ssl/t1_lib.c

   1 /* ssl/t1_lib.c */
   2 /* Copyright (C) 1995-1998 Eric Young (eay@cryptsoft.com)
   3  * All rights reserved.
   4  *
   5  * This package is an SSL implementation written
   6  * by Eric Young (eay@cryptsoft.com).
   7  * The implementation was written so as to conform with Netscapes SSL.
   8  *
   9  * This library is free for commercial and non-commercial use as long as
  10  * the following conditions are aheared to.  The following conditions
  11  * apply to all code found in this distribution, be it the RC4, RSA,
  12  * lhash, DES, etc., code; not just the SSL code.  The SSL documentation
  13  * included with this distribution is covered by the same copyright terms
  14  * except that the holder is Tim Hudson (tjh@cryptsoft.com).
  15  *
  16  * Copyright remains Eric Young's, and as such any Copyright notices in
  17  * the code are not to be removed.
  18  * If this package is used in a product, Eric Young should be given attribution
  19  * as the author of the parts of the library used.
  20  * This can be in the form of a textual message at program startup or
  21  * in documentation (online or textual) provided with the package.
  22  *
  23  * Redistribution and use in source and binary forms, with or without
  24  * modification, are permitted provided that the following conditions
  25  * are met:
  26  * 1. Redistributions of source code must retain the copyright
  27  *    notice, this list of conditions and the following disclaimer.
  28  * 2. Redistributions in binary form must reproduce the above copyright
  29  *    notice, this list of conditions and the following disclaimer in the
  30  *    documentation and/or other materials provided with the distribution.
  31  * 3. All advertising materials mentioning features or use of this software
  32  *    must display the following acknowledgement:
  33  *    "This product includes cryptographic software written by
  34  *     Eric Young (eay@cryptsoft.com)"
  35  *    The word 'cryptographic' can be left out if the rouines from the library
  36  *    being used are not cryptographic related :-).
  37  * 4. If you include any Windows specific code (or a derivative thereof) from
  38  *    the apps directory (application code) you must include an acknowledgement:
  39  *    "This product includes software written by Tim Hudson (tjh@cryptsoft.com)"
  40  *
  41  * THIS SOFTWARE IS PROVIDED BY ERIC YOUNG ``AS IS'' AND
  42  * ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
  43  * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE
  44  * ARE DISCLAIMED.  IN NO EVENT SHALL THE AUTHOR OR CONTRIBUTORS BE LIABLE
  45  * FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL
  46  * DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS
  47  * OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION)
  48  * HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT
  49  * LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY
  50  * OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF
  51  * SUCH DAMAGE.
  52  *
  53  * The licence and distribution terms for any publically available version or
  54  * derivative of this code cannot be changed.  i.e. this code cannot simply be
  55  * copied and put under another distribution licence
  56  * [including the GNU Public Licence.]
  57  */
  58 /* ====================================================================
  59  * Copyright (c) 1998-2007 The OpenSSL Project.  All rights reserved.
  60  *
  61  * Redistribution and use in source and binary forms, with or without
  62  * modification, are permitted provided that the following conditions
  63  * are met:
  64  *
  65  * 1. Redistributions of source code must retain the above copyright
  66  *    notice, this list of conditions and the following disclaimer.
  67  *
  68  * 2. Redistributions in binary form must reproduce the above copyright
  69  *    notice, this list of conditions and the following disclaimer in
  70  *    the documentation and/or other materials provided with the
  71  *    distribution.
  72  *
  73  * 3. All advertising materials mentioning features or use of this
  74  *    software must display the following acknowledgment:
  75  *    "This product includes software developed by the OpenSSL Project
  76  *    for use in the OpenSSL Toolkit. (http://www.openssl.org/)"
  77  *
  78  * 4. The names "OpenSSL Toolkit" and "OpenSSL Project" must not be used to
  79  *    endorse or promote products derived from this software without
  80  *    prior written permission. For written permission, please contact
  81  *    openssl-core@openssl.org.
  82  *
  83  * 5. Products derived from this software may not be called "OpenSSL"
  84  *    nor may "OpenSSL" appear in their names without prior written
  85  *    permission of the OpenSSL Project.
  86  *
  87  * 6. Redistributions of any form whatsoever must retain the following
  88  *    acknowledgment:
  89  *    "This product includes software developed by the OpenSSL Project
  90  *    for use in the OpenSSL Toolkit (http://www.openssl.org/)"
  91  *
  92  * THIS SOFTWARE IS PROVIDED BY THE OpenSSL PROJECT ``AS IS'' AND ANY
  93  * EXPRESSED OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
  94  * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
  95  * PURPOSE ARE DISCLAIMED.  IN NO EVENT SHALL THE OpenSSL PROJECT OR
  96  * ITS CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL,
  97  * SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT
  98  * NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES;
  99  * LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION)
 100  * HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT,
 101  * STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE)
 102  * ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED
 103  * OF THE POSSIBILITY OF SUCH DAMAGE.
 104  * ====================================================================
 105  *
 106  * This product includes cryptographic software written by Eric Young
 107  * (eay@cryptsoft.com).  This product includes software written by Tim
 108  * Hudson (tjh@cryptsoft.com).
 109  *
 110  */
 111
 112 #include <stdio.h>
 113 #include <openssl/objects.h>
 114 #include <openssl/evp.h>
 115 #include <openssl/hmac.h>
 116 #include <openssl/ocsp.h>
 117 #include <openssl/rand.h>
 118 #include "ssl_locl.h"
 119
 120 const char tls1_version_str[]="TLSv1" OPENSSL_VERSION_PTEXT;
 121
 122 #ifndef OPENSSL_NO_TLSEXT
 123 static int tls_decrypt_ticket(SSL *s, const unsigned char *tick, int ticklen,
 124                                 const unsigned char *sess_id, int sesslen,
 125                                 SSL_SESSION **psess);
 126 #endif
 127
 128 SSL3_ENC_METHOD TLSv1_enc_data={
 129         tls1_enc,
 130         tls1_mac,
 131         tls1_setup_key_block,
 132         tls1_generate_master_secret,
 133         tls1_change_cipher_state,
 134         tls1_final_finish_mac,
 135         TLS1_FINISH_MAC_LENGTH,
 136         tls1_cert_verify_mac,
 137         TLS_MD_CLIENT_FINISH_CONST,TLS_MD_CLIENT_FINISH_CONST_SIZE,
 138         TLS_MD_SERVER_FINISH_CONST,TLS_MD_SERVER_FINISH_CONST_SIZE,
 139         tls1_alert_code,
 140         tls1_export_keying_material,
 141         };
 142
 143 long tls1_default_timeout(void)
 144         {
 145         /* 2 hours, the 24 hours mentioned in the TLSv1 spec
 146          * is way too long for http, the cache would over fill */
 147         return(60*60*2);
 148         }
 149
 150 int tls1_new(SSL *s)
 151         {
 152         if (!ssl3_new(s)) return(0);
 153         s->method->ssl_clear(s);
 154         return(1);
 155         }
 156
 157 void tls1_free(SSL *s)
 158         {
 159 #ifndef OPENSSL_NO_TLSEXT
 160         if (s->tlsext_session_ticket)
 161                 {
 162                 OPENSSL_free(s->tlsext_session_ticket);
 163                 }
 164 #endif /* OPENSSL_NO_TLSEXT */
 165         ssl3_free(s);
 166         }
 167
 168 void tls1_clear(SSL *s)
 169         {
 170         ssl3_clear(s);
 171         s->version = s->method->version;
 172         }
 173
 174 #ifndef OPENSSL_NO_EC
 175
 176 static int nid_list[] =
 177         {
 178                 NID_sect163k1, /* sect163k1 (1) */
 179                 NID_sect163r1, /* sect163r1 (2) */
 180                 NID_sect163r2, /* sect163r2 (3) */
 181                 NID_sect193r1, /* sect193r1 (4) */
 182                 NID_sect193r2, /* sect193r2 (5) */
 183                 NID_sect233k1, /* sect233k1 (6) */
 184                 NID_sect233r1, /* sect233r1 (7) */
 185                 NID_sect239k1, /* sect239k1 (8) */
 186                 NID_sect283k1, /* sect283k1 (9) */
 187                 NID_sect283r1, /* sect283r1 (10) */
 188                 NID_sect409k1, /* sect409k1 (11) */
 189                 NID_sect409r1, /* sect409r1 (12) */
 190                 NID_sect571k1, /* sect571k1 (13) */
 191                 NID_sect571r1, /* sect571r1 (14) */
 192                 NID_secp160k1, /* secp160k1 (15) */
 193                 NID_secp160r1, /* secp160r1 (16) */
 194                 NID_secp160r2, /* secp160r2 (17) */
 195                 NID_secp192k1, /* secp192k1 (18) */
 196                 NID_X9_62_prime192v1, /* secp192r1 (19) */
 197                 NID_secp224k1, /* secp224k1 (20) */
 198                 NID_secp224r1, /* secp224r1 (21) */
 199                 NID_secp256k1, /* secp256k1 (22) */
 200                 NID_X9_62_prime256v1, /* secp256r1 (23) */
 201                 NID_secp384r1, /* secp384r1 (24) */
 202                 NID_secp521r1  /* secp521r1 (25) */
 203         };
 204
 205
 206 static const unsigned char ecformats_default[] =
 207         {
 208         TLSEXT_ECPOINTFORMAT_uncompressed,
 209         TLSEXT_ECPOINTFORMAT_ansiX962_compressed_prime,
 210         TLSEXT_ECPOINTFORMAT_ansiX962_compressed_char2
 211         };
 212
 213 static const unsigned char eccurves_default[] =
 214         {
 215                 0,14, /* sect571r1 (14) */
 216                 0,13, /* sect571k1 (13) */
 217                 0,25, /* secp521r1 (25) */
 218                 0,11, /* sect409k1 (11) */
 219                 0,12, /* sect409r1 (12) */
 220                 0,24, /* secp384r1 (24) */
 221                 0,9,  /* sect283k1 (9) */
 222                 0,10, /* sect283r1 (10) */
 223                 0,22, /* secp256k1 (22) */
 224                 0,23, /* secp256r1 (23) */
 225                 0,8,  /* sect239k1 (8) */
 226                 0,6,  /* sect233k1 (6) */
 227                 0,7,  /* sect233r1 (7) */
 228                 0,20, /* secp224k1 (20) */
 229                 0,21, /* secp224r1 (21) */
 230                 0,4,  /* sect193r1 (4) */
 231                 0,5,  /* sect193r2 (5) */
 232                 0,18, /* secp192k1 (18) */
 233                 0,19, /* secp192r1 (19) */
 234                 0,1,  /* sect163k1 (1) */
 235                 0,2,  /* sect163r1 (2) */
 236                 0,3,  /* sect163r2 (3) */
 237                 0,15, /* secp160k1 (15) */
 238                 0,16, /* secp160r1 (16) */
 239                 0,17, /* secp160r2 (17) */
 240         };
 241
 242 int tls1_ec_curve_id2nid(int curve_id)
 243         {
 244         /* ECC curves from draft-ietf-tls-ecc-12.txt (Oct. 17, 2005) */
 245         if ((curve_id < 1) || ((unsigned int)curve_id >
 246                                 sizeof(nid_list)/sizeof(nid_list[0])))
 247                 return 0;
 248         return nid_list[curve_id-1];
 249         }
 250
 251 int tls1_ec_nid2curve_id(int nid)
 252         {
 253         /* ECC curves from draft-ietf-tls-ecc-12.txt (Oct. 17, 2005) */
 254         switch (nid)
 255                 {
 256         case NID_sect163k1: /* sect163k1 (1) */
 257                 return 1;
 258         case NID_sect163r1: /* sect163r1 (2) */
 259                 return 2;
 260         case NID_sect163r2: /* sect163r2 (3) */
 261                 return 3;
 262         case NID_sect193r1: /* sect193r1 (4) */
 263                 return 4;
 264         case NID_sect193r2: /* sect193r2 (5) */
 265                 return 5;
 266         case NID_sect233k1: /* sect233k1 (6) */
 267                 return 6;
 268         case NID_sect233r1: /* sect233r1 (7) */
 269                 return 7;
 270         case NID_sect239k1: /* sect239k1 (8) */
 271                 return 8;
 272         case NID_sect283k1: /* sect283k1 (9) */
 273                 return 9;
 274         case NID_sect283r1: /* sect283r1 (10) */
 275                 return 10;
 276         case NID_sect409k1: /* sect409k1 (11) */
 277                 return 11;
 278         case NID_sect409r1: /* sect409r1 (12) */
 279                 return 12;
 280         case NID_sect571k1: /* sect571k1 (13) */
 281                 return 13;
 282         case NID_sect571r1: /* sect571r1 (14) */
 283                 return 14;
 284         case NID_secp160k1: /* secp160k1 (15) */
 285                 return 15;
 286         case NID_secp160r1: /* secp160r1 (16) */
 287                 return 16;
 288         case NID_secp160r2: /* secp160r2 (17) */
 289                 return 17;
 290         case NID_secp192k1: /* secp192k1 (18) */
 291                 return 18;
 292         case NID_X9_62_prime192v1: /* secp192r1 (19) */
 293                 return 19;
 294         case NID_secp224k1: /* secp224k1 (20) */
 295                 return 20;
 296         case NID_secp224r1: /* secp224r1 (21) */
 297                 return 21;
 298         case NID_secp256k1: /* secp256k1 (22) */
 299                 return 22;
 300         case NID_X9_62_prime256v1: /* secp256r1 (23) */
 301                 return 23;
 302         case NID_secp384r1: /* secp384r1 (24) */
 303                 return 24;
 304         case NID_secp521r1:  /* secp521r1 (25) */
 305                 return 25;
 306         default:
 307                 return 0;
 308                 }
 309         }
 310 /* Get curves list, if "sess" is set return client curves otherwise
 311  * preferred list
 312  */
 313 static void tls1_get_curvelist(SSL *s, int sess,
 314                                         const unsigned char **pcurves,
 315                                         size_t *pcurveslen)
 316         {
 317         if (sess)
 318                 {
 319                 *pcurves = s->session->tlsext_ellipticcurvelist;
 320                 *pcurveslen = s->session->tlsext_ellipticcurvelist_length;
 321                 }
 322         else
 323                 {
 324                 *pcurves = s->tlsext_ellipticcurvelist;
 325                 *pcurveslen = s->tlsext_ellipticcurvelist_length;
 326                 }
 327         /* If not set use default: for now static structure */
 328         if (!*pcurves)
 329                 {
 330                 *pcurves = eccurves_default;
 331                 *pcurveslen = sizeof(eccurves_default);
 332                 }
 333         }
 334
 335 /* Return nth shared curve. If nmatch == -1 return number of
 336  * matches.
