crypto/openssl/ssl/t1_lib.c

   1 /* ssl/t1_lib.c */
   2 /* Copyright (C) 1995-1998 Eric Young (eay@cryptsoft.com)
   3  * All rights reserved.
   4  *
   5  * This package is an SSL implementation written
   6  * by Eric Young (eay@cryptsoft.com).
   7  * The implementation was written so as to conform with Netscapes SSL.
   8  *
   9  * This library is free for commercial and non-commercial use as long as
  10  * the following conditions are aheared to.  The following conditions
  11  * apply to all code found in this distribution, be it the RC4, RSA,
  12  * lhash, DES, etc., code; not just the SSL code.  The SSL documentation
  13  * included with this distribution is covered by the same copyright terms
  14  * except that the holder is Tim Hudson (tjh@cryptsoft.com).
  15  *
  16  * Copyright remains Eric Young's, and as such any Copyright notices in
  17  * the code are not to be removed.
  18  * If this package is used in a product, Eric Young should be given attribution
  19  * as the author of the parts of the library used.
  20  * This can be in the form of a textual message at program startup or
  21  * in documentation (online or textual) provided with the package.
  22  *
  23  * Redistribution and use in source and binary forms, with or without
  24  * modification, are permitted provided that the following conditions
  25  * are met:
  26  * 1. Redistributions of source code must retain the copyright
  27  *    notice, this list of conditions and the following disclaimer.
  28  * 2. Redistributions in binary form must reproduce the above copyright
  29  *    notice, this list of conditions and the following disclaimer in the
  30  *    documentation and/or other materials provided with the distribution.
  31  * 3. All advertising materials mentioning features or use of this software
  32  *    must display the following acknowledgement:
  33  *    "This product includes cryptographic software written by
  34  *     Eric Young (eay@cryptsoft.com)"
  35  *    The word 'cryptographic' can be left out if the rouines from the library
  36  *    being used are not cryptographic related :-).
  37  * 4. If you include any Windows specific code (or a derivative thereof) from
  38  *    the apps directory (application code) you must include an acknowledgement:
  39  *    "This product includes software written by Tim Hudson (tjh@cryptsoft.com)"
  40  *
  41  * THIS SOFTWARE IS PROVIDED BY ERIC YOUNG ``AS IS'' AND
  42  * ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
  43  * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE
  44  * ARE DISCLAIMED.  IN NO EVENT SHALL THE AUTHOR OR CONTRIBUTORS BE LIABLE
  45  * FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL
  46  * DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS
  47  * OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION)
  48  * HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT
  49  * LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY
  50  * OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF
  51  * SUCH DAMAGE.
  52  *
  53  * The licence and distribution terms for any publically available version or
  54  * derivative of this code cannot be changed.  i.e. this code cannot simply be
  55  * copied and put under another distribution licence
  56  * [including the GNU Public Licence.]
  57  */
  58 /* ====================================================================
  59  * Copyright (c) 1998-2007 The OpenSSL Project.  All rights reserved.
  60  *
  61  * Redistribution and use in source and binary forms, with or without
  62  * modification, are permitted provided that the following conditions
  63  * are met:
  64  *
  65  * 1. Redistributions of source code must retain the above copyright
  66  *    notice, this list of conditions and the following disclaimer.
  67  *
  68  * 2. Redistributions in binary form must reproduce the above copyright
  69  *    notice, this list of conditions and the following disclaimer in
  70  *    the documentation and/or other materials provided with the
  71  *    distribution.
  72  *
  73  * 3. All advertising materials mentioning features or use of this
  74  *    software must display the following acknowledgment:
  75  *    "This product includes software developed by the OpenSSL Project
  76  *    for use in the OpenSSL Toolkit. (http://www.openssl.org/)"
  77  *
  78  * 4. The names "OpenSSL Toolkit" and "OpenSSL Project" must not be used to
  79  *    endorse or promote products derived from this software without
  80  *    prior written permission. For written permission, please contact
  81  *    openssl-core@openssl.org.
  82  *
  83  * 5. Products derived from this software may not be called "OpenSSL"
  84  *    nor may "OpenSSL" appear in their names without prior written
  85  *    permission of the OpenSSL Project.
  86  *
  87  * 6. Redistributions of any form whatsoever must retain the following
  88  *    acknowledgment:
  89  *    "This product includes software developed by the OpenSSL Project
  90  *    for use in the OpenSSL Toolkit (http://www.openssl.org/)"
  91  *
  92  * THIS SOFTWARE IS PROVIDED BY THE OpenSSL PROJECT ``AS IS'' AND ANY
  93  * EXPRESSED OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
  94  * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
  95  * PURPOSE ARE DISCLAIMED.  IN NO EVENT SHALL THE OpenSSL PROJECT OR
  96  * ITS CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL,
  97  * SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT
  98  * NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES;
  99  * LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION)
 100  * HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT,
 101  * STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE)
 102  * ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED
 103  * OF THE POSSIBILITY OF SUCH DAMAGE.
 104  * ====================================================================
 105  *
 106  * This product includes cryptographic software written by Eric Young
 107  * (eay@cryptsoft.com).  This product includes software written by Tim
 108  * Hudson (tjh@cryptsoft.com).
 109  *
 110  */
 111
 112 #include <stdio.h>
 113 #include <openssl/objects.h>
 114 #include <openssl/evp.h>
 115 #include <openssl/hmac.h>
 116 #include <openssl/ocsp.h>
 117 #include <openssl/rand.h>
 118 #include "ssl_locl.h"
 119
 120 const char tls1_version_str[]="TLSv1" OPENSSL_VERSION_PTEXT;
 121
 122 #ifndef OPENSSL_NO_TLSEXT
 123 static int tls_decrypt_ticket(SSL *s, const unsigned char *tick, int ticklen,
 124                                 const unsigned char *sess_id, int sesslen,
 125                                 SSL_SESSION **psess);
 126 #endif
 127
 128 SSL3_ENC_METHOD TLSv1_enc_data={
 129         tls1_enc,
 130         tls1_mac,
 131         tls1_setup_key_block,
 132         tls1_generate_master_secret,
 133         tls1_change_cipher_state,
 134         tls1_final_finish_mac,
 135         TLS1_FINISH_MAC_LENGTH,
 136         tls1_cert_verify_mac,
 137         TLS_MD_CLIENT_FINISH_CONST,TLS_MD_CLIENT_FINISH_CONST_SIZE,
 138         TLS_MD_SERVER_FINISH_CONST,TLS_MD_SERVER_FINISH_CONST_SIZE,
 139         tls1_alert_code,
 140         tls1_export_keying_material,
 141         };
 142
 143 long tls1_default_timeout(void)
 144         {
 145         /* 2 hours, the 24 hours mentioned in the TLSv1 spec
 146          * is way too long for http, the cache would over fill */
 147         return(60*60*2);
 148         }
 149
 150 int tls1_new(SSL *s)
 151         {
 152         if (!ssl3_new(s)) return(0);
 153         s->method->ssl_clear(s);
 154         return(1);
 155         }
 156
 157 void tls1_free(SSL *s)
 158         {
 159 #ifndef OPENSSL_NO_TLSEXT
 160         if (s->tlsext_session_ticket)
 161                 {
 162                 OPENSSL_free(s->tlsext_session_ticket);
 163                 }
 164 #endif /* OPENSSL_NO_TLSEXT */
 165         ssl3_free(s);
 166         }
 167
 168 void tls1_clear(SSL *s)
 169         {
 170         ssl3_clear(s);
 171         s->version = s->method->version;
 172         }
 173
 174 #ifndef OPENSSL_NO_EC
 175
 176 static int nid_list[] =
 177         {
 178                 NID_sect163k1, /* sect163k1 (1) */
 179                 NID_sect163r1, /* sect163r1 (2) */
 180                 NID_sect163r2, /* sect163r2 (3) */
 181                 NID_sect193r1, /* sect193r1 (4) */
 182                 NID_sect193r2, /* sect193r2 (5) */
 183                 NID_sect233k1, /* sect233k1 (6) */
 184                 NID_sect233r1, /* sect233r1 (7) */
 185                 NID_sect239k1, /* sect239k1 (8) */
 186                 NID_sect283k1, /* sect283k1 (9) */
 187                 NID_sect283r1, /* sect283r1 (10) */
 188                 NID_sect409k1, /* sect409k1 (11) */
 189                 NID_sect409r1, /* sect409r1 (12) */
 190                 NID_sect571k1, /* sect571k1 (13) */
 191                 NID_sect571r1, /* sect571r1 (14) */
 192                 NID_secp160k1, /* secp160k1 (15) */
 193                 NID_secp160r1, /* secp160r1 (16) */
 194                 NID_secp160r2, /* secp160r2 (17) */
 195                 NID_secp192k1, /* secp192k1 (18) */
 196                 NID_X9_62_prime192v1, /* secp192r1 (19) */
 197                 NID_secp224k1, /* secp224k1 (20) */
 198                 NID_secp224r1, /* secp224r1 (21) */
 199                 NID_secp256k1, /* secp256k1 (22) */
 200                 NID_X9_62_prime256v1, /* secp256r1 (23) */
 201                 NID_secp384r1, /* secp384r1 (24) */
 202                 NID_secp521r1  /* secp521r1 (25) */
 203         };
 204
 205 static int pref_list[] =
 206         {
 207                 NID_sect571r1, /* sect571r1 (14) */
 208                 NID_sect571k1, /* sect571k1 (13) */
 209                 NID_secp521r1, /* secp521r1 (25) */
 210                 NID_sect409k1, /* sect409k1 (11) */
 211                 NID_sect409r1, /* sect409r1 (12) */
 212                 NID_secp384r1, /* secp384r1 (24) */
 213                 NID_sect283k1, /* sect283k1 (9) */
 214                 NID_sect283r1, /* sect283r1 (10) */
 215                 NID_secp256k1, /* secp256k1 (22) */
 216                 NID_X9_62_prime256v1, /* secp256r1 (23) */
 217                 NID_sect239k1, /* sect239k1 (8) */
 218                 NID_sect233k1, /* sect233k1 (6) */
 219                 NID_sect233r1, /* sect233r1 (7) */
 220                 NID_secp224k1, /* secp224k1 (20) */
 221                 NID_secp224r1, /* secp224r1 (21) */
 222                 NID_sect193r1, /* sect193r1 (4) */
 223                 NID_sect193r2, /* sect193r2 (5) */
 224                 NID_secp192k1, /* secp192k1 (18) */
 225                 NID_X9_62_prime192v1, /* secp192r1 (19) */
 226                 NID_sect163k1, /* sect163k1 (1) */
 227                 NID_sect163r1, /* sect163r1 (2) */
 228                 NID_sect163r2, /* sect163r2 (3) */
 229                 NID_secp160k1, /* secp160k1 (15) */
 230                 NID_secp160r1, /* secp160r1 (16) */
 231                 NID_secp160r2, /* secp160r2 (17) */
 232         };
 233
 234 int tls1_ec_curve_id2nid(int curve_id)
 235         {
 236         /* ECC curves from draft-ietf-tls-ecc-12.txt (Oct. 17, 2005) */
 237         if ((curve_id < 1) || ((unsigned int)curve_id >
 238                                 sizeof(nid_list)/sizeof(nid_list[0])))
 239                 return 0;
 240         return nid_list[curve_id-1];
 241         }
 242
 243 int tls1_ec_nid2curve_id(int nid)
 244         {
 245         /* ECC curves from draft-ietf-tls-ecc-12.txt (Oct. 17, 2005) */
 246         switch (nid)
 247                 {
 248         case NID_sect163k1: /* sect163k1 (1) */
 249                 return 1;
 250         case NID_sect163r1: /* sect163r1 (2) */
 251                 return 2;
 252         case NID_sect163r2: /* sect163r2 (3) */
 253                 return 3;
 254         case NID_sect193r1: /* sect193r1 (4) */
 255                 return 4;
 256         case NID_sect193r2: /* sect193r2 (5) */
 257                 return 5;
 258         case NID_sect233k1: /* sect233k1 (6) */
 259                 return 6;
 260         case NID_sect233r1: /* sect233r1 (7) */
 261                 return 7;
 262         case NID_sect239k1: /* sect239k1 (8) */
 263                 return 8;
 264         case NID_sect283k1: /* sect283k1 (9) */
 265                 return 9;
 266         case NID_sect283r1: /* sect283r1 (10) */
 267                 return 10;
 268         case NID_sect409k1: /* sect409k1 (11) */
 269                 return 11;
 270         case NID_sect409r1: /* sect409r1 (12) */
 271                 return 12;
 272         case NID_sect571k1: /* sect571k1 (13) */
 273                 return 13;
 274         case NID_sect571r1: /* sect571r1 (14) */
 275                 return 14;
 276         case NID_secp160k1: /* secp160k1 (15) */
 277                 return 15;
 278         case NID_secp160r1: /* secp160r1 (16) */
 279                 return 16;
 280         case NID_secp160r2: /* secp160r2 (17) */
 281                 return 17;
 282         case NID_secp192k1: /* secp192k1 (18) */
 283                 return 18;
 284         case NID_X9_62_prime192v1: /* secp192r1 (19) */
 285                 return 19;
 286         case NID_secp224k1: /* secp224k1 (20) */
 287                 return 20;
 288         case NID_secp224r1: /* secp224r1 (21) */
 289                 return 21;
 290         case NID_secp256k1: /* secp256k1 (22) */
 291                 return 22;
 292         case NID_X9_62_prime256v1: /* secp256r1 (23) */
 293                 return 23;
 294         case NID_secp384r1: /* secp384r1 (24) */
 295                 return 24;
 296         case NID_secp521r1:  /* secp521r1 (25) */
 297                 return 25;
 298         default:
 299                 return 0;
 300                 }
 301         }
 302 #endif /* OPENSSL_NO_EC */
 303
 304 #ifndef OPENSSL_NO_TLSEXT
 305
 306 /* List of supported signature algorithms and hashes. Should make this
 307  * customisable at some point, for now include everything we support.
