, &selected_len, data, size, s->ctx->next_proto_select_cb_arg) != SSL_TLSEXT_ERR_OK)
2167                                 {
2168                                 *al = TLS1_AD_INTERNAL_ERROR;
2169                                 return 0;
2170                                 }
2171                         s->next_proto_negotiated = OPENSSL_malloc(selected_len);
2172                         if (!s->next_proto_negotiated)
2173                                 {
2174                                 *al = TLS1_AD_INTERNAL_ERROR;
2175                                 return 0;
2176                                 }
2177                         memcpy(s->next_proto_negotiated, selected, selected_len);
2178                         s->next_proto_negotiated_len = selected_len;
2179                         s->s3->next_proto_neg_seen = 1;
2180                         }
2181 #endif
2182                 else if (type == TLSEXT_TYPE_renegotiate)
2183                         {
2184                         if(!ssl_parse_serverhello_renegotiate_ext(s, data, size, al))
2185                                 return 0;
2186                         renegotiate_seen = 1;
2187                         }
2188 #ifndef OPENSSL_NO_HEARTBEATS
2189                 else if (type == TLSEXT_TYPE_heartbeat)
2190                         {
2191                         switch(data[0])
2192                                 {
2193                                 case 0x01:      /* Server allows us to send HB requests */
2194                                                         s->tlsext_heartbeat |= SSL_TLSEXT_HB_ENABLED;
2195                                                         break;
2196                                 case 0x02:      /* Server doesn't accept HB requests */
2197                                                         s->tlsext_heartbeat |= SSL_TLSEXT_HB_ENABLED;
2198                                                         s->tlsext_heartbeat |= SSL_TLSEXT_HB_DONT_SEND_REQUESTS;
2199                                                         break;
2200                                 default:        *al = SSL_AD_ILLEGAL_PARAMETER;
2201                                                         return 0;
2202                                 }
2203                         }
2204 #endif
2205                 else if (type == TLSEXT_TYPE_use_srtp)
2206                         {
2207                         if(ssl_parse_serverhello_use_srtp_ext(s, data, size,
2208                                                               al))
2209                                 return 0;
2210                         }
2211
2212                 else if (type == TLSEXT_TYPE_server_authz)
2213                         {
2214                         /* We only support audit proofs. It's an error to send
2215                          * an authz hello extension if the client
2216                          * didn't request a proof. */
2217                         unsigned char *sdata = data;
2218                         unsigned char server_authz_dataformatlist_length;
2219
2220                         if (!s->ctx->tlsext_authz_server_audit_proof_cb)
2221                                 {
2222                                 *al = TLS1_AD_UNSUPPORTED_EXTENSION;
2223                                 return 0;
2224                                 }
2225
2226                         if (!size)
2227                                 {
2228                                 *al = TLS1_AD_DECODE_ERROR;
2229                                 return 0;
2230                                 }
2231
2232                         server_authz_dataformatlist_length = *(sdata++);
2233                         if (server_authz_dataformatlist_length != size - 1)
2234                                 {
2235                                 *al = TLS1_AD_DECODE_ERROR;
2236                                 return 0;
2237                                 }
2238
2239                         /* We only support audit proofs, so a legal ServerHello
2240                          * authz list contains exactly one entry. */
2241                         if (server_authz_dataformatlist_length != 1 ||
2242                                 sdata[0] != TLSEXT_AUTHZDATAFORMAT_audit_proof)
2243                                 {
2244                                 *al = TLS1_AD_UNSUPPORTED_EXTENSION;
2245                                 return 0;
2246                                 }
2247
2248                         s->s3->tlsext_authz_server_promised = 1;
2249                         }
2250
2251                 data += size;
2252                 }
2253
2254         if (data != d+n)
2255                 {
2256                 *al = SSL_AD_DECODE_ERROR;
2257                 return 0;
2258                 }
2259
2260         if (!s->hit && tlsext_servername == 1)
2261                 {
2262                 if (s->tlsext_hostname)
2263                         {
2264                         if (s->session->tlsext_hostname == NULL)
2265                                 {
2266                                 s->session->tlsext_hostname = BUF_strdup(s->tlsext_hostname);
2267                                 if (!s->session->tlsext_hostname)
2268                                         {
2269                                         *al = SSL_AD_UNRECOGNIZED_NAME;
2270                                         return 0;
2271                                         }
2272                                 }
2273                         else
2274                                 {
2275                                 *al = SSL_AD_DECODE_ERROR;
2276                                 return 0;
2277                                 }
2278                         }
2279                 }
2280
2281         *p = data;
2282
2283         ri_check:
2284
2285         /* Determine if we need to see RI. Strictly speaking if we want to
2286          * avoid an attack we should *always* see RI even on initial server
2287          * hello because the client doesn't see any renegotiation during an
2288          * attack. However this would mean we could not connect to any server
2289          * which doesn't support RI so for the immediate future tolerate RI
2290          * absence on initial connect only.
2291          */
2292         if (!renegotiate_seen
2293                 && !(s->options & SSL_OP_LEGACY_SERVER_CONNECT)
2294                 && !(s->options & SSL_OP_ALLOW_UNSAFE_LEGACY_RENEGOTIATION))
2295                 {
2296                 *al = SSL_AD_HANDSHAKE_FAILURE;
2297                 SSLerr(SSL_F_SSL_SCAN_SERVERHELLO_TLSEXT,
2298                                 SSL_R_UNSAFE_LEGACY_RENEGOTIATION_DISABLED);
2299                 return 0;
2300                 }
2301
2302         return 1;
2303         }
2304
2305
2306 int ssl_prepare_clienthello_tlsext(SSL *s)
2307         {
2308
2309 #ifdef TLSEXT_TYPE_opaque_prf_input
2310         {
2311                 int r = 1;
2312
2313                 if (s->ctx->tlsext_opaque_prf_input_callback != 0)
2314                         {
2315                         r = s->ctx->tlsext_opaque_prf_input_callback(s, NULL, 0, s->ctx->tlsext_opaque_prf_input_callback_arg);
2316                         if (!r)
2317                                 return -1;
2318                         }
2319
2320                 if (s->tlsext_opaque_prf_input != NULL)
2321                         {
2322                         if (s->s3->client_opaque_prf_input != NULL) /* shouldn't really happen */
2323                                 OPENSSL_free(s->s3->client_opaque_prf_input);
2324
2325                         if (s->tlsext_opaque_prf_input_len == 0)
2326                                 s->s3->client_opaque_prf_input = OPENSSL_malloc(1); /* dummy byte just to get non-NULL */
2327                         else
2328                                 s->s3->client_opaque_prf_input = BUF_memdup(s->tlsext_opaque_prf_input, s->tlsext_opaque_prf_input_len);
2329                         if (s->s3->client_opaque_prf_input == NULL)
2330                                 {
2331                                 SSLerr(SSL_F_SSL_PREPARE_CLIENTHELLO_TLSEXT,ERR_R_MALLOC_FAILURE);
2332                                 return -1;
2333                                 }
2334                         s->s3->client_opaque_prf_input_len = s->tlsext_opaque_prf_input_len;
2335                         }
2336
2337                 if (r == 2)
2338                         /* at callback's request, insist on receiving an appropriate server opaque PRF input */
2339                         s->s3->server_opaque_prf_input_len = s->tlsext_opaque_prf_input_len;
2340         }
2341 #endif
2342
2343         return 1;
2344         }
2345
2346 int ssl_prepare_serverhello_tlsext(SSL *s)
2347         {
2348 #ifndef OPENSSL_NO_EC
2349         /* If we are server and using an ECC cipher suite, send the point formats we support
2350          * if the client sent us an ECPointsFormat extension.  Note that the server is not
2351          * supposed to send an EllipticCurves extension.
