crypto/libressl/ssl/t1_lib.c

   1 /* $OpenBSD: t1_lib.c,v 1.87 2016/05/30 13:42:54 beck Exp $ */
   2 /* Copyright (C) 1995-1998 Eric Young (eay@cryptsoft.com)
   3  * All rights reserved.
   4  *
   5  * This package is an SSL implementation written
   6  * by Eric Young (eay@cryptsoft.com).
   7  * The implementation was written so as to conform with Netscapes SSL.
   8  *
   9  * This library is free for commercial and non-commercial use as long as
  10  * the following conditions are aheared to.  The following conditions
  11  * apply to all code found in this distribution, be it the RC4, RSA,
  12  * lhash, DES, etc., code; not just the SSL code.  The SSL documentation
  13  * included with this distribution is covered by the same copyright terms
  14  * except that the holder is Tim Hudson (tjh@cryptsoft.com).
  15  *
  16  * Copyright remains Eric Young's, and as such any Copyright notices in
  17  * the code are not to be removed.
  18  * If this package is used in a product, Eric Young should be given attribution
  19  * as the author of the parts of the library used.
  20  * This can be in the form of a textual message at program startup or
  21  * in documentation (online or textual) provided with the package.
  22  *
  23  * Redistribution and use in source and binary forms, with or without
  24  * modification, are permitted provided that the following conditions
  25  * are met:
  26  * 1. Redistributions of source code must retain the copyright
  27  *    notice, this list of conditions and the following disclaimer.
  28  * 2. Redistributions in binary form must reproduce the above copyright
  29  *    notice, this list of conditions and the following disclaimer in the
  30  *    documentation and/or other materials provided with the distribution.
  31  * 3. All advertising materials mentioning features or use of this software
  32  *    must display the following acknowledgement:
  33  *    "This product includes cryptographic software written by
  34  *     Eric Young (eay@cryptsoft.com)"
  35  *    The word 'cryptographic' can be left out if the rouines from the library
  36  *    being used are not cryptographic related :-).
  37  * 4. If you include any Windows specific code (or a derivative thereof) from
  38  *    the apps directory (application code) you must include an acknowledgement:
  39  *    "This product includes software written by Tim Hudson (tjh@cryptsoft.com)"
  40  *
  41  * THIS SOFTWARE IS PROVIDED BY ERIC YOUNG ``AS IS'' AND
  42  * ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
  43  * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE
  44  * ARE DISCLAIMED.  IN NO EVENT SHALL THE AUTHOR OR CONTRIBUTORS BE LIABLE
  45  * FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL
  46  * DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS
  47  * OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION)
  48  * HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT
  49  * LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY
  50  * OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF
  51  * SUCH DAMAGE.
  52  *
  53  * The licence and distribution terms for any publically available version or
  54  * derivative of this code cannot be changed.  i.e. this code cannot simply be
  55  * copied and put under another distribution licence
  56  * [including the GNU Public Licence.]
  57  */
  58 /* ====================================================================
  59  * Copyright (c) 1998-2007 The OpenSSL Project.  All rights reserved.
  60  *
  61  * Redistribution and use in source and binary forms, with or without
  62  * modification, are permitted provided that the following conditions
  63  * are met:
  64  *
  65  * 1. Redistributions of source code must retain the above copyright
  66  *    notice, this list of conditions and the following disclaimer.
  67  *
  68  * 2. Redistributions in binary form must reproduce the above copyright
  69  *    notice, this list of conditions and the following disclaimer in
  70  *    the documentation and/or other materials provided with the
  71  *    distribution.
  72  *
  73  * 3. All advertising materials mentioning features or use of this
  74  *    software must display the following acknowledgment:
  75  *    "This product includes software developed by the OpenSSL Project
  76  *    for use in the OpenSSL Toolkit. (http://www.openssl.org/)"
  77  *
  78  * 4. The names "OpenSSL Toolkit" and "OpenSSL Project" must not be used to
  79  *    endorse or promote products derived from this software without
  80  *    prior written permission. For written permission, please contact
  81  *    openssl-core@openssl.org.
  82  *
  83  * 5. Products derived from this software may not be called "OpenSSL"
  84  *    nor may "OpenSSL" appear in their names without prior written
  85  *    permission of the OpenSSL Project.
  86  *
  87  * 6. Redistributions of any form whatsoever must retain the following
  88  *    acknowledgment:
  89  *    "This product includes software developed by the OpenSSL Project
  90  *    for use in the OpenSSL Toolkit (http://www.openssl.org/)"
  91  *
  92  * THIS SOFTWARE IS PROVIDED BY THE OpenSSL PROJECT ``AS IS'' AND ANY
  93  * EXPRESSED OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
  94  * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
  95  * PURPOSE ARE DISCLAIMED.  IN NO EVENT SHALL THE OpenSSL PROJECT OR
  96  * ITS CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL,
  97  * SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT
  98  * NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES;
  99  * LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION)
 100  * HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT,
 101  * STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE)
 102  * ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED
 103  * OF THE POSSIBILITY OF SUCH DAMAGE.
 104  * ====================================================================
 105  *
 106  * This product includes cryptographic software written by Eric Young
 107  * (eay@cryptsoft.com).  This product includes software written by Tim
 108  * Hudson (tjh@cryptsoft.com).
 109  *
 110  */
 111
 112 #include <stdio.h>
 113
 114 #include <openssl/evp.h>
 115 #include <openssl/hmac.h>
 116 #include <openssl/objects.h>
 117 #include <openssl/ocsp.h>
 118
 119 #include "ssl_locl.h"
 120 #include "bytestring.h"
 121
 122 static int tls_decrypt_ticket(SSL *s, const unsigned char *tick, int ticklen,
 123     const unsigned char *sess_id, int sesslen,
 124     SSL_SESSION **psess);
 125
 126 SSL3_ENC_METHOD TLSv1_enc_data = {
 127         .enc = tls1_enc,
 128         .mac = tls1_mac,
 129         .setup_key_block = tls1_setup_key_block,
 130         .generate_master_secret = tls1_generate_master_secret,
 131         .change_cipher_state = tls1_change_cipher_state,
 132         .final_finish_mac = tls1_final_finish_mac,
 133         .finish_mac_length = TLS1_FINISH_MAC_LENGTH,
 134         .cert_verify_mac = tls1_cert_verify_mac,
 135         .client_finished_label = TLS_MD_CLIENT_FINISH_CONST,
 136         .client_finished_label_len = TLS_MD_CLIENT_FINISH_CONST_SIZE,
 137         .server_finished_label = TLS_MD_SERVER_FINISH_CONST,
 138         .server_finished_label_len = TLS_MD_SERVER_FINISH_CONST_SIZE,
 139         .alert_value = tls1_alert_code,
 140         .export_keying_material = tls1_export_keying_material,
 141         .enc_flags = 0,
 142 };
 143
 144 SSL3_ENC_METHOD TLSv1_1_enc_data = {
 145         .enc = tls1_enc,
 146         .mac = tls1_mac,
 147         .setup_key_block = tls1_setup_key_block,
 148         .generate_master_secret = tls1_generate_master_secret,
 149         .change_cipher_state = tls1_change_cipher_state,
 150         .final_finish_mac = tls1_final_finish_mac,
 151         .finish_mac_length = TLS1_FINISH_MAC_LENGTH,
 152         .cert_verify_mac = tls1_cert_verify_mac,
 153         .client_finished_label = TLS_MD_CLIENT_FINISH_CONST,
 154         .client_finished_label_len = TLS_MD_CLIENT_FINISH_CONST_SIZE,
 155         .server_finished_label = TLS_MD_SERVER_FINISH_CONST,
 156         .server_finished_label_len = TLS_MD_SERVER_FINISH_CONST_SIZE,
 157         .alert_value = tls1_alert_code,
 158         .export_keying_material = tls1_export_keying_material,
 159         .enc_flags = SSL_ENC_FLAG_EXPLICIT_IV,
 160 };
 161
 162 SSL3_ENC_METHOD TLSv1_2_enc_data = {
 163         .enc = tls1_enc,
 164         .mac = tls1_mac,
 165         .setup_key_block = tls1_setup_key_block,
 166         .generate_master_secret = tls1_generate_master_secret,
 167         .change_cipher_state = tls1_change_cipher_state,
 168         .final_finish_mac = tls1_final_finish_mac,
 169         .finish_mac_length = TLS1_FINISH_MAC_LENGTH,
 170         .cert_verify_mac = tls1_cert_verify_mac,
 171         .client_finished_label = TLS_MD_CLIENT_FINISH_CONST,
 172         .client_finished_label_len = TLS_MD_CLIENT_FINISH_CONST_SIZE,
 173         .server_finished_label = TLS_MD_SERVER_FINISH_CONST,
 174         .server_finished_label_len = TLS_MD_SERVER_FINISH_CONST_SIZE,
 175         .alert_value = tls1_alert_code,
 176         .export_keying_material = tls1_export_keying_material,
 177         .enc_flags = SSL_ENC_FLAG_EXPLICIT_IV|SSL_ENC_FLAG_SIGALGS|
 178             SSL_ENC_FLAG_SHA256_PRF|SSL_ENC_FLAG_TLS1_2_CIPHERS,
 179 };
 180
 181 long
 182 tls1_default_timeout(void)
 183 {
 184         /* 2 hours, the 24 hours mentioned in the TLSv1 spec
 185          * is way too long for http, the cache would over fill */
 186         return (60 * 60 * 2);
 187 }
 188
 189 int
 190 tls1_new(SSL *s)
 191 {
 192         if (!ssl3_new(s))
 193                 return (0);
 194         s->method->ssl_clear(s);
 195         return (1);
 196 }
 197
 198 void
 199 tls1_free(SSL *s)
 200 {
 201         if (s == NULL)
 202                 return;
 203
 204         free(s->tlsext_session_ticket);
 205         ssl3_free(s);
 206 }
 207
 208 void
 209 tls1_clear(SSL *s)
 210 {
 211         ssl3_clear(s);
 212         s->version = s->method->version;
 213 }
 214
 215
 216 static int nid_list[] = {
 217         NID_sect163k1,          /* sect163k1 (1) */
 218         NID_sect163r1,          /* sect163r1 (2) */
 219         NID_sect163r2,          /* sect163r2 (3) */
 220         NID_sect193r1,          /* sect193r1 (4) */
 221         NID_sect193r2,          /* sect193r2 (5) */
 222         NID_sect233k1,          /* sect233k1 (6) */
 223         NID_sect233r1,          /* sect233r1 (7) */
 224         NID_sect239k1,          /* sect239k1 (8) */
 225         NID_sect283k1,          /* sect283k1 (9) */
 226         NID_sect283r1,          /* sect283r1 (10) */
 227         NID_sect409k1,          /* sect409k1 (11) */
 228         NID_sect409r1,          /* sect409r1 (12) */
 229         NID_sect571k1,          /* sect571k1 (13) */
 230         NID_sect571r1,          /* sect571r1 (14) */
 231         NID_secp160k1,          /* secp160k1 (15) */
 232         NID_secp160r1,          /* secp160r1 (16) */
 233         NID_secp160r2,          /* secp160r2 (17) */
 234         NID_secp192k1,          /* secp192k1 (18) */
 235         NID_X9_62_prime192v1,   /* secp192r1 (19) */
 236         NID_secp224k1,          /* secp224k1 (20) */
 237         NID_secp224r1,          /* secp224r1 (21) */
 238         NID_secp256k1,          /* secp256k1 (22) */
 239         NID_X9_62_prime256v1,   /* secp256r1 (23) */
 240         NID_secp384r1,          /* secp384r1 (24) */
 241         NID_secp521r1,          /* secp521r1 (25) */
 242         NID_brainpoolP256r1,    /* brainpoolP256r1 (26) */
 243         NID_brainpoolP384r1,    /* brainpoolP384r1 (27) */
 244         NID_brainpoolP512r1     /* brainpoolP512r1 (28) */
 245 };
 246
 247 static const uint8_t ecformats_default[] = {
 248         TLSEXT_ECPOINTFORMAT_uncompressed,
 249         TLSEXT_ECPOINTFORMAT_ansiX962_compressed_prime,
 250         TLSEXT_ECPOINTFORMAT_ansiX962_compressed_char2
 251 };
 252
 253 static const uint16_t eccurves_default[] = {
 254         14,                     /* sect571r1 (14) */
 255         13,                     /* sect571k1 (13) */
 256         25,                     /* secp521r1 (25) */
 257         28,                     /* brainpool512r1 (28) */
 258         11,                     /* sect409k1 (11) */
 259         12,                     /* sect409r1 (12) */
 260         27,                     /* brainpoolP384r1 (27) */
 261         24,                     /* secp384r1 (24) */