 308  */
 309
 310 #ifdef OPENSSL_NO_RSA
 311 #define tlsext_sigalg_rsa(md) /* */
 312 #else
 313 #define tlsext_sigalg_rsa(md) md, TLSEXT_signature_rsa,
 314 #endif
 315
 316 #ifdef OPENSSL_NO_DSA
 317 #define tlsext_sigalg_dsa(md) /* */
 318 #else
 319 #define tlsext_sigalg_dsa(md) md, TLSEXT_signature_dsa,
 320 #endif
 321
 322 #ifdef OPENSSL_NO_ECDSA
 323 #define tlsext_sigalg_ecdsa(md) /* */
 324 #else
 325 #define tlsext_sigalg_ecdsa(md) md, TLSEXT_signature_ecdsa,
 326 #endif
 327
 328 #define tlsext_sigalg(md) \
 329                 tlsext_sigalg_rsa(md) \
 330                 tlsext_sigalg_dsa(md) \
 331                 tlsext_sigalg_ecdsa(md)
 332
 333 static unsigned char tls12_sigalgs[] = {
 334 #ifndef OPENSSL_NO_SHA512
 335         tlsext_sigalg(TLSEXT_hash_sha512)
 336         tlsext_sigalg(TLSEXT_hash_sha384)
 337 #endif
 338 #ifndef OPENSSL_NO_SHA256
 339         tlsext_sigalg(TLSEXT_hash_sha256)
 340         tlsext_sigalg(TLSEXT_hash_sha224)
 341 #endif
 342 #ifndef OPENSSL_NO_SHA
 343         tlsext_sigalg(TLSEXT_hash_sha1)
 344 #endif
 345 };
 346
 347 int tls12_get_req_sig_algs(SSL *s, unsigned char *p)
 348         {
 349         size_t slen = sizeof(tls12_sigalgs);
 350         if (p)
 351                 memcpy(p, tls12_sigalgs, slen);
 352         return (int)slen;
 353         }
 354
 355 unsigned char *ssl_add_clienthello_tlsext(SSL *s, unsigned char *p, unsigned char *limit)
 356         {
 357         int extdatalen=0;
 358         unsigned char *ret = p;
 359
 360         /* don't add extensions for SSLv3 unless doing secure renegotiation */
 361         if (s->client_version == SSL3_VERSION
 362                                         && !s->s3->send_connection_binding)
 363                 return p;
 364
 365         ret+=2;
 366
 367         if (ret>=limit) return NULL; /* this really never occurs, but ... */
 368
 369         if (s->tlsext_hostname != NULL)
 370                 {
 371                 /* Add TLS extension servername to the Client Hello message */
 372                 unsigned long size_str;
 373                 long lenmax;
 374
 375                 /* check for enough space.
 376                    4 for the servername type and entension length
 377                    2 for servernamelist length
 378                    1 for the hostname type
 379                    2 for hostname length
 380                    + hostname length
 381                 */
 382
 383                 if ((lenmax = limit - ret - 9) < 0
 384                     || (size_str = strlen(s->tlsext_hostname)) > (unsigned long)lenmax)
 385                         return NULL;
 386
 387                 /* extension type and length */
 388                 s2n(TLSEXT_TYPE_server_name,ret);
 389                 s2n(size_str+5,ret);
 390
 391                 /* length of servername list */
 392                 s2n(size_str+3,ret);
 393
 394                 /* hostname type, length and hostname */
 395                 *(ret++) = (unsigned char) TLSEXT_NAMETYPE_host_name;
 396                 s2n(size_str,ret);
 397                 memcpy(ret, s->tlsext_hostname, size_str);
 398                 ret+=size_str;
 399                 }
 400
 401         /* Add RI if renegotiating */
 402         if (s->renegotiate)
 403           {
 404           int el;
 405
 406           if(!ssl_add_clienthello_renegotiate_ext(s, 0, &el, 0))
 407               {
 408               SSLerr(SSL_F_SSL_ADD_CLIENTHELLO_TLSEXT, ERR_R_INTERNAL_ERROR);
 409               return NULL;
 410               }
 411
 412           if((limit - p - 4 - el) < 0) return NULL;
 413
 414           s2n(TLSEXT_TYPE_renegotiate,ret);
 415           s2n(el,ret);
 416
 417           if(!ssl_add_clienthello_renegotiate_ext(s, ret, &el, el))
 418               {
 419               SSLerr(SSL_F_SSL_ADD_CLIENTHELLO_TLSEXT, ERR_R_INTERNAL_ERROR);
 420               return NULL;
 421               }
 422
 423           ret += el;
 424         }
 425
 426 #ifndef OPENSSL_NO_SRP
 427         /* Add SRP username if there is one */
 428         if (s->srp_ctx.login != NULL)
 429                 { /* Add TLS extension SRP username to the Client Hello message */
 430
 431                 int login_len = strlen(s->srp_ctx.login);
 432                 if (login_len > 255 || login_len == 0)
 433                         {
 434                         SSLerr(SSL_F_SSL_ADD_CLIENTHELLO_TLSEXT, ERR_R_INTERNAL_ERROR);
 435                         return NULL;
 436                         }
 437
 438                 /* check for enough space.
 439                    4 for the srp type type and entension length
 440                    1 for the srp user identity
 441                    + srp user identity length
 442                 */
 443                 if ((limit - ret - 5 - login_len) < 0) return NULL;
 444
 445                 /* fill in the extension */
 446                 s2n(TLSEXT_TYPE_srp,ret);
 447                 s2n(login_len+1,ret);
 448                 (*ret++) = (unsigned char) login_len;
 449                 memcpy(ret, s->srp_ctx.login, login_len);
 450                 ret+=login_len;
 451                 }
 452 #endif
 453
 454 #ifndef OPENSSL_NO_EC
 455         if (s->tlsext_ecpointformatlist != NULL &&
 456             s->version != DTLS1_VERSION)
 457                 {
 458                 /* Add TLS extension ECPointFormats to the ClientHello message */
 459                 long lenmax;
 460
 461                 if ((lenmax = limit - ret - 5) < 0) return NULL;
 462                 if (s->tlsext_ecpointformatlist_length > (unsigned long)lenmax) return NULL;
 463                 if (s->tlsext_ecpointformatlist_length > 255)
 464                         {
 465                         SSLerr(SSL_F_SSL_ADD_CLIENTHELLO_TLSEXT, ERR_R_INTERNAL_ERROR);
 466                         return NULL;
 467                         }
 468
 469                 s2n(TLSEXT_TYPE_ec_point_formats,ret);
 470                 s2n(s->tlsext_ecpointformatlist_length + 1,ret);
 471                 *(ret++) = (unsigned char) s->tlsext_ecpointformatlist_length;
 472                 memcpy(ret, s->tlsext_ecpointformatlist, s->tlsext_ecpointformatlist_length);
 473                 ret+=s->tlsext_ecpointformatlist_length;
 474                 }
 475         if (s->tlsext_ellipticcurvelist != NULL &&
 476             s->version != DTLS1_VERSION)
 477                 {
 478                 /* Add TLS extension EllipticCurves to the ClientHello message */
 479                 long lenmax;
 480
 481                 if ((lenmax = limit - ret - 6) < 0) return NULL;
 482                 if (s->tlsext_ellipticcurvelist_length > (unsigned long)lenmax) return NULL;
 483                 if (s->tlsext_ellipticcurvelist_length > 65532)
 484                         {
 485                         SSLerr(SSL_F_SSL_ADD_CLIENTHELLO_TLSEXT, ERR_R_INTERNAL_ERROR);
 486                         return NULL;
 487                         }
 488
 489                 s2n(TLSEXT_TYPE_elliptic_curves,ret);
 490                 s2n(s->tlsext_ellipticcurvelist_length + 2, ret);
 491
 492                 /* NB: draft-ietf-tls-ecc-12.txt uses a one-byte prefix for
 493                  * elliptic_curve_list, but the examples use two bytes.
 494                  * http://www1.ietf.org/mail-archive/web/tls/current/msg00538.html
 495                  * resolves this to two bytes.
 496                  */
 497                 s2n(s->tlsext_ellipticcurvelist_length, ret);
 498                 memcpy(ret, s->tlsext_ellipticcurvelist, s->tlsext_ellipticcurvelist_length);
 499                 ret+=s->tlsext_ellipticcurvelist_length;
 500                 }
 501 #endif /* OPENSSL_NO_EC */
 502
 503         if (!(SSL_get_options(s) & SSL_OP_NO_TICKET))
 504                 {
 505                 int ticklen;
 506                 if (!s->new_session && s->session && s->session->tlsext_tick)
 507                         ticklen = s->session->tlsext_ticklen;
 508                 else if (s->session && s->tlsext_session_ticket &&
 509                          s->tlsext_session_ticket->data)
 510                         {
 511                         ticklen = s->tlsext_session_ticket->length;
 512                         s->session->tlsext_tick = OPENSSL_malloc(ticklen);
 513                         if (!s->session->tlsext_tick)
 514                                 return NULL;
 515                         memcpy(s->session->tlsext_tick,
 516                                s->tlsext_session_ticket->data,
 517                                ticklen);
 518                         s->session->tlsext_ticklen = ticklen;
 519                         }
 520                 else
 521                         ticklen = 0;
 522                 if (ticklen == 0 && s->tlsext_session_ticket &&
 523                     s->tlsext_session_ticket->data == NULL)
 524                         goto skip_ext;
 525                 /* Check for enough room 2 for extension type, 2 for len
 526                  * rest for ticket
 527                  */
 528                 if ((long)(limit - ret - 4 - ticklen) < 0) return NULL;
 529                 s2n(TLSEXT_TYPE_session_ticket,ret);
 530                 s2n(ticklen,ret);
 531                 if (ticklen)
 532                         {
 533                         memcpy(ret, s->session->tlsext_tick, ticklen);
 534                         ret += ticklen;
 535                         }
 536                 }
 537                 skip_ext:
 538
 539         if (TLS1_get_client_version(s) >= TLS1_2_VERSION)
 540                 {
 541                 if ((size_t)(limit - ret) < sizeof(tls12_sigalgs) + 6)
 542                         return NULL;
 543                 s2n(TLSEXT_TYPE_signature_algorithms,ret);
 544                 s2n(sizeof(tls12_sigalgs) + 2, ret);
 545                 s2n(sizeof(tls12_sigalgs), ret);
 546                 memcpy(ret, tls12_sigalgs, sizeof(tls12_sigalgs));
 547                 ret += sizeof(tls12_sigalgs);
 548                 }
 549
 550 #ifdef TLSEXT_TYPE_opaque_prf_input
 551         if (s->s3->client_opaque_prf_input != NULL &&
 552             s->version != DTLS1_VERSION)
 553                 {
 554                 size_t col = s->s3->client_opaque_prf_input_len;
 555
 556                 if ((long)(limit - ret - 6 - col < 0))
 557                         return NULL;
 558                 if (col > 0xFFFD) /* can't happen */
 559                         return NULL;
 560
 561                 s2n(TLSEXT_TYPE_opaque_prf_input, ret);
 562                 s2n(col + 2, ret);
 563                 s2n(col, ret);
 564                 memcpy(ret, s->s3->client_opaque_prf_input, col);
 565                 ret += col;
 566                 }
 567 #endif
 568
 569         if (s->tlsext_status_type == TLSEXT_STATUSTYPE_ocsp &&
 570             s->version != DTLS1_VERSION)
 571                 {
 572                 int i;
 573                 long extlen, idlen, itmp;
 574                 OCSP_RESPID *id;
 575
 576                 idlen = 0;
 577                 for (i = 0; i < sk_OCSP_RESPID_num(s->tlsext_ocsp_ids); i++)
 578                         {
 579                         id = sk_OCSP_RESPID_value(s->tlsext_ocsp_ids, i);
 580                         itmp = i2d_OCSP_RESPID(id, NULL);
 581                         if (itmp <= 0)
 582                                 return NULL;
 583                         idlen += itmp + 2;
 584                         }
 585
 586                 if (s->tlsext_ocsp_exts)
 587                         {
 588                         extlen = i2d_X509_EXTENSIONS(s->tlsext_ocsp_exts, NULL);
 589                         if (extlen < 0)
 590                                 return NULL;
 591                         }
 592                 else
 593                         extlen = 0;
 594
 595                 if ((long)(limit - ret - 7 - extlen - idlen) < 0) return NULL;
 596                 s2n(TLSEXT_TYPE_status_request, ret);
 597                 if (extlen + idlen > 0xFFF0)
 598                         return NULL;
 599                 s2n(extlen + idlen + 5, ret);
 600                 *(ret++) = TLSEXT_STATUSTYPE_ocsp;
 601                 s2n(idlen, ret);
 602                 for (i = 0; i < sk_OCSP_RESPID_num(s->tlsext_ocsp_ids); i++)
 603                         {
 604                         /* save position of id len */
 605                         unsigned char *q = ret;
 606                         id = sk_OCSP_RESPID_value(s->tlsext_ocsp_ids, i);
 607                         /* skip over id len */
 608                         ret += 2;
 609                         itmp = i2d_OCSP_RESPID(id, &ret);
 610                         /* write id len */
 611                         s2n(itmp, q);
 612                         }
 613                 s2n(extlen, ret);
 614                 if (extlen > 0)
 615                         i2d_X509_EXTENSIONS(s->tlsext_ocsp_exts, &ret);
 616                 }
 617
 618 #ifndef OPENSSL_NO_HEARTBEATS
 619         /* Add Heartbeat extension */
 620         if ((limit - ret - 4 - 1) < 0)
 621                 return NULL;
 622         s2n(TLSEXT_TYPE_heartbeat,ret);
 623         s2n(1,ret);
 624         /* Set mode:
 625          * 1: peer may send requests
 626          * 2: peer not allowed to send requests
 627          */
 628         if (s->tlsext_heartbeat & SSL_TLSEXT_HB_DONT_RECV_REQUESTS)
 629                 *(ret++) = SSL_TLSEXT_HB_DONT_SEND_REQUESTS;
 630         else
 631                 *(ret++) = SSL_TLSEXT_HB_ENABLED;
 632 #endif
 633
 634 #ifndef OPENSSL_NO_NEXTPROTONEG
 635         if (s->ctx->next_proto_select_cb && !s->s3->tmp.finish_md_len)
 636                 {
 637                 /* The client advertises an emtpy extension to indicate its
 638                  * support for Next Protocol Negotiation */
 639                 if (limit - ret - 4 < 0)
 640                         return NULL;
 641                 s2n(TLSEXT_TYPE_next_proto_neg,ret);
 642                 s2n(0,ret);
 643                 }
 644 #endif
 645
 646 #ifndef OPENSSL_NO_SRTP
 647         if(SSL_get_srtp_profiles(s))
 648                 {
 649                 int el;
 650
 651                 ssl_add_clienthello_use_srtp_ext(s, 0, &el, 0);
 652
 653                 if((limit - p - 4 - el) < 0) return NULL;
 654
 655                 s2n(TLSEXT_TYPE_use_srtp,ret);
 656                 s2n(el,ret);
 657
 658                 if(ssl_add_clienthello_use_srtp_ext(s, ret, &el, el))
 659                         {
 660                         SSLerr(SSL_F_SSL_ADD_CLIENTHELLO_TLSEXT, ERR_R_INTERNAL_ERROR);
 661                         return NULL;
 662                         }
 663                 ret += el;
 664                 }
 665 #endif
 666         /* Add padding to workaround bugs in F5 terminators.