2352          */
2353
2354         unsigned long alg_k = s->s3->tmp.new_cipher->algorithm_mkey;
2355         unsigned long alg_a = s->s3->tmp.new_cipher->algorithm_auth;
2356         int using_ecc = (alg_k & (SSL_kEECDH|SSL_kECDHr|SSL_kECDHe)) || (alg_a & SSL_aECDSA);
2357         using_ecc = using_ecc && (s->session->tlsext_ecpointformatlist != NULL);
2358
2359         if (using_ecc)
2360                 {
2361                 if (s->tlsext_ecpointformatlist != NULL) OPENSSL_free(s->tlsext_ecpointformatlist);
2362                 if ((s->tlsext_ecpointformatlist = OPENSSL_malloc(3)) == NULL)
2363                         {
2364                         SSLerr(SSL_F_SSL_PREPARE_SERVERHELLO_TLSEXT,ERR_R_MALLOC_FAILURE);
2365                         return -1;
2366                         }
2367                 s->tlsext_ecpointformatlist_length = 3;
2368                 s->tlsext_ecpointformatlist[0] = TLSEXT_ECPOINTFORMAT_uncompressed;
2369                 s->tlsext_ecpointformatlist[1] = TLSEXT_ECPOINTFORMAT_ansiX962_compressed_prime;
2370                 s->tlsext_ecpointformatlist[2] = TLSEXT_ECPOINTFORMAT_ansiX962_compressed_char2;
2371                 }
2372 #endif /* OPENSSL_NO_EC */
2373
2374         return 1;
2375         }
2376
2377 static int ssl_check_clienthello_tlsext_early(SSL *s)
2378         {
2379         int ret=SSL_TLSEXT_ERR_NOACK;
2380         int al = SSL_AD_UNRECOGNIZED_NAME;
2381
2382 #ifndef OPENSSL_NO_EC
2383         /* The handling of the ECPointFormats extension is done elsewhere, namely in
2384          * ssl3_choose_cipher in s3_lib.c.
2385          */
2386         /* The handling of the EllipticCurves extension is done elsewhere, namely in
2387          * ssl3_choose_cipher in s3_lib.c.
2388          */
2389 #endif
2390
2391         if (s->ctx != NULL && s->ctx->tlsext_servername_callback != 0)
2392                 ret = s->ctx->tlsext_servername_callback(s, &al, s->ctx->tlsext_servername_arg);
2393         else if (s->initial_ctx != NULL && s->initial_ctx->tlsext_servername_callback != 0)
2394                 ret = s->initial_ctx->tlsext_servername_callback(s, &al, s->initial_ctx->tlsext_servername_arg);
2395
2396 #ifdef TLSEXT_TYPE_opaque_prf_input
2397         {
2398                 /* This sort of belongs into ssl_prepare_serverhello_tlsext(),
2399                  * but we might be sending an alert in response to the client hello,
2400                  * so this has to happen here in
2401                  * ssl_check_clienthello_tlsext_early(). */
2402
2403                 int r = 1;
2404
2405                 if (s->ctx->tlsext_opaque_prf_input_callback != 0)
2406                         {
2407                         r = s->ctx->tlsext_opaque_prf_input_callback(s, NULL, 0, s->ctx->tlsext_opaque_prf_input_callback_arg);
2408                         if (!r)
2409                                 {
2410                                 ret = SSL_TLSEXT_ERR_ALERT_FATAL;
2411                                 al = SSL_AD_INTERNAL_ERROR;
2412                                 goto err;
2413                                 }
2414                         }
2415
2416                 if (s->s3->server_opaque_prf_input != NULL) /* shouldn't really happen */
2417                         OPENSSL_free(s->s3->server_opaque_prf_input);
2418                 s->s3->server_opaque_prf_input = NULL;
2419
2420                 if (s->tlsext_opaque_prf_input != NULL)
2421                         {
2422                         if (s->s3->client_opaque_prf_input != NULL &&
2423                                 s->s3->client_opaque_prf_input_len == s->tlsext_opaque_prf_input_len)
2424                                 {
2425                                 /* can only use this extension if we have a server opaque PRF input
2426                                  * of the same length as the client opaque PRF input! */
2427
2428                                 if (s->tlsext_opaque_prf_input_len == 0)
2429                                         s->s3->server_opaque_prf_input = OPENSSL_malloc(1); /* dummy byte just to get non-NULL */
2430                                 else
2431                                         s->s3->server_opaque_prf_input = BUF_memdup(s->tlsext_opaque_prf_input, s->tlsext_opaque_prf_input_len);
2432                                 if (s->s3->server_opaque_prf_input == NULL)
2433                                         {
2434                                         ret = SSL_TLSEXT_ERR_ALERT_FATAL;
2435                                         al = SSL_AD_INTERNAL_ERROR;
2436                                         goto err;
2437                                         }
2438                                 s->s3->server_opaque_prf_input_len = s->tlsext_opaque_prf_input_len;
2439                                 }
2440                         }
2441
2442                 if (r == 2 && s->s3->server_opaque_prf_input == NULL)
2443                         {
2444                         /* The callback wants to enforce use of the extension,
2445                          * but we can't do that with the client opaque PRF input;
2446                          * abort the handshake.
2447                          */
2448                         ret = SSL_TLSEXT_ERR_ALERT_FATAL;
2449                         al = SSL_AD_HANDSHAKE_FAILURE;
2450                         }
2451         }
2452
2453  err:
2454 #endif
2455         switch (ret)
2456                 {
2457                 case SSL_TLSEXT_ERR_ALERT_FATAL:
2458                         ssl3_send_alert(s,SSL3_AL_FATAL,al);
2459                         return -1;
2460
2461                 case SSL_TLSEXT_ERR_ALERT_WARNING:
2462                         ssl3_send_alert(s,SSL3_AL_WARNING,al);
2463                         return 1;
2464
2465                 case SSL_TLSEXT_ERR_NOACK:
2466                         s->servername_done=0;
2467                         default:
2468                 return 1;
2469                 }
2470         }
2471
2472 int ssl_check_clienthello_tlsext_late(SSL *s)
2473         {
2474         int ret = SSL_TLSEXT_ERR_OK;
2475         int al;
2476
2477         /* If status request then ask callback what to do.
2478          * Note: this must be called after servername callbacks in case
2479          * the certificate has changed, and must be called after the cipher
2480          * has been chosen because this may influence which certificate is sent
2481          */
2482         if ((s->tlsext_status_type != -1) && s->ctx && s->ctx->tlsext_status_cb)
2483                 {
2484                 int r;
2485                 CERT_PKEY *certpkey;
2486                 certpkey = ssl_get_server_send_pkey(s);
2487                 /* If no certificate can't return certificate status */
2488                 if (certpkey == NULL)
2489                         {
2490                         s->tlsext_status_expected = 0;
2491                         return 1;
2492                         }
2493                 /* Set current certificate to one we will use so
2494                  * SSL_get_certificate et al can pick it up.