 262         9,                      /* sect283k1 (9) */
 263         10,                     /* sect283r1 (10) */
 264         26,                     /* brainpoolP256r1 (26) */
 265         22,                     /* secp256k1 (22) */
 266         23,                     /* secp256r1 (23) */
 267         8,                      /* sect239k1 (8) */
 268         6,                      /* sect233k1 (6) */
 269         7,                      /* sect233r1 (7) */
 270         20,                     /* secp224k1 (20) */
 271         21,                     /* secp224r1 (21) */
 272         4,                      /* sect193r1 (4) */
 273         5,                      /* sect193r2 (5) */
 274         18,                     /* secp192k1 (18) */
 275         19,                     /* secp192r1 (19) */
 276         1,                      /* sect163k1 (1) */
 277         2,                      /* sect163r1 (2) */
 278         3,                      /* sect163r2 (3) */
 279         15,                     /* secp160k1 (15) */
 280         16,                     /* secp160r1 (16) */
 281         17,                     /* secp160r2 (17) */
 282 };
 283
 284 int
 285 tls1_ec_curve_id2nid(uint16_t curve_id)
 286 {
 287         /* ECC curves from draft-ietf-tls-ecc-12.txt (Oct. 17, 2005) */
 288         if ((curve_id < 1) ||
 289             ((unsigned int)curve_id > sizeof(nid_list) / sizeof(nid_list[0])))
 290                 return 0;
 291         return nid_list[curve_id - 1];
 292 }
 293
 294 uint16_t
 295 tls1_ec_nid2curve_id(int nid)
 296 {
 297         /* ECC curves from draft-ietf-tls-ecc-12.txt (Oct. 17, 2005) */
 298         switch (nid) {
 299         case NID_sect163k1: /* sect163k1 (1) */
 300                 return 1;
 301         case NID_sect163r1: /* sect163r1 (2) */
 302                 return 2;
 303         case NID_sect163r2: /* sect163r2 (3) */
 304                 return 3;
 305         case NID_sect193r1: /* sect193r1 (4) */
 306                 return 4;
 307         case NID_sect193r2: /* sect193r2 (5) */
 308                 return 5;
 309         case NID_sect233k1: /* sect233k1 (6) */
 310                 return 6;
 311         case NID_sect233r1: /* sect233r1 (7) */
 312                 return 7;
 313         case NID_sect239k1: /* sect239k1 (8) */
 314                 return 8;
 315         case NID_sect283k1: /* sect283k1 (9) */
 316                 return 9;
 317         case NID_sect283r1: /* sect283r1 (10) */
 318                 return 10;
 319         case NID_sect409k1: /* sect409k1 (11) */
 320                 return 11;
 321         case NID_sect409r1: /* sect409r1 (12) */
 322                 return 12;
 323         case NID_sect571k1: /* sect571k1 (13) */
 324                 return 13;
 325         case NID_sect571r1: /* sect571r1 (14) */
 326                 return 14;
 327         case NID_secp160k1: /* secp160k1 (15) */
 328                 return 15;
 329         case NID_secp160r1: /* secp160r1 (16) */
 330                 return 16;
 331         case NID_secp160r2: /* secp160r2 (17) */
 332                 return 17;
 333         case NID_secp192k1: /* secp192k1 (18) */
 334                 return 18;
 335         case NID_X9_62_prime192v1: /* secp192r1 (19) */
 336                 return 19;
 337         case NID_secp224k1: /* secp224k1 (20) */
 338                 return 20;
 339         case NID_secp224r1: /* secp224r1 (21) */
 340                 return 21;
 341         case NID_secp256k1: /* secp256k1 (22) */
 342                 return 22;
 343         case NID_X9_62_prime256v1: /* secp256r1 (23) */
 344                 return 23;
 345         case NID_secp384r1: /* secp384r1 (24) */
 346                 return 24;
 347         case NID_secp521r1: /* secp521r1 (25) */
 348                 return 25;
 349         case NID_brainpoolP256r1: /* brainpoolP256r1 (26) */
 350                 return 26;
 351         case NID_brainpoolP384r1: /* brainpoolP384r1 (27) */
 352                 return 27;
 353         case NID_brainpoolP512r1: /* brainpoolP512r1 (28) */
 354                 return 28;
 355         default:
 356                 return 0;
 357         }
 358 }
 359
 360 /*
 361  * Return the appropriate format list. If client_formats is non-zero, return
 362  * the client/session formats. Otherwise return the custom format list if one
 363  * exists, or the default formats if a custom list has not been specified.
 364  */
 365 static void
 366 tls1_get_formatlist(SSL *s, int client_formats, const uint8_t **pformats,
 367     size_t *pformatslen)
 368 {
 369         if (client_formats != 0) {
 370                 *pformats = s->session->tlsext_ecpointformatlist;
 371                 *pformatslen = s->session->tlsext_ecpointformatlist_length;
 372                 return;
 373         }
 374
 375         *pformats = s->tlsext_ecpointformatlist;
 376         *pformatslen = s->tlsext_ecpointformatlist_length;
 377         if (*pformats == NULL) {
 378                 *pformats = ecformats_default;
 379                 *pformatslen = sizeof(ecformats_default);
 380         }
 381 }
 382
 383 /*
 384  * Return the appropriate curve list. If client_curves is non-zero, return
 385  * the client/session curves. Otherwise return the custom curve list if one
 386  * exists, or the default curves if a custom list has not been specified.
 387  */
 388 static void
 389 tls1_get_curvelist(SSL *s, int client_curves, const uint16_t **pcurves,
 390     size_t *pcurveslen)
 391 {
 392         if (client_curves != 0) {
 393                 *pcurves = s->session->tlsext_ellipticcurvelist;
 394                 *pcurveslen = s->session->tlsext_ellipticcurvelist_length;
 395                 return;
 396         }
 397
 398         *pcurves = s->tlsext_ellipticcurvelist;
 399         *pcurveslen = s->tlsext_ellipticcurvelist_length;
 400         if (*pcurves == NULL) {
 401                 *pcurves = eccurves_default;
 402                 *pcurveslen = sizeof(eccurves_default) / 2;
 403         }
 404 }
 405
 406 /* Check that a curve is one of our preferences. */
 407 int
 408 tls1_check_curve(SSL *s, const unsigned char *p, size_t len)
 409 {
 410         CBS cbs;
 411         const uint16_t *curves;
 412         size_t curveslen, i;
 413         uint8_t type;
 414         uint16_t cid;
 415
 416         CBS_init(&cbs, p, len);
 417
 418         /* Only named curves are supported. */
 419         if (CBS_len(&cbs) != 3 ||
 420             !CBS_get_u8(&cbs, &type) ||
 421             type != NAMED_CURVE_TYPE ||
 422             !CBS_get_u16(&cbs, &cid))
 423                 return (0);
 424
 425         tls1_get_curvelist(s, 0, &curves, &curveslen);
 426
 427         for (i = 0; i < curveslen; i++) {
 428                 if (curves[i] == cid)
 429                         return (1);
 430         }
 431         return (0);
 432 }
 433
 434 int
 435 tls1_get_shared_curve(SSL *s)
 436 {
 437         size_t preflen, supplen, i, j;
 438         const uint16_t *pref, *supp;
 439         unsigned long server_pref;
 440
 441         /* Cannot do anything on the client side. */
 442         if (s->server == 0)
 443                 return (NID_undef);
 444
 445         /* Return first preference shared curve. */
 446         server_pref = (s->options & SSL_OP_CIPHER_SERVER_PREFERENCE);
 447         tls1_get_curvelist(s, (server_pref == 0), &pref, &preflen);
 448         tls1_get_curvelist(s, (server_pref != 0), &supp, &supplen);
 449
 450         for (i = 0; i < preflen; i++) {
 451                 for (j = 0; j < supplen; j++) {
 452                         if (pref[i] == supp[j])
 453                                 return (tls1_ec_curve_id2nid(pref[i]));
 454                 }
 455         }
 456         return (NID_undef);
 457 }
 458
 459 /* For an EC key set TLS ID and required compression based on parameters. */
 460 static int
 461 tls1_set_ec_id(uint16_t *curve_id, uint8_t *comp_id, EC_KEY *ec)
 462 {
 463         const EC_GROUP *grp;
 464         const EC_METHOD *meth;
 465         int is_prime = 0;
 466         int nid, id;
 467
 468         if (ec == NULL)
 469                 return (0);
 470
 471         /* Determine if it is a prime field. */
 472         if ((grp = EC_KEY_get0_group(ec)) == NULL)
 473                 return (0);
 474         if ((meth = EC_GROUP_method_of(grp)) == NULL)
 475                 return (0);
 476         if (EC_METHOD_get_field_type(meth) == NID_X9_62_prime_field)
 477                 is_prime = 1;
 478
 479         /* Determine curve ID. */
 480         nid = EC_GROUP_get_curve_name(grp);
 481         id = tls1_ec_nid2curve_id(nid);
 482
 483         /* If we have an ID set it, otherwise set arbitrary explicit curve. */
 484         if (id != 0)
 485                 *curve_id = id;
 486         else
 487                 *curve_id = is_prime ? 0xff01 : 0xff02;
 488
 489         /* Specify the compression identifier. */
 490         if (comp_id != NULL) {
 491                 if (EC_KEY_get0_public_key(ec) == NULL)
 492                         return (0);
 493
 494                 if (EC_KEY_get_conv_form(ec) == POINT_CONVERSION_COMPRESSED) {
 495                         *comp_id = is_prime ?
 496                             TLSEXT_ECPOINTFORMAT_ansiX962_compressed_prime :
 497                             TLSEXT_ECPOINTFORMAT_ansiX962_compressed_char2;
 498                 } else {
 499                         *comp_id = TLSEXT_ECPOINTFORMAT_uncompressed;
 500                 }
 501         }
 502         return (1);
 503 }
 504
 505 /* Check that an EC key is compatible with extensions. */
 506 static int
 507 tls1_check_ec_key(SSL *s, const uint16_t *curve_id, const uint8_t *comp_id)
 508 {
 509         size_t curveslen, formatslen, i;
 510         const uint16_t *curves;
 511         const uint8_t *formats;
 512
 513         /*
 514          * Check point formats extension if present, otherwise everything
 515          * is supported (see RFC4492).
 516          */
 517         tls1_get_formatlist(s, 1, &formats, &formatslen);
 518         if (comp_id != NULL && formats != NULL) {
 519                 for (i = 0; i < formatslen; i++) {
 520                         if (formats[i] == *comp_id)
 521                                 break;
 522                 }
 523                 if (i == formatslen)
 524                         return (0);
 525         }
 526
 527         /*
 528          * Check curve list if present, otherwise everything is supported.
 529          */
 530         tls1_get_curvelist(s, 1, &curves, &curveslen);
 531         if (curve_id != NULL && curves != NULL) {
 532                 for (i = 0; i < curveslen; i++) {
 533                         if (curves[i] == *curve_id)
 534                                 break;
 535                 }
 536                 if (i == curveslen)
 537                         return (0);
 538         }
 539
 540         return (1);
 541 }
 542
 543 /* Check EC server key is compatible with client extensions. */
 544 int
 545 tls1_check_ec_server_key(SSL *s)
 546 {
 547         CERT_PKEY *cpk = s->cert->pkeys + SSL_PKEY_ECC;
 548         uint16_t curve_id;
 549         uint8_t comp_id;
 550         EVP_PKEY *pkey;
 551         int rv;
 552
 553         if (cpk->x509 == NULL || cpk->privatekey == NULL)
 554                 return (0);
 555         if ((pkey = X509_get_pubkey(cpk->x509)) == NULL)
 556                 return (0);
 557         rv = tls1_set_ec_id(&curve_id, &comp_id, pkey->pkey.ec);
 558         EVP_PKEY_free(pkey);
 559         if (rv != 1)
 560                 return (0);
 561
 562         return tls1_check_ec_key(s, &curve_id, &comp_id);
 563 }
 564
 565 /* Check EC temporary key is compatible with client extensions. */
 566 int
 567 tls1_check_ec_tmp_key(SSL *s)
 568 {
 569         EC_KEY *ec = s->cert->ecdh_tmp;
 570         uint16_t curve_id;
 571
 572         if (s->cert->ecdh_tmp_auto != 0) {
 573                 /* Need a shared curve. */
 574                 if (tls1_get_shared_curve(s) != NID_undef)
 575                         return (1);
 576                 return (0);
 577         }
 578
 579         if (ec == NULL) {
 580                 if (s->cert->ecdh_tmp_cb != NULL)
 581                         return (1);
 582                 return (0);
 583         }
 584         if (tls1_set_ec_id(&curve_id, NULL, ec) != 1)
 585                 return (0);
 586
 587         return tls1_check_ec_key(s, &curve_id, NULL);
 588 }
 589
 590 /*
 591  * List of supported signature algorithms and hashes. Should make this
 592  * customisable at some point, for now include everything we support.