 667          * See https://tools.ietf.org/html/draft-agl-tls-padding-03
 668          *
 669          * NB: because this code works out the length of all existing
 670          * extensions it MUST always appear last.
 671          */
 672         if (s->options & SSL_OP_TLSEXT_PADDING)
 673                 {
 674                 int hlen = ret - (unsigned char *)s->init_buf->data;
 675                 /* The code in s23_clnt.c to build ClientHello messages
 676                  * includes the 5-byte record header in the buffer, while
 677                  * the code in s3_clnt.c does not.
 678                  */
 679                 if (s->state == SSL23_ST_CW_CLNT_HELLO_A)
 680                         hlen -= 5;
 681                 if (hlen > 0xff && hlen < 0x200)
 682                         {
 683                         hlen = 0x200 - hlen;
 684                         if (hlen >= 4)
 685                                 hlen -= 4;
 686                         else
 687                                 hlen = 0;
 688
 689                         s2n(TLSEXT_TYPE_padding, ret);
 690                         s2n(hlen, ret);
 691                         memset(ret, 0, hlen);
 692                         ret += hlen;
 693                         }
 694                 }
 695
 696         if ((extdatalen = ret-p-2)== 0)
 697                 return p;
 698
 699         s2n(extdatalen,p);
 700         return ret;
 701         }
 702
 703 unsigned char *ssl_add_serverhello_tlsext(SSL *s, unsigned char *p, unsigned char *limit)
 704         {
 705         int extdatalen=0;
 706         unsigned char *ret = p;
 707 #ifndef OPENSSL_NO_NEXTPROTONEG
 708         int next_proto_neg_seen;
 709 #endif
 710
 711         /* don't add extensions for SSLv3, unless doing secure renegotiation */
 712         if (s->version == SSL3_VERSION && !s->s3->send_connection_binding)
 713                 return p;
 714
 715         ret+=2;
 716         if (ret>=limit) return NULL; /* this really never occurs, but ... */
 717
 718         if (!s->hit && s->servername_done == 1 && s->session->tlsext_hostname != NULL)
 719                 {
 720                 if ((long)(limit - ret - 4) < 0) return NULL;
 721
 722                 s2n(TLSEXT_TYPE_server_name,ret);
 723                 s2n(0,ret);
 724                 }
 725
 726         if(s->s3->send_connection_binding)
 727         {
 728           int el;
 729
 730           if(!ssl_add_serverhello_renegotiate_ext(s, 0, &el, 0))
 731               {
 732               SSLerr(SSL_F_SSL_ADD_SERVERHELLO_TLSEXT, ERR_R_INTERNAL_ERROR);
 733               return NULL;
 734               }
 735
 736           if((limit - p - 4 - el) < 0) return NULL;
 737
 738           s2n(TLSEXT_TYPE_renegotiate,ret);
 739           s2n(el,ret);
 740
 741           if(!ssl_add_serverhello_renegotiate_ext(s, ret, &el, el))
 742               {
 743               SSLerr(SSL_F_SSL_ADD_SERVERHELLO_TLSEXT, ERR_R_INTERNAL_ERROR);
 744               return NULL;
 745               }
 746
 747           ret += el;
 748         }
 749
 750 #ifndef OPENSSL_NO_EC
 751         if (s->tlsext_ecpointformatlist != NULL &&
 752             s->version != DTLS1_VERSION)
 753                 {
 754                 /* Add TLS extension ECPointFormats to the ServerHello message */
 755                 long lenmax;
 756
 757                 if ((lenmax = limit - ret - 5) < 0) return NULL;
 758                 if (s->tlsext_ecpointformatlist_length > (unsigned long)lenmax) return NULL;
 759                 if (s->tlsext_ecpointformatlist_length > 255)
 760                         {
 761                         SSLerr(SSL_F_SSL_ADD_SERVERHELLO_TLSEXT, ERR_R_INTERNAL_ERROR);
 762                         return NULL;
 763                         }
 764
 765                 s2n(TLSEXT_TYPE_ec_point_formats,ret);
 766                 s2n(s->tlsext_ecpointformatlist_length + 1,ret);
 767                 *(ret++) = (unsigned char) s->tlsext_ecpointformatlist_length;
 768                 memcpy(ret, s->tlsext_ecpointformatlist, s->tlsext_ecpointformatlist_length);
 769                 ret+=s->tlsext_ecpointformatlist_length;
 770
 771                 }
 772         /* Currently the server should not respond with a SupportedCurves extension */
 773 #endif /* OPENSSL_NO_EC */
 774
 775         if (s->tlsext_ticket_expected
 776                 && !(SSL_get_options(s) & SSL_OP_NO_TICKET))
 777                 {
 778                 if ((long)(limit - ret - 4) < 0) return NULL;
 779                 s2n(TLSEXT_TYPE_session_ticket,ret);
 780                 s2n(0,ret);
 781                 }
 782
 783         if (s->tlsext_status_expected)
 784                 {
 785                 if ((long)(limit - ret - 4) < 0) return NULL;
 786                 s2n(TLSEXT_TYPE_status_request,ret);
 787                 s2n(0,ret);
 788                 }
 789
 790 #ifdef TLSEXT_TYPE_opaque_prf_input
 791         if (s->s3->server_opaque_prf_input != NULL &&
 792             s->version != DTLS1_VERSION)
 793                 {
 794                 size_t sol = s->s3->server_opaque_prf_input_len;
 795
 796                 if ((long)(limit - ret - 6 - sol) < 0)
 797                         return NULL;
 798                 if (sol > 0xFFFD) /* can't happen */
 799                         return NULL;
 800
 801                 s2n(TLSEXT_TYPE_opaque_prf_input, ret);
 802                 s2n(sol + 2, ret);
 803                 s2n(sol, ret);
 804                 memcpy(ret, s->s3->server_opaque_prf_input, sol);
 805                 ret += sol;
 806                 }
 807 #endif
 808
 809 #ifndef OPENSSL_NO_SRTP
 810         if(s->srtp_profile)
 811                 {
 812                 int el;
 813
 814                 ssl_add_serverhello_use_srtp_ext(s, 0, &el, 0);
 815
 816                 if((limit - p - 4 - el) < 0) return NULL;
 817
 818                 s2n(TLSEXT_TYPE_use_srtp,ret);
 819                 s2n(el,ret);
 820
 821                 if(ssl_add_serverhello_use_srtp_ext(s, ret, &el, el))
 822                         {
 823                         SSLerr(SSL_F_SSL_ADD_SERVERHELLO_TLSEXT, ERR_R_INTERNAL_ERROR);
 824                         return NULL;
 825                         }
 826                 ret+=el;
 827                 }
 828 #endif
 829
 830         if (((s->s3->tmp.new_cipher->id & 0xFFFF)==0x80 || (s->s3->tmp.new_cipher->id & 0xFFFF)==0x81)
 831                 && (SSL_get_options(s) & SSL_OP_CRYPTOPRO_TLSEXT_BUG))
 832                 { const unsigned char cryptopro_ext[36] = {
 833                         0xfd, 0xe8, /*65000*/
 834                         0x00, 0x20, /*32 bytes length*/
 835                         0x30, 0x1e, 0x30, 0x08, 0x06, 0x06, 0x2a, 0x85,
 836                         0x03,   0x02, 0x02, 0x09, 0x30, 0x08, 0x06, 0x06,
 837                         0x2a, 0x85, 0x03, 0x02, 0x02, 0x16, 0x30, 0x08,
 838                         0x06, 0x06, 0x2a, 0x85, 0x03, 0x02, 0x02, 0x17};
 839                         if (limit-ret<36) return NULL;
 840                         memcpy(ret,cryptopro_ext,36);
 841                         ret+=36;
 842
 843                 }
 844
 845 #ifndef OPENSSL_NO_HEARTBEATS
 846         /* Add Heartbeat extension if we've received one */
 847         if (s->tlsext_heartbeat & SSL_TLSEXT_HB_ENABLED)
 848                 {
 849                 if ((limit - ret - 4 - 1) < 0)
 850                         return NULL;
 851                 s2n(TLSEXT_TYPE_heartbeat,ret);
 852                 s2n(1,ret);
 853                 /* Set mode:
 854                  * 1: peer may send requests
 855                  * 2: peer not allowed to send requests
 856                  */
 857                 if (s->tlsext_heartbeat & SSL_TLSEXT_HB_DONT_RECV_REQUESTS)
 858                         *(ret++) = SSL_TLSEXT_HB_DONT_SEND_REQUESTS;
 859                 else
 860                         *(ret++) = SSL_TLSEXT_HB_ENABLED;
 861
 862                 }
 863 #endif
 864
 865 #ifndef OPENSSL_NO_NEXTPROTONEG
 866         next_proto_neg_seen = s->s3->next_proto_neg_seen;
 867         s->s3->next_proto_neg_seen = 0;
 868         if (next_proto_neg_seen && s->ctx->next_protos_advertised_cb)
 869                 {
 870                 const unsigned char *npa;
 871                 unsigned int npalen;
 872                 int r;
 873
 874                 r = s->ctx->next_protos_advertised_cb(s, &npa, &npalen, s->ctx->next_protos_advertised_cb_arg);
 875                 if (r == SSL_TLSEXT_ERR_OK)
 876                         {
 877                         if ((long)(limit - ret - 4 - npalen) < 0) return NULL;
 878                         s2n(TLSEXT_TYPE_next_proto_neg,ret);
 879                         s2n(npalen,ret);
 880                         memcpy(ret, npa, npalen);
 881                         ret += npalen;
 882                         s->s3->next_proto_neg_seen = 1;
 883                         }
 884                 }
 885 #endif
 886
 887         if ((extdatalen = ret-p-2)== 0)
 888                 return p;
 889
 890         s2n(extdatalen,p);
 891         return ret;
 892         }
 893
 894 #ifndef OPENSSL_NO_EC
 895 /* ssl_check_for_safari attempts to fingerprint Safari using OS X
 896  * SecureTransport using the TLS extension block in |d|, of length |n|.
 897  * Safari, since 10.6, sends exactly these extensions, in this order:
 898  *   SNI,
 899  *   elliptic_curves
 900  *   ec_point_formats
 901  *
 902  * We wish to fingerprint Safari because they broke ECDHE-ECDSA support in 10.8,
 903  * but they advertise support. So enabling ECDHE-ECDSA ciphers breaks them.
 904  * Sadly we cannot differentiate 10.6, 10.7 and 10.8.4 (which work), from
 905  * 10.8..10.8.3 (which don't work).
 906  */
 907 static void ssl_check_for_safari(SSL *s, const unsigned char *data, const unsigned char *d, int n) {
 908         unsigned short type, size;
 909         static const unsigned char kSafariExtensionsBlock[] = {
 910                 0x00, 0x0a,  /* elliptic_curves extension */
 911                 0x00, 0x08,  /* 8 bytes */
 912                 0x00, 0x06,  /* 6 bytes of curve ids */
 913                 0x00, 0x17,  /* P-256 */
 914                 0x00, 0x18,  /* P-384 */
 915                 0x00, 0x19,  /* P-521 */
 916
 917                 0x00, 0x0b,  /* ec_point_formats */
 918                 0x00, 0x02,  /* 2 bytes */
 919                 0x01,        /* 1 point format */
 920                 0x00,        /* uncompressed */
 921         };
 922
 923         /* The following is only present in TLS 1.2 */
 924         static const unsigned char kSafariTLS12ExtensionsBlock[] = {
 925                 0x00, 0x0d,  /* signature_algorithms */
 926                 0x00, 0x0c,  /* 12 bytes */
 927                 0x00, 0x0a,  /* 10 bytes */
 928                 0x05, 0x01,  /* SHA-384/RSA */
 929                 0x04, 0x01,  /* SHA-256/RSA */
 930                 0x02, 0x01,  /* SHA-1/RSA */
 931                 0x04, 0x03,  /* SHA-256/ECDSA */
 932                 0x02, 0x03,  /* SHA-1/ECDSA */
 933         };
 934
 935         if (data >= (d+n-2))
 936                 return;
 937         data += 2;
 938
 939         if (data > (d+n-4))
 940                 return;
 941         n2s(data,type);
 942         n2s(data,size);
 943
 944         if (type != TLSEXT_TYPE_server_name)
 945                 return;
 946
 947         if (data+size > d+n)
 948                 return;
 949         data += size;
 950
 951         if (TLS1_get_client_version(s) >= TLS1_2_VERSION)
 952                 {
 953                 const size_t len1 = sizeof(kSafariExtensionsBlock);
 954                 const size_t len2 = sizeof(kSafariTLS12ExtensionsBlock);
 955
 956                 if (data + len1 + len2 != d+n)
 957                         return;
 958                 if (memcmp(data, kSafariExtensionsBlock, len1) != 0)
 959                         return;
 960                 if (memcmp(data + len1, kSafariTLS12ExtensionsBlock, len2) != 0)
 961                         return;
 962                 }
 963         else
 964                 {
 965                 const size_t len = sizeof(kSafariExtensionsBlock);
 966
 967                 if (data + len != d+n)
 968                         return;
 969                 if (memcmp(data, kSafariExtensionsBlock, len) != 0)
 970                         return;
 971                 }
 972
 973         s->s3->is_probably_safari = 1;
 974 }
 975 #endif /* !OPENSSL_NO_EC */
 976
 977 int ssl_parse_clienthello_tlsext(SSL *s, unsigned char **p, unsigned char *d, int n, int *al)
 978         {
 979         unsigned short type;
 980         unsigned short size;
 981         unsigned short len;
 982         unsigned char *data = *p;
 983         int renegotiate_seen = 0;
 984         int sigalg_seen = 0;
 985
 986         s->servername_done = 0;
 987         s->tlsext_status_type = -1;
 988 #ifndef OPENSSL_NO_NEXTPROTONEG
 989         s->s3->next_proto_neg_seen = 0;
 990 #endif
 991
 992 #ifndef OPENSSL_NO_HEARTBEATS
 993         s->tlsext_heartbeat &= ~(SSL_TLSEXT_HB_ENABLED |
 994                                SSL_TLSEXT_HB_DONT_SEND_REQUESTS);
 995 #endif
 996
 997 #ifndef OPENSSL_NO_EC
 998         if (s->options & SSL_OP_SAFARI_ECDHE_ECDSA_BUG)
 999                 ssl_check_for_safari(s, data, d, n);
1000 #endif /* !OPENSSL_NO_EC */
1001
1002         if (data >= (d+n-2))
1003                 goto ri_check;
1004         n2s(data,len);
1005
1006         if (data > (d+n-len))
1007                 goto ri_check;
1008
1009         while (data <= (d+n-4))
1010                 {
1011                 n2s(data,type);
1012                 n2s(data,size);
1013
1014                 if (data+size > (d+n))
1015                         goto ri_check;
1016 #if 0
1017                 fprintf(stderr,"Received extension type %d size %d\n",type,size);
1018 #endif
1019                 if (s->tlsext_debug_cb)
1020                         s->tlsext_debug_cb(s, 0, type, data, size,
1021                                                 s->tlsext_debug_arg);
1022 /* The servername extension is treated as follows:
1023
1024    - Only the hostname type is supported with a maximum length of 255.