 337  */
 338
 339 int tls1_shared_curve(SSL *s, int nmatch)
 340         {
 341         const unsigned char *pref, *supp;
 342         size_t preflen, supplen, i, j;
 343         int k;
 344         /* Can't do anything on client side */
 345         if (s->server == 0)
 346                 return -1;
 347         tls1_get_curvelist(s, !!(s->options & SSL_OP_CIPHER_SERVER_PREFERENCE),
 348                                 &supp, &supplen);
 349         tls1_get_curvelist(s, !(s->options & SSL_OP_CIPHER_SERVER_PREFERENCE),
 350                                 &pref, &preflen);
 351         preflen /= 2;
 352         supplen /= 2;
 353         k = 0;
 354         for (i = 0; i < preflen; i++, pref+=2)
 355                 {
 356                 const unsigned char *tsupp = supp;
 357                 for (j = 0; j < supplen; j++, tsupp+=2)
 358                         {
 359                         if (pref[0] == tsupp[0] && pref[1] == tsupp[1])
 360                                 {
 361                                 if (nmatch == k)
 362                                         {
 363                                         int id = (pref[0] << 8) | pref[1];
 364                                         return tls1_ec_curve_id2nid(id);
 365                                         }
 366                                 k++;
 367                                 }
 368                         }
 369                 }
 370         if (nmatch == -1)
 371                 return k;
 372         return 0;
 373         }
 374
 375 int tls1_set_curves(unsigned char **pext, size_t *pextlen,
 376                         int *curves, size_t ncurves)
 377         {
 378         unsigned char *clist, *p;
 379         size_t i;
 380         /* Bitmap of curves included to detect duplicates: only works
 381          * while curve ids < 32
 382          */
 383         unsigned long dup_list = 0;
 384         clist = OPENSSL_malloc(ncurves * 2);
 385         if (!clist)
 386                 return 0;
 387         for (i = 0, p = clist; i < ncurves; i++)
 388                 {
 389                 unsigned long idmask;
 390                 int id;
 391                 id = tls1_ec_nid2curve_id(curves[i]);
 392                 idmask = 1L << id;
 393                 if (!id || (dup_list & idmask))
 394                         {
 395                         OPENSSL_free(clist);
 396                         return 0;
 397                         }
 398                 dup_list |= idmask;
 399                 s2n(id, p);
 400                 }
 401         if (*pext)
 402                 OPENSSL_free(*pext);
 403         *pext = clist;
 404         *pextlen = ncurves * 2;
 405         return 1;
 406         }
 407
 408 #define MAX_CURVELIST   25
 409
 410 typedef struct
 411         {
 412         size_t nidcnt;
 413         int nid_arr[MAX_CURVELIST];
 414         } nid_cb_st;
 415
 416 static int nid_cb(const char *elem, int len, void *arg)
 417         {
 418         nid_cb_st *narg = arg;
 419         size_t i;
 420         int nid;
 421         char etmp[20];
 422         if (narg->nidcnt == MAX_CURVELIST)
 423                 return 0;
 424         if (len > (int)(sizeof(etmp) - 1))
 425                 return 0;
 426         memcpy(etmp, elem, len);
 427         etmp[len] = 0;
 428         nid = EC_curve_nist2nid(etmp);
 429         if (nid == NID_undef)
 430                 nid = OBJ_sn2nid(etmp);
 431         if (nid == NID_undef)
 432                 nid = OBJ_ln2nid(etmp);
 433         if (nid == NID_undef)
 434                 return 0;
 435         for (i = 0; i < narg->nidcnt; i++)
 436                 if (narg->nid_arr[i] == nid)
 437                         return 0;
 438         narg->nid_arr[narg->nidcnt++] = nid;
 439         return 1;
 440         }
 441 /* Set curves based on a colon separate list */
 442 int tls1_set_curves_list(unsigned char **pext, size_t *pextlen,
 443                                 const char *str)
 444         {
 445         nid_cb_st ncb;
 446         ncb.nidcnt = 0;
 447         if (!CONF_parse_list(str, ':', 1, nid_cb, &ncb))
 448                 return 0;
 449         return tls1_set_curves(pext, pextlen, ncb.nid_arr, ncb.nidcnt);
 450         }
 451 /* For an EC key set TLS id and required compression based on parameters */
 452 static int tls1_set_ec_id(unsigned char *curve_id, unsigned char *comp_id,
 453                                 EC_KEY *ec)
 454         {
 455         int is_prime, id;
 456         const EC_GROUP *grp;
 457         const EC_POINT *pt;
 458         const EC_METHOD *meth;
 459         if (!ec)
 460                 return 0;
 461         /* Determine if it is a prime field */
 462         grp = EC_KEY_get0_group(ec);
 463         pt = EC_KEY_get0_public_key(ec);
 464         if (!grp || !pt)
 465                 return 0;
 466         meth = EC_GROUP_method_of(grp);
 467         if (!meth)
 468                 return 0;
 469         if (EC_METHOD_get_field_type(meth) == NID_X9_62_prime_field)
 470                 is_prime = 1;
 471         else
 472                 is_prime = 0;
 473         /* Determine curve ID */
 474         id = EC_GROUP_get_curve_name(grp);
 475         id = tls1_ec_nid2curve_id(id);
 476         /* If we have an ID set it, otherwise set arbitrary explicit curve */
 477         if (id)
 478                 {
 479                 curve_id[0] = 0;
 480                 curve_id[1] = (unsigned char)id;
 481                 }
 482         else
 483                 {
 484                 curve_id[0] = 0xff;
 485                 if (is_prime)
 486                         curve_id[1] = 0x01;
 487                 else
 488                         curve_id[1] = 0x02;
 489                 }
 490         if (comp_id)
 491                 {
 492                 if (EC_KEY_get_conv_form(ec) == POINT_CONVERSION_COMPRESSED)
 493                         {
 494                         if (is_prime)
 495                                 *comp_id = TLSEXT_ECPOINTFORMAT_ansiX962_compressed_prime;
 496                         else
 497                                 *comp_id = TLSEXT_ECPOINTFORMAT_ansiX962_compressed_char2;
 498                         }
 499                 else
 500                         *comp_id = TLSEXT_ECPOINTFORMAT_uncompressed;
 501                 }
 502         return 1;
 503         }
 504 /* Check an EC key is compatible with extensions */
 505 static int tls1_check_ec_key(SSL *s,
 506                         unsigned char *curve_id, unsigned char *comp_id)
 507         {
 508         const unsigned char *p;
 509         size_t plen, i;
 510         int j;
 511         /* If point formats extension present check it, otherwise everything
 512          * is supported (see RFC4492).
 513          */
 514         if (comp_id && s->session->tlsext_ecpointformatlist)
 515                 {
 516                 p = s->session->tlsext_ecpointformatlist;
 517                 plen = s->session->tlsext_ecpointformatlist_length;
 518                 for (i = 0; i < plen; i++, p++)
 519                         {
 520                         if (*comp_id == *p)
 521                                 break;
 522                         }
 523                 if (i == plen)
 524                         return 0;
 525                 }
 526         /* Check curve is consistent with client and server preferences */
 527         for (j = 0; j <= 1; j++)
 528                 {
 529                 tls1_get_curvelist(s, j, &p, &plen);
 530                 for (i = 0; i < plen; i+=2, p+=2)
 531                         {
 532                         if (p[0] == curve_id[0] && p[1] == curve_id[1])
 533                                 break;
 534                         }
 535                 if (i == plen)
 536                         return 0;
 537                 }
 538         return 1;
 539         }
 540 /* Check EC server key is compatible with client extensions */
 541 int tls1_check_ec_server_key(SSL *s)
 542         {
 543         int rv;
 544         CERT_PKEY *cpk = s->cert->pkeys + SSL_PKEY_ECC;
 545         EVP_PKEY *pkey;
 546         unsigned char comp_id, curve_id[2];
 547         if (!cpk->x509 || !cpk->privatekey)
 548                 return 0;
 549         pkey = X509_get_pubkey(cpk->x509);
 550         if (!pkey)
 551                 return 0;
 552         rv = tls1_set_ec_id(curve_id, &comp_id, pkey->pkey.ec);
 553         EVP_PKEY_free(pkey);
 554         if (!rv)
 555                 return 0;
 556         return tls1_check_ec_key(s, curve_id, &comp_id);
 557         }
 558 /* Check EC temporary key is compatible with client extensions */
 559 int tls1_check_ec_tmp_key(SSL *s)
 560         {
 561         unsigned char curve_id[2];
 562         EC_KEY *ec = s->cert->ecdh_tmp;
 563         if (s->cert->ecdh_tmp_auto)
 564                 {
 565                 /* Need a shared curve */
 566                 if (tls1_shared_curve(s, 0))
 567                         return 1;
 568                 else return 0;
 569                 }
 570         if (!ec)
 571                 {
 572                 if (s->cert->ecdh_tmp_cb)
 573                         return 1;
 574                 else
 575                         return 0;
 576                 }
 577         if (!tls1_set_ec_id(curve_id, NULL, ec))
 578                 return 1;
 579         return tls1_check_ec_key(s, curve_id, NULL);
 580         }
 581
 582 #endif /* OPENSSL_NO_EC */
 583
 584 #ifndef OPENSSL_NO_TLSEXT
 585
 586 /* List of supported signature algorithms and hashes. Should make this
 587  * customisable at some point, for now include everything we support.
 588  */
 589
 590 #ifdef OPENSSL_NO_RSA
 591 #define tlsext_sigalg_rsa(md) /* */
 592 #else
 593 #define tlsext_sigalg_rsa(md) md, TLSEXT_signature_rsa,
 594 #endif
 595
 596 #ifdef OPENSSL_NO_DSA
 597 #define tlsext_sigalg_dsa(md) /* */
 598 #else
 599 #define tlsext_sigalg_dsa(md) md, TLSEXT_signature_dsa,
 600 #endif
 601
 602 #ifdef OPENSSL_NO_ECDSA
 603 #define tlsext_sigalg_ecdsa(md) /* */
 604 #else
 605 #define tlsext_sigalg_ecdsa(md) md, TLSEXT_signature_ecdsa,
 606 #endif
 607
 608 #define tlsext_sigalg(md) \
 609                 tlsext_sigalg_rsa(md) \
 610                 tlsext_sigalg_dsa(md) \
 611                 tlsext_sigalg_ecdsa(md)
 612
 613 static unsigned char tls12_sigalgs[] = {
 614 #ifndef OPENSSL_NO_SHA512
 615         tlsext_sigalg(TLSEXT_hash_sha512)
 616         tlsext_sigalg(TLSEXT_hash_sha384)
 617 #endif
 618 #ifndef OPENSSL_NO_SHA256
 619         tlsext_sigalg(TLSEXT_hash_sha256)
 620         tlsext_sigalg(TLSEXT_hash_sha224)
 621 #endif
 622 #ifndef OPENSSL_NO_SHA
 623         tlsext_sigalg(TLSEXT_hash_sha1)
 624 #endif
 625 #ifndef OPENSSL_NO_MD5
 626         tlsext_sigalg_rsa(TLSEXT_hash_md5)
 627 #endif
 628 };
 629
 630 int tls12_get_req_sig_algs(SSL *s, unsigned char *p)
 631         {
 632         size_t slen = sizeof(tls12_sigalgs);
 633 #ifdef OPENSSL_FIPS
 634         /* If FIPS mode don't include MD5 which is last */
 635         if (FIPS_mode())
 636                 slen -= 2;
 637 #endif
 638         if (p)
 639                 memcpy(p, tls12_sigalgs, slen);
 640         return (int)slen;
 641         }
 642
 643 unsigned char *ssl_add_clienthello_tlsext(SSL *s, unsigned char *p, unsigned char *limit)
 644         {
 645         int extdatalen=0;
 646         unsigned char *ret = p;
 647 #ifndef OPENSSL_NO_EC
 648         /* See if we support any ECC ciphersuites */
 649         int using_ecc = 0;
 650         if (s->version != DTLS1_VERSION && s->version >= TLS1_VERSION)
 651                 {
 652                 int i;
 653                 unsigned long alg_k, alg_a;
 654                 STACK_OF(SSL_CIPHER) *cipher_stack = SSL_get_ciphers(s);
 655
 656                 for (i = 0; i < sk_SSL_CIPHER_num(cipher_stack); i++)
 657                         {
 658                         SSL_CIPHER *c = sk_SSL_CIPHER_value(cipher_stack, i);
 659
 660                         alg_k = c->algorithm_mkey;
 661                         alg_a = c->algorithm_auth;
 662                         if ((alg_k & (SSL_kEECDH|SSL_kECDHr|SSL_kECDHe)
 663                                 || (alg_a & SSL_aECDSA)))
 664                                 {
 665                                 using_ecc = 1;
 666                                 break;
 667                                 }
 668                         }
 669                 }
 670 #endif
 671
 672         /* don't add extensions for SSLv3 unless doing secure renegotiation */
 673         if (s->client_version == SSL3_VERSION
 674                                         && !s->s3->send_connection_binding)
 675                 return p;
 676
 677         ret+=2;
 678
 679         if (ret>=limit) return NULL; /* this really never occurs, but ... */
 680
 681         if (s->tlsext_hostname != NULL)
 682                 {
 683                 /* Add TLS extension servername to the Client Hello message */
 684                 unsigned long size_str;
 685                 long lenmax;
 686
 687                 /* check for enough space.
 688                    4 for the servername type and entension length
 689                    2 for servernamelist length
 690                    1 for the hostname type
 691                    2 for hostname length
 692                    + hostname length
 693                 */
 694
 695                 if ((lenmax = limit - ret - 9) < 0
 696                     || (size_str = strlen(s->tlsext_hostname)) > (unsigned long)lenmax)
 697                         return NULL;
 698
 699                 /* extension type and length */
 700                 s2n(TLSEXT_TYPE_server_name,ret);
 701                 s2n(size_str+5,ret);
 702
 703                 /* length of servername list */
 704                 s2n(size_str+3,ret);
 705
 706                 /* hostname type, length and hostname */
 707                 *(ret++) = (unsigned char) TLSEXT_NAMETYPE_host_name;
 708                 s2n(size_str,ret);
 709                 memcpy(ret, s->tlsext_hostname, size_str);
 710                 ret+=size_str;
 711                 }
 712
 713         /* Add RI if renegotiating */
 714         if (s->renegotiate)
 715           {
 716           int el;
 717
 718           if(!ssl_add_clienthello_renegotiate_ext(s, 0, &el, 0))
 719               {
 720               SSLerr(SSL_F_SSL_ADD_CLIENTHELLO_TLSEXT, ERR_R_INTERNAL_ERROR);
 721               return NULL;
 722               }
 723
 724           if((limit - p - 4 - el) < 0) return NULL;
 725
 726           s2n(TLSEXT_TYPE_renegotiate,ret);
 727           s2n(el,ret);
 728
 729           if(!ssl_add_clienthello_renegotiate_ext(s, ret, &el, el))
 730               {
 731               SSLerr(SSL_F_SSL_ADD_CLIENTHELLO_TLSEXT, ERR_R_INTERNAL_ERROR);
 732               return NULL;
 733               }
 734
 735           ret += el;
 736         }
 737
 738 #ifndef OPENSSL_NO_SRP
 739         /* Add SRP username if there is one */
 740         if (s->srp_ctx.login != NULL)
 741                 { /* Add TLS extension SRP username to the Client Hello message */
 742
 743                 int login_len = strlen(s->srp_ctx.login);
 744                 if (login_len > 255 || login_len == 0)
 745                         {
 746                         SSLerr(SSL_F_SSL_ADD_CLIENTHELLO_TLSEXT, ERR_R_INTERNAL_ERROR);
 747                         return NULL;
 748                         }
 749
 750                 /* check for enough space.