2495                  */
2496                 s->cert->key = certpkey;
2497                 r = s->ctx->tlsext_status_cb(s, s->ctx->tlsext_status_arg);
2498                 switch (r)
2499                         {
2500                         /* We don't want to send a status request response */
2501                         case SSL_TLSEXT_ERR_NOACK:
2502                                 s->tlsext_status_expected = 0;
2503                                 break;
2504                         /* status request response should be sent */
2505                         case SSL_TLSEXT_ERR_OK:
2506                                 if (s->tlsext_ocsp_resp)
2507                                         s->tlsext_status_expected = 1;
2508                                 else
2509                                         s->tlsext_status_expected = 0;
2510                                 break;
2511                         /* something bad happened */
2512                         case SSL_TLSEXT_ERR_ALERT_FATAL:
2513                                 ret = SSL_TLSEXT_ERR_ALERT_FATAL;
2514                                 al = SSL_AD_INTERNAL_ERROR;
2515                                 goto err;
2516                         }
2517                 }
2518         else
2519                 s->tlsext_status_expected = 0;
2520
2521  err:
2522         switch (ret)
2523                 {
2524                 case SSL_TLSEXT_ERR_ALERT_FATAL:
2525                         ssl3_send_alert(s, SSL3_AL_FATAL,al);
2526                         return -1;
2527
2528                 case SSL_TLSEXT_ERR_ALERT_WARNING:
2529                         ssl3_send_alert(s, SSL3_AL_WARNING,al);
2530                         return 1;
2531
2532                 default:
2533                         return 1;
2534                 }
2535         }
2536
2537 int ssl_check_serverhello_tlsext(SSL *s)
2538         {
2539         int ret=SSL_TLSEXT_ERR_NOACK;
2540         int al = SSL_AD_UNRECOGNIZED_NAME;
2541
2542 #ifndef OPENSSL_NO_EC
2543         /* If we are client and using an elliptic curve cryptography cipher
2544          * suite, then if server returns an EC point formats lists extension
2545          * it must contain uncompressed.
2546          */
2547         unsigned long alg_k = s->s3->tmp.new_cipher->algorithm_mkey;
2548         unsigned long alg_a = s->s3->tmp.new_cipher->algorithm_auth;
2549         if ((s->tlsext_ecpointformatlist != NULL) && (s->tlsext_ecpointformatlist_length > 0) &&
2550             (s->session->tlsext_ecpointformatlist != NULL) && (s->session->tlsext_ecpointformatlist_length > 0) &&
2551             ((alg_k & (SSL_kEECDH|SSL_kECDHr|SSL_kECDHe)) || (alg_a & SSL_aECDSA)))
2552                 {
2553                 /* we are using an ECC cipher */
2554                 size_t i;
2555                 unsigned char *list;
2556                 int found_uncompressed = 0;
2557                 list = s->session->tlsext_ecpointformatlist;
2558                 for (i = 0; i < s->session->tlsext_ecpointformatlist_length; i++)
2559                         {
2560                         if (*(list++) == TLSEXT_ECPOINTFORMAT_uncompressed)
2561                                 {
2562                                 found_uncompressed = 1;
2563                                 break;
2564                                 }
2565                         }
2566                 if (!found_uncompressed)
2567                         {
2568                         SSLerr(SSL_F_SSL_CHECK_SERVERHELLO_TLSEXT,SSL_R_TLS_INVALID_ECPOINTFORMAT_LIST);
2569                         return -1;
2570                         }
2571                 }
2572         ret = SSL_TLSEXT_ERR_OK;
2573 #endif /* OPENSSL_NO_EC */
2574
2575         if (s->ctx != NULL && s->ctx->tlsext_servername_callback != 0)
2576                 ret = s->ctx->tlsext_servername_callback(s, &al, s->ctx->tlsext_servername_arg);
2577         else if (s->initial_ctx != NULL && s->initial_ctx->tlsext_servername_callback != 0)
2578                 ret = s->initial_ctx->tlsext_servername_callback(s, &al, s->initial_ctx->tlsext_servername_arg);
2579
2580 #ifdef TLSEXT_TYPE_opaque_prf_input
2581         if (s->s3->server_opaque_prf_input_len > 0)
2582                 {
2583                 /* This case may indicate that we, as a client, want to insist on using opaque PRF inputs.
2584                  * So first verify that we really have a value from the server too. */
2585
2586                 if (s->s3->server_opaque_prf_input == NULL)
2587                         {
2588                         ret = SSL_TLSEXT_ERR_ALERT_FATAL;
2589                         al = SSL_AD_HANDSHAKE_FAILURE;
2590                         }
2591
2592                 /* Anytime the server *has* sent an opaque PRF input, we need to check
2593                  * that we have a client opaque PRF input of the same size. */
2594                 if (s->s3->client_opaque_prf_input == NULL ||
2595                     s->s3->client_opaque_prf_input_len != s->s3->server_opaque_prf_input_len)
2596                         {
2597                         ret = SSL_TLSEXT_ERR_ALERT_FATAL;
2598                         al = SSL_AD_ILLEGAL_PARAMETER;
2599                         }
2600                 }
2601 #endif
2602
2603         /* If we've requested certificate status and we wont get one
2604          * tell the callback
2605          */
2606         if ((s->tlsext_status_type != -1) && !(s->tlsext_status_expected)
2607                         && s->ctx && s->ctx->tlsext_status_cb)
2608                 {
2609                 int r;
2610                 /* Set resp to NULL, resplen to -1 so callback knows
2611                  * there is no response.
2612                  */
2613                 if (s->tlsext_ocsp_resp)
2614                         {
2615                         OPENSSL_free(s->tlsext_ocsp_resp);
2616                         s->tlsext_ocsp_resp = NULL;
2617                         }
2618                 s->tlsext_ocsp_resplen = -1;
2619                 r = s->ctx->tlsext_status_cb(s, s->ctx->tlsext_status_arg);
2620                 if (r == 0)
2621                         {
2622                         al = SSL_AD_BAD_CERTIFICATE_STATUS_RESPONSE;
2623                         ret = SSL_TLSEXT_ERR_ALERT_FATAL;
2624                         }
2625                 if (r < 0)
2626                         {
2627                         al = SSL_AD_INTERNAL_ERROR;
2628                         ret = SSL_TLSEXT_ERR_ALERT_FATAL;
2629                         }
2630                 }
2631
2632         switch (ret)
2633                 {
2634                 case SSL_TLSEXT_ERR_ALERT_FATAL:
2635                         ssl3_send_alert(s,SSL3_AL_FATAL,al);
2636                         return -1;
2637
2638                 case SSL_TLSEXT_ERR_ALERT_WARNING:
2639                         ssl3_send_alert(s,SSL3_AL_WARNING,al);
2640                         return 1;
2641
2642                 case SSL_TLSEXT_ERR_NOACK:
2643                         s->servername_done=0;
2644                         default:
2645                 return 1;
2646                 }
2647         }
2648
2649 int ssl_parse_serverhello_tlsext(SSL *s, unsigned char **p, unsigned char *d, int n)
2650         {
2651         int al = -1;
2652         if (s->version < SSL3_VERSION)
2653                 return 1;
2654         if (ssl_scan_serverhello_tlsext(s, p, d, n, &al) <= 0)
2655                 {
2656                 ssl3_send_alert(s,SSL3_AL_FATAL,al);
2657                 return 0;
2658                 }
2659
2660         if (ssl_check_serverhello_tlsext(s) <= 0)
2661                 {
2662                 SSLerr(SSL_F_SSL_PARSE_SERVERHELLO_TLSEXT,SSL_R_SERVERHELLO_TLSEXT);
2663                 return 0;
2664                 }
2665         return 1;
2666 }
2667
2668 /* Since the server cache lookup is done early on in the processing of the
2669  * ClientHello, and other operations depend on the result, we need to handle
2670  * any TLS session ticket extension at the same time.
2671  *
2672  *   session_id: points at the session ID in the ClientHello. This code will
2673  *       read past the end of this in order to parse out the session ticket
2674  *       extension, if any.
2675  *   len: the length of the session ID.
2676  *   limit: a pointer to the first byte after the ClientHello.
2677  *   ret: (output) on return, if a ticket was decrypted, then this is set to
2678  *       point to the resulting session.
2679  *
2680  * If s->tls_session_secret_cb is set then we are expecting a pre-shared key
2681  * ciphersuite, in which case we have no use for session tickets and one will
2682  * never be decrypted, nor will s->tlsext_ticket_expected be set to 1.
2683  *
2684  * Returns:
2685  *   -1: fatal error, either from parsing or decrypting the ticket.
2686  *    0: no ticket was found (or was ignored, based on settings).