 593  */
 594
 595 static unsigned char tls12_sigalgs[] = {
 596         TLSEXT_hash_sha512, TLSEXT_signature_rsa,
 597         TLSEXT_hash_sha512, TLSEXT_signature_dsa,
 598         TLSEXT_hash_sha512, TLSEXT_signature_ecdsa,
 599 #ifndef OPENSSL_NO_GOST
 600         TLSEXT_hash_streebog_512, TLSEXT_signature_gostr12_512,
 601 #endif
 602
 603         TLSEXT_hash_sha384, TLSEXT_signature_rsa,
 604         TLSEXT_hash_sha384, TLSEXT_signature_dsa,
 605         TLSEXT_hash_sha384, TLSEXT_signature_ecdsa,
 606
 607         TLSEXT_hash_sha256, TLSEXT_signature_rsa,
 608         TLSEXT_hash_sha256, TLSEXT_signature_dsa,
 609         TLSEXT_hash_sha256, TLSEXT_signature_ecdsa,
 610
 611 #ifndef OPENSSL_NO_GOST
 612         TLSEXT_hash_streebog_256, TLSEXT_signature_gostr12_256,
 613         TLSEXT_hash_gost94, TLSEXT_signature_gostr01,
 614 #endif
 615
 616         TLSEXT_hash_sha224, TLSEXT_signature_rsa,
 617         TLSEXT_hash_sha224, TLSEXT_signature_dsa,
 618         TLSEXT_hash_sha224, TLSEXT_signature_ecdsa,
 619
 620         TLSEXT_hash_sha1, TLSEXT_signature_rsa,
 621         TLSEXT_hash_sha1, TLSEXT_signature_dsa,
 622         TLSEXT_hash_sha1, TLSEXT_signature_ecdsa,
 623 };
 624
 625 int
 626 tls12_get_req_sig_algs(SSL *s, unsigned char *p)
 627 {
 628         size_t slen = sizeof(tls12_sigalgs);
 629
 630         if (p)
 631                 memcpy(p, tls12_sigalgs, slen);
 632         return (int)slen;
 633 }
 634
 635 unsigned char *
 636 ssl_add_clienthello_tlsext(SSL *s, unsigned char *p, unsigned char *limit)
 637 {
 638         int extdatalen = 0;
 639         unsigned char *ret = p;
 640         int using_ecc = 0;
 641
 642         /* See if we support any ECC ciphersuites. */
 643         if (s->version != DTLS1_VERSION && s->version >= TLS1_VERSION) {
 644                 STACK_OF(SSL_CIPHER) *cipher_stack = SSL_get_ciphers(s);
 645                 unsigned long alg_k, alg_a;
 646                 int i;
 647
 648                 for (i = 0; i < sk_SSL_CIPHER_num(cipher_stack); i++) {
 649                         SSL_CIPHER *c = sk_SSL_CIPHER_value(cipher_stack, i);
 650
 651                         alg_k = c->algorithm_mkey;
 652                         alg_a = c->algorithm_auth;
 653
 654                         if ((alg_k & (SSL_kECDHE|SSL_kECDHr|SSL_kECDHe) ||
 655                             (alg_a & SSL_aECDSA))) {
 656                                 using_ecc = 1;
 657                                 break;
 658                         }
 659                 }
 660         }
 661
 662         ret += 2;
 663
 664         if (ret >= limit)
 665                 return NULL; /* this really never occurs, but ... */
 666
 667         if (s->tlsext_hostname != NULL) {
 668                 /* Add TLS extension servername to the Client Hello message */
 669                 size_t size_str, lenmax;
 670
 671                 /* check for enough space.
 672                    4 for the servername type and extension length
 673                    2 for servernamelist length
 674                    1 for the hostname type
 675                    2 for hostname length
 676                    + hostname length
 677                 */
 678
 679                 if ((size_t)(limit - ret) < 9)
 680                         return NULL;
 681
 682                 lenmax = limit - ret - 9;
 683                 if ((size_str = strlen(s->tlsext_hostname)) > lenmax)
 684                         return NULL;
 685
 686                 /* extension type and length */
 687                 s2n(TLSEXT_TYPE_server_name, ret);
 688
 689                 s2n(size_str + 5, ret);
 690
 691                 /* length of servername list */
 692                 s2n(size_str + 3, ret);
 693
 694                 /* hostname type, length and hostname */
 695                 *(ret++) = (unsigned char) TLSEXT_NAMETYPE_host_name;
 696                 s2n(size_str, ret);
 697                 memcpy(ret, s->tlsext_hostname, size_str);
 698                 ret += size_str;
 699         }
 700
 701         /* Add RI if renegotiating */
 702         if (s->renegotiate) {
 703                 int el;
 704
 705                 if (!ssl_add_clienthello_renegotiate_ext(s, 0, &el, 0)) {
 706                         SSLerr(SSL_F_SSL_ADD_CLIENTHELLO_TLSEXT,
 707                             ERR_R_INTERNAL_ERROR);
 708                         return NULL;
 709                 }
 710
 711                 if ((size_t)(limit - ret) < 4 + el)
 712                         return NULL;
 713
 714                 s2n(TLSEXT_TYPE_renegotiate, ret);
 715                 s2n(el, ret);
 716
 717                 if (!ssl_add_clienthello_renegotiate_ext(s, ret, &el, el)) {
 718                         SSLerr(SSL_F_SSL_ADD_CLIENTHELLO_TLSEXT,
 719                             ERR_R_INTERNAL_ERROR);
 720                         return NULL;
 721                 }
 722
 723                 ret += el;
 724         }
 725
 726         if (using_ecc) {
 727                 size_t curveslen, formatslen, lenmax;
 728                 const uint16_t *curves;
 729                 const uint8_t *formats;
 730                 int i;
 731
 732                 /*
 733                  * Add TLS extension ECPointFormats to the ClientHello message.
 734                  */
 735                 tls1_get_formatlist(s, 0, &formats, &formatslen);
 736
 737                 if ((size_t)(limit - ret) < 5)
 738                         return NULL;
 739
 740                 lenmax = limit - ret - 5;
 741                 if (formatslen > lenmax)
 742                         return NULL;
 743                 if (formatslen > 255) {
 744                         SSLerr(SSL_F_SSL_ADD_CLIENTHELLO_TLSEXT,
 745                             ERR_R_INTERNAL_ERROR);
 746                         return NULL;
 747                 }
 748
 749                 s2n(TLSEXT_TYPE_ec_point_formats, ret);
 750                 s2n(formatslen + 1, ret);
 751                 *(ret++) = (unsigned char)formatslen;
 752                 memcpy(ret, formats, formatslen);
 753                 ret += formatslen;
 754
 755                 /*
 756                  * Add TLS extension EllipticCurves to the ClientHello message.
 757                  */
 758                 tls1_get_curvelist(s, 0, &curves, &curveslen);
 759
 760                 if ((size_t)(limit - ret) < 6)
 761                         return NULL;
 762
 763                 lenmax = limit - ret - 6;
 764                 if (curveslen > lenmax)
 765                         return NULL;
 766                 if (curveslen > 65532) {
 767                         SSLerr(SSL_F_SSL_ADD_CLIENTHELLO_TLSEXT,
 768                             ERR_R_INTERNAL_ERROR);
 769                         return NULL;
 770                 }
 771
 772                 s2n(TLSEXT_TYPE_elliptic_curves, ret);
 773                 s2n((curveslen * 2) + 2, ret);
 774
 775                 /* NB: draft-ietf-tls-ecc-12.txt uses a one-byte prefix for
 776                  * elliptic_curve_list, but the examples use two bytes.
 777                  * https://www1.ietf.org/mail-archive/web/tls/current/msg00538.html
 778                  * resolves this to two bytes.
 779                  */
 780                 s2n(curveslen * 2, ret);
 781                 for (i = 0; i < curveslen; i++)
 782                         s2n(curves[i], ret);
 783         }
 784
 785         if (!(SSL_get_options(s) & SSL_OP_NO_TICKET)) {
 786                 int ticklen;
 787                 if (!s->new_session && s->session && s->session->tlsext_tick)
 788                         ticklen = s->session->tlsext_ticklen;
 789                 else if (s->session && s->tlsext_session_ticket &&
 790                     s->tlsext_session_ticket->data) {
 791                         ticklen = s->tlsext_session_ticket->length;
 792                         s->session->tlsext_tick = malloc(ticklen);
 793                         if (!s->session->tlsext_tick)
 794                                 return NULL;
 795                         memcpy(s->session->tlsext_tick,
 796                             s->tlsext_session_ticket->data, ticklen);
 797                         s->session->tlsext_ticklen = ticklen;
 798                 } else
 799                         ticklen = 0;
 800                 if (ticklen == 0 && s->tlsext_session_ticket &&
 801                     s->tlsext_session_ticket->data == NULL)
 802                         goto skip_ext;
 803                 /* Check for enough room 2 for extension type, 2 for len
 804                  * rest for ticket
 805                  */
 806                 if ((size_t)(limit - ret) < 4 + ticklen)
 807                         return NULL;
 808                 s2n(TLSEXT_TYPE_session_ticket, ret);
 809
 810                 s2n(ticklen, ret);
 811                 if (ticklen) {
 812                         memcpy(ret, s->session->tlsext_tick, ticklen);
 813                         ret += ticklen;
 814                 }
 815         }
 816 skip_ext:
 817
 818         if (TLS1_get_client_version(s) >= TLS1_2_VERSION) {
 819                 if ((size_t)(limit - ret) < sizeof(tls12_sigalgs) + 6)
 820                         return NULL;
 821
 822                 s2n(TLSEXT_TYPE_signature_algorithms, ret);
 823                 s2n(sizeof(tls12_sigalgs) + 2, ret);
 824                 s2n(sizeof(tls12_sigalgs), ret);
 825                 memcpy(ret, tls12_sigalgs, sizeof(tls12_sigalgs));
 826                 ret += sizeof(tls12_sigalgs);
 827         }
 828
 829         if (s->tlsext_status_type == TLSEXT_STATUSTYPE_ocsp &&
 830             s->version != DTLS1_VERSION) {
 831                 int i;
 832                 long extlen, idlen, itmp;
 833                 OCSP_RESPID *id;
 834
 835                 idlen = 0;
 836                 for (i = 0; i < sk_OCSP_RESPID_num(s->tlsext_ocsp_ids); i++) {
 837                         id = sk_OCSP_RESPID_value(s->tlsext_ocsp_ids, i);
 838                         itmp = i2d_OCSP_RESPID(id, NULL);
 839                         if (itmp <= 0)
 840                                 return NULL;
 841                         idlen += itmp + 2;
 842                 }
 843
 844                 if (s->tlsext_ocsp_exts) {
 845                         extlen = i2d_X509_EXTENSIONS(s->tlsext_ocsp_exts, NULL);
 846                         if (extlen < 0)
 847                                 return NULL;
 848                 } else
 849                         extlen = 0;
 850
 851                 if ((size_t)(limit - ret) < 7 + extlen + idlen)
 852                         return NULL;
 853                 s2n(TLSEXT_TYPE_status_request, ret);
 854                 if (extlen + idlen > 0xFFF0)
 855                         return NULL;
 856                 s2n(extlen + idlen + 5, ret);
 857                 *(ret++) = TLSEXT_STATUSTYPE_ocsp;
 858                 s2n(idlen, ret);
 859                 for (i = 0; i < sk_OCSP_RESPID_num(s->tlsext_ocsp_ids); i++) {
 860                         /* save position of id len */
 861                         unsigned char *q = ret;
 862                         id = sk_OCSP_RESPID_value(s->tlsext_ocsp_ids, i);
 863                         /* skip over id len */
 864                         ret += 2;
 865                         itmp = i2d_OCSP_RESPID(id, &ret);
 866                         /* write id len */
 867                         s2n(itmp, q);
 868                 }
 869                 s2n(extlen, ret);
 870                 if (extlen > 0)
 871                         i2d_X509_EXTENSIONS(s->tlsext_ocsp_exts, &ret);
 872         }
 873
 874         if (s->ctx->next_proto_select_cb && !s->s3->tmp.finish_md_len) {
 875                 /* The client advertises an emtpy extension to indicate its
 876                  * support for Next Protocol Negotiation */
 877                 if ((size_t)(limit - ret) < 4)
 878                         return NULL;
 879                 s2n(TLSEXT_TYPE_next_proto_neg, ret);
 880                 s2n(0, ret);
 881         }
 882
 883         if (s->alpn_client_proto_list != NULL &&
 884             s->s3->tmp.finish_md_len == 0) {
 885                 if ((size_t)(limit - ret) < 6 + s->alpn_client_proto_list_len)
 886                         return (NULL);
 887                 s2n(TLSEXT_TYPE_application_layer_protocol_negotiation, ret);
 888                 s2n(2 + s->alpn_client_proto_list_len, ret);
 889                 s2n(s->alpn_client_proto_list_len, ret);
 890                 memcpy(ret, s->alpn_client_proto_list,
 891                     s->alpn_client_proto_list_len);
 892                 ret += s->alpn_client_proto_list_len;
 893         }
 894
 895 #ifndef OPENSSL_NO_SRTP
 896         if (SSL_IS_DTLS(s) && SSL_get_srtp_profiles(s)) {
 897                 int el;
 898
 899                 ssl_add_clienthello_use_srtp_ext(s, 0, &el, 0);
 900
 901                 if ((size_t)(limit - ret) < 4 + el)
 902                         return NULL;
 903
 904                 s2n(TLSEXT_TYPE_use_srtp, ret);
 905                 s2n(el, ret);
 906
 907                 if (ssl_add_clienthello_use_srtp_ext(s, ret, &el, el)) {
 908                         SSLerr(SSL_F_SSL_ADD_CLIENTHELLO_TLSEXT,
 909                             ERR_R_INTERNAL_ERROR);
 910                         return NULL;
 911                 }
 912                 ret += el;
 913         }
 914 #endif
 915
 916         /*
 917          * Add padding to workaround bugs in F5 terminators.