 751                    4 for the srp type type and entension length
 752                    1 for the srp user identity
 753                    + srp user identity length
 754                 */
 755                 if ((limit - ret - 5 - login_len) < 0) return NULL;
 756
 757                 /* fill in the extension */
 758                 s2n(TLSEXT_TYPE_srp,ret);
 759                 s2n(login_len+1,ret);
 760                 (*ret++) = (unsigned char) login_len;
 761                 memcpy(ret, s->srp_ctx.login, login_len);
 762                 ret+=login_len;
 763                 }
 764 #endif
 765
 766 #ifndef OPENSSL_NO_EC
 767         if (using_ecc)
 768                 {
 769                 /* Add TLS extension ECPointFormats to the ClientHello message */
 770                 long lenmax;
 771                 const unsigned char *plist;
 772                 size_t plistlen;
 773                 /* If we have a custom point format list use it otherwise
 774                  * use default */
 775                 plist = s->tlsext_ecpointformatlist;
 776                 if (plist)
 777                         plistlen = s->tlsext_ecpointformatlist_length;
 778                 else
 779                         {
 780                         plist = ecformats_default;
 781                         plistlen = sizeof(ecformats_default);
 782                         }
 783
 784                 if ((lenmax = limit - ret - 5) < 0) return NULL;
 785                 if (plistlen > (size_t)lenmax) return NULL;
 786                 if (plistlen > 255)
 787                         {
 788                         SSLerr(SSL_F_SSL_ADD_CLIENTHELLO_TLSEXT, ERR_R_INTERNAL_ERROR);
 789                         return NULL;
 790                         }
 791
 792                 s2n(TLSEXT_TYPE_ec_point_formats,ret);
 793                 s2n(plistlen + 1,ret);
 794                 *(ret++) = (unsigned char)plistlen ;
 795                 memcpy(ret, plist, plistlen);
 796                 ret+=plistlen;
 797
 798                 /* Add TLS extension EllipticCurves to the ClientHello message */
 799                 plist = s->tlsext_ellipticcurvelist;
 800                 tls1_get_curvelist(s, 0, &plist, &plistlen);
 801
 802                 if ((lenmax = limit - ret - 6) < 0) return NULL;
 803                 if (plistlen > (size_t)lenmax) return NULL;
 804                 if (plistlen > 65532)
 805                         {
 806                         SSLerr(SSL_F_SSL_ADD_CLIENTHELLO_TLSEXT, ERR_R_INTERNAL_ERROR);
 807                         return NULL;
 808                         }
 809
 810                 s2n(TLSEXT_TYPE_elliptic_curves,ret);
 811                 s2n(plistlen + 2, ret);
 812
 813                 /* NB: draft-ietf-tls-ecc-12.txt uses a one-byte prefix for
 814                  * elliptic_curve_list, but the examples use two bytes.
 815                  * http://www1.ietf.org/mail-archive/web/tls/current/msg00538.html
 816                  * resolves this to two bytes.
 817                  */
 818                 s2n(plistlen, ret);
 819                 memcpy(ret, plist, plistlen);
 820                 ret+=plistlen;
 821                 }
 822 #endif /* OPENSSL_NO_EC */
 823
 824         if (!(SSL_get_options(s) & SSL_OP_NO_TICKET))
 825                 {
 826                 int ticklen;
 827                 if (!s->new_session && s->session && s->session->tlsext_tick)
 828                         ticklen = s->session->tlsext_ticklen;
 829                 else if (s->session && s->tlsext_session_ticket &&
 830                          s->tlsext_session_ticket->data)
 831                         {
 832                         ticklen = s->tlsext_session_ticket->length;
 833                         s->session->tlsext_tick = OPENSSL_malloc(ticklen);
 834                         if (!s->session->tlsext_tick)
 835                                 return NULL;
 836                         memcpy(s->session->tlsext_tick,
 837                                s->tlsext_session_ticket->data,
 838                                ticklen);
 839                         s->session->tlsext_ticklen = ticklen;
 840                         }
 841                 else
 842                         ticklen = 0;
 843                 if (ticklen == 0 && s->tlsext_session_ticket &&
 844                     s->tlsext_session_ticket->data == NULL)
 845                         goto skip_ext;
 846                 /* Check for enough room 2 for extension type, 2 for len
 847                  * rest for ticket
 848                  */
 849                 if ((long)(limit - ret - 4 - ticklen) < 0) return NULL;
 850                 s2n(TLSEXT_TYPE_session_ticket,ret);
 851                 s2n(ticklen,ret);
 852                 if (ticklen)
 853                         {
 854                         memcpy(ret, s->session->tlsext_tick, ticklen);
 855                         ret += ticklen;
 856                         }
 857                 }
 858                 skip_ext:
 859
 860         if (TLS1_get_client_version(s) >= TLS1_2_VERSION)
 861                 {
 862                 if ((size_t)(limit - ret) < sizeof(tls12_sigalgs) + 6)
 863                         return NULL;
 864                 s2n(TLSEXT_TYPE_signature_algorithms,ret);
 865                 s2n(sizeof(tls12_sigalgs) + 2, ret);
 866                 s2n(sizeof(tls12_sigalgs), ret);
 867                 memcpy(ret, tls12_sigalgs, sizeof(tls12_sigalgs));
 868                 ret += sizeof(tls12_sigalgs);
 869                 }
 870
 871 #ifdef TLSEXT_TYPE_opaque_prf_input
 872         if (s->s3->client_opaque_prf_input != NULL &&
 873             s->version != DTLS1_VERSION)
 874                 {
 875                 size_t col = s->s3->client_opaque_prf_input_len;
 876
 877                 if ((long)(limit - ret - 6 - col < 0))
 878                         return NULL;
 879                 if (col > 0xFFFD) /* can't happen */
 880                         return NULL;
 881
 882                 s2n(TLSEXT_TYPE_opaque_prf_input, ret);
 883                 s2n(col + 2, ret);
 884                 s2n(col, ret);
 885                 memcpy(ret, s->s3->client_opaque_prf_input, col);
 886                 ret += col;
 887                 }
 888 #endif
 889
 890         if (s->tlsext_status_type == TLSEXT_STATUSTYPE_ocsp &&
 891             s->version != DTLS1_VERSION)
 892                 {
 893                 int i;
 894                 long extlen, idlen, itmp;
 895                 OCSP_RESPID *id;
 896
 897                 idlen = 0;
 898                 for (i = 0; i < sk_OCSP_RESPID_num(s->tlsext_ocsp_ids); i++)
 899                         {
 900                         id = sk_OCSP_RESPID_value(s->tlsext_ocsp_ids, i);
 901                         itmp = i2d_OCSP_RESPID(id, NULL);
 902                         if (itmp <= 0)
 903                                 return NULL;
 904                         idlen += itmp + 2;
 905                         }
 906
 907                 if (s->tlsext_ocsp_exts)
 908                         {
 909                         extlen = i2d_X509_EXTENSIONS(s->tlsext_ocsp_exts, NULL);
 910                         if (extlen < 0)
 911                                 return NULL;
 912                         }
 913                 else
 914                         extlen = 0;
 915
 916                 if ((long)(limit - ret - 7 - extlen - idlen) < 0) return NULL;
 917                 s2n(TLSEXT_TYPE_status_request, ret);
 918                 if (extlen + idlen > 0xFFF0)
 919                         return NULL;
 920                 s2n(extlen + idlen + 5, ret);
 921                 *(ret++) = TLSEXT_STATUSTYPE_ocsp;
 922                 s2n(idlen, ret);
 923                 for (i = 0; i < sk_OCSP_RESPID_num(s->tlsext_ocsp_ids); i++)
 924                         {
 925                         /* save position of id len */
 926                         unsigned char *q = ret;
 927                         id = sk_OCSP_RESPID_value(s->tlsext_ocsp_ids, i);
 928                         /* skip over id len */
 929                         ret += 2;
 930                         itmp = i2d_OCSP_RESPID(id, &ret);
 931                         /* write id len */
 932                         s2n(itmp, q);
 933                         }
 934                 s2n(extlen, ret);
 935                 if (extlen > 0)
 936                         i2d_X509_EXTENSIONS(s->tlsext_ocsp_exts, &ret);
 937                 }
 938
 939 #ifndef OPENSSL_NO_HEARTBEATS
 940         /* Add Heartbeat extension */
 941         s2n(TLSEXT_TYPE_heartbeat,ret);
 942         s2n(1,ret);
 943         /* Set mode:
 944          * 1: peer may send requests
 945          * 2: peer not allowed to send requests
 946          */
 947         if (s->tlsext_heartbeat & SSL_TLSEXT_HB_DONT_RECV_REQUESTS)
 948                 *(ret++) = SSL_TLSEXT_HB_DONT_SEND_REQUESTS;
 949         else
 950                 *(ret++) = SSL_TLSEXT_HB_ENABLED;
 951 #endif
 952
 953 #ifndef OPENSSL_NO_NEXTPROTONEG
 954         if (s->ctx->next_proto_select_cb && !s->s3->tmp.finish_md_len)
 955                 {
 956                 /* The client advertises an emtpy extension to indicate its
 957                  * support for Next Protocol Negotiation */
 958                 if (limit - ret - 4 < 0)
 959                         return NULL;
 960                 s2n(TLSEXT_TYPE_next_proto_neg,ret);
 961                 s2n(0,ret);
 962                 }
 963 #endif
 964
 965         if(SSL_get_srtp_profiles(s))
 966                 {
 967                 int el;
 968
 969                 ssl_add_clienthello_use_srtp_ext(s, 0, &el, 0);
 970
 971                 if((limit - p - 4 - el) < 0) return NULL;
 972
 973                 s2n(TLSEXT_TYPE_use_srtp,ret);
 974                 s2n(el,ret);
 975
 976                 if(ssl_add_clienthello_use_srtp_ext(s, ret, &el, el))
 977                         {
 978                         SSLerr(SSL_F_SSL_ADD_CLIENTHELLO_TLSEXT, ERR_R_INTERNAL_ERROR);
 979                         return NULL;
 980                         }
 981                 ret += el;
 982                 }
 983
 984         if ((extdatalen = ret-p-2)== 0)
 985                 return p;
 986
 987         s2n(extdatalen,p);
 988         return ret;
 989         }
 990
 991 unsigned char *ssl_add_serverhello_tlsext(SSL *s, unsigned char *p, unsigned char *limit)
 992         {
 993         int extdatalen=0;
 994         unsigned char *ret = p;
 995 #ifndef OPENSSL_NO_NEXTPROTONEG
 996         int next_proto_neg_seen;
 997 #endif
 998
 999         /* don't add extensions for SSLv3, unless doing secure renegotiation */
1000         if (s->version == SSL3_VERSION && !s->s3->send_connection_binding)
1001                 return p;
1002
1003         ret+=2;
1004         if (ret>=limit) return NULL; /* this really never occurs, but ... */
1005
1006         if (!s->hit && s->servername_done == 1 && s->session->tlsext_hostname != NULL)
1007                 {
1008                 if ((long)(limit - ret - 4) < 0) return NULL;
1009
1010                 s2n(TLSEXT_TYPE_server_name,ret);
1011                 s2n(0,ret);
1012                 }
1013
1014         if(s->s3->send_connection_binding)
1015         {
1016           int el;
1017
1018           if(!ssl_add_serverhello_renegotiate_ext(s, 0, &el, 0))
1019               {
1020               SSLerr(SSL_F_SSL_ADD_SERVERHELLO_TLSEXT, ERR_R_INTERNAL_ERROR);
1021               return NULL;
1022               }
1023
1024           if((limit - p - 4 - el) < 0) return NULL;
1025
1026           s2n(TLSEXT_TYPE_renegotiate,ret);
1027           s2n(el,ret);
1028
1029           if(!ssl_add_serverhello_renegotiate_ext(s, ret, &el, el))
1030               {
1031               SSLerr(SSL_F_SSL_ADD_SERVERHELLO_TLSEXT, ERR_R_INTERNAL_ERROR);
1032               return NULL;
1033               }
1034
1035           ret += el;
1036         }
1037
1038 #ifndef OPENSSL_NO_EC
1039         if (s->tlsext_ecpointformatlist != NULL &&
1040             s->version != DTLS1_VERSION)
1041                 {
1042                 /* Add TLS extension ECPointFormats to the ServerHello message */
1043                 long lenmax;
1044
1045                 if ((lenmax = limit - ret - 5) < 0) return NULL;
1046                 if (s->tlsext_ecpointformatlist_length > (unsigned long)lenmax) return NULL;
1047                 if (s->tlsext_ecpointformatlist_length > 255)
1048                         {
1049                         SSLerr(SSL_F_SSL_ADD_SERVERHELLO_TLSEXT, ERR_R_INTERNAL_ERROR);
1050                         return NULL;
1051                         }
1052
1053                 s2n(TLSEXT_TYPE_ec_point_formats,ret);
1054                 s2n(s->tlsext_ecpointformatlist_length + 1,ret);
1055                 *(ret++) = (unsigned char) s->tlsext_ecpointformatlist_length;
1056                 memcpy(ret, s->tlsext_ecpointformatlist, s->tlsext_ecpointformatlist_length);
1057                 ret+=s->tlsext_ecpointformatlist_length;
1058
1059                 }
1060         /* Currently the server should not respond with a SupportedCurves extension */
1061 #endif /* OPENSSL_NO_EC */
1062
1063         if (s->tlsext_ticket_expected
1064                 && !(SSL_get_options(s) & SSL_OP_NO_TICKET))
1065                 {
1066                 if ((long)(limit - ret - 4) < 0) return NULL;
1067                 s2n(TLSEXT_TYPE_session_ticket,ret);
1068                 s2n(0,ret);
1069                 }
1070
1071         if (s->tlsext_status_expected)
1072                 {
1073                 if ((long)(limit - ret - 4) < 0) return NULL;
1074                 s2n(TLSEXT_TYPE_status_request,ret);
1075                 s2n(0,ret);
1076                 }
1077
1078 #ifdef TLSEXT_TYPE_opaque_prf_input
1079         if (s->s3->server_opaque_prf_input != NULL &&
1080             s->version != DTLS1_VERSION)
1081                 {
1082                 size_t sol = s->s3->server_opaque_prf_input_len;
1083
1084                 if ((long)(limit - ret - 6 - sol) < 0)
1085                         return NULL;
1086                 if (sol > 0xFFFD) /* can't happen */
1087                         return NULL;
1088
1089                 s2n(TLSEXT_TYPE_opaque_prf_input, ret);
1090                 s2n(sol + 2, ret);
1091                 s2n(sol, ret);
1092                 memcpy(ret, s->s3->server_opaque_prf_input, sol);
1093                 ret += sol;
1094                 }
1095 #endif
1096
1097         if(s->srtp_profile)
1098                 {
1099                 int el;
1100
1101                 ssl_add_serverhello_use_srtp_ext(s, 0, &el, 0);
1102
1103                 if((limit - p - 4 - el) < 0) return NULL;
1104
1105                 s2n(TLSEXT_TYPE_use_srtp,ret);
1106                 s2n(el,ret);
1107
1108                 if(ssl_add_serverhello_use_srtp_ext(s, ret, &el, el))
1109                         {
1110                         SSLerr(SSL_F_SSL_ADD_SERVERHELLO_TLSEXT, ERR_R_INTERNAL_ERROR);
1111                         return NULL;
1112                         }
1113                 ret+=el;
1114                 }
1115
1116         if (((s->s3->tmp.new_cipher->id & 0xFFFF)==0x80 || (s->s3->tmp.new_cipher->id & 0xFFFF)==0x81)
1117                 && (SSL_get_options(s) & SSL_OP_CRYPTOPRO_TLSEXT_BUG))
1118                 { const unsigned char cryptopro_ext[36] = {
1119                         0xfd, 0xe8, /*65000*/
1120                         0x00, 0x20, /*32 bytes length*/
1121                         0x30, 0x1e, 0x30, 0x08, 0x06, 0x06, 0x2a, 0x85,
1122                         0x03,   0x02, 0x02, 0x09, 0x30, 0x08, 0x06, 0x06,
1123                         0x2a, 0x85, 0x03, 0x02, 0x02, 0x16, 0x30, 0x08,
1124                         0x06, 0x06, 0x2a, 0x85, 0x03, 0x02, 0x02, 0x17};
1125                         if (limit-ret<36) return NULL;
1126                         memcpy(ret,cryptopro_ext,36);
1127                         ret+=36;
1128
1129                 }
1130
1131 #ifndef OPENSSL_NO_HEARTBEATS
1132         /* Add Heartbeat extension if we've received one */
1133         if (s->tlsext_heartbeat & SSL_TLSEXT_HB_ENABLED)
1134                 {
1135                 s2n(TLSEXT_TYPE_heartbeat,ret);
1136                 s2n(1,ret);
1137                 /* Set mode:
1138                  * 1: peer may send requests
1139                  * 2: peer not allowed to send requests
1140                  */
1141                 if (s->tlsext_heartbeat & SSL_TLSEXT_HB_DONT_RECV_REQUESTS)
1142                         *(ret++) = SSL_TLSEXT_HB_DONT_SEND_REQUESTS;
1143                 else
1144                         *(ret++) = SSL_TLSEXT_HB_ENABLED;
1145
1146                 }
1147 #endif
1148
1149 #ifndef OPENSSL_NO_NEXTPROTONEG
1150         next_proto_neg_seen = s->s3->next_proto_neg_seen;
1151         s->s3->next_proto_neg_seen = 0;
1152         if (next_proto_neg_seen && s->ctx->next_protos_advertised_cb)
1153                 {
1154                 const unsigned char *npa;
1155                 unsigned int npalen;
1156                 int r;
1157
1158                 r = s->ctx->next_protos_advertised_cb(s, &npa, &npalen, s->ctx->next_protos_advertised_cb_arg);
1159                 if (r == SSL_TLSEXT_ERR_OK)