2687  *    1: a zero length extension was found, indicating that the client supports
2688  *       session tickets but doesn't currently have one to offer.
2689  *    2: either s->tls_session_secret_cb was set, or a ticket was offered but
2690  *       couldn't be decrypted because of a non-fatal error.
2691  *    3: a ticket was successfully decrypted and *ret was set.
2692  *
2693  * Side effects:
2694  *   Sets s->tlsext_ticket_expected to 1 if the server will have to issue
2695  *   a new session ticket to the client because the client indicated support
2696  *   (and s->tls_session_secret_cb is NULL) but the client either doesn't have
2697  *   a session ticket or we couldn't use the one it gave us, or if
2698  *   s->ctx->tlsext_ticket_key_cb asked to renew the client's ticket.
2699  *   Otherwise, s->tlsext_ticket_expected is set to 0.
2700  */
2701 int tls1_process_ticket(SSL *s, unsigned char *session_id, int len,
2702                         const unsigned char *limit, SSL_SESSION **ret)
2703         {
2704         /* Point after session ID in client hello */
2705         const unsigned char *p = session_id + len;
2706         unsigned short i;
2707
2708         *ret = NULL;
2709         s->tlsext_ticket_expected = 0;
2710
2711         /* If tickets disabled behave as if no ticket present
2712          * to permit stateful resumption.
2713          */
2714         if (SSL_get_options(s) & SSL_OP_NO_TICKET)
2715                 return 0;
2716         if ((s->version <= SSL3_VERSION) || !limit)
2717                 return 0;
2718         if (p >= limit)
2719                 return -1;
2720         /* Skip past DTLS cookie */
2721         if (s->version == DTLS1_VERSION || s->version == DTLS1_BAD_VER)
2722                 {
2723                 i = *(p++);
2724                 p+= i;
2725                 if (p >= limit)
2726                         return -1;
2727                 }
2728         /* Skip past cipher list */
2729         n2s(p, i);
2730         p+= i;
2731         if (p >= limit)
2732                 return -1;
2733         /* Skip past compression algorithm list */
2734         i = *(p++);
2735         p += i;
2736         if (p > limit)
2737                 return -1;
2738         /* Now at start of extensions */
2739         if ((p + 2) >= limit)
2740                 return 0;
2741         n2s(p, i);
2742         while ((p + 4) <= limit)
2743                 {
2744                 unsigned short type, size;
2745                 n2s(p, type);
2746                 n2s(p, size);
2747                 if (p + size > limit)
2748                         return 0;
2749                 if (type == TLSEXT_TYPE_session_ticket)
2750                         {
2751                         int r;
2752                         if (size == 0)
2753                                 {
2754                                 /* The client will accept a ticket but doesn't
2755                                  * currently have one. */
2756                                 s->tlsext_ticket_expected = 1;
2757                                 return 1;
2758                                 }
2759                         if (s->tls_session_secret_cb)
2760                                 {
2761                                 /* Indicate that the ticket couldn't be
2762                                  * decrypted rather than generating the session
2763                                  * from ticket now, trigger abbreviated
2764                                  * handshake based on external mechanism to
2765                                  * calculate the master secret later. */
2766                                 return 2;
2767                                 }
2768                         r = tls_decrypt_ticket(s, p, size, session_id, len, ret);
2769                         switch (r)
2770                                 {
2771                                 case 2: /* ticket couldn't be decrypted */
2772                                         s->tlsext_ticket_expected = 1;
2773                                         return 2;
2774                                 case 3: /* ticket was decrypted */
2775                                         return r;
2776                                 case 4: /* ticket decrypted but need to renew */
2777                                         s->tlsext_ticket_expected = 1;
2778                                         return 3;
2779                                 default: /* fatal error */
2780                                         return -1;
2781                                 }
2782                         }
2783                 p += size;
2784                 }
2785         return 0;
2786         }
2787
2788 /* tls_decrypt_ticket attempts to decrypt a session ticket.
2789  *
2790  *   etick: points to the body of the session ticket extension.
2791  *   eticklen: the length of the session tickets extenion.
2792  *   sess_id: points at the session ID.
2793  *   sesslen: the length of the session ID.
2794  *   psess: (output) on return, if a ticket was decrypted, then this is set to
2795  *       point to the resulting session.
2796  *
2797  * Returns:
2798  *   -1: fatal error, either from parsing or decrypting the ticket.
2799  *    2: the ticket couldn't be decrypted.
2800  *    3: a ticket was successfully decrypted and *psess was set.
2801  *    4: same as 3, but the ticket needs to be renewed.
2802  */
2803 static int tls_decrypt_ticket(SSL *s, const unsigned char *etick, int eticklen,
2804                                 const unsigned char *sess_id, int sesslen,
2805                                 SSL_SESSION **psess)
2806         {
2807         SSL_SESSION *sess;
2808         unsigned char *sdec;
2809         const unsigned char *p;
2810         int slen, mlen, renew_ticket = 0;
2811         unsigned char tick_hmac[EVP_MAX_MD_SIZE];
2812         HMAC_CTX hctx;
2813         EVP_CIPHER_CTX ctx;
2814         SSL_CTX *tctx = s->initial_ctx;
2815         /* Need at least keyname + iv + some encrypted data */
2816         if (eticklen < 48)
2817                 return 2;
2818         /* Initialize session ticket encryption and HMAC contexts */
2819         HMAC_CTX_init(&hctx);
2820         EVP_CIPHER_CTX_init(&ctx);
2821         if (tctx->tlsext_ticket_key_cb)
2822                 {
2823                 unsigned char *nctick = (unsigned char *)etick;
2824                 int rv = tctx->tlsext_ticket_key_cb(s, nctick, nctick + 16,
2825                                                         &ctx, &hctx, 0);
2826                 if (rv < 0)
2827                         return -1;
2828                 if (rv == 0)
2829                         return 2;
2830                 if (rv == 2)
2831                         renew_ticket = 1;
2832                 }
2833         else
2834                 {
2835                 /* Check key name matches */
2836                 if (memcmp(etick, tctx->tlsext_tick_key_name, 16))
2837                         return 2;
2838                 HMAC_Init_ex(&hctx, tctx->tlsext_tick_hmac_key, 16,
2839                                         tlsext_tick_md(), NULL);
2840                 EVP_DecryptInit_ex(&ctx, EVP_aes_128_cbc(), NULL,
2841                                 tctx->tlsext_tick_aes_key, etick + 16);
2842                 }
2843         /* Attempt to process session ticket, first conduct sanity and
2844          * integrity checks on ticket.
2845          */
2846         mlen = HMAC_size(&hctx);
2847         if (mlen < 0)
2848                 {
2849                 EVP_CIPHER_CTX_cleanup(&ctx);
2850                 return -1;
2851                 }
2852         eticklen -= mlen;
2853         /* Check HMAC of encrypted ticket */
2854         HMAC_Update(&hctx, etick, eticklen);
2855         HMAC_Final(&hctx, tick_hmac, NULL);
2856         HMAC_CTX_cleanup(&hctx);
2857         if (memcmp(tick_hmac, etick + eticklen, mlen))
2858                 return 2;
2859         /* Attempt to decrypt session data */
2860         /* Move p after IV to start of encrypted ticket, update length */
2861         p = etick + 16 + EVP_CIPHER_CTX_iv_length(&ctx);
2862         eticklen -= 16 + EVP_CIPHER_CTX_iv_length(&ctx);
2863         sdec = OPENSSL_malloc(eticklen);
2864         if (!sdec)
2865                 {
2866                 EVP_CIPHER_CTX_cleanup(&ctx);
2867                 return -1;
2868                 }
2869         EVP_DecryptUpdate(&ctx, sdec, &slen, p, eticklen);
2870         if (EVP_DecryptFinal(&ctx, sdec + slen, &mlen) <= 0)
2871                 return 2;
2872         slen += mlen;
2873         EVP_CIPHER_CTX_cleanup(&ctx);
2874         p = sdec;
2875
2876         sess = d2i_SSL_SESSION(NULL, &p, slen);
2877         OPENSSL_free(sdec);
2878         if (sess)
2879                 {
2880                 /* The session ID, if non-empty, is used by some clients to
2881                  * detect that the ticket has been accepted. So we copy it to
2882                  * the session structure. If it is empty set length to zero
2883                  * as required by standard.