 918          * See https://tools.ietf.org/html/draft-agl-tls-padding-03
 919          *
 920          * Note that this seems to trigger issues with IronPort SMTP
 921          * appliances.
 922          *
 923          * NB: because this code works out the length of all existing
 924          * extensions it MUST always appear last.
 925          */
 926         if (s->options & SSL_OP_TLSEXT_PADDING) {
 927                 int hlen = ret - (unsigned char *)s->init_buf->data;
 928
 929                 /*
 930                  * The code in s23_clnt.c to build ClientHello messages
 931                  * includes the 5-byte record header in the buffer, while the
 932                  * code in s3_clnt.c does not.
 933                  */
 934                 if (s->state == SSL23_ST_CW_CLNT_HELLO_A)
 935                         hlen -= 5;
 936                 if (hlen > 0xff && hlen < 0x200) {
 937                         hlen = 0x200 - hlen;
 938                         if (hlen >= 4)
 939                                 hlen -= 4;
 940                         else
 941                                 hlen = 0;
 942
 943                         s2n(TLSEXT_TYPE_padding, ret);
 944                         s2n(hlen, ret);
 945                         memset(ret, 0, hlen);
 946                         ret += hlen;
 947                 }
 948         }
 949
 950         if ((extdatalen = ret - p - 2) == 0)
 951                 return p;
 952
 953         s2n(extdatalen, p);
 954         return ret;
 955 }
 956
 957 unsigned char *
 958 ssl_add_serverhello_tlsext(SSL *s, unsigned char *p, unsigned char *limit)
 959 {
 960         int using_ecc, extdatalen = 0;
 961         unsigned long alg_a, alg_k;
 962         unsigned char *ret = p;
 963         int next_proto_neg_seen;
 964
 965         alg_a = s->s3->tmp.new_cipher->algorithm_auth;
 966         alg_k = s->s3->tmp.new_cipher->algorithm_mkey;
 967         using_ecc = (alg_k & (SSL_kECDHE|SSL_kECDHr|SSL_kECDHe) ||
 968             alg_a & SSL_aECDSA) &&
 969             s->session->tlsext_ecpointformatlist != NULL;
 970
 971         ret += 2;
 972         if (ret >= limit)
 973                 return NULL; /* this really never occurs, but ... */
 974
 975         if (!s->hit && s->servername_done == 1 &&
 976             s->session->tlsext_hostname != NULL) {
 977                 if ((size_t)(limit - ret) < 4)
 978                         return NULL;
 979
 980                 s2n(TLSEXT_TYPE_server_name, ret);
 981                 s2n(0, ret);
 982         }
 983
 984         if (s->s3->send_connection_binding) {
 985                 int el;
 986
 987                 if (!ssl_add_serverhello_renegotiate_ext(s, 0, &el, 0)) {
 988                         SSLerr(SSL_F_SSL_ADD_SERVERHELLO_TLSEXT,
 989                             ERR_R_INTERNAL_ERROR);
 990                         return NULL;
 991                 }
 992
 993                 if ((size_t)(limit - ret) < 4 + el)
 994                         return NULL;
 995
 996                 s2n(TLSEXT_TYPE_renegotiate, ret);
 997                 s2n(el, ret);
 998
 999                 if (!ssl_add_serverhello_renegotiate_ext(s, ret, &el, el)) {
1000                         SSLerr(SSL_F_SSL_ADD_SERVERHELLO_TLSEXT,
1001                             ERR_R_INTERNAL_ERROR);
1002                         return NULL;
1003                 }
1004
1005                 ret += el;
1006         }
1007
1008         if (using_ecc && s->version != DTLS1_VERSION) {
1009                 const unsigned char *formats;
1010                 size_t formatslen, lenmax;
1011
1012                 /*
1013                  * Add TLS extension ECPointFormats to the ServerHello message.
1014                  */
1015                 tls1_get_formatlist(s, 0, &formats, &formatslen);
1016
1017                 if ((size_t)(limit - ret) < 5)
1018                         return NULL;
1019
1020                 lenmax = limit - ret - 5;
1021                 if (formatslen > lenmax)
1022                         return NULL;
1023                 if (formatslen > 255) {
1024                         SSLerr(SSL_F_SSL_ADD_SERVERHELLO_TLSEXT,
1025                             ERR_R_INTERNAL_ERROR);
1026                         return NULL;
1027                 }
1028
1029                 s2n(TLSEXT_TYPE_ec_point_formats, ret);
1030                 s2n(formatslen + 1, ret);
1031                 *(ret++) = (unsigned char)formatslen;
1032                 memcpy(ret, formats, formatslen);
1033                 ret += formatslen;
1034         }
1035
1036         /*
1037          * Currently the server should not respond with a SupportedCurves
1038          * extension.
1039          */
1040
1041         if (s->tlsext_ticket_expected &&
1042             !(SSL_get_options(s) & SSL_OP_NO_TICKET)) {
1043                 if ((size_t)(limit - ret) < 4)
1044                         return NULL;
1045
1046                 s2n(TLSEXT_TYPE_session_ticket, ret);
1047                 s2n(0, ret);
1048         }
1049
1050         if (s->tlsext_status_expected) {
1051                 if ((size_t)(limit - ret) < 4)
1052                         return NULL;
1053
1054                 s2n(TLSEXT_TYPE_status_request, ret);
1055                 s2n(0, ret);
1056         }
1057
1058 #ifndef OPENSSL_NO_SRTP
1059         if (SSL_IS_DTLS(s) && s->srtp_profile) {
1060                 int el;
1061
1062                 ssl_add_serverhello_use_srtp_ext(s, 0, &el, 0);
1063
1064                 if ((size_t)(limit - ret) < 4 + el)
1065                         return NULL;
1066
1067                 s2n(TLSEXT_TYPE_use_srtp, ret);
1068                 s2n(el, ret);
1069
1070                 if (ssl_add_serverhello_use_srtp_ext(s, ret, &el, el)) {
1071                         SSLerr(SSL_F_SSL_ADD_SERVERHELLO_TLSEXT,
1072                             ERR_R_INTERNAL_ERROR);
1073                         return NULL;
1074                 }
1075                 ret += el;
1076         }
1077 #endif
1078
1079         if (((s->s3->tmp.new_cipher->id & 0xFFFF) == 0x80 ||
1080             (s->s3->tmp.new_cipher->id & 0xFFFF) == 0x81) &&
1081             (SSL_get_options(s) & SSL_OP_CRYPTOPRO_TLSEXT_BUG)) {
1082                 static const unsigned char cryptopro_ext[36] = {
1083                         0xfd, 0xe8, /*65000*/
1084                         0x00, 0x20, /*32 bytes length*/
1085                         0x30, 0x1e, 0x30, 0x08, 0x06, 0x06, 0x2a, 0x85,
1086                         0x03, 0x02, 0x02, 0x09, 0x30, 0x08, 0x06, 0x06,
1087                         0x2a, 0x85, 0x03, 0x02, 0x02, 0x16, 0x30, 0x08,
1088                         0x06, 0x06, 0x2a, 0x85, 0x03, 0x02, 0x02, 0x17
1089                 };
1090                 if ((size_t)(limit - ret) < sizeof(cryptopro_ext))
1091                         return NULL;
1092                 memcpy(ret, cryptopro_ext, sizeof(cryptopro_ext));
1093                 ret += sizeof(cryptopro_ext);
1094         }
1095
1096         next_proto_neg_seen = s->s3->next_proto_neg_seen;
1097         s->s3->next_proto_neg_seen = 0;
1098         if (next_proto_neg_seen && s->ctx->next_protos_advertised_cb) {
1099                 const unsigned char *npa;
1100                 unsigned int npalen;
1101                 int r;
1102
1103                 r = s->ctx->next_protos_advertised_cb(s, &npa, &npalen,
1104                     s->ctx->next_protos_advertised_cb_arg);
1105                 if (r == SSL_TLSEXT_ERR_OK) {
1106                         if ((size_t)(limit - ret) < 4 + npalen)
1107                                 return NULL;
1108                         s2n(TLSEXT_TYPE_next_proto_neg, ret);
1109                         s2n(npalen, ret);
1110                         memcpy(ret, npa, npalen);
1111                         ret += npalen;
1112                         s->s3->next_proto_neg_seen = 1;
1113                 }
1114         }
1115
1116         if (s->s3->alpn_selected != NULL) {
1117                 const unsigned char *selected = s->s3->alpn_selected;
1118                 unsigned int len = s->s3->alpn_selected_len;
1119
1120                 if ((long)(limit - ret - 4 - 2 - 1 - len) < 0)
1121                         return (NULL);
1122                 s2n(TLSEXT_TYPE_application_layer_protocol_negotiation, ret);
1123                 s2n(3 + len, ret);
1124                 s2n(1 + len, ret);
1125                 *ret++ = len;
1126                 memcpy(ret, selected, len);
1127                 ret += len;
1128         }
1129
1130         if ((extdatalen = ret - p - 2) == 0)
1131                 return p;
1132
1133         s2n(extdatalen, p);
1134         return ret;
1135 }
1136
1137 /*
1138  * tls1_alpn_handle_client_hello is called to process the ALPN extension in a
1139  * ClientHello.
1140  *   data: the contents of the extension, not including the type and length.
1141  *   data_len: the number of bytes in data.
1142  *   al: a pointer to the alert value to send in the event of a non-zero
1143  *       return.
1144  *   returns: 1 on success.
1145  */
1146 static int
1147 tls1_alpn_handle_client_hello(SSL *s, const unsigned char *data,
1148     unsigned int data_len, int *al)
1149 {
1150         CBS cbs, proto_name_list, alpn;
1151         const unsigned char *selected;
1152         unsigned char selected_len;
1153         int r;
1154
1155         if (s->ctx->alpn_select_cb == NULL)
1156                 return (1);
1157
1158         if (data_len < 2)
1159                 goto parse_error;
1160
1161         CBS_init(&cbs, data, data_len);
1162
1163         /*
1164          * data should contain a uint16 length followed by a series of 8-bit,
1165          * length-prefixed strings.