1160                         {
1161                         if ((long)(limit - ret - 4 - npalen) < 0) return NULL;
1162                         s2n(TLSEXT_TYPE_next_proto_neg,ret);
1163                         s2n(npalen,ret);
1164                         memcpy(ret, npa, npalen);
1165                         ret += npalen;
1166                         s->s3->next_proto_neg_seen = 1;
1167                         }
1168                 }
1169 #endif
1170
1171         if ((extdatalen = ret-p-2)== 0)
1172                 return p;
1173
1174         s2n(extdatalen,p);
1175         return ret;
1176         }
1177
1178 int ssl_parse_clienthello_tlsext(SSL *s, unsigned char **p, unsigned char *d, int n, int *al)
1179         {
1180         unsigned short type;
1181         unsigned short size;
1182         unsigned short len;
1183         unsigned char *data = *p;
1184         int renegotiate_seen = 0;
1185         int sigalg_seen = 0;
1186
1187         s->servername_done = 0;
1188         s->tlsext_status_type = -1;
1189 #ifndef OPENSSL_NO_NEXTPROTONEG
1190         s->s3->next_proto_neg_seen = 0;
1191 #endif
1192
1193 #ifndef OPENSSL_NO_HEARTBEATS
1194         s->tlsext_heartbeat &= ~(SSL_TLSEXT_HB_ENABLED |
1195                                SSL_TLSEXT_HB_DONT_SEND_REQUESTS);
1196 #endif
1197
1198         if (data >= (d+n-2))
1199                 goto ri_check;
1200         n2s(data,len);
1201
1202         if (data > (d+n-len))
1203                 goto ri_check;
1204
1205         while (data <= (d+n-4))
1206                 {
1207                 n2s(data,type);
1208                 n2s(data,size);
1209
1210                 if (data+size > (d+n))
1211                         goto ri_check;
1212 #if 0
1213                 fprintf(stderr,"Received extension type %d size %d\n",type,size);
1214 #endif
1215                 if (s->tlsext_debug_cb)
1216                         s->tlsext_debug_cb(s, 0, type, data, size,
1217                                                 s->tlsext_debug_arg);
1218 /* The servername extension is treated as follows:
1219
1220    - Only the hostname type is supported with a maximum length of 255.
1221    - The servername is rejected if too long or if it contains zeros,
1222      in which case an fatal alert is generated.
1223    - The servername field is maintained together with the session cache.
1224    - When a session is resumed, the servername call back invoked in order
1225      to allow the application to position itself to the right context.
1226    - The servername is acknowledged if it is new for a session or when
1227      it is identical to a previously used for the same session.
1228      Applications can control the behaviour.  They can at any time
1229      set a 'desirable' servername for a new SSL object. This can be the
1230      case for example with HTTPS when a Host: header field is received and
1231      a renegotiation is requested. In this case, a possible servername
1232      presented in the new client hello is only acknowledged if it matches
1233      the value of the Host: field.
1234    - Applications must  use SSL_OP_NO_SESSION_RESUMPTION_ON_RENEGOTIATION
1235      if they provide for changing an explicit servername context for the session,
1236      i.e. when the session has been established with a servername extension.
1237    - On session reconnect, the servername extension may be absent.
1238
1239 */
1240
1241                 if (type == TLSEXT_TYPE_server_name)
1242                         {
1243                         unsigned char *sdata;
1244                         int servname_type;
1245                         int dsize;
1246
1247                         if (size < 2)
1248                                 {
1249                                 *al = SSL_AD_DECODE_ERROR;
1250                                 return 0;
1251                                 }
1252                         n2s(data,dsize);
1253                         size -= 2;
1254                         if (dsize > size  )
1255                                 {
1256                                 *al = SSL_AD_DECODE_ERROR;
1257                                 return 0;
1258                                 }
1259
1260                         sdata = data;
1261                         while (dsize > 3)
1262                                 {
1263                                 servname_type = *(sdata++);
1264                                 n2s(sdata,len);
1265                                 dsize -= 3;
1266
1267                                 if (len > dsize)
1268                                         {
1269                                         *al = SSL_AD_DECODE_ERROR;
1270                                         return 0;
1271                                         }
1272                                 if (s->servername_done == 0)
1273                                 switch (servname_type)
1274                                         {
1275                                 case TLSEXT_NAMETYPE_host_name:
1276                                         if (!s->hit)
1277                                                 {
1278                                                 if(s->session->tlsext_hostname)
1279                                                         {
1280                                                         *al = SSL_AD_DECODE_ERROR;
1281                                                         return 0;
1282                                                         }
1283                                                 if (len > TLSEXT_MAXLEN_host_name)
1284                                                         {
1285                                                         *al = TLS1_AD_UNRECOGNIZED_NAME;
1286                                                         return 0;
1287                                                         }
1288                                                 if ((s->session->tlsext_hostname = OPENSSL_malloc(len+1)) == NULL)
1289                                                         {
1290                                                         *al = TLS1_AD_INTERNAL_ERROR;
1291                                                         return 0;
1292                                                         }
1293                                                 memcpy(s->session->tlsext_hostname, sdata, len);
1294                                                 s->session->tlsext_hostname[len]='\0';
1295                                                 if (strlen(s->session->tlsext_hostname) != len) {
1296                                                         OPENSSL_free(s->session->tlsext_hostname);
1297                                                         s->session->tlsext_hostname = NULL;
1298                                                         *al = TLS1_AD_UNRECOGNIZED_NAME;
1299                                                         return 0;
1300                                                 }
1301                                                 s->servername_done = 1;
1302
1303                                                 }
1304                                         else
1305                                                 s->servername_done = s->session->tlsext_hostname
1306                                                         && strlen(s->session->tlsext_hostname) == len
1307                                                         && strncmp(s->session->tlsext_hostname, (char *)sdata, len) == 0;
1308
1309                                         break;
1310
1311                                 default:
1312                                         break;
1313                                         }
1314
1315                                 dsize -= len;
1316                                 }
1317                         if (dsize != 0)
1318                                 {
1319                                 *al = SSL_AD_DECODE_ERROR;
1320                                 return 0;
1321                                 }
1322
1323                         }
1324 #ifndef OPENSSL_NO_SRP
1325                 else if (type == TLSEXT_TYPE_srp)
1326                         {
1327                         if (size <= 0 || ((len = data[0])) != (size -1))
1328                                 {
1329                                 *al = SSL_AD_DECODE_ERROR;
1330                                 return 0;
1331                                 }
1332                         if (s->srp_ctx.login != NULL)
1333                                 {
1334                                 *al = SSL_AD_DECODE_ERROR;
1335                                 return 0;
1336                                 }
1337                         if ((s->srp_ctx.login = OPENSSL_malloc(len+1)) == NULL)
1338                                 return -1;
1339                         memcpy(s->srp_ctx.login, &data[1], len);
1340                         s->srp_ctx.login[len]='\0';
1341
1342                         if (strlen(s->srp_ctx.login) != len)
1343                                 {
1344                                 *al = SSL_AD_DECODE_ERROR;
1345                                 return 0;
1346                                 }
1347                         }
1348 #endif
1349
1350 #ifndef OPENSSL_NO_EC
1351                 else if (type == TLSEXT_TYPE_ec_point_formats &&
1352                      s->version != DTLS1_VERSION)
1353                         {
1354                         unsigned char *sdata = data;
1355                         int ecpointformatlist_length = *(sdata++);
1356
1357                         if (ecpointformatlist_length != size - 1)
1358                                 {
1359                                 *al = TLS1_AD_DECODE_ERROR;
1360                                 return 0;
1361                                 }
1362                         if (!s->hit)
1363                                 {
1364                                 if(s->session->tlsext_ecpointformatlist)
1365                                         {
1366                                         OPENSSL_free(s->session->tlsext_ecpointformatlist);
1367                                         s->session->tlsext_ecpointformatlist = NULL;
1368                                         }
1369                                 s->session->tlsext_ecpointformatlist_length = 0;
1370                                 if ((s->session->tlsext_ecpointformatlist = OPENSSL_malloc(ecpointformatlist_length)) == NULL)
1371                                         {
1372                                         *al = TLS1_AD_INTERNAL_ERROR;
1373                                         return 0;
1374                                         }
1375                                 s->session->tlsext_ecpointformatlist_length = ecpointformatlist_length;
1376                                 memcpy(s->session->tlsext_ecpointformatlist, sdata, ecpointformatlist_length);
1377                                 }
1378 #if 0
1379                         fprintf(stderr,"ssl_parse_clienthello_tlsext s->session->tlsext_ecpointformatlist (length=%i) ", s->session->tlsext_ecpointformatlist_length);
1380                         sdata = s->session->tlsext_ecpointformatlist;
1381                         for (i = 0; i < s->session->tlsext_ecpointformatlist_length; i++)
1382                                 fprintf(stderr,"%i ",*(sdata++));
1383                         fprintf(stderr,"\n");
1384 #endif
1385                         }
1386                 else if (type == TLSEXT_TYPE_elliptic_curves &&
1387                      s->version != DTLS1_VERSION)
1388                         {
1389                         unsigned char *sdata = data;
1390                         int ellipticcurvelist_length = (*(sdata++) << 8);
1391                         ellipticcurvelist_length += (*(sdata++));
1392
1393                         if (ellipticcurvelist_length != size - 2)
1394                                 {
1395                                 *al = TLS1_AD_DECODE_ERROR;
1396                                 return 0;
1397                                 }
1398                         if (!s->hit)
1399                                 {
1400                                 if(s->session->tlsext_ellipticcurvelist)
1401                                         {
1402                                         *al = TLS1_AD_DECODE_ERROR;
1403                                         return 0;
1404                                         }
1405                                 s->session->tlsext_ellipticcurvelist_length = 0;
1406                                 if ((s->session->tlsext_ellipticcurvelist = OPENSSL_malloc(ellipticcurvelist_length)) == NULL)
1407                                         {
1408                                         *al = TLS1_AD_INTERNAL_ERROR;
1409                                         return 0;
1410                                         }
1411                                 s->session->tlsext_ellipticcurvelist_length = ellipticcurvelist_length;
1412                                 memcpy(s->session->tlsext_ellipticcurvelist, sdata, ellipticcurvelist_length);
1413                                 }
1414 #if 0
1415                         fprintf(stderr,"ssl_parse_clienthello_tlsext s->session->tlsext_ellipticcurvelist (length=%i) ", s->session->tlsext_ellipticcurvelist_length);
1416                         sdata = s->session->tlsext_ellipticcurvelist;
1417                         for (i = 0; i < s->session->tlsext_ellipticcurvelist_length; i++)
1418                                 fprintf(stderr,"%i ",*(sdata++));
1419                         fprintf(stderr,"\n");
1420 #endif
1421                         }
1422 #endif /* OPENSSL_NO_EC */
1423 #ifdef TLSEXT_TYPE_opaque_prf_input
1424                 else if (type == TLSEXT_TYPE_opaque_prf_input &&
1425                      s->version != DTLS1_VERSION)
1426                         {
1427                         unsigned char *sdata = data;
1428
1429                         if (size < 2)
1430                                 {
1431                                 *al = SSL_AD_DECODE_ERROR;
1432                                 return 0;
1433                                 }
1434                         n2s(sdata, s->s3->client_opaque_prf_input_len);
1435                         if (s->s3->client_opaque_prf_input_len != size - 2)
1436                                 {
1437                                 *al = SSL_AD_DECODE_ERROR;
1438                                 return 0;
1439                                 }
1440
1441                         if (s->s3->client_opaque_prf_input != NULL) /* shouldn't really happen */
1442                                 OPENSSL_free(s->s3->client_opaque_prf_input);
1443                         if (s->s3->client_opaque_prf_input_len == 0)
1444                                 s->s3->client_opaque_prf_input = OPENSSL_malloc(1); /* dummy byte just to get non-NULL */
1445                         else
1446                                 s->s3->client_opaque_prf_input = BUF_memdup(sdata, s->s3->client_opaque_prf_input_len);
1447                         if (s->s3->client_opaque_prf_input == NULL)
1448                                 {
1449                                 *al = TLS1_AD_INTERNAL_ERROR;
1450                                 return 0;
1451                                 }
1452                         }
1453 #endif
1454                 else if (type == TLSEXT_TYPE_session_ticket)
1455                         {
1456                         if (s->tls_session_ticket_ext_cb &&
1457                             !s->tls_session_ticket_ext_cb(s, data, size, s->tls_session_ticket_ext_cb_arg))
1458                                 {
1459                                 *al = TLS1_AD_INTERNAL_ERROR;
1460                                 return 0;
1461                                 }
1462                         }
1463                 else if (type == TLSEXT_TYPE_renegotiate)
1464                         {
1465                         if(!ssl_parse_clienthello_renegotiate_ext(s, data, size, al))
1466                                 return 0;
1467                         renegotiate_seen = 1;
1468                         }
1469                 else if (type == TLSEXT_TYPE_signature_algorithms)
1470                         {
1471                         int dsize;
1472                         if (sigalg_seen || size < 2)
1473                                 {
1474                                 *al = SSL_AD_DECODE_ERROR;
1475                                 return 0;
1476                                 }
1477                         sigalg_seen = 1;
1478                         n2s(data,dsize);
1479                         size -= 2;
1480                         if (dsize != size || dsize & 1)
1481                                 {
1482                                 *al = SSL_AD_DECODE_ERROR;
1483                                 return 0;
1484                                 }
1485                         if (!tls1_process_sigalgs(s, data, dsize))
1486                                 {
1487                                 *al = SSL_AD_DECODE_ERROR;