2884                  */
2885                 if (sesslen)
2886                         memcpy(sess->session_id, sess_id, sesslen);
2887                 sess->session_id_length = sesslen;
2888                 *psess = sess;
2889                 if (renew_ticket)
2890                         return 4;
2891                 else
2892                         return 3;
2893                 }
2894         ERR_clear_error();
2895         /* For session parse failure, indicate that we need to send a new
2896          * ticket. */
2897         return 2;
2898         }
2899
2900 /* Tables to translate from NIDs to TLS v1.2 ids */
2901
2902 typedef struct
2903         {
2904         int nid;
2905         int id;
2906         } tls12_lookup;
2907
2908 static tls12_lookup tls12_md[] = {
2909         {NID_md5, TLSEXT_hash_md5},
2910         {NID_sha1, TLSEXT_hash_sha1},
2911         {NID_sha224, TLSEXT_hash_sha224},
2912         {NID_sha256, TLSEXT_hash_sha256},
2913         {NID_sha384, TLSEXT_hash_sha384},
2914         {NID_sha512, TLSEXT_hash_sha512}
2915 };
2916
2917 static tls12_lookup tls12_sig[] = {
2918         {EVP_PKEY_RSA, TLSEXT_signature_rsa},
2919         {EVP_PKEY_DSA, TLSEXT_signature_dsa},
2920         {EVP_PKEY_EC, TLSEXT_signature_ecdsa}
2921 };
2922
2923 static int tls12_find_id(int nid, tls12_lookup *table, size_t tlen)
2924         {
2925         size_t i;
2926         for (i = 0; i < tlen; i++)
2927                 {
2928                 if (table[i].nid == nid)
2929                         return table[i].id;
2930                 }
2931         return -1;
2932         }
2933
2934 static int tls12_find_nid(int id, tls12_lookup *table, size_t tlen)
2935         {
2936         size_t i;
2937         for (i = 0; i < tlen; i++)
2938                 {
2939                 if ((table[i].id) == id)
2940                         return table[i].nid;
2941                 }
2942         return NID_undef;
2943         }
2944
2945 int tls12_get_sigandhash(unsigned char *p, const EVP_PKEY *pk, const EVP_MD *md)
2946         {
2947         int sig_id, md_id;
2948         if (!md)
2949                 return 0;
2950         md_id = tls12_find_id(EVP_MD_type(md), tls12_md,
2951                                 sizeof(tls12_md)/sizeof(tls12_lookup));
2952         if (md_id == -1)
2953                 return 0;
2954         sig_id = tls12_get_sigid(pk);
2955         if (sig_id == -1)
2956                 return 0;
2957         p[0] = (unsigned char)md_id;
2958         p[1] = (unsigned char)sig_id;
2959         return 1;
2960         }
2961
2962 int tls12_get_sigid(const EVP_PKEY *pk)
2963         {
2964         return tls12_find_id(pk->type, tls12_sig,
2965                                 sizeof(tls12_sig)/sizeof(tls12_lookup));
2966         }
2967
2968 const EVP_MD *tls12_get_hash(unsigned char hash_alg)
2969         {
2970         switch(hash_alg)
2971                 {
2972 #ifndef OPENSSL_NO_MD5
2973                 case TLSEXT_hash_md5:
2974 #ifdef OPENSSL_FIPS
2975                 if (FIPS_mode())
2976                         return NULL;
2977 #endif
2978                 return EVP_md5();
2979 #endif
2980 #ifndef OPENSSL_NO_SHA
2981                 case TLSEXT_hash_sha1:
2982                 return EVP_sha1();
2983 #endif
2984 #ifndef OPENSSL_NO_SHA256
2985                 case TLSEXT_hash_sha224:
2986                 return EVP_sha224();
2987
2988                 case TLSEXT_hash_sha256:
2989                 return EVP_sha256();
2990 #endif
2991 #ifndef OPENSSL_NO_SHA512
2992                 case TLSEXT_hash_sha384:
2993                 return EVP_sha384();
2994
2995                 case TLSEXT_hash_sha512:
2996                 return EVP_sha512();
2997 #endif
2998                 default:
2999                 return NULL;
3000
3001                 }
3002         }
3003
3004 static int tls12_get_pkey_idx(unsigned char sig_alg)
3005         {
3006         switch(sig_alg)
3007                 {
3008 #ifndef OPENSSL_NO_RSA
3009         case TLSEXT_signature_rsa:
3010                 return SSL_PKEY_RSA_SIGN;
3011 #endif
3012 #ifndef OPENSSL_NO_DSA
3013         case TLSEXT_signature_dsa:
3014                 return SSL_PKEY_DSA_SIGN;
3015 #endif
3016 #ifndef OPENSSL_NO_ECDSA
3017         case TLSEXT_signature_ecdsa:
3018                 return SSL_PKEY_ECC;
3019 #endif
3020                 }
3021         return -1;
3022         }
3023
3024 /* Convert TLS 1.2 signature algorithm extension values into NIDs */
3025 static void tls1_lookup_sigalg(int *phash_nid, int *psign_nid,
3026                         int *psignhash_nid, const unsigned char *data)
3027         {
3028         int sign_nid, hash_nid;
3029         if (!phash_nid && !psign_nid && !psignhash_nid)
3030                 return;
3031         if (phash_nid || psignhash_nid)
3032                 {
3033                 hash_nid = tls12_find_nid(data[0], tls12_md,
3034                                         sizeof(tls12_md)/sizeof(tls12_lookup));
3035                 if (phash_nid)
3036                         *phash_nid = hash_nid;
3037                 }
3038         if (psign_nid || psignhash_nid)
3039                 {
3040                 sign_nid = tls12_find_nid(data[1], tls12_sig,
3041                                         sizeof(tls12_sig)/sizeof(tls12_lookup));
3042                 if (psign_nid)
3043                         *psign_nid = sign_nid;
3044                 }
3045         if (psignhash_nid)
3046                 {
3047                 if (sign_nid && hash_nid)
3048                         OBJ_find_sigid_by_algs(psignhash_nid,
3049                                                         hash_nid, sign_nid);
3050                 else
3051                         *psignhash_nid = NID_undef;
3052                 }
3053         }
3054 /* Given preference and allowed sigalgs set shared sigalgs */
3055 static int tls12_do_shared_sigalgs(TLS_SIGALGS *shsig,
3056                                 const unsigned char *pref, size_t preflen,
3057                                 const unsigned char *allow, size_t allowlen)
3058         {
3059         const unsigned char *ptmp, *atmp;
3060         size_t i, j, nmatch = 0;
3061         for (i = 0, ptmp = pref; i < preflen; i+=2, ptmp+=2)
3062                 {
3063                 /* Skip disabled hashes or signature algorithms */
3064                 if (tls12_get_hash(ptmp[0]) == NULL)
3065                         continue;
3066                 if (tls12_get_pkey_idx(ptmp[1]) == -1)
3067                         continue;
3068                 for (j = 0, atmp = allow; j < allowlen; j+=2, atmp+=2)
3069                         {
3070                         if (ptmp[0] == atmp[0] && ptmp[1] == atmp[1])
3071                                 {
3072                                 nmatch++;
3073                                 if (shsig)
3074                                         {
3075                                         shsig->rhash = ptmp[0];
3076                                         shsig->rsign = ptmp[1];
3077                                         tls1_lookup_sigalg(&shsig->hash_nid,
3078                                                 &shsig->sign_nid,
3079                                                 &shsig->signandhash_nid,
3080                                                 ptmp);
3081                                         shsig++;
3082                                         }
3083                                 break;