1166          */
1167         if (!CBS_get_u16_length_prefixed(&cbs, &alpn) ||
1168             CBS_len(&alpn) < 2 ||
1169             CBS_len(&cbs) != 0)
1170                 goto parse_error;
1171
1172         /* Validate data before sending to callback. */
1173         CBS_dup(&alpn, &proto_name_list);
1174         while (CBS_len(&proto_name_list) > 0) {
1175                 CBS proto_name;
1176
1177                 if (!CBS_get_u8_length_prefixed(&proto_name_list, &proto_name) ||
1178                     CBS_len(&proto_name) == 0)
1179                         goto parse_error;
1180         }
1181
1182         r = s->ctx->alpn_select_cb(s, &selected, &selected_len,
1183             CBS_data(&alpn), CBS_len(&alpn), s->ctx->alpn_select_cb_arg);
1184         if (r == SSL_TLSEXT_ERR_OK) {
1185                 free(s->s3->alpn_selected);
1186                 if ((s->s3->alpn_selected = malloc(selected_len)) == NULL) {
1187                         *al = SSL_AD_INTERNAL_ERROR;
1188                         return (-1);
1189                 }
1190                 memcpy(s->s3->alpn_selected, selected, selected_len);
1191                 s->s3->alpn_selected_len = selected_len;
1192         }
1193
1194         return (1);
1195
1196 parse_error:
1197         *al = SSL_AD_DECODE_ERROR;
1198         return (0);
1199 }
1200
1201 int
1202 ssl_parse_clienthello_tlsext(SSL *s, unsigned char **p, unsigned char *d,
1203     int n, int *al)
1204 {
1205         unsigned short type;
1206         unsigned short size;
1207         unsigned short len;
1208         unsigned char *data = *p;
1209         int renegotiate_seen = 0;
1210         int sigalg_seen = 0;
1211
1212         s->servername_done = 0;
1213         s->tlsext_status_type = -1;
1214         s->s3->next_proto_neg_seen = 0;
1215         free(s->s3->alpn_selected);
1216         s->s3->alpn_selected = NULL;
1217
1218         if (data >= (d + n - 2))
1219                 goto ri_check;
1220         n2s(data, len);
1221
1222         if (data > (d + n - len))
1223                 goto ri_check;
1224
1225         while (data <= (d + n - 4)) {
1226                 n2s(data, type);
1227                 n2s(data, size);
1228
1229                 if (data + size > (d + n))
1230                         goto ri_check;
1231                 if (s->tlsext_debug_cb)
1232                         s->tlsext_debug_cb(s, 0, type, data, size,
1233                             s->tlsext_debug_arg);
1234 /* The servername extension is treated as follows:
1235
1236    - Only the hostname type is supported with a maximum length of 255.
1237    - The servername is rejected if too long or if it contains zeros,
1238      in which case an fatal alert is generated.
1239    - The servername field is maintained together with the session cache.
1240    - When a session is resumed, the servername call back invoked in order
1241      to allow the application to position itself to the right context.
1242    - The servername is acknowledged if it is new for a session or when
1243      it is identical to a previously used for the same session.
1244      Applications can control the behaviour.  They can at any time
1245      set a 'desirable' servername for a new SSL object. This can be the
1246      case for example with HTTPS when a Host: header field is received and
1247      a renegotiation is requested. In this case, a possible servername
1248      presented in the new client hello is only acknowledged if it matches
1249      the value of the Host: field.
1250    - Applications must  use SSL_OP_NO_SESSION_RESUMPTION_ON_RENEGOTIATION
1251      if they provide for changing an explicit servername context for the session,
1252      i.e. when the session has been established with a servername extension.
1253    - On session reconnect, the servername extension may be absent.
1254
1255 */
1256
1257                 if (type == TLSEXT_TYPE_server_name) {
1258                         unsigned char *sdata;
1259                         int servname_type;
1260                         int dsize;
1261
1262                         if (size < 2) {
1263                                 *al = SSL_AD_DECODE_ERROR;
1264                                 return 0;
1265                         }
1266                         n2s(data, dsize);
1267
1268                         size -= 2;
1269                         if (dsize > size) {
1270                                 *al = SSL_AD_DECODE_ERROR;
1271                                 return 0;
1272                         }
1273
1274                         sdata = data;
1275                         while (dsize > 3) {
1276                                 servname_type = *(sdata++);
1277
1278                                 n2s(sdata, len);
1279                                 dsize -= 3;
1280
1281                                 if (len > dsize) {
1282                                         *al = SSL_AD_DECODE_ERROR;
1283                                         return 0;
1284                                 }
1285                                 if (s->servername_done == 0)
1286                                         switch (servname_type) {
1287                                         case TLSEXT_NAMETYPE_host_name:
1288                                                 if (!s->hit) {
1289                                                         if (s->session->tlsext_hostname) {
1290                                                                 *al = SSL_AD_DECODE_ERROR;
1291                                                                 return 0;
1292                                                         }
1293                                                         if (len > TLSEXT_MAXLEN_host_name) {
1294                                                                 *al = TLS1_AD_UNRECOGNIZED_NAME;
1295                                                                 return 0;
1296                                                         }
1297                                                         if ((s->session->tlsext_hostname =
1298                                                             malloc(len + 1)) == NULL) {
1299                                                                 *al = TLS1_AD_INTERNAL_ERROR;
1300                                                                 return 0;
1301                                                         }
1302                                                         memcpy(s->session->tlsext_hostname, sdata, len);
1303                                                         s->session->tlsext_hostname[len] = '\0';
1304                                                         if (strlen(s->session->tlsext_hostname) != len) {
1305                                                                 free(s->session->tlsext_hostname);
1306                                                                 s->session->tlsext_hostname = NULL;
1307                                                                 *al = TLS1_AD_UNRECOGNIZED_NAME;
1308                                                                 return 0;
1309                                                         }
1310                                                         s->servername_done = 1;
1311
1312
1313                                                 } else {
1314                                                         s->servername_done = s->session->tlsext_hostname &&
1315                                                             strlen(s->session->tlsext_hostname) == len &&
1316                                                             strncmp(s->session->tlsext_hostname, (char *)sdata, len) == 0;
1317                                                 }
1318                                                 break;
1319
1320                                         default:
1321                                                 break;
1322                                         }
1323
1324                                 dsize -= len;
1325                         }
1326                         if (dsize != 0) {
1327                                 *al = SSL_AD_DECODE_ERROR;
1328                                 return 0;
1329                         }
1330
1331                 }
1332
1333                 else if (type == TLSEXT_TYPE_ec_point_formats &&
1334                     s->version != DTLS1_VERSION) {
1335                         unsigned char *sdata = data;
1336                         size_t formatslen;
1337                         uint8_t *formats;
1338
1339                         if (size < 1) {
1340                                 *al = TLS1_AD_DECODE_ERROR;
1341                                 return 0;
1342                         }
1343                         formatslen = *(sdata++);
1344                         if (formatslen != size - 1) {
1345                                 *al = TLS1_AD_DECODE_ERROR;
1346                                 return 0;
1347                         }
1348
1349                         if (!s->hit) {
1350                                 free(s->session->tlsext_ecpointformatlist);
1351                                 s->session->tlsext_ecpointformatlist = NULL;
1352                                 s->session->tlsext_ecpointformatlist_length = 0;
1353
1354                                 if ((formats = reallocarray(NULL, formatslen,
1355                                     sizeof(uint8_t))) == NULL) {
1356                                         *al = TLS1_AD_INTERNAL_ERROR;
1357                                         return 0;
1358                                 }
1359                                 memcpy(formats, sdata, formatslen);
1360                                 s->session->tlsext_ecpointformatlist = formats;
1361                                 s->session->tlsext_ecpointformatlist_length =
1362                                     formatslen;
1363                         }
1364                 } else if (type == TLSEXT_TYPE_elliptic_curves &&
1365                     s->version != DTLS1_VERSION) {
1366                         unsigned char *sdata = data;
1367                         size_t curveslen, i;
1368                         uint16_t *curves;
1369
1370                         if (size < 2) {
1371                                 *al = TLS1_AD_DECODE_ERROR;
1372                                 return 0;
1373                         }
1374                         n2s(sdata, curveslen);
1375                         if (curveslen != size - 2 || curveslen % 2 != 0) {
1376                                 *al = TLS1_AD_DECODE_ERROR;
1377                                 return 0;
1378                         }
1379                         curveslen /= 2;
1380
1381                         if (!s->hit) {
1382                                 if (s->session->tlsext_ellipticcurvelist) {
1383                                         *al = TLS1_AD_DECODE_ERROR;
1384                                         return 0;
1385                                 }
1386                                 s->session->tlsext_ellipticcurvelist_length = 0;
1387                                 if ((curves = reallocarray(NULL, curveslen,
1388                                     sizeof(uint16_t))) == NULL) {
1389                                         *al = TLS1_AD_INTERNAL_ERROR;
1390                                         return 0;
1391                                 }
1392                                 for (i = 0; i < curveslen; i++)
1393                                         n2s(sdata, curves[i]);
1394                                 s->session->tlsext_ellipticcurvelist = curves;
1395                                 s->session->tlsext_ellipticcurvelist_length = curveslen;
1396                         }
1397                 }
1398                 else if (type == TLSEXT_TYPE_session_ticket) {
1399                         if (s->tls_session_ticket_ext_cb &&
1400                             !s->tls_session_ticket_ext_cb(s, data, size, s->tls_session_ticket_ext_cb_arg)) {
1401                                 *al = TLS1_AD_INTERNAL_ERROR;
1402                                 return 0;
1403                         }
1404                 } else if (type == TLSEXT_TYPE_renegotiate) {
1405                         if (!ssl_parse_clienthello_renegotiate_ext(s, data, size, al))
1406                                 return 0;
1407                         renegotiate_seen = 1;
1408                 } else if (type == TLSEXT_TYPE_signature_algorithms) {
1409                         int dsize;
1410                         if (sigalg_seen || size < 2) {
1411                                 *al = SSL_AD_DECODE_ERROR;
1412                                 return 0;
1413                         }
1414                         sigalg_seen = 1;
1415                         n2s(data, dsize);
1416                         size -= 2;
1417                         if (dsize != size || dsize & 1) {
1418                                 *al = SSL_AD_DECODE_ERROR;
1419                                 return 0;
1420                         }
1421                         if (!tls1_process_sigalgs(s, data, dsize)) {
1422                                 *al = SSL_AD_DECODE_ERROR;
1423                                 return 0;
1424                         }
1425                 } else if (type == TLSEXT_TYPE_status_request &&
1426                     s->version != DTLS1_VERSION) {
1427
1428                         if (size < 5) {
1429                                 *al = SSL_AD_DECODE_ERROR;
1430                                 return 0;
1431                         }
1432
1433                         s->tlsext_status_type = *data++;
1434                         size--;
1435                         if (s->tlsext_status_type == TLSEXT_STATUSTYPE_ocsp) {
1436                                 const unsigned char *sdata;
1437                                 int dsize;
1438                                 /* Read in responder_id_list */
1439                                 n2s(data, dsize);
1440                                 size -= 2;
1441                                 if (dsize > size) {
1442                                         *al = SSL_AD_DECODE_ERROR;
1443                                         return 0;
1444                                 }
1445
1446                                 /*
1447                                  * We remove any OCSP_RESPIDs from a
1448                                  * previous handshake to prevent
1449                                  * unbounded memory growth.
1450                                  */
1451                                 sk_OCSP_RESPID_pop_free(s->tlsext_ocsp_ids,
1452                                     OCSP_RESPID_free);
1453                                 s->tlsext_ocsp_ids = NULL;
1454                                 if (dsize > 0) {
1455                                         s->tlsext_ocsp_ids =
1456                                             sk_OCSP_RESPID_new_null();
1457                                         if (s->tlsext_ocsp_ids == NULL) {
1458                                                 *al = SSL_AD_INTERNAL_ERROR;
1459                                                 return 0;
1460                                         }
1461                                 }
1462
1463                                 while (dsize > 0) {
1464                                         OCSP_RESPID *id;
1465                                         int idsize;
1466                                         if (dsize < 4) {
1467                                                 *al = SSL_AD_DECODE_ERROR;
1468                                                 return 0;
1469                                         }
1470                                         n2s(data, idsize);
1471                                         dsize -= 2 + idsize;
1472                                         size -= 2 + idsize;
1473                                         if (dsize < 0) {
1474                                                 *al = SSL_AD_DECODE_ERROR;
1475                                                 return 0;
1476                                         }
1477                                         sdata = data;
1478                                         data += idsize;
1479                                         id = d2i_OCSP_RESPID(NULL,
1480                                             &sdata, idsize);
1481                                         if (!id) {
1482                                                 *al = SSL_AD_DECODE_ERROR;
1483                                                 return 0;
1484                                         }
1485                                         if (data != sdata) {
1486                                                 OCSP_RESPID_free(id);
1487                                                 *al = SSL_AD_DECODE_ERROR;
1488                                                 return 0;
1489                                         }
1490                                         if (!sk_OCSP_RESPID_push(
1491                                             s->tlsext_ocsp_ids, id)) {
1492                                                 OCSP_RESPID_free(id);
1493                                                 *al = SSL_AD_INTERNAL_ERROR;
1494                                                 return 0;
1495                                         }
1496                                 }
1497
1498                                 /* Read in request_extensions */
1499                                 if (size < 2) {
1500                                         *al = SSL_AD_DECODE_ERROR;
1501                                         return 0;
1502                                 }
1503                                 n2s(data, dsize);
1504                                 size -= 2;
1505                                 if (dsize != size) {
1506                                         *al = SSL_AD_DECODE_ERROR;
1507                                         return 0;
1508                                 }
1509                                 sdata = data;
1510                                 if (dsize > 0) {
1511                                         if (s->tlsext_ocsp_exts) {
1512                                                 sk_X509_EXTENSION_pop_free(s->tlsext_ocsp_exts,
1513                                                     X509_EXTENSION_free);
1514                                         }
1515
1516                                         s->tlsext_ocsp_exts =
1517                                             d2i_X509_EXTENSIONS(NULL,
1518                                             &sdata, dsize);
1519                                         if (!s->tlsext_ocsp_exts ||
1520                                                     (data + dsize != sdata)) {
1521                                                 *al = SSL_AD_DECODE_ERROR;
1522                                                 return 0;
1523                                         }
1524                                 }
1525                         } else {
1526                                 /* We don't know what to do with any other type
1527                                 * so ignore it.