1488                                 return 0;
1489                                 }
1490                         }
1491                 else if (type == TLSEXT_TYPE_status_request &&
1492                          s->version != DTLS1_VERSION && s->ctx->tlsext_status_cb)
1493                         {
1494
1495                         if (size < 5)
1496                                 {
1497                                 *al = SSL_AD_DECODE_ERROR;
1498                                 return 0;
1499                                 }
1500
1501                         s->tlsext_status_type = *data++;
1502                         size--;
1503                         if (s->tlsext_status_type == TLSEXT_STATUSTYPE_ocsp)
1504                                 {
1505                                 const unsigned char *sdata;
1506                                 int dsize;
1507                                 /* Read in responder_id_list */
1508                                 n2s(data,dsize);
1509                                 size -= 2;
1510                                 if (dsize > size  )
1511                                         {
1512                                         *al = SSL_AD_DECODE_ERROR;
1513                                         return 0;
1514                                         }
1515                                 while (dsize > 0)
1516                                         {
1517                                         OCSP_RESPID *id;
1518                                         int idsize;
1519                                         if (dsize < 4)
1520                                                 {
1521                                                 *al = SSL_AD_DECODE_ERROR;
1522                                                 return 0;
1523                                                 }
1524                                         n2s(data, idsize);
1525                                         dsize -= 2 + idsize;
1526                                         size -= 2 + idsize;
1527                                         if (dsize < 0)
1528                                                 {
1529                                                 *al = SSL_AD_DECODE_ERROR;
1530                                                 return 0;
1531                                                 }
1532                                         sdata = data;
1533                                         data += idsize;
1534                                         id = d2i_OCSP_RESPID(NULL,
1535                                                                 &sdata, idsize);
1536                                         if (!id)
1537                                                 {
1538                                                 *al = SSL_AD_DECODE_ERROR;
1539                                                 return 0;
1540                                                 }
1541                                         if (data != sdata)
1542                                                 {
1543                                                 OCSP_RESPID_free(id);
1544                                                 *al = SSL_AD_DECODE_ERROR;
1545                                                 return 0;
1546                                                 }
1547                                         if (!s->tlsext_ocsp_ids
1548                                                 && !(s->tlsext_ocsp_ids =
1549                                                 sk_OCSP_RESPID_new_null()))
1550                                                 {
1551                                                 OCSP_RESPID_free(id);
1552                                                 *al = SSL_AD_INTERNAL_ERROR;
1553                                                 return 0;
1554                                                 }
1555                                         if (!sk_OCSP_RESPID_push(
1556                                                         s->tlsext_ocsp_ids, id))
1557                                                 {
1558                                                 OCSP_RESPID_free(id);
1559                                                 *al = SSL_AD_INTERNAL_ERROR;
1560                                                 return 0;
1561                                                 }
1562                                         }
1563
1564                                 /* Read in request_extensions */
1565                                 if (size < 2)
1566                                         {
1567                                         *al = SSL_AD_DECODE_ERROR;
1568                                         return 0;
1569                                         }
1570                                 n2s(data,dsize);
1571                                 size -= 2;
1572                                 if (dsize != size)
1573                                         {
1574                                         *al = SSL_AD_DECODE_ERROR;
1575                                         return 0;
1576                                         }
1577                                 sdata = data;
1578                                 if (dsize > 0)
1579                                         {
1580                                         if (s->tlsext_ocsp_exts)
1581                                                 {
1582                                                 sk_X509_EXTENSION_pop_free(s->tlsext_ocsp_exts,
1583                                                                            X509_EXTENSION_free);
1584                                                 }
1585
1586                                         s->tlsext_ocsp_exts =
1587                                                 d2i_X509_EXTENSIONS(NULL,
1588                                                         &sdata, dsize);
1589                                         if (!s->tlsext_ocsp_exts
1590                                                 || (data + dsize != sdata))
1591                                                 {
1592                                                 *al = SSL_AD_DECODE_ERROR;
1593                                                 return 0;
1594                                                 }
1595                                         }
1596                                 }
1597                                 /* We don't know what to do with any other type
1598                                 * so ignore it.
1599                                 */
1600                                 else
1601                                         s->tlsext_status_type = -1;
1602                         }
1603 #ifndef OPENSSL_NO_HEARTBEATS
1604                 else if (type == TLSEXT_TYPE_heartbeat)
1605                         {
1606                         switch(data[0])
1607                                 {
1608                                 case 0x01:      /* Client allows us to send HB requests */
1609                                                         s->tlsext_heartbeat |= SSL_TLSEXT_HB_ENABLED;
1610                                                         break;
1611                                 case 0x02:      /* Client doesn't accept HB requests */
1612                                                         s->tlsext_heartbeat |= SSL_TLSEXT_HB_ENABLED;
1613                                                         s->tlsext_heartbeat |= SSL_TLSEXT_HB_DONT_SEND_REQUESTS;
1614                                                         break;
1615                                 default:        *al = SSL_AD_ILLEGAL_PARAMETER;
1616                                                         return 0;
1617                                 }
1618                         }
1619 #endif
1620 #ifndef OPENSSL_NO_NEXTPROTONEG
1621                 else if (type == TLSEXT_TYPE_next_proto_neg &&
1622                          s->s3->tmp.finish_md_len == 0)
1623                         {
1624                         /* We shouldn't accept this extension on a
1625                          * renegotiation.
1626                          *
1627                          * s->new_session will be set on renegotiation, but we
1628                          * probably shouldn't rely that it couldn't be set on
1629                          * the initial renegotation too in certain cases (when
1630                          * there's some other reason to disallow resuming an
1631                          * earlier session -- the current code won't be doing
1632                          * anything like that, but this might change).
1633
1634                          * A valid sign that there's been a previous handshake
1635                          * in this connection is if s->s3->tmp.finish_md_len >
1636                          * 0.  (We are talking about a check that will happen
1637                          * in the Hello protocol round, well before a new
1638                          * Finished message could have been computed.) */
1639                         s->s3->next_proto_neg_seen = 1;
1640                         }
1641 #endif
1642
1643                 /* session ticket processed earlier */
1644                 else if (type == TLSEXT_TYPE_use_srtp)
1645                         {
1646                         if(ssl_parse_clienthello_use_srtp_ext(s, data, size,
1647                                                               al))
1648                                 return 0;
1649                         }
1650
1651                 data+=size;
1652                 }
1653
1654         *p = data;
1655
1656         ri_check:
1657
1658         /* Need RI if renegotiating */
1659
1660         if (!renegotiate_seen && s->renegotiate &&
1661                 !(s->options & SSL_OP_ALLOW_UNSAFE_LEGACY_RENEGOTIATION))
1662                 {
1663                 *al = SSL_AD_HANDSHAKE_FAILURE;
1664                 SSLerr(SSL_F_SSL_PARSE_CLIENTHELLO_TLSEXT,
1665                                 SSL_R_UNSAFE_LEGACY_RENEGOTIATION_DISABLED);
1666                 return 0;
1667                 }
1668
1669         return 1;
1670         }
1671
1672 #ifndef OPENSSL_NO_NEXTPROTONEG
1673 /* ssl_next_proto_validate validates a Next Protocol Negotiation block. No
1674  * elements of zero length are allowed and the set of elements must exactly fill
1675  * the length of the block. */
1676 static char ssl_next_proto_validate(unsigned char *d, unsigned len)
1677         {
1678         unsigned int off = 0;
1679
1680         while (off < len)
1681                 {
1682                 if (d[off] == 0)
1683                         return 0;
1684                 off += d[off];
1685                 off++;
1686                 }
1687
1688         return off == len;
1689         }
1690 #endif
1691
1692 int ssl_parse_serverhello_tlsext(SSL *s, unsigned char **p, unsigned char *d, int n, int *al)
1693         {
1694         unsigned short length;
1695         unsigned short type;
1696         unsigned short size;
1697         unsigned char *data = *p;
1698         int tlsext_servername = 0;
1699         int renegotiate_seen = 0;
1700
1701 #ifndef OPENSSL_NO_NEXTPROTONEG
1702         s->s3->next_proto_neg_seen = 0;
1703 #endif
1704
1705 #ifndef OPENSSL_NO_HEARTBEATS
1706         s->tlsext_heartbeat &= ~(SSL_TLSEXT_HB_ENABLED |
1707                                SSL_TLSEXT_HB_DONT_SEND_REQUESTS);
1708 #endif
1709
1710         if (data >= (d+n-2))
1711                 goto ri_check;
1712
1713         n2s(data,length);
1714         if (data+length != d+n)
1715                 {
1716                 *al = SSL_AD_DECODE_ERROR;
1717                 return 0;
1718                 }
1719
1720         while(data <= (d+n-4))
1721                 {
1722                 n2s(data,type);
1723                 n2s(data,size);
1724
1725                 if (data+size > (d+n))
1726                         goto ri_check;
1727
1728                 if (s->tlsext_debug_cb)
1729                         s->tlsext_debug_cb(s, 1, type, data, size,
1730                                                 s->tlsext_debug_arg);
1731
1732                 if (type == TLSEXT_TYPE_server_name)
1733                         {
1734                         if (s->tlsext_hostname == NULL || size > 0)
1735                                 {
1736                                 *al = TLS1_AD_UNRECOGNIZED_NAME;
1737                                 return 0;
1738                                 }
1739                         tlsext_servername = 1;
1740                         }
1741
1742 #ifndef OPENSSL_NO_EC
1743                 else if (type == TLSEXT_TYPE_ec_point_formats &&
1744                      s->version != DTLS1_VERSION)
1745                         {
1746                         unsigned char *sdata = data;
1747                         int ecpointformatlist_length = *(sdata++);
1748
1749                         if (ecpointformatlist_length != size - 1)
1750                                 {
1751                                 *al = TLS1_AD_DECODE_ERROR;
1752                                 return 0;
1753                                 }
1754                         s->session->tlsext_ecpointformatlist_length = 0;
1755                         if (s->session->tlsext_ecpointformatlist != NULL) OPENSSL_free(s->session->tlsext_ecpointformatlist);
1756                         if ((s->session->tlsext_ecpointformatlist = OPENSSL_malloc(ecpointformatlist_length)) == NULL)
1757                                 {
1758                                 *al = TLS1_AD_INTERNAL_ERROR;
1759                                 return 0;
1760                                 }
1761                         s->session->tlsext_ecpointformatlist_length = ecpointformatlist_length;
1762                         memcpy(s->session->tlsext_ecpointformatlist, sdata, ecpointformatlist_length);
1763 #if 0
1764                         fprintf(stderr,"ssl_parse_serverhello_tlsext s->session->tlsext_ecpointformatlist ");
1765                         sdata = s->session->tlsext_ecpointformatlist;
1766                         for (i = 0; i < s->session->tlsext_ecpointformatlist_length; i++)
1767                                 fprintf(stderr,"%i ",*(sdata++));
1768                         fprintf(stderr,"\n");
1769 #endif
1770                         }
1771 #endif /* OPENSSL_NO_EC */
1772
1773                 else if (type == TLSEXT_TYPE_session_ticket)
1774                         {
1775                         if (s->tls_session_ticket_ext_cb &&
1776                             !s->tls_session_ticket_ext_cb(s, data, size, s->tls_session_ticket_ext_cb_arg))
1777                                 {
1778                                 *al = TLS1_AD_INTERNAL_ERROR;
1779                                 return 0;
1780                                 }
1781                         if ((SSL_get_options(s) & SSL_OP_NO_TICKET)
1782                                 || (size > 0))
1783                                 {
1784                                 *al = TLS1_AD_UNSUPPORTED_EXTENSION;
1785                                 return 0;
1786                                 }
1787                         s->tlsext_ticket_expected = 1;
1788                         }
1789 #ifdef TLSEXT_TYPE_opaque_prf_input
1790                 else if (type == TLSEXT_TYPE_opaque_prf_input &&
1791                      s->version != DTLS1_VERSION)
1792                         {
1793                         unsigned char *sdata = data;
1794
1795                         if (size < 2)
1796                                 {
1797                                 *al = SSL_AD_DECODE_ERROR;
1798                                 return 0;
1799                                 }
1800                         n2s(sdata, s->s3->server_opaque_prf_input_len);
1801                         if (s->s3->server_opaque_prf_input_len != size - 2)
1802                                 {
1803                                 *al = SSL_AD_DECODE_ERROR;
1804                                 return 0;
1805                                 }
1806
1807                         if (s->s3->server_opaque_prf_input != NULL) /* shouldn't really happen */
1808                                 OPENSSL_free(s->s3->server_opaque_prf_input);
1809                         if (s->s3->server_opaque_prf_input_len == 0)
1810                                 s->s3->server_opaque_prf_input = OPENSSL_malloc(1); /* dummy byte just to get non-NULL */
1811                         else
1812                                 s->s3->server_opaque_prf_input = BUF_memdup(sdata, s->s3->server_opaque_prf_input_len);
1813
1814                         if (s->s3->server_opaque_prf_input == NULL)
1815                                 {
1816                                 *al = TLS1_AD_INTERNAL_ERROR;
1817                                 return 0;
1818                                 }
1819                         }
1820 #endif
1821                 else if (type == TLSEXT_TYPE_status_request &&
1822                          s->version != DTLS1_VERSION)
1823                         {
1824                         /* MUST be empty and only sent if we've requested
1825                          * a status request message.