1025    - The servername is rejected if too long or if it contains zeros,
1026      in which case an fatal alert is generated.
1027    - The servername field is maintained together with the session cache.
1028    - When a session is resumed, the servername call back invoked in order
1029      to allow the application to position itself to the right context.
1030    - The servername is acknowledged if it is new for a session or when
1031      it is identical to a previously used for the same session.
1032      Applications can control the behaviour.  They can at any time
1033      set a 'desirable' servername for a new SSL object. This can be the
1034      case for example with HTTPS when a Host: header field is received and
1035      a renegotiation is requested. In this case, a possible servername
1036      presented in the new client hello is only acknowledged if it matches
1037      the value of the Host: field.
1038    - Applications must  use SSL_OP_NO_SESSION_RESUMPTION_ON_RENEGOTIATION
1039      if they provide for changing an explicit servername context for the session,
1040      i.e. when the session has been established with a servername extension.
1041    - On session reconnect, the servername extension may be absent.
1042
1043 */
1044
1045                 if (type == TLSEXT_TYPE_server_name)
1046                         {
1047                         unsigned char *sdata;
1048                         int servname_type;
1049                         int dsize;
1050
1051                         if (size < 2)
1052                                 {
1053                                 *al = SSL_AD_DECODE_ERROR;
1054                                 return 0;
1055                                 }
1056                         n2s(data,dsize);
1057                         size -= 2;
1058                         if (dsize > size  )
1059                                 {
1060                                 *al = SSL_AD_DECODE_ERROR;
1061                                 return 0;
1062                                 }
1063
1064                         sdata = data;
1065                         while (dsize > 3)
1066                                 {
1067                                 servname_type = *(sdata++);
1068                                 n2s(sdata,len);
1069                                 dsize -= 3;
1070
1071                                 if (len > dsize)
1072                                         {
1073                                         *al = SSL_AD_DECODE_ERROR;
1074                                         return 0;
1075                                         }
1076                                 if (s->servername_done == 0)
1077                                 switch (servname_type)
1078                                         {
1079                                 case TLSEXT_NAMETYPE_host_name:
1080                                         if (!s->hit)
1081                                                 {
1082                                                 if(s->session->tlsext_hostname)
1083                                                         {
1084                                                         *al = SSL_AD_DECODE_ERROR;
1085                                                         return 0;
1086                                                         }
1087                                                 if (len > TLSEXT_MAXLEN_host_name)
1088                                                         {
1089                                                         *al = TLS1_AD_UNRECOGNIZED_NAME;
1090                                                         return 0;
1091                                                         }
1092                                                 if ((s->session->tlsext_hostname = OPENSSL_malloc(len+1)) == NULL)
1093                                                         {
1094                                                         *al = TLS1_AD_INTERNAL_ERROR;
1095                                                         return 0;
1096                                                         }
1097                                                 memcpy(s->session->tlsext_hostname, sdata, len);
1098                                                 s->session->tlsext_hostname[len]='\0';
1099                                                 if (strlen(s->session->tlsext_hostname) != len) {
1100                                                         OPENSSL_free(s->session->tlsext_hostname);
1101                                                         s->session->tlsext_hostname = NULL;
1102                                                         *al = TLS1_AD_UNRECOGNIZED_NAME;
1103                                                         return 0;
1104                                                 }
1105                                                 s->servername_done = 1;
1106
1107                                                 }
1108                                         else
1109                                                 s->servername_done = s->session->tlsext_hostname
1110                                                         && strlen(s->session->tlsext_hostname) == len
1111                                                         && strncmp(s->session->tlsext_hostname, (char *)sdata, len) == 0;
1112
1113                                         break;
1114
1115                                 default:
1116                                         break;
1117                                         }
1118
1119                                 dsize -= len;
1120                                 }
1121                         if (dsize != 0)
1122                                 {
1123                                 *al = SSL_AD_DECODE_ERROR;
1124                                 return 0;
1125                                 }
1126
1127                         }
1128 #ifndef OPENSSL_NO_SRP
1129                 else if (type == TLSEXT_TYPE_srp)
1130                         {
1131                         if (size <= 0 || ((len = data[0])) != (size -1))
1132                                 {
1133                                 *al = SSL_AD_DECODE_ERROR;
1134                                 return 0;
1135                                 }
1136                         if (s->srp_ctx.login != NULL)
1137                                 {
1138                                 *al = SSL_AD_DECODE_ERROR;
1139                                 return 0;
1140                                 }
1141                         if ((s->srp_ctx.login = OPENSSL_malloc(len+1)) == NULL)
1142                                 return -1;
1143                         memcpy(s->srp_ctx.login, &data[1], len);
1144                         s->srp_ctx.login[len]='\0';
1145
1146                         if (strlen(s->srp_ctx.login) != len)
1147                                 {
1148                                 *al = SSL_AD_DECODE_ERROR;
1149                                 return 0;
1150                                 }
1151                         }
1152 #endif
1153
1154 #ifndef OPENSSL_NO_EC
1155                 else if (type == TLSEXT_TYPE_ec_point_formats &&
1156                      s->version != DTLS1_VERSION)
1157                         {
1158                         unsigned char *sdata = data;
1159                         int ecpointformatlist_length = *(sdata++);
1160
1161                         if (ecpointformatlist_length != size - 1)
1162                                 {
1163                                 *al = TLS1_AD_DECODE_ERROR;
1164                                 return 0;
1165                                 }
1166                         if (!s->hit)
1167                                 {
1168                                 if(s->session->tlsext_ecpointformatlist)
1169                                         {
1170                                         OPENSSL_free(s->session->tlsext_ecpointformatlist);
1171                                         s->session->tlsext_ecpointformatlist = NULL;
1172                                         }
1173                                 s->session->tlsext_ecpointformatlist_length = 0;
1174                                 if ((s->session->tlsext_ecpointformatlist = OPENSSL_malloc(ecpointformatlist_length)) == NULL)
1175                                         {
1176                                         *al = TLS1_AD_INTERNAL_ERROR;
1177                                         return 0;
1178                                         }
1179                                 s->session->tlsext_ecpointformatlist_length = ecpointformatlist_length;
1180                                 memcpy(s->session->tlsext_ecpointformatlist, sdata, ecpointformatlist_length);
1181                                 }
1182 #if 0
1183                         fprintf(stderr,"ssl_parse_clienthello_tlsext s->session->tlsext_ecpointformatlist (length=%i) ", s->session->tlsext_ecpointformatlist_length);
1184                         sdata = s->session->tlsext_ecpointformatlist;
1185                         for (i = 0; i < s->session->tlsext_ecpointformatlist_length; i++)
1186                                 fprintf(stderr,"%i ",*(sdata++));
1187                         fprintf(stderr,"\n");
1188 #endif
1189                         }
1190                 else if (type == TLSEXT_TYPE_elliptic_curves &&
1191                      s->version != DTLS1_VERSION)
1192                         {
1193                         unsigned char *sdata = data;
1194                         int ellipticcurvelist_length = (*(sdata++) << 8);
1195                         ellipticcurvelist_length += (*(sdata++));
1196
1197                         if (ellipticcurvelist_length != size - 2 ||
1198                                 ellipticcurvelist_length < 1)
1199                                 {
1200                                 *al = TLS1_AD_DECODE_ERROR;
1201                                 return 0;
1202                                 }
1203                         if (!s->hit)
1204                                 {
1205                                 if(s->session->tlsext_ellipticcurvelist)
1206                                         {
1207                                         *al = TLS1_AD_DECODE_ERROR;
1208                                         return 0;
1209                                         }
1210                                 s->session->tlsext_ellipticcurvelist_length = 0;
1211                                 if ((s->session->tlsext_ellipticcurvelist = OPENSSL_malloc(ellipticcurvelist_length)) == NULL)
1212                                         {
1213                                         *al = TLS1_AD_INTERNAL_ERROR;
1214                                         return 0;
1215                                         }
1216                                 s->session->tlsext_ellipticcurvelist_length = ellipticcurvelist_length;
1217                                 memcpy(s->session->tlsext_ellipticcurvelist, sdata, ellipticcurvelist_length);
1218                                 }
1219 #if 0
1220                         fprintf(stderr,"ssl_parse_clienthello_tlsext s->session->tlsext_ellipticcurvelist (length=%i) ", s->session->tlsext_ellipticcurvelist_length);
1221                         sdata = s->session->tlsext_ellipticcurvelist;
1222                         for (i = 0; i < s->session->tlsext_ellipticcurvelist_length; i++)
1223                                 fprintf(stderr,"%i ",*(sdata++));
1224                         fprintf(stderr,"\n");
1225 #endif
1226                         }
1227 #endif /* OPENSSL_NO_EC */
1228 #ifdef TLSEXT_TYPE_opaque_prf_input
1229                 else if (type == TLSEXT_TYPE_opaque_prf_input &&
1230                      s->version != DTLS1_VERSION)
1231                         {
1232                         unsigned char *sdata = data;
1233
1234                         if (size < 2)
1235                                 {
1236                                 *al = SSL_AD_DECODE_ERROR;
1237                                 return 0;
1238                                 }
1239                         n2s(sdata, s->s3->client_opaque_prf_input_len);
1240                         if (s->s3->client_opaque_prf_input_len != size - 2)
1241                                 {
1242                                 *al = SSL_AD_DECODE_ERROR;
1243                                 return 0;
1244                                 }
1245
1246                         if (s->s3->client_opaque_prf_input != NULL) /* shouldn't really happen */
1247                                 OPENSSL_free(s->s3->client_opaque_prf_input);
1248                         if (s->s3->client_opaque_prf_input_len == 0)
1249                                 s->s3->client_opaque_prf_input = OPENSSL_malloc(1); /* dummy byte just to get non-NULL */
1250                         else
1251                                 s->s3->client_opaque_prf_input = BUF_memdup(sdata, s->s3->client_opaque_prf_input_len);
1252                         if (s->s3->client_opaque_prf_input == NULL)
1253                                 {
1254                                 *al = TLS1_AD_INTERNAL_ERROR;
1255                                 return 0;
1256                                 }
1257                         }
1258 #endif
1259                 else if (type == TLSEXT_TYPE_session_ticket)
1260                         {
1261                         if (s->tls_session_ticket_ext_cb &&
1262                             !s->tls_session_ticket_ext_cb(s, data, size, s->tls_session_ticket_ext_cb_arg))
1263                                 {
1264                                 *al = TLS1_AD_INTERNAL_ERROR;
1265                                 return 0;
1266                                 }
1267                         }
1268                 else if (type == TLSEXT_TYPE_renegotiate)
1269                         {
1270                         if(!ssl_parse_clienthello_renegotiate_ext(s, data, size, al))
1271                                 return 0;
1272                         renegotiate_seen = 1;
1273                         }
1274                 else if (type == TLSEXT_TYPE_signature_algorithms)
1275                         {
1276                         int dsize;
1277                         if (sigalg_seen || size < 2)
1278                                 {
1279                                 *al = SSL_AD_DECODE_ERROR;
1280                                 return 0;
1281                                 }
1282                         sigalg_seen = 1;
1283                         n2s(data,dsize);
1284                         size -= 2;
1285                         if (dsize != size || dsize & 1)
1286                                 {
1287                                 *al = SSL_AD_DECODE_ERROR;
1288                                 return 0;
1289                                 }
1290                         if (!tls1_process_sigalgs(s, data, dsize))
1291                                 {
1292                                 *al = SSL_AD_DECODE_ERROR;
1293                                 return 0;
1294                                 }
1295                         }
1296                 else if (type == TLSEXT_TYPE_status_request &&
1297                          s->version != DTLS1_VERSION)
1298                         {
1299
1300                         if (size < 5)
1301                                 {
1302                                 *al = SSL_AD_DECODE_ERROR;
1303                                 return 0;
1304                                 }
1305
1306                         s->tlsext_status_type = *data++;
1307                         size--;
1308                         if (s->tlsext_status_type == TLSEXT_STATUSTYPE_ocsp)
1309                                 {
1310                                 const unsigned char *sdata;
1311                                 int dsize;
1312                                 /* Read in responder_id_list */
1313                                 n2s(data,dsize);
1314                                 size -= 2;
1315                                 if (dsize > size  )
1316                                         {
1317                                         *al = SSL_AD_DECODE_ERROR;
1318                                         return 0;
1319                                         }
1320                                 while (dsize > 0)
1321                                         {
1322                                         OCSP_RESPID *id;
1323                                         int idsize;
1324                                         if (dsize < 4)
1325                                                 {
1326                                                 *al = SSL_AD_DECODE_ERROR;
1327                                                 return 0;
1328                                                 }
1329                                         n2s(data, idsize);
1330                                         dsize -= 2 + idsize;
1331                                         size -= 2 + idsize;
1332                                         if (dsize < 0)
1333                                                 {
1334                                                 *al = SSL_AD_DECODE_ERROR;
1335                                                 return 0;
1336                                                 }
1337                                         sdata = data;
1338                                         data += idsize;
1339                                         id = d2i_OCSP_RESPID(NULL,
1340                                                                 &sdata, idsize);
1341                                         if (!id)
1342                                                 {
1343                                                 *al = SSL_AD_DECODE_ERROR;
1344                                                 return 0;
1345                                                 }
1346                                         if (data != sdata)
1347                                                 {
1348                                                 OCSP_RESPID_free(id);
1349                                                 *al = SSL_AD_DECODE_ERROR;
1350                                                 return 0;
1351                                                 }
1352                                         if (!s->tlsext_ocsp_ids
1353                                                 && !(s->tlsext_ocsp_ids =
1354                                                 sk_OCSP_RESPID_new_null()))
1355                                                 {
1356                                                 OCSP_RESPID_free(id);
1357                                                 *al = SSL_AD_INTERNAL_ERROR;
1358                                                 return 0;
1359                                                 }
1360                                         if (!sk_OCSP_RESPID_push(
1361                                                         s->tlsext_ocsp_ids, id))
1362                                                 {
1363                                                 OCSP_RESPID_free(id);
1364                                                 *al = SSL_AD_INTERNAL_ERROR;
1365                                                 return 0;
1366                                                 }
1367                                         }
1368
1369                                 /* Read in request_extensions */
1370                                 if (size < 2)
1371                                         {
1372                                         *al = SSL_AD_DECODE_ERROR;
1373                                         return 0;
1374                                         }
1375                                 n2s(data,dsize);
1376                                 size -= 2;
1377                                 if (dsize != size)
1378                                         {
1379                                         *al = SSL_AD_DECODE_ERROR;
1380                                         return 0;
1381                                         }
1382                                 sdata = data;
1383                                 if (dsize > 0)
1384                                         {
1385                                         if (s->tlsext_ocsp_exts)
1386                                                 {
1387                                                 sk_X509_EXTENSION_pop_free(s->tlsext_ocsp_exts,
1388                                                                            X509_EXTENSION_free);
1389                                                 }
1390
1391                                         s->tlsext_ocsp_exts =
1392                                                 d2i_X509_EXTENSIONS(NULL,
1393                                                         &sdata, dsize);
1394                                         if (!s->tlsext_ocsp_exts
1395                                                 || (data + dsize != sdata))
1396                                                 {
1397                                                 *al = SSL_AD_DECODE_ERROR;
1398                                                 return 0;
1399                                                 }
1400                                         }
1401                                 }
1402                                 /* We don't know what to do with any other type
1403                                 * so ignore it.