1528                                 */
1529                                 s->tlsext_status_type = -1;
1530                         }
1531                 }
1532                 else if (type == TLSEXT_TYPE_next_proto_neg &&
1533                     s->s3->tmp.finish_md_len == 0 &&
1534                     s->s3->alpn_selected == NULL) {
1535                         /* We shouldn't accept this extension on a
1536                          * renegotiation.
1537                          *
1538                          * s->new_session will be set on renegotiation, but we
1539                          * probably shouldn't rely that it couldn't be set on
1540                          * the initial renegotation too in certain cases (when
1541                          * there's some other reason to disallow resuming an
1542                          * earlier session -- the current code won't be doing
1543                          * anything like that, but this might change).
1544
1545                          * A valid sign that there's been a previous handshake
1546                          * in this connection is if s->s3->tmp.finish_md_len >
1547                          * 0.  (We are talking about a check that will happen
1548                          * in the Hello protocol round, well before a new
1549                          * Finished message could have been computed.) */
1550                         s->s3->next_proto_neg_seen = 1;
1551                 }
1552                 else if (type ==
1553                     TLSEXT_TYPE_application_layer_protocol_negotiation &&
1554                     s->ctx->alpn_select_cb != NULL &&
1555                     s->s3->tmp.finish_md_len == 0) {
1556                         if (tls1_alpn_handle_client_hello(s, data,
1557                             size, al) != 1)
1558                                 return (0);
1559                         /* ALPN takes precedence over NPN. */
1560                         s->s3->next_proto_neg_seen = 0;
1561                 }
1562
1563                 /* session ticket processed earlier */
1564 #ifndef OPENSSL_NO_SRTP
1565                 else if (SSL_IS_DTLS(s) && type == TLSEXT_TYPE_use_srtp) {
1566                         if (ssl_parse_clienthello_use_srtp_ext(s, data, size, al))
1567                                 return 0;
1568                 }
1569 #endif
1570
1571                 data += size;
1572         }
1573
1574         *p = data;
1575
1576 ri_check:
1577
1578         /* Need RI if renegotiating */
1579
1580         if (!renegotiate_seen && s->renegotiate) {
1581                 *al = SSL_AD_HANDSHAKE_FAILURE;
1582                 SSLerr(SSL_F_SSL_PARSE_CLIENTHELLO_TLSEXT,
1583                     SSL_R_UNSAFE_LEGACY_RENEGOTIATION_DISABLED);
1584                 return 0;
1585         }
1586
1587         return 1;
1588 }
1589
1590 /*
1591  * ssl_next_proto_validate validates a Next Protocol Negotiation block. No
1592  * elements of zero length are allowed and the set of elements must exactly fill
1593  * the length of the block.
1594  */
1595 static char
1596 ssl_next_proto_validate(const unsigned char *d, unsigned int len)
1597 {
1598         CBS npn, value;
1599
1600         CBS_init(&npn, d, len);
1601         while (CBS_len(&npn) > 0) {
1602                 if (!CBS_get_u8_length_prefixed(&npn, &value) ||
1603                     CBS_len(&value) == 0)
1604                         return 0;
1605         }
1606         return 1;
1607 }
1608
1609 int
1610 ssl_parse_serverhello_tlsext(SSL *s, unsigned char **p, unsigned char *d,
1611     int n, int *al)
1612 {
1613         unsigned short length;
1614         unsigned short type;
1615         unsigned short size;
1616         unsigned char *data = *p;
1617         int tlsext_servername = 0;
1618         int renegotiate_seen = 0;
1619
1620         s->s3->next_proto_neg_seen = 0;
1621         free(s->s3->alpn_selected);
1622         s->s3->alpn_selected = NULL;
1623
1624         if (data >= (d + n - 2))
1625                 goto ri_check;
1626
1627         n2s(data, length);
1628         if (data + length != d + n) {
1629                 *al = SSL_AD_DECODE_ERROR;
1630                 return 0;
1631         }
1632
1633         while (data <= (d + n - 4)) {
1634                 n2s(data, type);
1635                 n2s(data, size);
1636
1637                 if (data + size > (d + n))
1638                         goto ri_check;
1639
1640                 if (s->tlsext_debug_cb)
1641                         s->tlsext_debug_cb(s, 1, type, data, size,
1642                             s->tlsext_debug_arg);
1643
1644                 if (type == TLSEXT_TYPE_server_name) {
1645                         if (s->tlsext_hostname == NULL || size > 0) {
1646                                 *al = TLS1_AD_UNRECOGNIZED_NAME;
1647                                 return 0;
1648                         }
1649                         tlsext_servername = 1;
1650
1651                 }
1652                 else if (type == TLSEXT_TYPE_ec_point_formats &&
1653                     s->version != DTLS1_VERSION) {
1654                         unsigned char *sdata = data;
1655                         size_t formatslen;
1656                         uint8_t *formats;
1657
1658                         if (size < 1) {
1659                                 *al = TLS1_AD_DECODE_ERROR;
1660                                 return 0;
1661                         }
1662                         formatslen = *(sdata++);
1663                         if (formatslen != size - 1) {
1664                                 *al = TLS1_AD_DECODE_ERROR;
1665                                 return 0;
1666                         }
1667
1668                         if (!s->hit) {
1669                                 free(s->session->tlsext_ecpointformatlist);
1670                                 s->session->tlsext_ecpointformatlist = NULL;
1671                                 s->session->tlsext_ecpointformatlist_length = 0;
1672
1673                                 if ((formats = reallocarray(NULL, formatslen,
1674                                     sizeof(uint8_t))) == NULL) {
1675                                         *al = TLS1_AD_INTERNAL_ERROR;
1676                                         return 0;
1677                                 }
1678                                 memcpy(formats, sdata, formatslen);
1679                                 s->session->tlsext_ecpointformatlist = formats;
1680                                 s->session->tlsext_ecpointformatlist_length =
1681                                     formatslen;
1682                         }
1683                 }
1684                 else if (type == TLSEXT_TYPE_session_ticket) {
1685                         if (s->tls_session_ticket_ext_cb &&
1686                             !s->tls_session_ticket_ext_cb(s, data, size, s->tls_session_ticket_ext_cb_arg)) {
1687                                 *al = TLS1_AD_INTERNAL_ERROR;
1688                                 return 0;
1689                         }
1690                         if ((SSL_get_options(s) & SSL_OP_NO_TICKET) || (size > 0)) {
1691                                 *al = TLS1_AD_UNSUPPORTED_EXTENSION;
1692                                 return 0;
1693                         }
1694                         s->tlsext_ticket_expected = 1;
1695                 }
1696                 else if (type == TLSEXT_TYPE_status_request &&
1697                     s->version != DTLS1_VERSION) {
1698                         /* MUST be empty and only sent if we've requested
1699                          * a status request message.
1700                          */
1701                         if ((s->tlsext_status_type == -1) || (size > 0)) {
1702                                 *al = TLS1_AD_UNSUPPORTED_EXTENSION;
1703                                 return 0;
1704                         }
1705                         /* Set flag to expect CertificateStatus message */
1706                         s->tlsext_status_expected = 1;
1707                 }
1708                 else if (type == TLSEXT_TYPE_next_proto_neg &&
1709                     s->s3->tmp.finish_md_len == 0) {
1710                         unsigned char *selected;
1711                         unsigned char selected_len;
1712
1713                         /* We must have requested it. */
1714                         if (s->ctx->next_proto_select_cb == NULL) {
1715                                 *al = TLS1_AD_UNSUPPORTED_EXTENSION;
1716                                 return 0;
1717                         }
1718                         /* The data must be valid */
1719                         if (!ssl_next_proto_validate(data, size)) {
1720                                 *al = TLS1_AD_DECODE_ERROR;
1721                                 return 0;
1722                         }
1723                         if (s->ctx->next_proto_select_cb(s, &selected, &selected_len, data, size, s->ctx->next_proto_select_cb_arg) != SSL_TLSEXT_ERR_OK) {
1724                                 *al = TLS1_AD_INTERNAL_ERROR;
1725                                 return 0;
1726                         }
1727                         s->next_proto_negotiated = malloc(selected_len);
1728                         if (!s->next_proto_negotiated) {
1729                                 *al = TLS1_AD_INTERNAL_ERROR;
1730                                 return 0;
1731                         }
1732                         memcpy(s->next_proto_negotiated, selected, selected_len);
1733                         s->next_proto_negotiated_len = selected_len;
1734                         s->s3->next_proto_neg_seen = 1;
1735                 }
1736                 else if (type ==
1737                     TLSEXT_TYPE_application_layer_protocol_negotiation) {
1738                         unsigned int len;
1739
1740                         /* We must have requested it. */
1741                         if (s->alpn_client_proto_list == NULL) {
1742                                 *al = TLS1_AD_UNSUPPORTED_EXTENSION;
1743                                 return 0;
1744                         }
1745                         if (size < 4) {
1746                                 *al = TLS1_AD_DECODE_ERROR;
1747                                 return (0);
1748                         }
1749
1750                         /* The extension data consists of:
1751                          *   uint16 list_length
1752                          *   uint8 proto_length;
1753                          *   uint8 proto[proto_length]; */
1754                         len = ((unsigned int)data[0]) << 8 |
1755                             ((unsigned int)data[1]);
1756                         if (len != (unsigned int)size - 2) {
1757                                 *al = TLS1_AD_DECODE_ERROR;
1758                                 return (0);
1759                         }
1760                         len = data[2];
1761                         if (len != (unsigned int)size - 3) {
1762                                 *al = TLS1_AD_DECODE_ERROR;
1763                                 return (0);
1764                         }
1765                         free(s->s3->alpn_selected);
1766                         s->s3->alpn_selected = malloc(len);
1767                         if (s->s3->alpn_selected == NULL) {
1768                                 *al = TLS1_AD_INTERNAL_ERROR;
1769                                 return (0);
1770                         }
1771                         memcpy(s->s3->alpn_selected, data + 3, len);
1772                         s->s3->alpn_selected_len = len;
1773
1774                 } else if (type == TLSEXT_TYPE_renegotiate) {
1775                         if (!ssl_parse_serverhello_renegotiate_ext(s, data, size, al))
1776                                 return 0;
1777                         renegotiate_seen = 1;
1778                 }
1779 #ifndef OPENSSL_NO_SRTP
1780                 else if (SSL_IS_DTLS(s) && type == TLSEXT_TYPE_use_srtp) {
1781                         if (ssl_parse_serverhello_use_srtp_ext(s, data,
1782                             size, al))
1783                                 return 0;
1784                 }
1785 #endif
1786
1787                 data += size;
1788
1789         }
1790
1791         if (data != d + n) {
1792                 *al = SSL_AD_DECODE_ERROR;
1793                 return 0;
1794         }
1795
1796         if (!s->hit && tlsext_servername == 1) {
1797                 if (s->tlsext_hostname) {
1798                         if (s->session->tlsext_hostname == NULL) {
1799                                 s->session->tlsext_hostname =
1800                                     strdup(s->tlsext_hostname);
1801
1802                                 if (!s->session->tlsext_hostname) {
1803                                         *al = SSL_AD_UNRECOGNIZED_NAME;
1804                                         return 0;
1805                                 }
1806                         } else {
1807                                 *al = SSL_AD_DECODE_ERROR;
1808                                 return 0;
1809                         }
1810                 }
1811         }
1812
1813         *p = data;
1814
1815 ri_check:
1816
1817         /* Determine if we need to see RI. Strictly speaking if we want to
1818          * avoid an attack we should *always* see RI even on initial server
1819          * hello because the client doesn't see any renegotiation during an
1820          * attack. However this would mean we could not connect to any server
1821          * which doesn't support RI so for the immediate future tolerate RI
1822          * absence on initial connect only.