1826                          */
1827                         if ((s->tlsext_status_type == -1) || (size > 0))
1828                                 {
1829                                 *al = TLS1_AD_UNSUPPORTED_EXTENSION;
1830                                 return 0;
1831                                 }
1832                         /* Set flag to expect CertificateStatus message */
1833                         s->tlsext_status_expected = 1;
1834                         }
1835 #ifndef OPENSSL_NO_NEXTPROTONEG
1836                 else if (type == TLSEXT_TYPE_next_proto_neg &&
1837                          s->s3->tmp.finish_md_len == 0)
1838                         {
1839                         unsigned char *selected;
1840                         unsigned char selected_len;
1841
1842                         /* We must have requested it. */
1843                         if ((s->ctx->next_proto_select_cb == NULL))
1844                                 {
1845                                 *al = TLS1_AD_UNSUPPORTED_EXTENSION;
1846                                 return 0;
1847                                 }
1848                         /* The data must be valid */
1849                         if (!ssl_next_proto_validate(data, size))
1850                                 {
1851                                 *al = TLS1_AD_DECODE_ERROR;
1852                                 return 0;
1853                                 }
1854                         if (s->ctx->next_proto_select_cb(s, &selected, &selected_len, data, size, s->ctx->next_proto_select_cb_arg) != SSL_TLSEXT_ERR_OK)
1855                                 {
1856                                 *al = TLS1_AD_INTERNAL_ERROR;
1857                                 return 0;
1858                                 }
1859                         s->next_proto_negotiated = OPENSSL_malloc(selected_len);
1860                         if (!s->next_proto_negotiated)
1861                                 {
1862                                 *al = TLS1_AD_INTERNAL_ERROR;
1863                                 return 0;
1864                                 }
1865                         memcpy(s->next_proto_negotiated, selected, selected_len);
1866                         s->next_proto_negotiated_len = selected_len;
1867                         s->s3->next_proto_neg_seen = 1;
1868                         }
1869 #endif
1870                 else if (type == TLSEXT_TYPE_renegotiate)
1871                         {
1872                         if(!ssl_parse_serverhello_renegotiate_ext(s, data, size, al))
1873                                 return 0;
1874                         renegotiate_seen = 1;
1875                         }
1876 #ifndef OPENSSL_NO_HEARTBEATS
1877                 else if (type == TLSEXT_TYPE_heartbeat)
1878                         {
1879                         switch(data[0])
1880                                 {
1881                                 case 0x01:      /* Server allows us to send HB requests */
1882                                                         s->tlsext_heartbeat |= SSL_TLSEXT_HB_ENABLED;
1883                                                         break;
1884                                 case 0x02:      /* Server doesn't accept HB requests */
1885                                                         s->tlsext_heartbeat |= SSL_TLSEXT_HB_ENABLED;
1886                                                         s->tlsext_heartbeat |= SSL_TLSEXT_HB_DONT_SEND_REQUESTS;
1887                                                         break;
1888                                 default:        *al = SSL_AD_ILLEGAL_PARAMETER;
1889                                                         return 0;
1890                                 }
1891                         }
1892 #endif
1893                 else if (type == TLSEXT_TYPE_use_srtp)
1894                         {
1895                         if(ssl_parse_serverhello_use_srtp_ext(s, data, size,
1896                                                               al))
1897                                 return 0;
1898                         }
1899
1900                 data+=size;
1901                 }
1902
1903         if (data != d+n)
1904                 {
1905                 *al = SSL_AD_DECODE_ERROR;
1906                 return 0;
1907                 }
1908
1909         if (!s->hit && tlsext_servername == 1)
1910                 {
1911                 if (s->tlsext_hostname)
1912                         {
1913                         if (s->session->tlsext_hostname == NULL)
1914                                 {
1915                                 s->session->tlsext_hostname = BUF_strdup(s->tlsext_hostname);
1916                                 if (!s->session->tlsext_hostname)
1917                                         {
1918                                         *al = SSL_AD_UNRECOGNIZED_NAME;
1919                                         return 0;
1920                                         }
1921                                 }
1922                         else
1923                                 {
1924                                 *al = SSL_AD_DECODE_ERROR;
1925                                 return 0;
1926                                 }
1927                         }
1928                 }
1929
1930         *p = data;
1931
1932         ri_check:
1933
1934         /* Determine if we need to see RI. Strictly speaking if we want to
1935          * avoid an attack we should *always* see RI even on initial server
1936          * hello because the client doesn't see any renegotiation during an
1937          * attack. However this would mean we could not connect to any server
1938          * which doesn't support RI so for the immediate future tolerate RI
1939          * absence on initial connect only.
1940          */
1941         if (!renegotiate_seen
1942                 && !(s->options & SSL_OP_LEGACY_SERVER_CONNECT)
1943                 && !(s->options & SSL_OP_ALLOW_UNSAFE_LEGACY_RENEGOTIATION))
1944                 {
1945                 *al = SSL_AD_HANDSHAKE_FAILURE;
1946                 SSLerr(SSL_F_SSL_PARSE_SERVERHELLO_TLSEXT,
1947                                 SSL_R_UNSAFE_LEGACY_RENEGOTIATION_DISABLED);
1948                 return 0;
1949                 }
1950
1951         return 1;
1952         }
1953
1954
1955 int ssl_prepare_clienthello_tlsext(SSL *s)
1956         {
1957
1958 #ifdef TLSEXT_TYPE_opaque_prf_input
1959         {
1960                 int r = 1;
1961
1962                 if (s->ctx->tlsext_opaque_prf_input_callback != 0)
1963                         {
1964                         r = s->ctx->tlsext_opaque_prf_input_callback(s, NULL, 0, s->ctx->tlsext_opaque_prf_input_callback_arg);
1965                         if (!r)
1966                                 return -1;
1967                         }
1968
1969                 if (s->tlsext_opaque_prf_input != NULL)
1970                         {
1971                         if (s->s3->client_opaque_prf_input != NULL) /* shouldn't really happen */
1972                                 OPENSSL_free(s->s3->client_opaque_prf_input);
1973
1974                         if (s->tlsext_opaque_prf_input_len == 0)
1975                                 s->s3->client_opaque_prf_input = OPENSSL_malloc(1); /* dummy byte just to get non-NULL */
1976                         else
1977                                 s->s3->client_opaque_prf_input = BUF_memdup(s->tlsext_opaque_prf_input, s->tlsext_opaque_prf_input_len);
1978                         if (s->s3->client_opaque_prf_input == NULL)
1979                                 {
1980                                 SSLerr(SSL_F_SSL_PREPARE_CLIENTHELLO_TLSEXT,ERR_R_MALLOC_FAILURE);
1981                                 return -1;
1982                                 }
1983                         s->s3->client_opaque_prf_input_len = s->tlsext_opaque_prf_input_len;
1984                         }
1985
1986                 if (r == 2)
1987                         /* at callback's request, insist on receiving an appropriate server opaque PRF input */
1988                         s->s3->server_opaque_prf_input_len = s->tlsext_opaque_prf_input_len;
1989         }
1990 #endif
1991
1992         return 1;
1993         }
1994
1995 int ssl_prepare_serverhello_tlsext(SSL *s)
1996         {
1997 #ifndef OPENSSL_NO_EC
1998         /* If we are server and using an ECC cipher suite, send the point formats we support
1999          * if the client sent us an ECPointsFormat extension.  Note that the server is not
2000          * supposed to send an EllipticCurves extension.
2001          */
2002
2003         unsigned long alg_k = s->s3->tmp.new_cipher->algorithm_mkey;
2004         unsigned long alg_a = s->s3->tmp.new_cipher->algorithm_auth;
2005         int using_ecc = (alg_k & (SSL_kEECDH|SSL_kECDHr|SSL_kECDHe)) || (alg_a & SSL_aECDSA);
2006         using_ecc = using_ecc && (s->session->tlsext_ecpointformatlist != NULL);
2007
2008         if (using_ecc)
2009                 {
2010                 if (s->tlsext_ecpointformatlist != NULL) OPENSSL_free(s->tlsext_ecpointformatlist);
2011                 if ((s->tlsext_ecpointformatlist = OPENSSL_malloc(3)) == NULL)
2012                         {
2013                         SSLerr(SSL_F_SSL_PREPARE_SERVERHELLO_TLSEXT,ERR_R_MALLOC_FAILURE);
2014                         return -1;
2015                         }
2016                 s->tlsext_ecpointformatlist_length = 3;
2017                 s->tlsext_ecpointformatlist[0] = TLSEXT_ECPOINTFORMAT_uncompressed;
2018                 s->tlsext_ecpointformatlist[1] = TLSEXT_ECPOINTFORMAT_ansiX962_compressed_prime;
2019                 s->tlsext_ecpointformatlist[2] = TLSEXT_ECPOINTFORMAT_ansiX962_compressed_char2;
2020                 }
2021 #endif /* OPENSSL_NO_EC */
2022
2023         return 1;
2024         }
2025
2026 int ssl_check_clienthello_tlsext(SSL *s)
2027         {
2028         int ret=SSL_TLSEXT_ERR_NOACK;
2029         int al = SSL_AD_UNRECOGNIZED_NAME;
2030
2031 #ifndef OPENSSL_NO_EC
2032         /* The handling of the ECPointFormats extension is done elsewhere, namely in
2033          * ssl3_choose_cipher in s3_lib.c.
2034          */
2035         /* The handling of the EllipticCurves extension is done elsewhere, namely in
2036          * ssl3_choose_cipher in s3_lib.c.
2037          */
2038 #endif
2039
2040         if (s->ctx != NULL && s->ctx->tlsext_servername_callback != 0)
2041                 ret = s->ctx->tlsext_servername_callback(s, &al, s->ctx->tlsext_servername_arg);
2042         else if (s->initial_ctx != NULL && s->initial_ctx->tlsext_servername_callback != 0)
2043                 ret = s->initial_ctx->tlsext_servername_callback(s, &al, s->initial_ctx->tlsext_servername_arg);
2044
2045         /* If status request then ask callback what to do.
2046          * Note: this must be called after servername callbacks in case
2047          * the certificate has changed.
2048          */
2049         if ((s->tlsext_status_type != -1) && s->ctx && s->ctx->tlsext_status_cb)
2050                 {
2051                 int r;
2052                 r = s->ctx->tlsext_status_cb(s, s->ctx->tlsext_status_arg);
2053                 switch (r)
2054                         {
2055                         /* We don't want to send a status request response */
2056                         case SSL_TLSEXT_ERR_NOACK:
2057                                 s->tlsext_status_expected = 0;
2058                                 break;
2059                         /* status request response should be sent */
2060                         case SSL_TLSEXT_ERR_OK:
2061                                 if (s->tlsext_ocsp_resp)
2062                                         s->tlsext_status_expected = 1;
2063                                 else
2064                                         s->tlsext_status_expected = 0;
2065                                 break;
2066                         /* something bad happened */
2067                         case SSL_TLSEXT_ERR_ALERT_FATAL:
2068                                 ret = SSL_TLSEXT_ERR_ALERT_FATAL;
2069                                 al = SSL_AD_INTERNAL_ERROR;
2070                                 goto err;
2071                         }
2072                 }
2073         else
2074                 s->tlsext_status_expected = 0;
2075
2076 #ifdef TLSEXT_TYPE_opaque_prf_input
2077         {
2078                 /* This sort of belongs into ssl_prepare_serverhello_tlsext(),
2079                  * but we might be sending an alert in response to the client hello,
2080                  * so this has to happen here in ssl_check_clienthello_tlsext(). */
2081
2082                 int r = 1;
2083
2084                 if (s->ctx->tlsext_opaque_prf_input_callback != 0)
2085                         {
2086                         r = s->ctx->tlsext_opaque_prf_input_callback(s, NULL, 0, s->ctx->tlsext_opaque_prf_input_callback_arg);
2087                         if (!r)
2088                                 {
2089                                 ret = SSL_TLSEXT_ERR_ALERT_FATAL;
2090                                 al = SSL_AD_INTERNAL_ERROR;
2091                                 goto err;
2092                                 }
2093                         }
2094
2095                 if (s->s3->server_opaque_prf_input != NULL) /* shouldn't really happen */
2096                         OPENSSL_free(s->s3->server_opaque_prf_input);
2097                 s->s3->server_opaque_prf_input = NULL;
2098
2099                 if (s->tlsext_opaque_prf_input != NULL)
2100                         {
2101                         if (s->s3->client_opaque_prf_input != NULL &&
2102                                 s->s3->client_opaque_prf_input_len == s->tlsext_opaque_prf_input_len)
2103                                 {
2104                                 /* can only use this extension if we have a server opaque PRF input
2105                                  * of the same length as the client opaque PRF input! */
2106
2107                                 if (s->tlsext_opaque_prf_input_len == 0)
2108                                         s->s3->server_opaque_prf_input = OPENSSL_malloc(1); /* dummy byte just to get non-NULL */
2109                                 else
2110                                         s->s3->server_opaque_prf_input = BUF_memdup(s->tlsext_opaque_prf_input, s->tlsext_opaque_prf_input_len);
2111                                 if (s->s3->server_opaque_prf_input == NULL)
2112                                         {
2113                                         ret = SSL_TLSEXT_ERR_ALERT_FATAL;
2114                                         al = SSL_AD_INTERNAL_ERROR;
2115                                         goto err;
2116                                         }
2117                                 s->s3->server_opaque_prf_input_len = s->tlsext_opaque_prf_input_len;
2118                                 }
2119                         }
2120
2121                 if (r == 2 && s->s3->server_opaque_prf_input == NULL)
2122                         {
2123                         /* The callback wants to enforce use of the extension,
2124                          * but we can't do that with the client opaque PRF input;
2125                          * abort the handshake.