3084                                 }
3085                         }
3086                 }
3087         return nmatch;
3088         }
3089
3090 /* Set shared signature algorithms for SSL structures */
3091 static int tls1_set_shared_sigalgs(SSL *s)
3092         {
3093         const unsigned char *pref, *allow, *conf;
3094         size_t preflen, allowlen, conflen;
3095         size_t nmatch;
3096         TLS_SIGALGS *salgs = NULL;
3097         CERT *c = s->cert;
3098         /* If client use client signature algorithms if not NULL */
3099         if (!s->server && c->client_sigalgs)
3100                 {
3101                 conf = c->client_sigalgs;
3102                 conflen = c->client_sigalgslen;
3103                 }
3104         else if (c->conf_sigalgs)
3105                 {
3106                 conf = c->conf_sigalgs;
3107                 conflen = c->conf_sigalgslen;
3108                 }
3109         else
3110                 {
3111                 conf = tls12_sigalgs;
3112                 conflen = sizeof(tls12_sigalgs);
3113 #ifdef OPENSSL_FIPS
3114                 if (FIPS_mode())
3115                         conflen -= 2;
3116 #endif
3117                 }
3118         if(s->options & SSL_OP_CIPHER_SERVER_PREFERENCE)
3119                 {
3120                 pref = conf;
3121                 preflen = conflen;
3122                 allow = c->peer_sigalgs;
3123                 allowlen = c->peer_sigalgslen;
3124                 }
3125         else
3126                 {
3127                 allow = conf;
3128                 allowlen = conflen;
3129                 pref = c->peer_sigalgs;
3130                 preflen = c->peer_sigalgslen;
3131                 }
3132         nmatch = tls12_do_shared_sigalgs(NULL, pref, preflen, allow, allowlen);
3133         if (!nmatch)
3134                 return 1;
3135         salgs = OPENSSL_malloc(nmatch * sizeof(TLS_SIGALGS));
3136         if (!salgs)
3137                 return 0;
3138         nmatch = tls12_do_shared_sigalgs(salgs, pref, preflen, allow, allowlen);
3139         c->shared_sigalgs = salgs;
3140         c->shared_sigalgslen = nmatch;
3141         return 1;
3142         }
3143
3144
3145 /* Set preferred digest for each key type */
3146
3147 int tls1_process_sigalgs(SSL *s, const unsigned char *data, int dsize)
3148         {
3149         int idx;
3150         size_t i;
3151         const EVP_MD *md;
3152         CERT *c = s->cert;
3153         TLS_SIGALGS *sigptr;
3154         /* Extension ignored for TLS versions below 1.2 */
3155         if (TLS1_get_version(s) < TLS1_2_VERSION)
3156                 return 1;
3157         /* Should never happen */
3158         if (!c)
3159                 return 0;
3160
3161         c->pkeys[SSL_PKEY_DSA_SIGN].digest = NULL;
3162         c->pkeys[SSL_PKEY_RSA_SIGN].digest = NULL;
3163         c->pkeys[SSL_PKEY_RSA_ENC].digest = NULL;
3164         c->pkeys[SSL_PKEY_ECC].digest = NULL;
3165
3166         c->peer_sigalgs = OPENSSL_malloc(dsize);
3167         if (!c->peer_sigalgs)
3168                 return 0;
3169         c->peer_sigalgslen = dsize;
3170         memcpy(c->peer_sigalgs, data, dsize);
3171
3172         tls1_set_shared_sigalgs(s);
3173
3174         for (i = 0, sigptr = c->shared_sigalgs;
3175                         i < c->shared_sigalgslen; i++, sigptr++)
3176                 {
3177                 idx = tls12_get_pkey_idx(sigptr->rsign);
3178                 if (idx > 0 && c->pkeys[idx].digest == NULL)
3179                         {
3180                         md = tls12_get_hash(sigptr->rhash);
3181                         c->pkeys[idx].digest = md;
3182                         if (idx == SSL_PKEY_RSA_SIGN)
3183                                 c->pkeys[SSL_PKEY_RSA_ENC].digest = md;
3184                         }
3185
3186                 }
3187         /* In strict mode leave unset digests as NULL to indicate we can't
3188          * use the certificate for signing.
3189          */
3190         if (!(s->cert->cert_flags & SSL_CERT_FLAG_TLS_STRICT))
3191                 {
3192                 /* Set any remaining keys to default values. NOTE: if alg is
3193                  * not supported it stays as NULL.
3194                  */
3195 #ifndef OPENSSL_NO_DSA
3196                 if (!c->pkeys[SSL_PKEY_DSA_SIGN].digest)
3197                         c->pkeys[SSL_PKEY_DSA_SIGN].digest = EVP_sha1();
3198 #endif
3199 #ifndef OPENSSL_NO_RSA
3200                 if (!c->pkeys[SSL_PKEY_RSA_SIGN].digest)
3201                         {
3202                         c->pkeys[SSL_PKEY_RSA_SIGN].digest = EVP_sha1();
3203                         c->pkeys[SSL_PKEY_RSA_ENC].digest = EVP_sha1();
3204                         }
3205 #endif
3206 #ifndef OPENSSL_NO_ECDSA
3207                 if (!c->pkeys[SSL_PKEY_ECC].digest)
3208                         c->pkeys[SSL_PKEY_ECC].digest = EVP_sha1();
3209 #endif
3210                 }
3211         return 1;
3212         }
3213
3214
3215 int SSL_get_sigalgs(SSL *s, int idx,
3216                         int *psign, int *phash, int *psignhash,
3217                         unsigned char *rsig, unsigned char *rhash)
3218         {
3219         const unsigned char *psig = s->cert->peer_sigalgs;
3220         if (psig == NULL)
3221                 return 0;
3222         if (idx >= 0)
3223                 {
3224                 idx <<= 1;
3225                 if (idx >= (int)s->cert->peer_sigalgslen)
3226                         return 0;
3227                 psig += idx;
3228                 if (rhash)
3229                         *rhash = psig[0];
3230                 if (rsig)
3231                         *rsig = psig[1];
3232                 tls1_lookup_sigalg(phash, psign, psignhash, psig);
3233                 }
3234         return s->cert->peer_sigalgslen / 2;
3235         }
3236
3237 int SSL_get_shared_sigalgs(SSL *s, int idx,
3238                         int *psign, int *phash, int *psignhash,
3239                         unsigned char *rsig, unsigned char *rhash)
3240         {
3241         TLS_SIGALGS *shsigalgs = s->cert->shared_sigalgs;
3242         if (!shsigalgs || idx >= (int)s->cert->shared_sigalgslen)
3243                 return 0;
3244         shsigalgs += idx;
3245         if (phash)
3246                 *phash = shsigalgs->hash_nid;
3247         if (psign)
3248                 *psign = shsigalgs->sign_nid;
3249         if (psignhash)
3250                 *psignhash = shsigalgs->signandhash_nid;
3251         if (rsig)
3252                 *rsig = shsigalgs->rsign;
3253         if (rhash)
3254                 *rhash = shsigalgs->rhash;
3255         return s->cert->shared_sigalgslen;
3256         }
3257
3258
3259 #ifndef OPENSSL_NO_HEARTBEATS
3260 int
3261 tls1_process_heartbeat(SSL *s)
3262         {
3263         unsigned char *p = &s->s3->rrec.data[0], *pl;
3264         unsigned short hbtype;
3265         unsigned int payload;
3266         unsigned int padding = 16; /* Use minimum padding */
3267
3268         /* Read type and payload length first */
3269         hbtype = *p++;
3270         n2s(p, payload);
3271         pl = p;
3272
3273         if (s->msg_callback)
3274                 s->msg_callback(0, s->version, TLS1_RT_HEARTBEAT,
3275                         &s->s3->rrec.data[0], s->s3->rrec.length,
3276                         s, s->msg_callback_arg);
3277
3278         if (hbtype == TLS1_HB_REQUEST)
3279                 {
3280                 unsigned char *buffer, *bp;