1823          */
1824         if (!renegotiate_seen && !(s->options & SSL_OP_LEGACY_SERVER_CONNECT)) {
1825                 *al = SSL_AD_HANDSHAKE_FAILURE;
1826                 SSLerr(SSL_F_SSL_PARSE_SERVERHELLO_TLSEXT,
1827                     SSL_R_UNSAFE_LEGACY_RENEGOTIATION_DISABLED);
1828                 return 0;
1829         }
1830
1831         return 1;
1832 }
1833
1834 int
1835 ssl_check_clienthello_tlsext_early(SSL *s)
1836 {
1837         int ret = SSL_TLSEXT_ERR_NOACK;
1838         int al = SSL_AD_UNRECOGNIZED_NAME;
1839
1840         /* The handling of the ECPointFormats extension is done elsewhere, namely in
1841          * ssl3_choose_cipher in s3_lib.c.
1842          */
1843         /* The handling of the EllipticCurves extension is done elsewhere, namely in
1844          * ssl3_choose_cipher in s3_lib.c.
1845          */
1846
1847         if (s->ctx != NULL && s->ctx->tlsext_servername_callback != 0)
1848                 ret = s->ctx->tlsext_servername_callback(s, &al, s->ctx->tlsext_servername_arg);
1849         else if (s->initial_ctx != NULL && s->initial_ctx->tlsext_servername_callback != 0)
1850                 ret = s->initial_ctx->tlsext_servername_callback(s, &al, s->initial_ctx->tlsext_servername_arg);
1851
1852         switch (ret) {
1853         case SSL_TLSEXT_ERR_ALERT_FATAL:
1854                 ssl3_send_alert(s, SSL3_AL_FATAL, al);
1855                 return -1;
1856         case SSL_TLSEXT_ERR_ALERT_WARNING:
1857                 ssl3_send_alert(s, SSL3_AL_WARNING, al);
1858                 return 1;
1859         case SSL_TLSEXT_ERR_NOACK:
1860                 s->servername_done = 0;
1861         default:
1862                 return 1;
1863         }
1864 }
1865
1866 int
1867 ssl_check_clienthello_tlsext_late(SSL *s)
1868 {
1869         int ret = SSL_TLSEXT_ERR_OK;
1870         int al = 0;     /* XXX gcc3 */
1871
1872         /* If status request then ask callback what to do.
1873          * Note: this must be called after servername callbacks in case
1874          * the certificate has changed, and must be called after the cipher
1875          * has been chosen because this may influence which certificate is sent
1876          */
1877         if ((s->tlsext_status_type != -1) &&
1878             s->ctx && s->ctx->tlsext_status_cb) {
1879                 int r;
1880                 CERT_PKEY *certpkey;
1881                 certpkey = ssl_get_server_send_pkey(s);
1882                 /* If no certificate can't return certificate status */
1883                 if (certpkey == NULL) {
1884                         s->tlsext_status_expected = 0;
1885                         return 1;
1886                 }
1887                 /* Set current certificate to one we will use so
1888                  * SSL_get_certificate et al can pick it up.
1889                  */
1890                 s->cert->key = certpkey;
1891                 r = s->ctx->tlsext_status_cb(s, s->ctx->tlsext_status_arg);
1892                 switch (r) {
1893                         /* We don't want to send a status request response */
1894                 case SSL_TLSEXT_ERR_NOACK:
1895                         s->tlsext_status_expected = 0;
1896                         break;
1897                         /* status request response should be sent */
1898                 case SSL_TLSEXT_ERR_OK:
1899                         if (s->tlsext_ocsp_resp)
1900                                 s->tlsext_status_expected = 1;
1901                         else
1902                                 s->tlsext_status_expected = 0;
1903                         break;
1904                         /* something bad happened */
1905                 case SSL_TLSEXT_ERR_ALERT_FATAL:
1906                         ret = SSL_TLSEXT_ERR_ALERT_FATAL;
1907                         al = SSL_AD_INTERNAL_ERROR;
1908                         goto err;
1909                 }
1910         } else
1911                 s->tlsext_status_expected = 0;
1912
1913 err:
1914         switch (ret) {
1915         case SSL_TLSEXT_ERR_ALERT_FATAL:
1916                 ssl3_send_alert(s, SSL3_AL_FATAL, al);
1917                 return -1;
1918         case SSL_TLSEXT_ERR_ALERT_WARNING:
1919                 ssl3_send_alert(s, SSL3_AL_WARNING, al);
1920                 return 1;
1921         default:
1922                 return 1;
1923         }
1924 }
1925
1926 int
1927 ssl_check_serverhello_tlsext(SSL *s)
1928 {
1929         int ret = SSL_TLSEXT_ERR_NOACK;
1930         int al = SSL_AD_UNRECOGNIZED_NAME;
1931
1932         /* If we are client and using an elliptic curve cryptography cipher
1933          * suite, then if server returns an EC point formats lists extension
1934          * it must contain uncompressed.
1935          */
1936         unsigned long alg_k = s->s3->tmp.new_cipher->algorithm_mkey;
1937         unsigned long alg_a = s->s3->tmp.new_cipher->algorithm_auth;
1938         if ((s->tlsext_ecpointformatlist != NULL) &&
1939             (s->tlsext_ecpointformatlist_length > 0) &&
1940             (s->session->tlsext_ecpointformatlist != NULL) &&
1941             (s->session->tlsext_ecpointformatlist_length > 0) &&
1942             ((alg_k & (SSL_kECDHE|SSL_kECDHr|SSL_kECDHe)) || (alg_a & SSL_aECDSA))) {
1943                 /* we are using an ECC cipher */
1944                 size_t i;
1945                 unsigned char *list;
1946                 int found_uncompressed = 0;
1947                 list = s->session->tlsext_ecpointformatlist;
1948                 for (i = 0; i < s->session->tlsext_ecpointformatlist_length; i++) {
1949                         if (*(list++) == TLSEXT_ECPOINTFORMAT_uncompressed) {
1950                                 found_uncompressed = 1;
1951                                 break;
1952                         }
1953                 }
1954                 if (!found_uncompressed) {
1955                         SSLerr(SSL_F_SSL_CHECK_SERVERHELLO_TLSEXT, SSL_R_TLS_INVALID_ECPOINTFORMAT_LIST);
1956                         return -1;
1957                 }
1958         }
1959         ret = SSL_TLSEXT_ERR_OK;
1960
1961         if (s->ctx != NULL && s->ctx->tlsext_servername_callback != 0)
1962                 ret = s->ctx->tlsext_servername_callback(s, &al, s->ctx->tlsext_servername_arg);
1963         else if (s->initial_ctx != NULL && s->initial_ctx->tlsext_servername_callback != 0)
1964                 ret = s->initial_ctx->tlsext_servername_callback(s, &al, s->initial_ctx->tlsext_servername_arg);
1965
1966         /* If we've requested certificate status and we wont get one
1967          * tell the callback
1968          */
1969         if ((s->tlsext_status_type != -1) && !(s->tlsext_status_expected) &&
1970             s->ctx && s->ctx->tlsext_status_cb) {
1971                 int r;
1972                 /* Set resp to NULL, resplen to -1 so callback knows
1973                  * there is no response.
1974                  */
1975                 free(s->tlsext_ocsp_resp);
1976                 s->tlsext_ocsp_resp = NULL;
1977                 s->tlsext_ocsp_resplen = -1;
1978                 r = s->ctx->tlsext_status_cb(s, s->ctx->tlsext_status_arg);
1979                 if (r == 0) {
1980                         al = SSL_AD_BAD_CERTIFICATE_STATUS_RESPONSE;
1981                         ret = SSL_TLSEXT_ERR_ALERT_FATAL;
1982                 }
1983                 if (r < 0) {
1984                         al = SSL_AD_INTERNAL_ERROR;
1985                         ret = SSL_TLSEXT_ERR_ALERT_FATAL;
1986                 }
1987         }
1988
1989         switch (ret) {
1990         case SSL_TLSEXT_ERR_ALERT_FATAL:
1991                 ssl3_send_alert(s, SSL3_AL_FATAL, al);
1992
1993                 return -1;
1994         case SSL_TLSEXT_ERR_ALERT_WARNING:
1995                 ssl3_send_alert(s, SSL3_AL_WARNING, al);
1996
1997                 return 1;
1998         case SSL_TLSEXT_ERR_NOACK:
1999                 s->servername_done = 0;
2000         default:
2001                 return 1;
2002         }
2003 }
2004
2005 /* Since the server cache lookup is done early on in the processing of the
2006  * ClientHello, and other operations depend on the result, we need to handle
2007  * any TLS session ticket extension at the same time.
2008  *
2009  *   session_id: points at the session ID in the ClientHello. This code will
2010  *       read past the end of this in order to parse out the session ticket
2011  *       extension, if any.
2012  *   len: the length of the session ID.
2013  *   limit: a pointer to the first byte after the ClientHello.
2014  *   ret: (output) on return, if a ticket was decrypted, then this is set to
2015  *       point to the resulting session.
2016  *
2017  * If s->tls_session_secret_cb is set then we are expecting a pre-shared key
2018  * ciphersuite, in which case we have no use for session tickets and one will
2019  * never be decrypted, nor will s->tlsext_ticket_expected be set to 1.
2020  *
2021  * Returns:
2022  *   -1: fatal error, either from parsing or decrypting the ticket.
2023  *    0: no ticket was found (or was ignored, based on settings).
2024  *    1: a zero length extension was found, indicating that the client supports
2025  *       session tickets but doesn't currently have one to offer.
2026  *    2: either s->tls_session_secret_cb was set, or a ticket was offered but
2027  *       couldn't be decrypted because of a non-fatal error.
2028  *    3: a ticket was successfully decrypted and *ret was set.
2029  *
2030  * Side effects:
2031  *   Sets s->tlsext_ticket_expected to 1 if the server will have to issue
2032  *   a new session ticket to the client because the client indicated support
2033  *   (and s->tls_session_secret_cb is NULL) but the client either doesn't have
2034  *   a session ticket or we couldn't use the one it gave us, or if
2035  *   s->ctx->tlsext_ticket_key_cb asked to renew the client's ticket.
2036  *   Otherwise, s->tlsext_ticket_expected is set to 0.
2037  */
2038 int
2039 tls1_process_ticket(SSL *s, const unsigned char *session, int session_len,
2040     const unsigned char *limit, SSL_SESSION **ret)
2041 {
2042         /* Point after session ID in client hello */
2043         CBS session_id, cookie, cipher_list, compress_algo, extensions;
2044
2045         *ret = NULL;
2046         s->tlsext_ticket_expected = 0;
2047
2048         /* If tickets disabled behave as if no ticket present
2049          * to permit stateful resumption.
2050          */
2051         if (SSL_get_options(s) & SSL_OP_NO_TICKET)
2052                 return 0;
2053         if (!limit)
2054                 return 0;
2055
2056         if (limit < session)
2057                 return -1;
2058
2059         CBS_init(&session_id, session, limit - session);
2060
2061         /* Skip past the session id */
2062         if (!CBS_skip(&session_id, session_len))
2063                 return -1;
2064
2065         /* Skip past DTLS cookie */
2066         if (SSL_IS_DTLS(s)) {
2067                 if (!CBS_get_u8_length_prefixed(&session_id, &cookie))
2068                         return -1;
2069         }
2070
2071         /* Skip past cipher list */
2072         if (!CBS_get_u16_length_prefixed(&session_id, &cipher_list))
2073                 return -1;
2074
2075         /* Skip past compression algorithm list */
2076         if (!CBS_get_u8_length_prefixed(&session_id, &compress_algo))
2077                 return -1;
2078
2079         /* Now at start of extensions */
2080         if (CBS_len(&session_id) == 0)
2081                 return 0;
2082         if (!CBS_get_u16_length_prefixed(&session_id, &extensions))
2083                 return -1;
2084
2085         while (CBS_len(&extensions) > 0) {
2086                 CBS ext_data;
2087                 uint16_t ext_type;
2088
2089                 if (!CBS_get_u16(&extensions, &ext_type) ||
2090                     !CBS_get_u16_length_prefixed(&extensions, &ext_data))
2091                         return -1;
2092
2093                 if (ext_type == TLSEXT_TYPE_session_ticket) {
2094                         int r;
2095                         if (CBS_len(&ext_data) == 0) {
2096                                 /* The client will accept a ticket but doesn't
2097                                  * currently have one. */
2098                                 s->tlsext_ticket_expected = 1;
2099                                 return 1;
2100                         }
2101                         if (s->tls_session_secret_cb) {
2102                                 /* Indicate that the ticket couldn't be
2103                                  * decrypted rather than generating the session
2104                                  * from ticket now, trigger abbreviated
2105                                  * handshake based on external mechanism to
2106                                  * calculate the master secret later. */
2107                                 return 2;
2108                         }
2109
2110                         r = tls_decrypt_ticket(s, CBS_data(&ext_data),
2111                             CBS_len(&ext_data), session, session_len, ret);
2112
2113                         switch (r) {
2114                         case 2: /* ticket couldn't be decrypted */
2115                                 s->tlsext_ticket_expected = 1;
2116                                 return 2;
2117                         case 3: /* ticket was decrypted */
2118                                 return r;
2119                         case 4: /* ticket decrypted but need to renew */
2120                                 s->tlsext_ticket_expected = 1;
2121                                 return 3;
2122                         default: /* fatal error */
2123                                 return -1;
2124                         }
2125                 }
2126         }
2127         return 0;
2128 }
2129
2130 /* tls_decrypt_ticket attempts to decrypt a session ticket.