2126                          */
2127                         ret = SSL_TLSEXT_ERR_ALERT_FATAL;
2128                         al = SSL_AD_HANDSHAKE_FAILURE;
2129                         }
2130         }
2131
2132 #endif
2133  err:
2134         switch (ret)
2135                 {
2136                 case SSL_TLSEXT_ERR_ALERT_FATAL:
2137                         ssl3_send_alert(s,SSL3_AL_FATAL,al);
2138                         return -1;
2139
2140                 case SSL_TLSEXT_ERR_ALERT_WARNING:
2141                         ssl3_send_alert(s,SSL3_AL_WARNING,al);
2142                         return 1;
2143
2144                 case SSL_TLSEXT_ERR_NOACK:
2145                         s->servername_done=0;
2146                         default:
2147                 return 1;
2148                 }
2149         }
2150
2151 int ssl_check_serverhello_tlsext(SSL *s)
2152         {
2153         int ret=SSL_TLSEXT_ERR_NOACK;
2154         int al = SSL_AD_UNRECOGNIZED_NAME;
2155
2156 #ifndef OPENSSL_NO_EC
2157         /* If we are client and using an elliptic curve cryptography cipher
2158          * suite, then if server returns an EC point formats lists extension
2159          * it must contain uncompressed.
2160          */
2161         unsigned long alg_k = s->s3->tmp.new_cipher->algorithm_mkey;
2162         unsigned long alg_a = s->s3->tmp.new_cipher->algorithm_auth;
2163         if ((s->tlsext_ecpointformatlist != NULL) && (s->tlsext_ecpointformatlist_length > 0) &&
2164             (s->session->tlsext_ecpointformatlist != NULL) && (s->session->tlsext_ecpointformatlist_length > 0) &&
2165             ((alg_k & (SSL_kEECDH|SSL_kECDHr|SSL_kECDHe)) || (alg_a & SSL_aECDSA)))
2166                 {
2167                 /* we are using an ECC cipher */
2168                 size_t i;
2169                 unsigned char *list;
2170                 int found_uncompressed = 0;
2171                 list = s->session->tlsext_ecpointformatlist;
2172                 for (i = 0; i < s->session->tlsext_ecpointformatlist_length; i++)
2173                         {
2174                         if (*(list++) == TLSEXT_ECPOINTFORMAT_uncompressed)
2175                                 {
2176                                 found_uncompressed = 1;
2177                                 break;
2178                                 }
2179                         }
2180                 if (!found_uncompressed)
2181                         {
2182                         SSLerr(SSL_F_SSL_CHECK_SERVERHELLO_TLSEXT,SSL_R_TLS_INVALID_ECPOINTFORMAT_LIST);
2183                         return -1;
2184                         }
2185                 }
2186         ret = SSL_TLSEXT_ERR_OK;
2187 #endif /* OPENSSL_NO_EC */
2188
2189         if (s->ctx != NULL && s->ctx->tlsext_servername_callback != 0)
2190                 ret = s->ctx->tlsext_servername_callback(s, &al, s->ctx->tlsext_servername_arg);
2191         else if (s->initial_ctx != NULL && s->initial_ctx->tlsext_servername_callback != 0)
2192                 ret = s->initial_ctx->tlsext_servername_callback(s, &al, s->initial_ctx->tlsext_servername_arg);
2193
2194 #ifdef TLSEXT_TYPE_opaque_prf_input
2195         if (s->s3->server_opaque_prf_input_len > 0)
2196                 {
2197                 /* This case may indicate that we, as a client, want to insist on using opaque PRF inputs.
2198                  * So first verify that we really have a value from the server too. */
2199
2200                 if (s->s3->server_opaque_prf_input == NULL)
2201                         {
2202                         ret = SSL_TLSEXT_ERR_ALERT_FATAL;
2203                         al = SSL_AD_HANDSHAKE_FAILURE;
2204                         }
2205
2206                 /* Anytime the server *has* sent an opaque PRF input, we need to check
2207                  * that we have a client opaque PRF input of the same size. */
2208                 if (s->s3->client_opaque_prf_input == NULL ||
2209                     s->s3->client_opaque_prf_input_len != s->s3->server_opaque_prf_input_len)
2210                         {
2211                         ret = SSL_TLSEXT_ERR_ALERT_FATAL;
2212                         al = SSL_AD_ILLEGAL_PARAMETER;
2213                         }
2214                 }
2215 #endif
2216
2217         /* If we've requested certificate status and we wont get one
2218          * tell the callback
2219          */
2220         if ((s->tlsext_status_type != -1) && !(s->tlsext_status_expected)
2221                         && s->ctx && s->ctx->tlsext_status_cb)
2222                 {
2223                 int r;
2224                 /* Set resp to NULL, resplen to -1 so callback knows
2225                  * there is no response.
2226                  */
2227                 if (s->tlsext_ocsp_resp)
2228                         {
2229                         OPENSSL_free(s->tlsext_ocsp_resp);
2230                         s->tlsext_ocsp_resp = NULL;
2231                         }
2232                 s->tlsext_ocsp_resplen = -1;
2233                 r = s->ctx->tlsext_status_cb(s, s->ctx->tlsext_status_arg);
2234                 if (r == 0)
2235                         {
2236                         al = SSL_AD_BAD_CERTIFICATE_STATUS_RESPONSE;
2237                         ret = SSL_TLSEXT_ERR_ALERT_FATAL;
2238                         }
2239                 if (r < 0)
2240                         {
2241                         al = SSL_AD_INTERNAL_ERROR;
2242                         ret = SSL_TLSEXT_ERR_ALERT_FATAL;
2243                         }
2244                 }
2245
2246         switch (ret)
2247                 {
2248                 case SSL_TLSEXT_ERR_ALERT_FATAL:
2249                         ssl3_send_alert(s,SSL3_AL_FATAL,al);
2250                         return -1;
2251
2252                 case SSL_TLSEXT_ERR_ALERT_WARNING:
2253                         ssl3_send_alert(s,SSL3_AL_WARNING,al);
2254                         return 1;
2255
2256                 case SSL_TLSEXT_ERR_NOACK:
2257                         s->servername_done=0;
2258                         default:
2259                 return 1;
2260                 }
2261         }
2262
2263 /* Since the server cache lookup is done early on in the processing of the
2264  * ClientHello, and other operations depend on the result, we need to handle
2265  * any TLS session ticket extension at the same time.
2266  *
2267  *   session_id: points at the session ID in the ClientHello. This code will
2268  *       read past the end of this in order to parse out the session ticket
2269  *       extension, if any.
2270  *   len: the length of the session ID.
2271  *   limit: a pointer to the first byte after the ClientHello.
2272  *   ret: (output) on return, if a ticket was decrypted, then this is set to
2273  *       point to the resulting session.
2274  *
2275  * If s->tls_session_secret_cb is set then we are expecting a pre-shared key
2276  * ciphersuite, in which case we have no use for session tickets and one will
2277  * never be decrypted, nor will s->tlsext_ticket_expected be set to 1.
2278  *
2279  * Returns:
2280  *   -1: fatal error, either from parsing or decrypting the ticket.
2281  *    0: no ticket was found (or was ignored, based on settings).
2282  *    1: a zero length extension was found, indicating that the client supports
2283  *       session tickets but doesn't currently have one to offer.
2284  *    2: either s->tls_session_secret_cb was set, or a ticket was offered but
2285  *       couldn't be decrypted because of a non-fatal error.
2286  *    3: a ticket was successfully decrypted and *ret was set.
2287  *
2288  * Side effects:
2289  *   Sets s->tlsext_ticket_expected to 1 if the server will have to issue
2290  *   a new session ticket to the client because the client indicated support
2291  *   (and s->tls_session_secret_cb is NULL) but the client either doesn't have
2292  *   a session ticket or we couldn't use the one it gave us, or if
2293  *   s->ctx->tlsext_ticket_key_cb asked to renew the client's ticket.
2294  *   Otherwise, s->tlsext_ticket_expected is set to 0.
2295  */
2296 int tls1_process_ticket(SSL *s, unsigned char *session_id, int len,
2297                         const unsigned char *limit, SSL_SESSION **ret)
2298         {
2299         /* Point after session ID in client hello */
2300         const unsigned char *p = session_id + len;
2301         unsigned short i;
2302
2303         *ret = NULL;
2304         s->tlsext_ticket_expected = 0;
2305
2306         /* If tickets disabled behave as if no ticket present
2307          * to permit stateful resumption.
2308          */
2309         if (SSL_get_options(s) & SSL_OP_NO_TICKET)
2310                 return 0;
2311         if ((s->version <= SSL3_VERSION) || !limit)
2312                 return 0;
2313         if (p >= limit)
2314                 return -1;
2315         /* Skip past DTLS cookie */
2316         if (s->version == DTLS1_VERSION || s->version == DTLS1_BAD_VER)
2317                 {
2318                 i = *(p++);
2319                 p+= i;
2320                 if (p >= limit)
2321                         return -1;
2322                 }
2323         /* Skip past cipher list */
2324         n2s(p, i);
2325         p+= i;
2326         if (p >= limit)
2327                 return -1;
2328         /* Skip past compression algorithm list */
2329         i = *(p++);
2330         p += i;
2331         if (p > limit)
2332                 return -1;
2333         /* Now at start of extensions */
2334         if ((p + 2) >= limit)
2335                 return 0;
2336         n2s(p, i);
2337         while ((p + 4) <= limit)
2338                 {
2339                 unsigned short type, size;
2340                 n2s(p, type);
2341                 n2s(p, size);
2342                 if (p + size > limit)
2343                         return 0;
2344                 if (type == TLSEXT_TYPE_session_ticket)
2345                         {
2346                         int r;
2347                         if (size == 0)
2348                                 {
2349                                 /* The client will accept a ticket but doesn't
2350                                  * currently have one. */
2351                                 s->tlsext_ticket_expected = 1;
2352                                 return 1;
2353                                 }
2354                         if (s->tls_session_secret_cb)
2355                                 {
2356                                 /* Indicate that the ticket couldn't be
2357                                  * decrypted rather than generating the session
2358                                  * from ticket now, trigger abbreviated
2359                                  * handshake based on external mechanism to
2360                                  * calculate the master secret later. */
2361                                 return 2;
2362                                 }
2363                         r = tls_decrypt_ticket(s, p, size, session_id, len, ret);
2364                         switch (r)
2365                                 {
2366                                 case 2: /* ticket couldn't be decrypted */
2367                                         s->tlsext_ticket_expected = 1;
2368                                         return 2;
2369                                 case 3: /* ticket was decrypted */
2370                                         return r;
2371                                 case 4: /* ticket decrypted but need to renew */
2372                                         s->tlsext_ticket_expected = 1;
2373                                         return 3;
2374                                 default: /* fatal error */
2375                                         return -1;
2376                                 }
2377                         }
2378                 p += size;
2379                 }
2380         return 0;
2381         }
2382
2383 /* tls_decrypt_ticket attempts to decrypt a session ticket.
2384  *
2385  *   etick: points to the body of the session ticket extension.
2386  *   eticklen: the length of the session tickets extenion.
2387  *   sess_id: points at the session ID.
2388  *   sesslen: the length of the session ID.
2389  *   psess: (output) on return, if a ticket was decrypted, then this is set to
2390  *       point to the resulting session.
2391  *
2392  * Returns:
2393  *   -1: fatal error, either from parsing or decrypting the ticket.
2394  *    2: the ticket couldn't be decrypted.
2395  *    3: a ticket was successfully decrypted and *psess was set.
2396  *    4: same as 3, but the ticket needs to be renewed.
2397  */
2398 static int tls_decrypt_ticket(SSL *s, const unsigned char *etick, int eticklen,
2399                                 const unsigned char *sess_id, int sesslen,
2400                                 SSL_SESSION **psess)
2401         {
2402         SSL_SESSION *sess;
2403         unsigned char *sdec;
2404         const unsigned char *p;
2405         int slen, mlen, renew_ticket = 0;
2406         unsigned char tick_hmac[EVP_MAX_MD_SIZE];
2407         HMAC_CTX hctx;
2408         EVP_CIPHER_CTX ctx;
2409         SSL_CTX *tctx = s->initial_ctx;
2410         /* Need at least keyname + iv + some encrypted data */
2411         if (eticklen < 48)
2412                 return 2;
2413         /* Initialize session ticket encryption and HMAC contexts */
2414         HMAC_CTX_init(&hctx);
2415         EVP_CIPHER_CTX_init(&ctx);
2416         if (tctx->tlsext_ticket_key_cb)
2417                 {
2418                 unsigned char *nctick = (unsigned char *)etick;
2419                 int rv = tctx->tlsext_ticket_key_cb(s, nctick, nctick + 16,
2420                                                         &ctx, &hctx, 0);
2421                 if (rv < 0)
2422                         return -1;
2423                 if (rv == 0)
2424                         return 2;
2425                 if (rv == 2)
2426                         renew_ticket = 1;
2427                 }
2428         else
2429                 {
2430                 /* Check key name matches */
2431                 if (memcmp(etick, tctx->tlsext_tick_key_name, 16))
2432                         return 2;
2433                 HMAC_Init_ex(&hctx, tctx->tlsext_tick_hmac_key, 16,
2434                                         tlsext_tick_md(), NULL);
2435                 EVP_DecryptInit_ex(&ctx, EVP_aes_128_cbc(), NULL,
2436                                 tctx->tlsext_tick_aes_key, etick + 16);
2437                 }
2438         /* Attempt to process session ticket, first conduct sanity and
2439          * integrity checks on ticket.
2440          */
2441         mlen = HMAC_size(&hctx);
2442         if (mlen < 0)
2443                 {
2444                 EVP_CIPHER_CTX_cleanup(&ctx);
2445                 return -1;
2446                 }
2447         eticklen -= mlen;
2448         /* Check HMAC of encrypted ticket */
2449         HMAC_Update(&hctx, etick, eticklen);
2450         HMAC_Final(&hctx, tick_hmac, NULL);
2451         HMAC_CTX_cleanup(&hctx);
2452         if (memcmp(tick_hmac, etick + eticklen, mlen))
2453                 return 2;
2454         /* Attempt to decrypt session data */
2455         /* Move p after IV to start of encrypted ticket, update length */
2456         p = etick + 16 + EVP_CIPHER_CTX_iv_length(&ctx);
2457         eticklen -= 16 + EVP_CIPHER_CTX_iv_length(&ctx);
2458         sdec = OPENSSL_malloc(eticklen);
2459         if (!sdec)
2460                 {
2461                 EVP_CIPHER_CTX_cleanup(&ctx);
2462                 return -1;
2463                 }
2464         EVP_DecryptUpdate(&ctx, sdec, &slen, p, eticklen);
2465         if (EVP_DecryptFinal(&ctx, sdec + slen, &mlen) <= 0)
2466                 return 2;
2467         slen += mlen;
2468         EVP_CIPHER_CTX_cleanup(&ctx);
2469         p = sdec;
2470
2471         sess = d2i_SSL_SESSION(NULL, &p, slen);
2472         OPENSSL_free(sdec);
2473         if (sess)
2474                 {
2475                 /* The session ID, if non-empty, is used by some clients to
2476                  * detect that the ticket has been accepted. So we copy it to
2477                  * the session structure. If it is empty set length to zero
2478                  * as required by standard.