1404                                 */
1405                                 else
1406                                         s->tlsext_status_type = -1;
1407                         }
1408 #ifndef OPENSSL_NO_HEARTBEATS
1409                 else if (type == TLSEXT_TYPE_heartbeat)
1410                         {
1411                         switch(data[0])
1412                                 {
1413                                 case 0x01:      /* Client allows us to send HB requests */
1414                                                         s->tlsext_heartbeat |= SSL_TLSEXT_HB_ENABLED;
1415                                                         break;
1416                                 case 0x02:      /* Client doesn't accept HB requests */
1417                                                         s->tlsext_heartbeat |= SSL_TLSEXT_HB_ENABLED;
1418                                                         s->tlsext_heartbeat |= SSL_TLSEXT_HB_DONT_SEND_REQUESTS;
1419                                                         break;
1420                                 default:        *al = SSL_AD_ILLEGAL_PARAMETER;
1421                                                         return 0;
1422                                 }
1423                         }
1424 #endif
1425 #ifndef OPENSSL_NO_NEXTPROTONEG
1426                 else if (type == TLSEXT_TYPE_next_proto_neg &&
1427                          s->s3->tmp.finish_md_len == 0)
1428                         {
1429                         /* We shouldn't accept this extension on a
1430                          * renegotiation.
1431                          *
1432                          * s->new_session will be set on renegotiation, but we
1433                          * probably shouldn't rely that it couldn't be set on
1434                          * the initial renegotation too in certain cases (when
1435                          * there's some other reason to disallow resuming an
1436                          * earlier session -- the current code won't be doing
1437                          * anything like that, but this might change).
1438
1439                          * A valid sign that there's been a previous handshake
1440                          * in this connection is if s->s3->tmp.finish_md_len >
1441                          * 0.  (We are talking about a check that will happen
1442                          * in the Hello protocol round, well before a new
1443                          * Finished message could have been computed.) */
1444                         s->s3->next_proto_neg_seen = 1;
1445                         }
1446 #endif
1447
1448                 /* session ticket processed earlier */
1449 #ifndef OPENSSL_NO_SRTP
1450                 else if (type == TLSEXT_TYPE_use_srtp)
1451                         {
1452                         if(ssl_parse_clienthello_use_srtp_ext(s, data, size,
1453                                                               al))
1454                                 return 0;
1455                         }
1456 #endif
1457
1458                 data+=size;
1459                 }
1460
1461         *p = data;
1462
1463         ri_check:
1464
1465         /* Need RI if renegotiating */
1466
1467         if (!renegotiate_seen && s->renegotiate &&
1468                 !(s->options & SSL_OP_ALLOW_UNSAFE_LEGACY_RENEGOTIATION))
1469                 {
1470                 *al = SSL_AD_HANDSHAKE_FAILURE;
1471                 SSLerr(SSL_F_SSL_PARSE_CLIENTHELLO_TLSEXT,
1472                                 SSL_R_UNSAFE_LEGACY_RENEGOTIATION_DISABLED);
1473                 return 0;
1474                 }
1475
1476         return 1;
1477         }
1478
1479 #ifndef OPENSSL_NO_NEXTPROTONEG
1480 /* ssl_next_proto_validate validates a Next Protocol Negotiation block. No
1481  * elements of zero length are allowed and the set of elements must exactly fill
1482  * the length of the block. */
1483 static char ssl_next_proto_validate(unsigned char *d, unsigned len)
1484         {
1485         unsigned int off = 0;
1486
1487         while (off < len)
1488                 {
1489                 if (d[off] == 0)
1490                         return 0;
1491                 off += d[off];
1492                 off++;
1493                 }
1494
1495         return off == len;
1496         }
1497 #endif
1498
1499 int ssl_parse_serverhello_tlsext(SSL *s, unsigned char **p, unsigned char *d, int n, int *al)
1500         {
1501         unsigned short length;
1502         unsigned short type;
1503         unsigned short size;
1504         unsigned char *data = *p;
1505         int tlsext_servername = 0;
1506         int renegotiate_seen = 0;
1507
1508 #ifndef OPENSSL_NO_NEXTPROTONEG
1509         s->s3->next_proto_neg_seen = 0;
1510 #endif
1511
1512 #ifndef OPENSSL_NO_HEARTBEATS
1513         s->tlsext_heartbeat &= ~(SSL_TLSEXT_HB_ENABLED |
1514                                SSL_TLSEXT_HB_DONT_SEND_REQUESTS);
1515 #endif
1516
1517         if (data >= (d+n-2))
1518                 goto ri_check;
1519
1520         n2s(data,length);
1521         if (data+length != d+n)
1522                 {
1523                 *al = SSL_AD_DECODE_ERROR;
1524                 return 0;
1525                 }
1526
1527         while(data <= (d+n-4))
1528                 {
1529                 n2s(data,type);
1530                 n2s(data,size);
1531
1532                 if (data+size > (d+n))
1533                         goto ri_check;
1534
1535                 if (s->tlsext_debug_cb)
1536                         s->tlsext_debug_cb(s, 1, type, data, size,
1537                                                 s->tlsext_debug_arg);
1538
1539                 if (type == TLSEXT_TYPE_server_name)
1540                         {
1541                         if (s->tlsext_hostname == NULL || size > 0)
1542                                 {
1543                                 *al = TLS1_AD_UNRECOGNIZED_NAME;
1544                                 return 0;
1545                                 }
1546                         tlsext_servername = 1;
1547                         }
1548
1549 #ifndef OPENSSL_NO_EC
1550                 else if (type == TLSEXT_TYPE_ec_point_formats &&
1551                      s->version != DTLS1_VERSION)
1552                         {
1553                         unsigned char *sdata = data;
1554                         int ecpointformatlist_length = *(sdata++);
1555
1556                         if (ecpointformatlist_length != size - 1 ||
1557                                 ecpointformatlist_length < 1)
1558                                 {
1559                                 *al = TLS1_AD_DECODE_ERROR;
1560                                 return 0;
1561                                 }
1562                         s->session->tlsext_ecpointformatlist_length = 0;
1563                         if (s->session->tlsext_ecpointformatlist != NULL) OPENSSL_free(s->session->tlsext_ecpointformatlist);
1564                         if ((s->session->tlsext_ecpointformatlist = OPENSSL_malloc(ecpointformatlist_length)) == NULL)
1565                                 {
1566                                 *al = TLS1_AD_INTERNAL_ERROR;
1567                                 return 0;
1568                                 }
1569                         s->session->tlsext_ecpointformatlist_length = ecpointformatlist_length;
1570                         memcpy(s->session->tlsext_ecpointformatlist, sdata, ecpointformatlist_length);
1571 #if 0
1572                         fprintf(stderr,"ssl_parse_serverhello_tlsext s->session->tlsext_ecpointformatlist ");
1573                         sdata = s->session->tlsext_ecpointformatlist;
1574                         for (i = 0; i < s->session->tlsext_ecpointformatlist_length; i++)
1575                                 fprintf(stderr,"%i ",*(sdata++));
1576                         fprintf(stderr,"\n");
1577 #endif
1578                         }
1579 #endif /* OPENSSL_NO_EC */
1580
1581                 else if (type == TLSEXT_TYPE_session_ticket)
1582                         {
1583                         if (s->tls_session_ticket_ext_cb &&
1584                             !s->tls_session_ticket_ext_cb(s, data, size, s->tls_session_ticket_ext_cb_arg))
1585                                 {
1586                                 *al = TLS1_AD_INTERNAL_ERROR;
1587                                 return 0;
1588                                 }
1589                         if ((SSL_get_options(s) & SSL_OP_NO_TICKET)
1590                                 || (size > 0))
1591                                 {
1592                                 *al = TLS1_AD_UNSUPPORTED_EXTENSION;
1593                                 return 0;
1594                                 }
1595                         s->tlsext_ticket_expected = 1;
1596                         }
1597 #ifdef TLSEXT_TYPE_opaque_prf_input
1598                 else if (type == TLSEXT_TYPE_opaque_prf_input &&
1599                      s->version != DTLS1_VERSION)
1600                         {
1601                         unsigned char *sdata = data;
1602
1603                         if (size < 2)
1604                                 {
1605                                 *al = SSL_AD_DECODE_ERROR;
1606                                 return 0;
1607                                 }
1608                         n2s(sdata, s->s3->server_opaque_prf_input_len);
1609                         if (s->s3->server_opaque_prf_input_len != size - 2)
1610                                 {
1611                                 *al = SSL_AD_DECODE_ERROR;
1612                                 return 0;
1613                                 }
1614
1615                         if (s->s3->server_opaque_prf_input != NULL) /* shouldn't really happen */
1616                                 OPENSSL_free(s->s3->server_opaque_prf_input);
1617                         if (s->s3->server_opaque_prf_input_len == 0)
1618                                 s->s3->server_opaque_prf_input = OPENSSL_malloc(1); /* dummy byte just to get non-NULL */
1619                         else
1620                                 s->s3->server_opaque_prf_input = BUF_memdup(sdata, s->s3->server_opaque_prf_input_len);
1621
1622                         if (s->s3->server_opaque_prf_input == NULL)
1623                                 {
1624                                 *al = TLS1_AD_INTERNAL_ERROR;
1625                                 return 0;
1626                                 }
1627                         }
1628 #endif
1629                 else if (type == TLSEXT_TYPE_status_request &&
1630                          s->version != DTLS1_VERSION)
1631                         {
1632                         /* MUST be empty and only sent if we've requested
1633                          * a status request message.
1634                          */
1635                         if ((s->tlsext_status_type == -1) || (size > 0))
1636                                 {
1637                                 *al = TLS1_AD_UNSUPPORTED_EXTENSION;
1638                                 return 0;
1639                                 }
1640                         /* Set flag to expect CertificateStatus message */
1641                         s->tlsext_status_expected = 1;
1642                         }
1643 #ifndef OPENSSL_NO_NEXTPROTONEG
1644                 else if (type == TLSEXT_TYPE_next_proto_neg &&
1645                          s->s3->tmp.finish_md_len == 0)
1646                         {
1647                         unsigned char *selected;
1648                         unsigned char selected_len;
1649
1650                         /* We must have requested it. */
1651                         if (s->ctx->next_proto_select_cb == NULL)
1652                                 {
1653                                 *al = TLS1_AD_UNSUPPORTED_EXTENSION;
1654                                 return 0;
1655                                 }
1656                         /* The data must be valid */
1657                         if (!ssl_next_proto_validate(data, size))
1658                                 {
1659                                 *al = TLS1_AD_DECODE_ERROR;
1660                                 return 0;
1661                                 }
1662                         if (s->ctx->next_proto_select_cb(s, &selected, &selected_len, data, size, s->ctx->next_proto_select_cb_arg) != SSL_TLSEXT_ERR_OK)
1663                                 {
1664                                 *al = TLS1_AD_INTERNAL_ERROR;
1665                                 return 0;
1666                                 }
1667                         s->next_proto_negotiated = OPENSSL_malloc(selected_len);
1668                         if (!s->next_proto_negotiated)
1669                                 {
1670                                 *al = TLS1_AD_INTERNAL_ERROR;
1671                                 return 0;
1672                                 }
1673                         memcpy(s->next_proto_negotiated, selected, selected_len);
1674                         s->next_proto_negotiated_len = selected_len;
1675                         s->s3->next_proto_neg_seen = 1;
1676                         }
1677 #endif
1678                 else if (type == TLSEXT_TYPE_renegotiate)
1679                         {
1680                         if(!ssl_parse_serverhello_renegotiate_ext(s, data, size, al))
1681                                 return 0;
1682                         renegotiate_seen = 1;
1683                         }
1684 #ifndef OPENSSL_NO_HEARTBEATS
1685                 else if (type == TLSEXT_TYPE_heartbeat)
1686                         {
1687                         switch(data[0])
1688                                 {
1689                                 case 0x01:      /* Server allows us to send HB requests */
1690                                                         s->tlsext_heartbeat |= SSL_TLSEXT_HB_ENABLED;
1691                                                         break;
1692                                 case 0x02:      /* Server doesn't accept HB requests */
1693                                                         s->tlsext_heartbeat |= SSL_TLSEXT_HB_ENABLED;
1694                                                         s->tlsext_heartbeat |= SSL_TLSEXT_HB_DONT_SEND_REQUESTS;
1695                                                         break;
1696                                 default:        *al = SSL_AD_ILLEGAL_PARAMETER;
1697                                                         return 0;
1698                                 }
1699                         }
1700 #endif
1701 #ifndef OPENSSL_NO_SRTP
1702                 else if (type == TLSEXT_TYPE_use_srtp)
1703                         {
1704                         if(ssl_parse_serverhello_use_srtp_ext(s, data, size,
1705                                                               al))
1706                                 return 0;
1707                         }
1708 #endif
1709
1710                 data+=size;
1711                 }
1712
1713         if (data != d+n)
1714                 {
1715                 *al = SSL_AD_DECODE_ERROR;
1716                 return 0;
1717                 }
1718
1719         if (!s->hit && tlsext_servername == 1)
1720                 {
1721                 if (s->tlsext_hostname)
1722                         {
1723                         if (s->session->tlsext_hostname == NULL)
1724                                 {
1725                                 s->session->tlsext_hostname = BUF_strdup(s->tlsext_hostname);
1726                                 if (!s->session->tlsext_hostname)
1727                                         {
1728                                         *al = SSL_AD_UNRECOGNIZED_NAME;
1729                                         return 0;
1730                                         }
1731                                 }
1732                         else
1733                                 {
1734                                 *al = SSL_AD_DECODE_ERROR;
1735                                 return 0;
1736                                 }
1737                         }
1738                 }
1739
1740         *p = data;
1741
1742         ri_check:
1743
1744         /* Determine if we need to see RI. Strictly speaking if we want to
1745          * avoid an attack we should *always* see RI even on initial server
1746          * hello because the client doesn't see any renegotiation during an
1747          * attack. However this would mean we could not connect to any server
1748          * which doesn't support RI so for the immediate future tolerate RI
1749          * absence on initial connect only.