2131  *
2132  *   etick: points to the body of the session ticket extension.
2133  *   eticklen: the length of the session tickets extenion.
2134  *   sess_id: points at the session ID.
2135  *   sesslen: the length of the session ID.
2136  *   psess: (output) on return, if a ticket was decrypted, then this is set to
2137  *       point to the resulting session.
2138  *
2139  * Returns:
2140  *   -1: fatal error, either from parsing or decrypting the ticket.
2141  *    2: the ticket couldn't be decrypted.
2142  *    3: a ticket was successfully decrypted and *psess was set.
2143  *    4: same as 3, but the ticket needs to be renewed.
2144  */
2145 static int
2146 tls_decrypt_ticket(SSL *s, const unsigned char *etick, int eticklen,
2147     const unsigned char *sess_id, int sesslen, SSL_SESSION **psess)
2148 {
2149         SSL_SESSION *sess;
2150         unsigned char *sdec;
2151         const unsigned char *p;
2152         int slen, mlen, renew_ticket = 0;
2153         unsigned char tick_hmac[EVP_MAX_MD_SIZE];
2154         HMAC_CTX hctx;
2155         EVP_CIPHER_CTX ctx;
2156         SSL_CTX *tctx = s->initial_ctx;
2157         /* Need at least keyname + iv + some encrypted data */
2158         if (eticklen < 48)
2159                 return 2;
2160         /* Initialize session ticket encryption and HMAC contexts */
2161         HMAC_CTX_init(&hctx);
2162         EVP_CIPHER_CTX_init(&ctx);
2163         if (tctx->tlsext_ticket_key_cb) {
2164                 unsigned char *nctick = (unsigned char *)etick;
2165                 int rv = tctx->tlsext_ticket_key_cb(s, nctick, nctick + 16,
2166                     &ctx, &hctx, 0);
2167                 if (rv < 0) {
2168                         EVP_CIPHER_CTX_cleanup(&ctx);
2169                         return -1;
2170                 }
2171                 if (rv == 0) {
2172                         EVP_CIPHER_CTX_cleanup(&ctx);
2173                         return 2;
2174                 }
2175                 if (rv == 2)
2176                         renew_ticket = 1;
2177         } else {
2178                 /* Check key name matches */
2179                 if (timingsafe_memcmp(etick, tctx->tlsext_tick_key_name, 16))
2180                         return 2;
2181                 HMAC_Init_ex(&hctx, tctx->tlsext_tick_hmac_key, 16,
2182                     tlsext_tick_md(), NULL);
2183                 EVP_DecryptInit_ex(&ctx, EVP_aes_128_cbc(), NULL,
2184                     tctx->tlsext_tick_aes_key, etick + 16);
2185         }
2186         /* Attempt to process session ticket, first conduct sanity and
2187          * integrity checks on ticket.
2188          */
2189         mlen = HMAC_size(&hctx);
2190         if (mlen < 0) {
2191                 EVP_CIPHER_CTX_cleanup(&ctx);
2192                 return -1;
2193         }
2194         eticklen -= mlen;
2195         /* Check HMAC of encrypted ticket */
2196         HMAC_Update(&hctx, etick, eticklen);
2197         HMAC_Final(&hctx, tick_hmac, NULL);
2198         HMAC_CTX_cleanup(&hctx);
2199         if (timingsafe_memcmp(tick_hmac, etick + eticklen, mlen)) {
2200                 EVP_CIPHER_CTX_cleanup(&ctx);
2201                 return 2;
2202         }
2203         /* Attempt to decrypt session data */
2204         /* Move p after IV to start of encrypted ticket, update length */
2205         p = etick + 16 + EVP_CIPHER_CTX_iv_length(&ctx);
2206         eticklen -= 16 + EVP_CIPHER_CTX_iv_length(&ctx);
2207         sdec = malloc(eticklen);
2208         if (!sdec) {
2209                 EVP_CIPHER_CTX_cleanup(&ctx);
2210                 return -1;
2211         }
2212         EVP_DecryptUpdate(&ctx, sdec, &slen, p, eticklen);
2213         if (EVP_DecryptFinal_ex(&ctx, sdec + slen, &mlen) <= 0) {
2214                 free(sdec);
2215                 EVP_CIPHER_CTX_cleanup(&ctx);
2216                 return 2;
2217         }
2218         slen += mlen;
2219         EVP_CIPHER_CTX_cleanup(&ctx);
2220         p = sdec;
2221
2222         sess = d2i_SSL_SESSION(NULL, &p, slen);
2223         free(sdec);
2224         if (sess) {
2225                 /* The session ID, if non-empty, is used by some clients to
2226                  * detect that the ticket has been accepted. So we copy it to
2227                  * the session structure. If it is empty set length to zero
2228                  * as required by standard.
2229                  */
2230                 if (sesslen)
2231                         memcpy(sess->session_id, sess_id, sesslen);
2232                 sess->session_id_length = sesslen;
2233                 *psess = sess;
2234                 if (renew_ticket)
2235                         return 4;
2236                 else
2237                         return 3;
2238         }
2239         ERR_clear_error();
2240         /* For session parse failure, indicate that we need to send a new
2241          * ticket. */
2242         return 2;
2243 }
2244
2245 /* Tables to translate from NIDs to TLS v1.2 ids */
2246
2247 typedef struct {
2248         int nid;
2249         int id;
2250 } tls12_lookup;
2251
2252 static tls12_lookup tls12_md[] = {
2253         {NID_md5, TLSEXT_hash_md5},
2254         {NID_sha1, TLSEXT_hash_sha1},
2255         {NID_sha224, TLSEXT_hash_sha224},
2256         {NID_sha256, TLSEXT_hash_sha256},
2257         {NID_sha384, TLSEXT_hash_sha384},
2258         {NID_sha512, TLSEXT_hash_sha512},
2259         {NID_id_GostR3411_94, TLSEXT_hash_gost94},
2260         {NID_id_tc26_gost3411_2012_256, TLSEXT_hash_streebog_256},
2261         {NID_id_tc26_gost3411_2012_512, TLSEXT_hash_streebog_512}
2262 };
2263
2264 static tls12_lookup tls12_sig[] = {
2265         {EVP_PKEY_RSA, TLSEXT_signature_rsa},
2266         {EVP_PKEY_DSA, TLSEXT_signature_dsa},
2267         {EVP_PKEY_EC, TLSEXT_signature_ecdsa},
2268         {EVP_PKEY_GOSTR01, TLSEXT_signature_gostr01},
2269 };
2270
2271 static int
2272 tls12_find_id(int nid, tls12_lookup *table, size_t tlen)
2273 {
2274         size_t i;
2275         for (i = 0; i < tlen; i++) {
2276                 if (table[i].nid == nid)
2277                         return table[i].id;
2278         }
2279         return -1;
2280 }
2281
2282 int
2283 tls12_get_sigandhash(unsigned char *p, const EVP_PKEY *pk, const EVP_MD *md)
2284 {
2285         int sig_id, md_id;
2286         if (!md)
2287                 return 0;
2288         md_id = tls12_find_id(EVP_MD_type(md), tls12_md,
2289             sizeof(tls12_md) / sizeof(tls12_lookup));
2290         if (md_id == -1)
2291                 return 0;
2292         sig_id = tls12_get_sigid(pk);
2293         if (sig_id == -1)
2294                 return 0;
2295         p[0] = (unsigned char)md_id;
2296         p[1] = (unsigned char)sig_id;
2297         return 1;
2298 }
2299
2300 int
2301 tls12_get_sigid(const EVP_PKEY *pk)
2302 {
2303         return tls12_find_id(pk->type, tls12_sig,
2304             sizeof(tls12_sig) / sizeof(tls12_lookup));
2305 }
2306
2307 const EVP_MD *
2308 tls12_get_hash(unsigned char hash_alg)
2309 {
2310         switch (hash_alg) {
2311         case TLSEXT_hash_sha1:
2312                 return EVP_sha1();
2313         case TLSEXT_hash_sha224:
2314                 return EVP_sha224();
2315         case TLSEXT_hash_sha256:
2316                 return EVP_sha256();
2317         case TLSEXT_hash_sha384:
2318                 return EVP_sha384();
2319         case TLSEXT_hash_sha512:
2320                 return EVP_sha512();
2321 #ifndef OPENSSL_NO_GOST
2322         case TLSEXT_hash_gost94:
2323                 return EVP_gostr341194();
2324         case TLSEXT_hash_streebog_256:
2325                 return EVP_streebog256();
2326         case TLSEXT_hash_streebog_512:
2327                 return EVP_streebog512();
2328 #endif
2329         default:
2330                 return NULL;
2331         }
2332 }
2333
2334 /* Set preferred digest for each key type */
2335
2336 int
2337 tls1_process_sigalgs(SSL *s, const unsigned char *data, int dsize)
2338 {
2339         int idx;
2340         const EVP_MD *md;
2341         CERT *c = s->cert;
2342         CBS cbs;
2343
2344         /* Extension ignored for inappropriate versions */
2345         if (!SSL_USE_SIGALGS(s))
2346                 return 1;
2347
2348         /* Should never happen */
2349         if (!c || dsize < 0)
2350                 return 0;
2351
2352         CBS_init(&cbs, data, dsize);
2353
2354         c->pkeys[SSL_PKEY_DSA_SIGN].digest = NULL;
2355         c->pkeys[SSL_PKEY_RSA_SIGN].digest = NULL;
2356         c->pkeys[SSL_PKEY_RSA_ENC].digest = NULL;
2357         c->pkeys[SSL_PKEY_ECC].digest = NULL;
2358         c->pkeys[SSL_PKEY_GOST01].digest = NULL;
2359
2360         while (CBS_len(&cbs) > 0) {
2361                 uint8_t hash_alg, sig_alg;
2362
2363                 if (!CBS_get_u8(&cbs, &hash_alg) ||
2364                     !CBS_get_u8(&cbs, &sig_alg)) {
2365                         /* Should never happen */
2366                         return 0;
2367                 }
2368
2369                 switch (sig_alg) {
2370                 case TLSEXT_signature_rsa:
2371                         idx = SSL_PKEY_RSA_SIGN;
2372                         break;
2373                 case TLSEXT_signature_dsa:
2374                         idx = SSL_PKEY_DSA_SIGN;
2375                         break;
2376                 case TLSEXT_signature_ecdsa:
2377                         idx = SSL_PKEY_ECC;
2378                         break;
2379                 case TLSEXT_signature_gostr01:
2380                 case TLSEXT_signature_gostr12_256:
2381                 case TLSEXT_signature_gostr12_512:
2382                         idx = SSL_PKEY_GOST01;
2383                         break;
2384                 default:
2385                         continue;
2386                 }
2387
2388                 if (c->pkeys[idx].digest == NULL) {
2389                         md = tls12_get_hash(hash_alg);
2390                         if (md) {
2391                                 c->pkeys[idx].digest = md;
2392                                 if (idx == SSL_PKEY_RSA_SIGN)
2393                                         c->pkeys[SSL_PKEY_RSA_ENC].digest = md;
2394                         }
2395                 }
2396
2397         }
2398
2399         /* Set any remaining keys to default values. NOTE: if alg is not
2400          * supported it stays as NULL.
2401          */
2402         if (!c->pkeys[SSL_PKEY_DSA_SIGN].digest)
2403                 c->pkeys[SSL_PKEY_DSA_SIGN].digest = EVP_sha1();
2404         if (!c->pkeys[SSL_PKEY_RSA_SIGN].digest) {
2405                 c->pkeys[SSL_PKEY_RSA_SIGN].digest = EVP_sha1();
2406                 c->pkeys[SSL_PKEY_RSA_ENC].digest = EVP_sha1();
2407         }
2408         if (!c->pkeys[SSL_PKEY_ECC].digest)
2409                 c->pkeys[SSL_PKEY_ECC].digest = EVP_sha1();
2410 #ifndef OPENSSL_NO_GOST
2411         if (!c->pkeys[SSL_PKEY_GOST01].digest)
2412                 c->pkeys[SSL_PKEY_GOST01].digest = EVP_gostr341194();
2413 #endif
2414         return 1;
2415 }