2479                  */
2480                 if (sesslen)
2481                         memcpy(sess->session_id, sess_id, sesslen);
2482                 sess->session_id_length = sesslen;
2483                 *psess = sess;
2484                 if (renew_ticket)
2485                         return 4;
2486                 else
2487                         return 3;
2488                 }
2489         ERR_clear_error();
2490         /* For session parse failure, indicate that we need to send a new
2491          * ticket. */
2492         return 2;
2493         }
2494
2495 /* Tables to translate from NIDs to TLS v1.2 ids */
2496
2497 typedef struct
2498         {
2499         int nid;
2500         int id;
2501         } tls12_lookup;
2502
2503 static tls12_lookup tls12_md[] = {
2504         {NID_md5, TLSEXT_hash_md5},
2505         {NID_sha1, TLSEXT_hash_sha1},
2506         {NID_sha224, TLSEXT_hash_sha224},
2507         {NID_sha256, TLSEXT_hash_sha256},
2508         {NID_sha384, TLSEXT_hash_sha384},
2509         {NID_sha512, TLSEXT_hash_sha512}
2510 };
2511
2512 static tls12_lookup tls12_sig[] = {
2513         {EVP_PKEY_RSA, TLSEXT_signature_rsa},
2514         {EVP_PKEY_DSA, TLSEXT_signature_dsa},
2515         {EVP_PKEY_EC, TLSEXT_signature_ecdsa}
2516 };
2517
2518 static int tls12_find_id(int nid, tls12_lookup *table, size_t tlen)
2519         {
2520         size_t i;
2521         for (i = 0; i < tlen; i++)
2522                 {
2523                 if (table[i].nid == nid)
2524                         return table[i].id;
2525                 }
2526         return -1;
2527         }
2528
2529 static int tls12_find_nid(int id, tls12_lookup *table, size_t tlen)
2530         {
2531         size_t i;
2532         for (i = 0; i < tlen; i++)
2533                 {
2534                 if ((table[i].id) == id)
2535                         return table[i].nid;
2536                 }
2537         return NID_undef;
2538         }
2539
2540 int tls12_get_sigandhash(unsigned char *p, const EVP_PKEY *pk, const EVP_MD *md)
2541         {
2542         int sig_id, md_id;
2543         if (!md)
2544                 return 0;
2545         md_id = tls12_find_id(EVP_MD_type(md), tls12_md,
2546                                 sizeof(tls12_md)/sizeof(tls12_lookup));
2547         if (md_id == -1)
2548                 return 0;
2549         sig_id = tls12_get_sigid(pk);
2550         if (sig_id == -1)
2551                 return 0;
2552         p[0] = (unsigned char)md_id;
2553         p[1] = (unsigned char)sig_id;
2554         return 1;
2555         }
2556
2557 int tls12_get_sigid(const EVP_PKEY *pk)
2558         {
2559         return tls12_find_id(pk->type, tls12_sig,
2560                                 sizeof(tls12_sig)/sizeof(tls12_lookup));
2561         }
2562
2563 const EVP_MD *tls12_get_hash(unsigned char hash_alg)
2564         {
2565         switch(hash_alg)
2566                 {
2567 #ifndef OPENSSL_NO_MD5
2568                 case TLSEXT_hash_md5:
2569 #ifdef OPENSSL_FIPS
2570                 if (FIPS_mode())
2571                         return NULL;
2572 #endif
2573                 return EVP_md5();
2574 #endif
2575 #ifndef OPENSSL_NO_SHA
2576                 case TLSEXT_hash_sha1:
2577                 return EVP_sha1();
2578 #endif
2579 #ifndef OPENSSL_NO_SHA256
2580                 case TLSEXT_hash_sha224:
2581                 return EVP_sha224();
2582
2583                 case TLSEXT_hash_sha256:
2584                 return EVP_sha256();
2585 #endif
2586 #ifndef OPENSSL_NO_SHA512
2587                 case TLSEXT_hash_sha384:
2588                 return EVP_sha384();
2589
2590                 case TLSEXT_hash_sha512:
2591                 return EVP_sha512();
2592 #endif
2593                 default:
2594                 return NULL;
2595
2596                 }
2597         }
2598
2599 /* Set preferred digest for each key type */
2600
2601 int tls1_process_sigalgs(SSL *s, const unsigned char *data, int dsize)
2602         {
2603         int i, idx;
2604         const EVP_MD *md;
2605         CERT *c = s->cert;
2606         TLS_SIGALGS *sigptr;
2607         /* Extension ignored for TLS versions below 1.2 */
2608         if (TLS1_get_version(s) < TLS1_2_VERSION)
2609                 return 1;
2610         /* Should never happen */
2611         if (!c)
2612                 return 0;
2613
2614         c->pkeys[SSL_PKEY_DSA_SIGN].digest = NULL;
2615         c->pkeys[SSL_PKEY_RSA_SIGN].digest = NULL;
2616         c->pkeys[SSL_PKEY_RSA_ENC].digest = NULL;
2617         c->pkeys[SSL_PKEY_ECC].digest = NULL;
2618
2619         if (c->sigalgs)
2620                 OPENSSL_free(c->sigalgs);
2621         c->sigalgs = OPENSSL_malloc((dsize/2) * sizeof(TLS_SIGALGS));
2622         if (!c->sigalgs)
2623                 return 0;
2624         c->sigalgslen = dsize/2;
2625
2626         for (i = 0, sigptr = c->sigalgs; i < dsize; i += 2, sigptr++)
2627                 {
2628                 sigptr->rhash = data[i];
2629                 sigptr->rsign = data[i + 1];
2630                 sigptr->hash_nid = tls12_find_nid(sigptr->rhash, tls12_md,
2631                                         sizeof(tls12_md)/sizeof(tls12_lookup));
2632                 sigptr->sign_nid = tls12_find_nid(sigptr->rsign, tls12_sig,
2633                                         sizeof(tls12_sig)/sizeof(tls12_lookup));
2634                 if (!OBJ_find_sigid_by_algs(&sigptr->signandhash_nid,
2635                                                 sigptr->hash_nid,
2636                                                 sigptr->sign_nid))
2637                         sigptr->signandhash_nid = NID_undef;
2638                 switch(sigptr->rsign)
2639                         {
2640 #ifndef OPENSSL_NO_RSA
2641                         case TLSEXT_signature_rsa:
2642                         idx = SSL_PKEY_RSA_SIGN;
2643                         break;
2644 #endif
2645 #ifndef OPENSSL_NO_DSA
2646                         case TLSEXT_signature_dsa:
2647                         idx = SSL_PKEY_DSA_SIGN;
2648                         break;
2649 #endif
2650 #ifndef OPENSSL_NO_ECDSA
2651                         case TLSEXT_signature_ecdsa:
2652                         idx = SSL_PKEY_ECC;
2653                         break;
2654 #endif
2655                         default:
2656                         continue;
2657                         }
2658
2659                 if (c->pkeys[idx].digest == NULL)
2660                         {
2661                         md = tls12_get_hash(sigptr->rhash);
2662                         if (md)
2663                                 {
2664                                 c->pkeys[idx].digest = md;
2665                                 if (idx == SSL_PKEY_RSA_SIGN)
2666                                         c->pkeys[SSL_PKEY_RSA_ENC].digest = md;
2667                                 }
2668                         }
2669
2670                 }
2671
2672
2673         /* Set any remaining keys to default values. NOTE: if alg is not
2674          * supported it stays as NULL.
2675          */
2676 #ifndef OPENSSL_NO_DSA
2677         if (!c->pkeys[SSL_PKEY_DSA_SIGN].digest)
2678                 c->pkeys[SSL_PKEY_DSA_SIGN].digest = EVP_dss1();
2679 #endif
2680 #ifndef OPENSSL_NO_RSA
2681         if (!c->pkeys[SSL_PKEY_RSA_SIGN].digest)
2682                 {
2683                 c->pkeys[SSL_PKEY_RSA_SIGN].digest = EVP_sha1();
2684                 c->pkeys[SSL_PKEY_RSA_ENC].digest = EVP_sha1();
2685                 }
2686 #endif
2687 #ifndef OPENSSL_NO_ECDSA
2688         if (!c->pkeys[SSL_PKEY_ECC].digest)
2689                 c->pkeys[SSL_PKEY_ECC].digest = EVP_ecdsa();
2690 #endif
2691         return 1;
2692         }
2693
2694 #endif
2695
2696 int SSL_get_sigalgs(SSL *s, int idx,
2697                         int *psign, int *phash, int *psignandhash,
2698                         unsigned char *rsig, unsigned char *rhash)
2699         {
2700         if (s->cert->sigalgs == NULL)
2701                 return 0;
2702         if (idx >= 0)
2703                 {
2704                 TLS_SIGALGS *psig;
2705                 if (idx >= (int)s->cert->sigalgslen)
2706                         return 0;
2707                 psig = s->cert->sigalgs + idx;
2708                 if (psign)
2709                         *psign = psig->sign_nid;
2710                 if (phash)
2711                         *phash = psig->hash_nid;
2712                 if (psignandhash)
2713                         *psignandhash = psig->signandhash_nid;
2714                 if (rsig)
2715                         *rsig = psig->rsign;
2716                 if (rhash)
2717                         *rhash = psig->rhash;
2718                 }
2719         return s->cert->sigalgslen;
2720         }
2721
2722
2723 #ifndef OPENSSL_NO_HEARTBEATS
2724 int
2725 tls1_process_heartbeat(SSL *s)
2726         {
2727         unsigned char *p = &s->s3->rrec.data[0], *pl;
2728         unsigned short hbtype;
2729         unsigned int payload;
2730         unsigned int padding = 16; /* Use minimum padding */
2731
2732         /* Read type and payload length first */
2733         hbtype = *p++;
2734         n2s(p, payload);
2735         pl = p;
2736
2737         if (s->msg_callback)
2738                 s->msg_callback(0, s->version, TLS1_RT_HEARTBEAT,
2739                         &s->s3->rrec.data[0], s->s3->rrec.length,
2740                         s, s->msg_callback_arg);
2741
2742         if (hbtype == TLS1_HB_REQUEST)
2743                 {
2744                 unsigned char *buffer, *bp;
2745                 int r;
2746
2747                 /* Allocate memory for the response, size is 1 bytes
2748                  * message type, plus 2 bytes payload length, plus
2749                  * payload, plus padding
2750                  */
2751                 buffer = OPENSSL_malloc(1 + 2 + payload + padding);
2752                 bp = buffer;
2753
2754                 /* Enter response type, length and copy payload */
2755                 *bp++ = TLS1_HB_RESPONSE;
2756                 s2n(payload, bp);
2757                 memcpy(bp, pl, payload);
2758                 bp += payload;
2759                 /* Random padding */
2760                 RAND_pseudo_bytes(bp, padding);
2761
2762                 r = ssl3_write_bytes(s, TLS1_RT_HEARTBEAT, buffer, 3 + payload + padding);
2763
2764                 if (r >= 0 && s->msg_callback)
2765                         s->msg_callback(1, s->version, TLS1_RT_HEARTBEAT,
2766                                 buffer, 3 + payload + padding,
2767                                 s, s->msg_callback_arg);
2768
2769                 OPENSSL_free(buffer);
2770
2771                 if (r < 0)
2772                         return r;
2773                 }
2774         else if (hbtype == TLS1_HB_RESPONSE)
2775                 {
2776                 unsigned int seq;
2777
2778                 /* We only send sequence numbers (2 bytes unsigned int),
2779                  * and 16 random bytes, so we just try to read the
2780                  * sequence number */
2781                 n2s(pl, seq);
2782
2783                 if (payload == 18 && seq == s->tlsext_hb_seq)
2784                         {
2785                         s->tlsext_hb_seq++;
2786                         s->tlsext_hb_pending = 0;
2787                         }
2788                 }
2789
2790         return 0;
2791         }
2792
2793 int
2794 tls1_heartbeat(SSL *s)
2795         {
2796         unsigned char *buf, *p;
2797         int ret;
2798         unsigned int payload = 18; /* Sequence number + random bytes */
2799         unsigned int padding = 16; /* Use minimum padding */
2800
2801         /* Only send if peer supports and accepts HB requests... */
2802         if (!(s->tlsext_heartbeat & SSL_TLSEXT_HB_ENABLED) ||
2803             s->tlsext_heartbeat & SSL_TLSEXT_HB_DONT_SEND_REQUESTS)
2804                 {
2805                 SSLerr(SSL_F_TLS1_HEARTBEAT,SSL_R_TLS_HEARTBEAT_PEER_DOESNT_ACCEPT);
2806                 return -1;
2807                 }
2808
2809         /* ...and there is none in flight yet... */
2810         if (s->tlsext_hb_pending)
2811                 {
2812                 SSLerr(SSL_F_TLS1_HEARTBEAT,SSL_R_TLS_HEARTBEAT_PENDING);
2813                 return -1;
2814                 }
2815
2816         /* ...and no handshake in progress. */
2817         if (SSL_in_init(s) || s->in_handshake)
2818                 {
2819                 SSLerr(SSL_F_TLS1_HEARTBEAT,SSL_R_UNEXPECTED_MESSAGE);
2820                 return -1;
2821                 }
2822
2823         /* Check if padding is too long, payload and padding
2824          * must not exceed 2^14 - 3 = 16381 bytes in total.
2825          */
2826         OPENSSL_assert(payload + padding <= 16381);
2827
2828         /* Create HeartBeat message, we just use a sequence number
2829          * as payload to distuingish different messages and add
2830          * some random stuff.
2831          *  - Message Type, 1 byte
2832          *  - Payload Length, 2 bytes (unsigned int)
2833          *  - Payload, the sequence number (2 bytes uint)
2834          *  - Payload, random bytes (16 bytes uint)
2835          *  - Padding
2836          */
2837         buf = OPENSSL_malloc(1 + 2 + payload + padding);
2838         p = buf;
2839         /* Message Type */
2840         *p++ = TLS1_HB_REQUEST;
2841         /* Payload length (18 bytes here) */
2842         s2n(payload, p);
2843         /* Sequence number */
2844         s2n(s->tlsext_hb_seq, p);
2845         /* 16 random bytes */
2846         RAND_pseudo_bytes(p, 16);
2847         p += 16;
2848         /* Random padding */
2849         RAND_pseudo_bytes(p, padding);
2850
2851         ret = ssl3_write_bytes(s, TLS1_RT_HEARTBEAT, buf, 3 + payload + padding);
2852         if (ret >= 0)
2853                 {
2854                 if (s->msg_callback)
2855                         s->msg_callback(1, s->version, TLS1_RT_HEARTBEAT,
2856                                 buf, 3 + payload + padding,
2857                                 s, s->msg_callback_arg);
2858
2859                 s->tlsext_hb_pending = 1;
2860                 }
2861
2862         OPENSSL_free(buf);
2863
2864         return ret;
2865         }
2866 #endif