1750          */
1751         if (!renegotiate_seen
1752                 && !(s->options & SSL_OP_LEGACY_SERVER_CONNECT)
1753                 && !(s->options & SSL_OP_ALLOW_UNSAFE_LEGACY_RENEGOTIATION))
1754                 {
1755                 *al = SSL_AD_HANDSHAKE_FAILURE;
1756                 SSLerr(SSL_F_SSL_PARSE_SERVERHELLO_TLSEXT,
1757                                 SSL_R_UNSAFE_LEGACY_RENEGOTIATION_DISABLED);
1758                 return 0;
1759                 }
1760
1761         return 1;
1762         }
1763
1764
1765 int ssl_prepare_clienthello_tlsext(SSL *s)
1766         {
1767 #ifndef OPENSSL_NO_EC
1768         /* If we are client and using an elliptic curve cryptography cipher suite, send the point formats
1769          * and elliptic curves we support.
1770          */
1771         int using_ecc = 0;
1772         int i;
1773         unsigned char *j;
1774         unsigned long alg_k, alg_a;
1775         STACK_OF(SSL_CIPHER) *cipher_stack = SSL_get_ciphers(s);
1776
1777         for (i = 0; i < sk_SSL_CIPHER_num(cipher_stack); i++)
1778                 {
1779                 SSL_CIPHER *c = sk_SSL_CIPHER_value(cipher_stack, i);
1780
1781                 alg_k = c->algorithm_mkey;
1782                 alg_a = c->algorithm_auth;
1783                 if ((alg_k & (SSL_kEECDH|SSL_kECDHr|SSL_kECDHe) || (alg_a & SSL_aECDSA)))
1784                         {
1785                         using_ecc = 1;
1786                         break;
1787                         }
1788                 }
1789         using_ecc = using_ecc && (s->version >= TLS1_VERSION);
1790         if (using_ecc)
1791                 {
1792                 if (s->tlsext_ecpointformatlist != NULL) OPENSSL_free(s->tlsext_ecpointformatlist);
1793                 if ((s->tlsext_ecpointformatlist = OPENSSL_malloc(3)) == NULL)
1794                         {
1795                         SSLerr(SSL_F_SSL_PREPARE_CLIENTHELLO_TLSEXT,ERR_R_MALLOC_FAILURE);
1796                         return -1;
1797                         }
1798                 s->tlsext_ecpointformatlist_length = 3;
1799                 s->tlsext_ecpointformatlist[0] = TLSEXT_ECPOINTFORMAT_uncompressed;
1800                 s->tlsext_ecpointformatlist[1] = TLSEXT_ECPOINTFORMAT_ansiX962_compressed_prime;
1801                 s->tlsext_ecpointformatlist[2] = TLSEXT_ECPOINTFORMAT_ansiX962_compressed_char2;
1802
1803                 /* we support all named elliptic curves in draft-ietf-tls-ecc-12 */
1804                 if (s->tlsext_ellipticcurvelist != NULL) OPENSSL_free(s->tlsext_ellipticcurvelist);
1805                 s->tlsext_ellipticcurvelist_length = sizeof(pref_list)/sizeof(pref_list[0]) * 2;
1806                 if ((s->tlsext_ellipticcurvelist = OPENSSL_malloc(s->tlsext_ellipticcurvelist_length)) == NULL)
1807                         {
1808                         s->tlsext_ellipticcurvelist_length = 0;
1809                         SSLerr(SSL_F_SSL_PREPARE_CLIENTHELLO_TLSEXT,ERR_R_MALLOC_FAILURE);
1810                         return -1;
1811                         }
1812                 for (i = 0, j = s->tlsext_ellipticcurvelist; (unsigned int)i <
1813                                 sizeof(pref_list)/sizeof(pref_list[0]); i++)
1814                         {
1815                         int id = tls1_ec_nid2curve_id(pref_list[i]);
1816                         s2n(id,j);
1817                         }
1818                 }
1819 #endif /* OPENSSL_NO_EC */
1820
1821 #ifdef TLSEXT_TYPE_opaque_prf_input
1822         {
1823                 int r = 1;
1824
1825                 if (s->ctx->tlsext_opaque_prf_input_callback != 0)
1826                         {
1827                         r = s->ctx->tlsext_opaque_prf_input_callback(s, NULL, 0, s->ctx->tlsext_opaque_prf_input_callback_arg);
1828                         if (!r)
1829                                 return -1;
1830                         }
1831
1832                 if (s->tlsext_opaque_prf_input != NULL)
1833                         {
1834                         if (s->s3->client_opaque_prf_input != NULL) /* shouldn't really happen */
1835                                 OPENSSL_free(s->s3->client_opaque_prf_input);
1836
1837                         if (s->tlsext_opaque_prf_input_len == 0)
1838                                 s->s3->client_opaque_prf_input = OPENSSL_malloc(1); /* dummy byte just to get non-NULL */
1839                         else
1840                                 s->s3->client_opaque_prf_input = BUF_memdup(s->tlsext_opaque_prf_input, s->tlsext_opaque_prf_input_len);
1841                         if (s->s3->client_opaque_prf_input == NULL)
1842                                 {
1843                                 SSLerr(SSL_F_SSL_PREPARE_CLIENTHELLO_TLSEXT,ERR_R_MALLOC_FAILURE);
1844                                 return -1;
1845                                 }
1846                         s->s3->client_opaque_prf_input_len = s->tlsext_opaque_prf_input_len;
1847                         }
1848
1849                 if (r == 2)
1850                         /* at callback's request, insist on receiving an appropriate server opaque PRF input */
1851                         s->s3->server_opaque_prf_input_len = s->tlsext_opaque_prf_input_len;
1852         }
1853 #endif
1854
1855         return 1;
1856         }
1857
1858 int ssl_prepare_serverhello_tlsext(SSL *s)
1859         {
1860 #ifndef OPENSSL_NO_EC
1861         /* If we are server and using an ECC cipher suite, send the point formats we support
1862          * if the client sent us an ECPointsFormat extension.  Note that the server is not
1863          * supposed to send an EllipticCurves extension.
1864          */
1865
1866         unsigned long alg_k = s->s3->tmp.new_cipher->algorithm_mkey;
1867         unsigned long alg_a = s->s3->tmp.new_cipher->algorithm_auth;
1868         int using_ecc = (alg_k & (SSL_kEECDH|SSL_kECDHr|SSL_kECDHe)) || (alg_a & SSL_aECDSA);
1869         using_ecc = using_ecc && (s->session->tlsext_ecpointformatlist != NULL);
1870
1871         if (using_ecc)
1872                 {
1873                 if (s->tlsext_ecpointformatlist != NULL) OPENSSL_free(s->tlsext_ecpointformatlist);
1874                 if ((s->tlsext_ecpointformatlist = OPENSSL_malloc(3)) == NULL)
1875                         {
1876                         SSLerr(SSL_F_SSL_PREPARE_SERVERHELLO_TLSEXT,ERR_R_MALLOC_FAILURE);
1877                         return -1;
1878                         }
1879                 s->tlsext_ecpointformatlist_length = 3;
1880                 s->tlsext_ecpointformatlist[0] = TLSEXT_ECPOINTFORMAT_uncompressed;
1881                 s->tlsext_ecpointformatlist[1] = TLSEXT_ECPOINTFORMAT_ansiX962_compressed_prime;
1882                 s->tlsext_ecpointformatlist[2] = TLSEXT_ECPOINTFORMAT_ansiX962_compressed_char2;
1883                 }
1884 #endif /* OPENSSL_NO_EC */
1885
1886         return 1;
1887         }
1888
1889 int ssl_check_clienthello_tlsext_early(SSL *s)
1890         {
1891         int ret=SSL_TLSEXT_ERR_NOACK;
1892         int al = SSL_AD_UNRECOGNIZED_NAME;
1893
1894 #ifndef OPENSSL_NO_EC
1895         /* The handling of the ECPointFormats extension is done elsewhere, namely in
1896          * ssl3_choose_cipher in s3_lib.c.
1897          */
1898         /* The handling of the EllipticCurves extension is done elsewhere, namely in
1899          * ssl3_choose_cipher in s3_lib.c.
1900          */
1901 #endif
1902
1903         if (s->ctx != NULL && s->ctx->tlsext_servername_callback != 0)
1904                 ret = s->ctx->tlsext_servername_callback(s, &al, s->ctx->tlsext_servername_arg);
1905         else if (s->initial_ctx != NULL && s->initial_ctx->tlsext_servername_callback != 0)
1906                 ret = s->initial_ctx->tlsext_servername_callback(s, &al, s->initial_ctx->tlsext_servername_arg);
1907
1908 #ifdef TLSEXT_TYPE_opaque_prf_input
1909         {
1910                 /* This sort of belongs into ssl_prepare_serverhello_tlsext(),
1911                  * but we might be sending an alert in response to the client hello,
1912                  * so this has to happen here in
1913                  * ssl_check_clienthello_tlsext_early(). */
1914
1915                 int r = 1;
1916
1917                 if (s->ctx->tlsext_opaque_prf_input_callback != 0)
1918                         {
1919                         r = s->ctx->tlsext_opaque_prf_input_callback(s, NULL, 0, s->ctx->tlsext_opaque_prf_input_callback_arg);
1920                         if (!r)
1921                                 {
1922                                 ret = SSL_TLSEXT_ERR_ALERT_FATAL;
1923                                 al = SSL_AD_INTERNAL_ERROR;
1924                                 goto err;
1925                                 }
1926                         }
1927
1928                 if (s->s3->server_opaque_prf_input != NULL) /* shouldn't really happen */
1929                         OPENSSL_free(s->s3->server_opaque_prf_input);
1930                 s->s3->server_opaque_prf_input = NULL;
1931
1932                 if (s->tlsext_opaque_prf_input != NULL)
1933                         {
1934                         if (s->s3->client_opaque_prf_input != NULL &&
1935                                 s->s3->client_opaque_prf_input_len == s->tlsext_opaque_prf_input_len)
1936                                 {
1937                                 /* can only use this extension if we have a server opaque PRF input
1938                                  * of the same length as the client opaque PRF input! */
1939
1940                                 if (s->tlsext_opaque_prf_input_len == 0)
1941                                         s->s3->server_opaque_prf_input = OPENSSL_malloc(1); /* dummy byte just to get non-NULL */
1942                                 else
1943                                         s->s3->server_opaque_prf_input = BUF_memdup(s->tlsext_opaque_prf_input, s->tlsext_opaque_prf_input_len);
1944                                 if (s->s3->server_opaque_prf_input == NULL)
1945                                         {
1946                                         ret = SSL_TLSEXT_ERR_ALERT_FATAL;
1947                                         al = SSL_AD_INTERNAL_ERROR;
1948                                         goto err;
1949                                         }
1950                                 s->s3->server_opaque_prf_input_len = s->tlsext_opaque_prf_input_len;
1951                                 }
1952                         }
1953
1954                 if (r == 2 && s->s3->server_opaque_prf_input == NULL)
1955                         {
1956                         /* The callback wants to enforce use of the extension,
1957                          * but we can't do that with the client opaque PRF input;
1958                          * abort the handshake.
1959                          */
1960                         ret = SSL_TLSEXT_ERR_ALERT_FATAL;
1961                         al = SSL_AD_HANDSHAKE_FAILURE;
1962                         }
1963         }
1964
1965  err:
1966 #endif
1967         switch (ret)
1968                 {
1969                 case SSL_TLSEXT_ERR_ALERT_FATAL:
1970                         ssl3_send_alert(s,SSL3_AL_FATAL,al);
1971                         return -1;
1972
1973                 case SSL_TLSEXT_ERR_ALERT_WARNING:
1974                         ssl3_send_alert(s,SSL3_AL_WARNING,al);
1975                         return 1;
1976
1977                 case SSL_TLSEXT_ERR_NOACK:
1978                         s->servername_done=0;
1979                         default:
1980                 return 1;
1981                 }
1982         }
1983
1984 int ssl_check_clienthello_tlsext_late(SSL *s)
1985         {
1986         int ret = SSL_TLSEXT_ERR_OK;
1987         int al;
1988
1989         /* If status request then ask callback what to do.
1990          * Note: this must be called after servername callbacks in case
1991          * the certificate has changed, and must be called after the cipher
1992          * has been chosen because this may influence which certificate is sent
1993          */
1994         if ((s->tlsext_status_type != -1) && s->ctx && s->ctx->tlsext_status_cb)
1995                 {
1996                 int r;
1997                 CERT_PKEY *certpkey;
1998                 certpkey = ssl_get_server_send_pkey(s);
1999                 /* If no certificate can't return certificate status */
2000                 if (certpkey == NULL)
2001                         {
2002                         s->tlsext_status_expected = 0;
2003                         return 1;
2004                         }
2005                 /* Set current certificate to one we will use so
2006                  * SSL_get_certificate et al can pick it up.