3281                 int r;
3282
3283                 /* Allocate memory for the response, size is 1 bytes
3284                  * message type, plus 2 bytes payload length, plus
3285                  * payload, plus padding
3286                  */
3287                 buffer = OPENSSL_malloc(1 + 2 + payload + padding);
3288                 bp = buffer;
3289
3290                 /* Enter response type, length and copy payload */
3291                 *bp++ = TLS1_HB_RESPONSE;
3292                 s2n(payload, bp);
3293                 memcpy(bp, pl, payload);
3294                 bp += payload;
3295                 /* Random padding */
3296                 RAND_pseudo_bytes(bp, padding);
3297
3298                 r = ssl3_write_bytes(s, TLS1_RT_HEARTBEAT, buffer, 3 + payload + padding);
3299
3300                 if (r >= 0 && s->msg_callback)
3301                         s->msg_callback(1, s->version, TLS1_RT_HEARTBEAT,
3302                                 buffer, 3 + payload + padding,
3303                                 s, s->msg_callback_arg);
3304
3305                 OPENSSL_free(buffer);
3306
3307                 if (r < 0)
3308                         return r;
3309                 }
3310         else if (hbtype == TLS1_HB_RESPONSE)
3311                 {
3312                 unsigned int seq;
3313
3314                 /* We only send sequence numbers (2 bytes unsigned int),
3315                  * and 16 random bytes, so we just try to read the
3316                  * sequence number */
3317                 n2s(pl, seq);
3318
3319                 if (payload == 18 && seq == s->tlsext_hb_seq)
3320                         {
3321                         s->tlsext_hb_seq++;
3322                         s->tlsext_hb_pending = 0;
3323                         }
3324                 }
3325
3326         return 0;
3327         }
3328
3329 int
3330 tls1_heartbeat(SSL *s)
3331         {
3332         unsigned char *buf, *p;
3333         int ret;
3334         unsigned int payload = 18; /* Sequence number + random bytes */
3335         unsigned int padding = 16; /* Use minimum padding */
3336
3337         /* Only send if peer supports and accepts HB requests... */
3338         if (!(s->tlsext_heartbeat & SSL_TLSEXT_HB_ENABLED) ||
3339             s->tlsext_heartbeat & SSL_TLSEXT_HB_DONT_SEND_REQUESTS)
3340                 {
3341                 SSLerr(SSL_F_TLS1_HEARTBEAT,SSL_R_TLS_HEARTBEAT_PEER_DOESNT_ACCEPT);
3342                 return -1;
3343                 }
3344
3345         /* ...and there is none in flight yet... */
3346         if (s->tlsext_hb_pending)
3347                 {
3348                 SSLerr(SSL_F_TLS1_HEARTBEAT,SSL_R_TLS_HEARTBEAT_PENDING);
3349                 return -1;
3350                 }
3351
3352         /* ...and no handshake in progress. */
3353         if (SSL_in_init(s) || s->in_handshake)
3354                 {
3355                 SSLerr(SSL_F_TLS1_HEARTBEAT,SSL_R_UNEXPECTED_MESSAGE);
3356                 return -1;
3357                 }
3358
3359         /* Check if padding is too long, payload and padding
3360          * must not exceed 2^14 - 3 = 16381 bytes in total.
3361          */
3362         OPENSSL_assert(payload + padding <= 16381);
3363
3364         /* Create HeartBeat message, we just use a sequence number
3365          * as payload to distuingish different messages and add
3366          * some random stuff.
3367          *  - Message Type, 1 byte
3368          *  - Payload Length, 2 bytes (unsigned int)
3369          *  - Payload, the sequence number (2 bytes uint)
3370          *  - Payload, random bytes (16 bytes uint)
3371          *  - Padding
3372          */
3373         buf = OPENSSL_malloc(1 + 2 + payload + padding);
3374         p = buf;
3375         /* Message Type */
3376         *p++ = TLS1_HB_REQUEST;
3377         /* Payload length (18 bytes here) */
3378         s2n(payload, p);
3379         /* Sequence number */
3380         s2n(s->tlsext_hb_seq, p);
3381         /* 16 random bytes */
3382         RAND_pseudo_bytes(p, 16);
3383         p += 16;
3384         /* Random padding */
3385         RAND_pseudo_bytes(p, padding);
3386
3387         ret = ssl3_write_bytes(s, TLS1_RT_HEARTBEAT, buf, 3 + payload + padding);
3388         if (ret >= 0)
3389                 {
3390                 if (s->msg_callback)
3391                         s->msg_callback(1, s->version, TLS1_RT_HEARTBEAT,
3392                                 buf, 3 + payload + padding,
3393                                 s, s->msg_callback_arg);
3394
3395                 s->tlsext_hb_pending = 1;
3396                 }
3397
3398         OPENSSL_free(buf);
3399
3400         return ret;
3401         }
3402 #endif
3403
3404 #define MAX_SIGALGLEN   (TLSEXT_hash_num * TLSEXT_signature_num * 2)
3405
3406 typedef struct
3407         {
3408         size_t sigalgcnt;
3409         int sigalgs[MAX_SIGALGLEN];
3410         } sig_cb_st;
3411
3412 static int sig_cb(const char *elem, int len, void *arg)
3413         {
3414         sig_cb_st *sarg = arg;
3415         size_t i;
3416         char etmp[20], *p;
3417         int sig_alg, hash_alg;
3418         if (sarg->sigalgcnt == MAX_SIGALGLEN)
3419                 return 0;
3420         if (len > (int)(sizeof(etmp) - 1))
3421                 return 0;
3422         memcpy(etmp, elem, len);
3423         etmp[len] = 0;
3424         p = strchr(etmp, '+');
3425         if (!p)
3426                 return 0;
3427         *p = 0;
3428         p++;
3429         if (!*p)
3430                 return 0;
3431
3432         if (!strcmp(etmp, "RSA"))
3433                 sig_alg = EVP_PKEY_RSA;
3434         else if (!strcmp(etmp, "DSA"))
3435                 sig_alg = EVP_PKEY_DSA;
3436         else if (!strcmp(etmp, "ECDSA"))
3437                 sig_alg = EVP_PKEY_EC;
3438         else return 0;
3439
3440         hash_alg = OBJ_sn2nid(p);
3441         if (hash_alg == NID_undef)
3442                 hash_alg = OBJ_ln2nid(p);
3443         if (hash_alg == NID_undef)
3444                 return 0;
3445
3446         for (i = 0; i < sarg->sigalgcnt; i+=2)
3447                 {
3448                 if (sarg->sigalgs[i] == sig_alg
3449                         && sarg->sigalgs[i + 1] == hash_alg)
3450                         return 0;
3451                 }
3452         sarg->sigalgs[sarg->sigalgcnt++] = hash_alg;
3453         sarg->sigalgs[sarg->sigalgcnt++] = sig_alg;
3454         return 1;
3455         }
3456
3457 /* Set suppored signature algorithms based on a colon separated list
3458  * of the form sig+hash e.g. RSA+SHA512:DSA+SHA512 */
3459 int tls1_set_sigalgs_list(CERT *c, const char *str, int client)
3460         {
3461         sig_cb_st sig;
3462         sig.sigalgcnt = 0;
3463         if (!CONF_parse_list(str, ':', 1, sig_cb, &sig))
3464                 return 0;
3465         return tls1_set_sigalgs(c, sig.sigalgs, sig.sigalgcnt, client);
3466         }
3467
3468 int tls1_set_sigalgs(CERT *c, const int *psig_nids, size_t salglen, int client)
3469         {
3470         unsigned char *sigalgs, *sptr;
3471         int rhash, rsign;
3472         size_t i;
3473         if (salglen & 1)
3474                 return 0;
3475         sigalgs = OPENSSL_malloc(salglen);
3476         if (sigalgs == NULL)
3477                 return 0;
3478         for (i = 0, sptr = sigalgs; i < salglen; i+=2)
3479                 {
3480                 rhash = tls12_find_id(*psig_nids++, tls12_md,