2007                  */
2008                 s->cert->key = certpkey;
2009                 r = s->ctx->tlsext_status_cb(s, s->ctx->tlsext_status_arg);
2010                 switch (r)
2011                         {
2012                         /* We don't want to send a status request response */
2013                         case SSL_TLSEXT_ERR_NOACK:
2014                                 s->tlsext_status_expected = 0;
2015                                 break;
2016                         /* status request response should be sent */
2017                         case SSL_TLSEXT_ERR_OK:
2018                                 if (s->tlsext_ocsp_resp)
2019                                         s->tlsext_status_expected = 1;
2020                                 else
2021                                         s->tlsext_status_expected = 0;
2022                                 break;
2023                         /* something bad happened */
2024                         case SSL_TLSEXT_ERR_ALERT_FATAL:
2025                                 ret = SSL_TLSEXT_ERR_ALERT_FATAL;
2026                                 al = SSL_AD_INTERNAL_ERROR;
2027                                 goto err;
2028                         }
2029                 }
2030         else
2031                 s->tlsext_status_expected = 0;
2032
2033  err:
2034         switch (ret)
2035                 {
2036                 case SSL_TLSEXT_ERR_ALERT_FATAL:
2037                         ssl3_send_alert(s,SSL3_AL_FATAL,al);
2038                         return -1;
2039
2040                 case SSL_TLSEXT_ERR_ALERT_WARNING:
2041                         ssl3_send_alert(s,SSL3_AL_WARNING,al);
2042                         return 1;
2043
2044                 default:
2045                         return 1;
2046                 }
2047         }
2048
2049 int ssl_check_serverhello_tlsext(SSL *s)
2050         {
2051         int ret=SSL_TLSEXT_ERR_NOACK;
2052         int al = SSL_AD_UNRECOGNIZED_NAME;
2053
2054 #ifndef OPENSSL_NO_EC
2055         /* If we are client and using an elliptic curve cryptography cipher
2056          * suite, then if server returns an EC point formats lists extension
2057          * it must contain uncompressed.
2058          */
2059         unsigned long alg_k = s->s3->tmp.new_cipher->algorithm_mkey;
2060         unsigned long alg_a = s->s3->tmp.new_cipher->algorithm_auth;
2061         if ((s->tlsext_ecpointformatlist != NULL) && (s->tlsext_ecpointformatlist_length > 0) &&
2062             (s->session->tlsext_ecpointformatlist != NULL) && (s->session->tlsext_ecpointformatlist_length > 0) &&
2063             ((alg_k & (SSL_kEECDH|SSL_kECDHr|SSL_kECDHe)) || (alg_a & SSL_aECDSA)))
2064                 {
2065                 /* we are using an ECC cipher */
2066                 size_t i;
2067                 unsigned char *list;
2068                 int found_uncompressed = 0;
2069                 list = s->session->tlsext_ecpointformatlist;
2070                 for (i = 0; i < s->session->tlsext_ecpointformatlist_length; i++)
2071                         {
2072                         if (*(list++) == TLSEXT_ECPOINTFORMAT_uncompressed)
2073                                 {
2074                                 found_uncompressed = 1;
2075                                 break;
2076                                 }
2077                         }
2078                 if (!found_uncompressed)
2079                         {
2080                         SSLerr(SSL_F_SSL_CHECK_SERVERHELLO_TLSEXT,SSL_R_TLS_INVALID_ECPOINTFORMAT_LIST);
2081                         return -1;
2082                         }
2083                 }
2084         ret = SSL_TLSEXT_ERR_OK;
2085 #endif /* OPENSSL_NO_EC */
2086
2087         if (s->ctx != NULL && s->ctx->tlsext_servername_callback != 0)
2088                 ret = s->ctx->tlsext_servername_callback(s, &al, s->ctx->tlsext_servername_arg);
2089         else if (s->initial_ctx != NULL && s->initial_ctx->tlsext_servername_callback != 0)
2090                 ret = s->initial_ctx->tlsext_servername_callback(s, &al, s->initial_ctx->tlsext_servername_arg);
2091
2092 #ifdef TLSEXT_TYPE_opaque_prf_input
2093         if (s->s3->server_opaque_prf_input_len > 0)
2094                 {
2095                 /* This case may indicate that we, as a client, want to insist on using opaque PRF inputs.
2096                  * So first verify that we really have a value from the server too. */
2097
2098                 if (s->s3->server_opaque_prf_input == NULL)
2099                         {
2100                         ret = SSL_TLSEXT_ERR_ALERT_FATAL;
2101                         al = SSL_AD_HANDSHAKE_FAILURE;
2102                         }
2103
2104                 /* Anytime the server *has* sent an opaque PRF input, we need to check
2105                  * that we have a client opaque PRF input of the same size. */
2106                 if (s->s3->client_opaque_prf_input == NULL ||
2107                     s->s3->client_opaque_prf_input_len != s->s3->server_opaque_prf_input_len)
2108                         {
2109                         ret = SSL_TLSEXT_ERR_ALERT_FATAL;
2110                         al = SSL_AD_ILLEGAL_PARAMETER;
2111                         }
2112                 }
2113 #endif
2114
2115         /* If we've requested certificate status and we wont get one
2116          * tell the callback
2117          */
2118         if ((s->tlsext_status_type != -1) && !(s->tlsext_status_expected)
2119                         && s->ctx && s->ctx->tlsext_status_cb)
2120                 {
2121                 int r;
2122                 /* Set resp to NULL, resplen to -1 so callback knows
2123                  * there is no response.
2124                  */
2125                 if (s->tlsext_ocsp_resp)
2126                         {
2127                         OPENSSL_free(s->tlsext_ocsp_resp);
2128                         s->tlsext_ocsp_resp = NULL;
2129                         }
2130                 s->tlsext_ocsp_resplen = -1;
2131                 r = s->ctx->tlsext_status_cb(s, s->ctx->tlsext_status_arg);
2132                 if (r == 0)
2133                         {
2134                         al = SSL_AD_BAD_CERTIFICATE_STATUS_RESPONSE;
2135                         ret = SSL_TLSEXT_ERR_ALERT_FATAL;
2136                         }
2137                 if (r < 0)
2138                         {
2139                         al = SSL_AD_INTERNAL_ERROR;
2140                         ret = SSL_TLSEXT_ERR_ALERT_FATAL;
2141                         }
2142                 }
2143
2144         switch (ret)
2145                 {
2146                 case SSL_TLSEXT_ERR_ALERT_FATAL:
2147                         ssl3_send_alert(s,SSL3_AL_FATAL,al);
2148                         return -1;
2149
2150                 case SSL_TLSEXT_ERR_ALERT_WARNING:
2151                         ssl3_send_alert(s,SSL3_AL_WARNING,al);
2152                         return 1;
2153
2154                 case SSL_TLSEXT_ERR_NOACK:
2155                         s->servername_done=0;
2156                         default:
2157                 return 1;
2158                 }
2159         }
2160
2161 /* Since the server cache lookup is done early on in the processing of the
2162  * ClientHello, and other operations depend on the result, we need to handle
2163  * any TLS session ticket extension at the same time.
2164  *
2165  *   session_id: points at the session ID in the ClientHello. This code will
2166  *       read past the end of this in order to parse out the session ticket
2167  *       extension, if any.
2168  *   len: the length of the session ID.
2169  *   limit: a pointer to the first byte after the ClientHello.
2170  *   ret: (output) on return, if a ticket was decrypted, then this is set to
2171  *       point to the resulting session.
2172  *
2173  * If s->tls_session_secret_cb is set then we are expecting a pre-shared key
2174  * ciphersuite, in which case we have no use for session tickets and one will
2175  * never be decrypted, nor will s->tlsext_ticket_expected be set to 1.
2176  *
2177  * Returns:
2178  *   -1: fatal error, either from parsing or decrypting the ticket.
2179  *    0: no ticket was found (or was ignored, based on settings).
2180  *    1: a zero length extension was found, indicating that the client supports
2181  *       session tickets but doesn't currently have one to offer.
2182  *    2: either s->tls_session_secret_cb was set, or a ticket was offered but
2183  *       couldn't be decrypted because of a non-fatal error.
2184  *    3: a ticket was successfully decrypted and *ret was set.
2185  *
2186  * Side effects:
2187  *   Sets s->tlsext_ticket_expected to 1 if the server will have to issue
2188  *   a new session ticket to the client because the client indicated support
2189  *   (and s->tls_session_secret_cb is NULL) but the client either doesn't have
2190  *   a session ticket or we couldn't use the one it gave us, or if
2191  *   s->ctx->tlsext_ticket_key_cb asked to renew the client's ticket.
2192  *   Otherwise, s->tlsext_ticket_expected is set to 0.
2193  */
2194 int tls1_process_ticket(SSL *s, unsigned char *session_id, int len,
2195                         const unsigned char *limit, SSL_SESSION **ret)
2196         {
2197         /* Point after session ID in client hello */
2198         const unsigned char *p = session_id + len;
2199         unsigned short i;
2200
2201         *ret = NULL;
2202         s->tlsext_ticket_expected = 0;
2203
2204         /* If tickets disabled behave as if no ticket present
2205          * to permit stateful resumption.
2206          */
2207         if (SSL_get_options(s) & SSL_OP_NO_TICKET)
2208                 return 0;
2209         if ((s->version <= SSL3_VERSION) || !limit)
2210                 return 0;
2211         if (p >= limit)
2212                 return -1;
2213         /* Skip past DTLS cookie */
2214         if (s->version == DTLS1_VERSION || s->version == DTLS1_BAD_VER)
2215                 {
2216                 i = *(p++);
2217                 p+= i;
2218                 if (p >= limit)
2219                         return -1;
2220                 }
2221         /* Skip past cipher list */
2222         n2s(p, i);
2223         p+= i;
2224         if (p >= limit)
2225                 return -1;
2226         /* Skip past compression algorithm list */
2227         i = *(p++);
2228         p += i;
2229         if (p > limit)
2230                 return -1;
2231         /* Now at start of extensions */
2232         if ((p + 2) >= limit)
2233                 return 0;
2234         n2s(p, i);
2235         while ((p + 4) <= limit)
2236                 {
2237                 unsigned short type, size;
2238                 n2s(p, type);
2239                 n2s(p, size);
2240                 if (p + size > limit)
2241                         return 0;
2242                 if (type == TLSEXT_TYPE_session_ticket)
2243                         {
2244                         int r;
2245                         if (size == 0)
2246                                 {
2247                                 /* The client will accept a ticket but doesn't
2248                                  * currently have one. */
2249                                 s->tlsext_ticket_expected = 1;
2250                                 return 1;
2251                                 }
2252                         if (s->tls_session_secret_cb)
2253                                 {
2254                                 /* Indicate that the ticket couldn't be
2255                                  * decrypted rather than generating the session
2256                                  * from ticket now, trigger abbreviated
2257                                  * handshake based on external mechanism to
2258                                  * calculate the master secret later. */
2259                                 return 2;
2260                                 }
2261                         r = tls_decrypt_ticket(s, p, size, session_id, len, ret);
2262                         switch (r)
2263                                 {
2264                                 case 2: /* ticket couldn't be decrypted */
2265                                         s->tlsext_ticket_expected = 1;
2266                                         return 2;
2267                                 case 3: /* ticket was decrypted */
2268                                         return r;
2269                                 case 4: /* ticket decrypted but need to renew */
2270                                         s->tlsext_ticket_expected = 1;
2271                                         return 3;
2272                                 default: /* fatal error */
2273                                         return -1;
2274                                 }
2275                         }
2276                 p += size;
2277                 }
2278         return 0;
2279         }
2280
2281 /* tls_decrypt_ticket attempts to decrypt a session ticket.
2282  *
2283  *   etick: points to the body of the session ticket extension.
2284  *   eticklen: the length of the session tickets extenion.
2285  *   sess_id: points at the session ID.
2286  *   sesslen: the length of the session ID.
2287  *   psess: (output) on return, if a ticket was decrypted, then this is set to
2288  *       point to the resulting session.
2289  *
2290  * Returns:
2291  *   -1: fatal error, either from parsing or decrypting the ticket.
2292  *    2: the ticket couldn't be decrypted.
2293  *    3: a ticket was successfully decrypted and *psess was set.
2294  *    4: same as 3, but the ticket needs to be renewed.
2295  */
2296 static int tls_decrypt_ticket(SSL *s, const unsigned char *etick, int eticklen,
2297                                 const unsigned char *sess_id, int sesslen,
2298                                 SSL_SESSION **psess)
2299         {
2300         SSL_SESSION *sess;
2301         unsigned char *sdec;
2302         const unsigned char *p;
2303         int slen, mlen, renew_ticket = 0;
2304         unsigned char tick_hmac[EVP_MAX_MD_SIZE];
2305         HMAC_CTX hctx;
2306         EVP_CIPHER_CTX ctx;
2307         SSL_CTX *tctx = s->initial_ctx;
2308         /* Need at least keyname + iv + some encrypted data */
2309         if (eticklen < 48)
2310                 return 2;
2311         /* Initialize session ticket encryption and HMAC contexts */
2312         HMAC_CTX_init(&hctx);
2313         EVP_CIPHER_CTX_init(&ctx);
2314         if (tctx->tlsext_ticket_key_cb)
2315                 {
2316                 unsigned char *nctick = (unsigned char *)etick;
2317                 int rv = tctx->tlsext_ticket_key_cb(s, nctick, nctick + 16,
2318                                                         &ctx, &hctx, 0);
2319                 if (rv < 0)
2320                         return -1;
2321                 if (rv == 0)
2322                         return 2;
2323                 if (rv == 2)
2324                         renew_ticket = 1;
2325                 }
2326         else
2327                 {
2328                 /* Check key name matches */
2329                 if (memcmp(etick, tctx->tlsext_tick_key_name, 16))
2330                         return 2;
2331                 HMAC_Init_ex(&hctx, tctx->tlsext_tick_hmac_key, 16,
2332                                         tlsext_tick_md(), NULL);
2333                 EVP_DecryptInit_ex(&ctx, EVP_aes_128_cbc(), NULL,
2334                                 tctx->tlsext_tick_aes_key, etick + 16);
2335                 }
2336         /* Attempt to process session ticket, first conduct sanity and
2337          * integrity checks on ticket.