3481                                         sizeof(tls12_md)/sizeof(tls12_lookup));
3482                 rsign = tls12_find_id(*psig_nids++, tls12_sig,
3483                                 sizeof(tls12_sig)/sizeof(tls12_lookup));
3484
3485                 if (rhash == -1 || rsign == -1)
3486                         goto err;
3487                 *sptr++ = rhash;
3488                 *sptr++ = rsign;
3489                 }
3490
3491         if (client)
3492                 {
3493                 if (c->client_sigalgs)
3494                         OPENSSL_free(c->client_sigalgs);
3495                 c->client_sigalgs = sigalgs;
3496                 c->client_sigalgslen = salglen;
3497                 }
3498         else
3499                 {
3500                 if (c->conf_sigalgs)
3501                         OPENSSL_free(c->conf_sigalgs);
3502                 c->conf_sigalgs = sigalgs;
3503                 c->conf_sigalgslen = salglen;
3504                 }
3505
3506         return 1;
3507
3508         err:
3509         OPENSSL_free(sigalgs);
3510         return 0;
3511         }
3512
3513 static int tls1_check_sig_alg(CERT *c, X509 *x, int default_nid)
3514         {
3515         int sig_nid;
3516         size_t i;
3517         if (default_nid == -1)
3518                 return 1;
3519         sig_nid = X509_get_signature_nid(x);
3520         if (default_nid)
3521                 return sig_nid == default_nid ? 1 : 0;
3522         for (i = 0; i < c->shared_sigalgslen; i++)
3523                 if (sig_nid == c->shared_sigalgs[i].signandhash_nid)
3524                         return 1;
3525         return 0;
3526         }
3527
3528 /* Check certificate chain is consistent with TLS extensions and is
3529  * usable by server.
3530  */
3531 int tls1_check_chain(SSL *s, X509 *x, EVP_PKEY *pk, STACK_OF(X509) *chain,
3532                                                                         int idx)
3533         {
3534         int i;
3535         int rv = CERT_PKEY_INVALID;
3536         CERT_PKEY *cpk = NULL;
3537         CERT *c = s->cert;
3538         if (idx != -1)
3539                 {
3540                 cpk = c->pkeys + idx;
3541                 x = cpk->x509;
3542                 pk = cpk->privatekey;
3543                 chain = cpk->chain;
3544                 /* If no cert or key, forget it */
3545                 if (!x || !pk)
3546                         goto end;
3547                 }
3548         else
3549                 {
3550                 idx = ssl_cert_type(x, pk);
3551                 if (idx == -1)
3552                         goto end;
3553                 }
3554
3555         /* Check all signature algorithms are consistent with
3556          * signature algorithms extension if TLS 1.2 or later
3557          * and strict mode.
3558          */
3559         if (TLS1_get_version(s) >= TLS1_2_VERSION
3560                 && c->cert_flags & SSL_CERT_FLAG_TLS_STRICT)
3561                 {
3562                 int default_nid;
3563                 unsigned char rsign = 0;
3564                 if (c->peer_sigalgs)
3565                         default_nid = 0;
3566                 /* If no sigalgs extension use defaults from RFC5246 */
3567                 else
3568                         {
3569                         switch(idx)
3570                                 {
3571                         case SSL_PKEY_RSA_ENC:
3572                         case SSL_PKEY_RSA_SIGN:
3573                         case SSL_PKEY_DH_RSA:
3574                                 rsign = TLSEXT_signature_rsa;
3575                                 default_nid = NID_sha1WithRSAEncryption;
3576                                 break;
3577
3578                         case SSL_PKEY_DSA_SIGN:
3579                         case SSL_PKEY_DH_DSA:
3580                                 rsign = TLSEXT_signature_dsa;
3581                                 default_nid = NID_dsaWithSHA1;
3582                                 break;
3583
3584                         case SSL_PKEY_ECC:
3585                                 rsign = TLSEXT_signature_ecdsa;
3586                                 default_nid = NID_ecdsa_with_SHA1;
3587                                 break;
3588
3589                         default:
3590                                 default_nid = -1;
3591                                 break;
3592                                 }
3593                         }
3594                 /* If peer sent no signature algorithms extension and we
3595                  * have set preferred signature algorithms check we support
3596                  * sha1.
3597                  */
3598                 if (default_nid > 0 && c->conf_sigalgs)
3599                         {
3600                         size_t j;
3601                         const unsigned char *p = c->conf_sigalgs;
3602                         for (j = 0; j < c->conf_sigalgslen; j += 2, p += 2)
3603                                 {
3604                                 if (p[0] == TLSEXT_hash_sha1 && p[1] == rsign)
3605                                         break;
3606                                 }
3607                         if (j == c->conf_sigalgslen)
3608                                 goto end;
3609                         }
3610                 /* Check signature algorithm of each cert in chain */
3611                 if (!tls1_check_sig_alg(c, x, default_nid))
3612                         goto end;
3613                 for (i = 0; i < sk_X509_num(chain); i++)
3614                         {
3615                         if (!tls1_check_sig_alg(c, sk_X509_value(chain, i),
3616                                                         default_nid))
3617                                 goto end;
3618                         }
3619                 }
3620
3621         /* Check cert parameters are consistent */
3622         if (!tls1_check_cert_param(s, x))
3623                 goto end;
3624         /* In strict mode check rest of chain too */
3625         if (c->cert_flags & SSL_CERT_FLAG_TLS_STRICT)
3626                 {
3627                 for (i = 0; i < sk_X509_num(chain); i++)
3628                         {
3629                         if (!tls1_check_cert_param(s, sk_X509_value(chain, i)))
3630                                 goto end;
3631                         }
3632                 }
3633         rv = CERT_PKEY_VALID;
3634
3635         end:
3636         if (cpk)
3637                 {
3638                 if (rv && cpk->digest)
3639                         rv |= CERT_PKEY_SIGN;
3640                 cpk->valid_flags = rv;
3641                 }
3642         return rv;
3643         }
3644
3645 /* Set validity of certificates in an SSL structure */
3646 void tls1_set_cert_validity(SSL *s)
3647         {
3648         tls1_check_chain(s, NULL, NULL, NULL, SSL_PKEY_RSA_ENC);
3649         tls1_check_chain(s, NULL, NULL, NULL, SSL_PKEY_RSA_SIGN);
3650         tls1_check_chain(s, NULL, NULL, NULL, SSL_PKEY_DSA_SIGN);
3651         tls1_check_chain(s, NULL, NULL, NULL, SSL_PKEY_DH_RSA);
3652         tls1_check_chain(s, NULL, NULL, NULL, SSL_PKEY_DH_DSA);
3653         tls1_check_chain(s, NULL, NULL, NULL, SSL_PKEY_ECC);
3654         }
3655 /* User level utiity function to check a chain is suitable */
3656 int SSL_check_chain(SSL *s, X509 *x, EVP_PKEY *pk, STACK_OF(X509) *chain)
3657         {
3658         return tls1_check_chain(s, x, pk, chain, -1);
3659         }
3660
3661 #endif