2338          */
2339         mlen = HMAC_size(&hctx);
2340         if (mlen < 0)
2341                 {
2342                 EVP_CIPHER_CTX_cleanup(&ctx);
2343                 return -1;
2344                 }
2345         eticklen -= mlen;
2346         /* Check HMAC of encrypted ticket */
2347         HMAC_Update(&hctx, etick, eticklen);
2348         HMAC_Final(&hctx, tick_hmac, NULL);
2349         HMAC_CTX_cleanup(&hctx);
2350         if (CRYPTO_memcmp(tick_hmac, etick + eticklen, mlen))
2351                 return 2;
2352         /* Attempt to decrypt session data */
2353         /* Move p after IV to start of encrypted ticket, update length */
2354         p = etick + 16 + EVP_CIPHER_CTX_iv_length(&ctx);
2355         eticklen -= 16 + EVP_CIPHER_CTX_iv_length(&ctx);
2356         sdec = OPENSSL_malloc(eticklen);
2357         if (!sdec)
2358                 {
2359                 EVP_CIPHER_CTX_cleanup(&ctx);
2360                 return -1;
2361                 }
2362         EVP_DecryptUpdate(&ctx, sdec, &slen, p, eticklen);
2363         if (EVP_DecryptFinal(&ctx, sdec + slen, &mlen) <= 0)
2364                 return 2;
2365         slen += mlen;
2366         EVP_CIPHER_CTX_cleanup(&ctx);
2367         p = sdec;
2368
2369         sess = d2i_SSL_SESSION(NULL, &p, slen);
2370         OPENSSL_free(sdec);
2371         if (sess)
2372                 {
2373                 /* The session ID, if non-empty, is used by some clients to
2374                  * detect that the ticket has been accepted. So we copy it to
2375                  * the session structure. If it is empty set length to zero
2376                  * as required by standard.
2377                  */
2378                 if (sesslen)
2379                         memcpy(sess->session_id, sess_id, sesslen);
2380                 sess->session_id_length = sesslen;
2381                 *psess = sess;
2382                 if (renew_ticket)
2383                         return 4;
2384                 else
2385                         return 3;
2386                 }
2387         ERR_clear_error();
2388         /* For session parse failure, indicate that we need to send a new
2389          * ticket. */
2390         return 2;
2391         }
2392
2393 /* Tables to translate from NIDs to TLS v1.2 ids */
2394
2395 typedef struct
2396         {
2397         int nid;
2398         int id;
2399         } tls12_lookup;
2400
2401 static tls12_lookup tls12_md[] = {
2402 #ifndef OPENSSL_NO_MD5
2403         {NID_md5, TLSEXT_hash_md5},
2404 #endif
2405 #ifndef OPENSSL_NO_SHA
2406         {NID_sha1, TLSEXT_hash_sha1},
2407 #endif
2408 #ifndef OPENSSL_NO_SHA256
2409         {NID_sha224, TLSEXT_hash_sha224},
2410         {NID_sha256, TLSEXT_hash_sha256},
2411 #endif
2412 #ifndef OPENSSL_NO_SHA512
2413         {NID_sha384, TLSEXT_hash_sha384},
2414         {NID_sha512, TLSEXT_hash_sha512}
2415 #endif
2416 };
2417
2418 static tls12_lookup tls12_sig[] = {
2419 #ifndef OPENSSL_NO_RSA
2420         {EVP_PKEY_RSA, TLSEXT_signature_rsa},
2421 #endif
2422 #ifndef OPENSSL_NO_DSA
2423         {EVP_PKEY_DSA, TLSEXT_signature_dsa},
2424 #endif
2425 #ifndef OPENSSL_NO_ECDSA
2426         {EVP_PKEY_EC, TLSEXT_signature_ecdsa}
2427 #endif
2428 };
2429
2430 static int tls12_find_id(int nid, tls12_lookup *table, size_t tlen)
2431         {
2432         size_t i;
2433         for (i = 0; i < tlen; i++)
2434                 {
2435                 if (table[i].nid == nid)
2436                         return table[i].id;
2437                 }
2438         return -1;
2439         }
2440 #if 0
2441 static int tls12_find_nid(int id, tls12_lookup *table, size_t tlen)
2442         {
2443         size_t i;
2444         for (i = 0; i < tlen; i++)
2445                 {
2446                 if (table[i].id == id)
2447                         return table[i].nid;
2448                 }
2449         return -1;
2450         }
2451 #endif
2452
2453 int tls12_get_sigandhash(unsigned char *p, const EVP_PKEY *pk, const EVP_MD *md)
2454         {
2455         int sig_id, md_id;
2456         if (!md)
2457                 return 0;
2458         md_id = tls12_find_id(EVP_MD_type(md), tls12_md,
2459                                 sizeof(tls12_md)/sizeof(tls12_lookup));
2460         if (md_id == -1)
2461                 return 0;
2462         sig_id = tls12_get_sigid(pk);
2463         if (sig_id == -1)
2464                 return 0;
2465         p[0] = (unsigned char)md_id;
2466         p[1] = (unsigned char)sig_id;
2467         return 1;
2468         }
2469
2470 int tls12_get_sigid(const EVP_PKEY *pk)
2471         {
2472         return tls12_find_id(pk->type, tls12_sig,
2473                                 sizeof(tls12_sig)/sizeof(tls12_lookup));
2474         }
2475
2476 const EVP_MD *tls12_get_hash(unsigned char hash_alg)
2477         {
2478         switch(hash_alg)
2479                 {
2480 #ifndef OPENSSL_NO_SHA
2481                 case TLSEXT_hash_sha1:
2482                 return EVP_sha1();
2483 #endif
2484 #ifndef OPENSSL_NO_SHA256
2485                 case TLSEXT_hash_sha224:
2486                 return EVP_sha224();
2487
2488                 case TLSEXT_hash_sha256:
2489                 return EVP_sha256();
2490 #endif
2491 #ifndef OPENSSL_NO_SHA512
2492                 case TLSEXT_hash_sha384:
2493                 return EVP_sha384();
2494
2495                 case TLSEXT_hash_sha512:
2496                 return EVP_sha512();
2497 #endif
2498                 default:
2499                 return NULL;
2500
2501                 }
2502         }
2503
2504 /* Set preferred digest for each key type */
2505
2506 int tls1_process_sigalgs(SSL *s, const unsigned char *data, int dsize)
2507         {
2508         int i, idx;
2509         const EVP_MD *md;
2510         CERT *c = s->cert;
2511         /* Extension ignored for TLS versions below 1.2 */
2512         if (TLS1_get_version(s) < TLS1_2_VERSION)
2513                 return 1;
2514         /* Should never happen */
2515         if (!c)
2516                 return 0;
2517
2518         c->pkeys[SSL_PKEY_DSA_SIGN].digest = NULL;
2519         c->pkeys[SSL_PKEY_RSA_SIGN].digest = NULL;
2520         c->pkeys[SSL_PKEY_RSA_ENC].digest = NULL;
2521         c->pkeys[SSL_PKEY_ECC].digest = NULL;
2522
2523         for (i = 0; i < dsize; i += 2)
2524                 {
2525                 unsigned char hash_alg = data[i], sig_alg = data[i+1];
2526
2527                 switch(sig_alg)
2528                         {
2529 #ifndef OPENSSL_NO_RSA
2530                         case TLSEXT_signature_rsa:
2531                         idx = SSL_PKEY_RSA_SIGN;
2532                         break;
2533 #endif
2534 #ifndef OPENSSL_NO_DSA
2535                         case TLSEXT_signature_dsa:
2536                         idx = SSL_PKEY_DSA_SIGN;
2537                         break;
2538 #endif
2539 #ifndef OPENSSL_NO_ECDSA
2540                         case TLSEXT_signature_ecdsa:
2541                         idx = SSL_PKEY_ECC;
2542                         break;
2543 #endif
2544                         default:
2545                         continue;
2546                         }
2547
2548                 if (c->pkeys[idx].digest == NULL)
2549                         {
2550                         md = tls12_get_hash(hash_alg);
2551                         if (md)
2552                                 {
2553                                 c->pkeys[idx].digest = md;
2554                                 if (idx == SSL_PKEY_RSA_SIGN)
2555                                         c->pkeys[SSL_PKEY_RSA_ENC].digest = md;
2556                                 }
2557                         }
2558
2559                 }
2560
2561
2562         /* Set any remaining keys to default values. NOTE: if alg is not
2563          * supported it stays as NULL.
2564          */
2565 #ifndef OPENSSL_NO_DSA
2566         if (!c->pkeys[SSL_PKEY_DSA_SIGN].digest)
2567                 c->pkeys[SSL_PKEY_DSA_SIGN].digest = EVP_sha1();
2568 #endif
2569 #ifndef OPENSSL_NO_RSA
2570         if (!c->pkeys[SSL_PKEY_RSA_SIGN].digest)
2571                 {
2572                 c->pkeys[SSL_PKEY_RSA_SIGN].digest = EVP_sha1();
2573                 c->pkeys[SSL_PKEY_RSA_ENC].digest = EVP_sha1();
2574                 }
2575 #endif
2576 #ifndef OPENSSL_NO_ECDSA
2577         if (!c->pkeys[SSL_PKEY_ECC].digest)
2578                 c->pkeys[SSL_PKEY_ECC].digest = EVP_sha1();
2579 #endif
2580         return 1;
2581         }
2582
2583 #endif
2584
2585 #ifndef OPENSSL_NO_HEARTBEATS
2586 int
2587 tls1_process_heartbeat(SSL *s)
2588         {
2589         unsigned char *p = &s->s3->rrec.data[0], *pl;
2590         unsigned short hbtype;
2591         unsigned int payload;
2592         unsigned int padding = 16; /* Use minimum padding */
2593
2594         if (s->msg_callback)
2595                 s->msg_callback(0, s->version, TLS1_RT_HEARTBEAT,
2596                         &s->s3->rrec.data[0], s->s3->rrec.length,
2597                         s, s->msg_callback_arg);
2598
2599         /* Read type and payload length first */
2600         if (1 + 2 + 16 > s->s3->rrec.length)
2601                 return 0; /* silently discard */
2602         hbtype = *p++;
2603         n2s(p, payload);
2604         if (1 + 2 + payload + 16 > s->s3->rrec.length)
2605                 return 0; /* silently discard per RFC 6520 sec. 4 */
2606         pl = p;
2607
2608         if (hbtype == TLS1_HB_REQUEST)
2609                 {
2610                 unsigned char *buffer, *bp;
2611                 int r;
2612
2613                 /* Allocate memory for the response, size is 1 bytes
2614                  * message type, plus 2 bytes payload length, plus
2615                  * payload, plus padding
2616                  */
2617                 buffer = OPENSSL_malloc(1 + 2 + payload + padding);
2618                 bp = buffer;
2619
2620                 /* Enter response type, length and copy payload */
2621                 *bp++ = TLS1_HB_RESPONSE;
2622                 s2n(payload, bp);
2623                 memcpy(bp, pl, payload);
2624                 bp += payload;
2625                 /* Random padding */
2626                 RAND_pseudo_bytes(bp, padding);
2627
2628                 r = ssl3_write_bytes(s, TLS1_RT_HEARTBEAT, buffer, 3 + payload + padding);
2629
2630                 if (r >= 0 && s->msg_callback)
2631                         s->msg_callback(1, s->version, TLS1_RT_HEARTBEAT,
2632                                 buffer, 3 + payload + padding,
2633                                 s, s->msg_callback_arg);
2634
2635                 OPENSSL_free(buffer);
2636
2637                 if (r < 0)
2638                         return r;
2639                 }
2640         else if (hbtype == TLS1_HB_RESPONSE)
2641                 {
2642                 unsigned int seq;
2643
2644                 /* We only send sequence numbers (2 bytes unsigned int),
2645                  * and 16 random bytes, so we just try to read the
2646                  * sequence number */
2647                 n2s(pl, seq);
2648
2649                 if (payload == 18 && seq == s->tlsext_hb_seq)
2650                         {
2651                         s->tlsext_hb_seq++;
2652                         s->tlsext_hb_pending = 0;
2653                         }
2654                 }
2655
2656         return 0;
2657         }
2658
2659 int
2660 tls1_heartbeat(SSL *s)
2661         {
2662         unsigned char *buf, *p;
2663         int ret;
2664         unsigned int payload = 18; /* Sequence number + random bytes */
2665         unsigned int padding = 16; /* Use minimum padding */
2666
2667         /* Only send if peer supports and accepts HB requests... */
2668         if (!(s->tlsext_heartbeat & SSL_TLSEXT_HB_ENABLED) ||
2669             s->tlsext_heartbeat & SSL_TLSEXT_HB_DONT_SEND_REQUESTS)
2670                 {
2671                 SSLerr(SSL_F_TLS1_HEARTBEAT,SSL_R_TLS_HEARTBEAT_PEER_DOESNT_ACCEPT);
2672                 return -1;
2673                 }
2674
2675         /* ...and there is none in flight yet... */
2676         if (s->tlsext_hb_pending)
2677                 {
2678                 SSLerr(SSL_F_TLS1_HEARTBEAT,SSL_R_TLS_HEARTBEAT_PENDING);
2679                 return -1;
2680                 }
2681
2682         /* ...and no handshake in progress. */
2683         if (SSL_in_init(s) || s->in_handshake)
2684                 {
2685                 SSLerr(SSL_F_TLS1_HEARTBEAT,SSL_R_UNEXPECTED_MESSAGE);
2686                 return -1;
2687                 }
2688
2689         /* Check if padding is too long, payload and padding
2690          * must not exceed 2^14 - 3 = 16381 bytes in total.
2691          */
2692         OPENSSL_assert(payload + padding <= 16381);
2693
2694         /* Create HeartBeat message, we just use a sequence number
2695          * as payload to distuingish different messages and add
2696          * some random stuff.
2697          *  - Message Type, 1 byte
2698          *  - Payload Length, 2 bytes (unsigned int)
2699          *  - Payload, the sequence number (2 bytes uint)
2700          *  - Payload, random bytes (16 bytes uint)
2701          *  - Padding
2702          */
2703         buf = OPENSSL_malloc(1 + 2 + payload + padding);
2704         p = buf;
2705         /* Message Type */
2706         *p++ = TLS1_HB_REQUEST;
2707         /* Payload length (18 bytes here) */
2708         s2n(payload, p);
2709         /* Sequence number */
2710         s2n(s->tlsext_hb_seq, p);
2711         /* 16 random bytes */
2712         RAND_pseudo_bytes(p, 16);
2713         p += 16;
2714         /* Random padding */
2715         RAND_pseudo_bytes(p, padding);
2716
2717         ret = ssl3_write_bytes(s, TLS1_RT_HEARTBEAT, buf, 3 + payload + padding);
2718         if (ret >= 0)
2719                 {
2720                 if (s->msg_callback)
2721                         s->msg_callback(1, s->version, TLS1_RT_HEARTBEAT,
2722                                 buf, 3 + payload + padding,
2723                                 s, s->msg_callback_arg);
2724
2725                 s->tlsext_hb_pending = 1;
2726                 }
2727
2728         OPENSSL_free(buf);
2729
2730         return ret;
2731         }
2732 #endif