ssl/t1_lib.c

   1 /* ssl/t1_lib.c */
   2 /* Copyright (C) 1995-1998 Eric Young (eay@cryptsoft.com)
   3  * All rights reserved.
   4  *
   5  * This package is an SSL implementation written
   6  * by Eric Young (eay@cryptsoft.com).
   7  * The implementation was written so as to conform with Netscapes SSL.
   8  *
   9  * This library is free for commercial and non-commercial use as long as
  10  * the following conditions are aheared to.  The following conditions
  11  * apply to all code found in this distribution, be it the RC4, RSA,
  12  * lhash, DES, etc., code; not just the SSL code.  The SSL documentation
  13  * included with this distribution is covered by the same copyright terms
  14  * except that the holder is Tim Hudson (tjh@cryptsoft.com).
  15  *
  16  * Copyright remains Eric Young's, and as such any Copyright notices in
  17  * the code are not to be removed.
  18  * If this package is used in a product, Eric Young should be given attribution
  19  * as the author of the parts of the library used.
  20  * This can be in the form of a textual message at program startup or
  21  * in documentation (online or textual) provided with the package.
  22  *
  23  * Redistribution and use in source and binary forms, with or without
  24  * modification, are permitted provided that the following conditions
  25  * are met:
  26  * 1. Redistributions of source code must retain the copyright
  27  *    notice, this list of conditions and the following disclaimer.
  28  * 2. Redistributions in binary form must reproduce the above copyright
  29  *    notice, this list of conditions and the following disclaimer in the
  30  *    documentation and/or other materials provided with the distribution.
  31  * 3. All advertising materials mentioning features or use of this software
  32  *    must display the following acknowledgement:
  33  *    "This product includes cryptographic software written by
  34  *     Eric Young (eay@cryptsoft.com)"
  35  *    The word 'cryptographic' can be left out if the rouines from the library
  36  *    being used are not cryptographic related :-).
  37  * 4. If you include any Windows specific code (or a derivative thereof) from
  38  *    the apps directory (application code) you must include an acknowledgement:
  39  *    "This product includes software written by Tim Hudson (tjh@cryptsoft.com)"
  40  *
  41  * THIS SOFTWARE IS PROVIDED BY ERIC YOUNG ``AS IS'' AND
  42  * ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
  43  * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE
  44  * ARE DISCLAIMED.  IN NO EVENT SHALL THE AUTHOR OR CONTRIBUTORS BE LIABLE
  45  * FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL
  46  * DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS
  47  * OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION)
  48  * HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT
  49  * LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY
  50  * OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF
  51  * SUCH DAMAGE.
  52  *
  53  * The licence and distribution terms for any publically available version or
  54  * derivative of this code cannot be changed.  i.e. this code cannot simply be
  55  * copied and put under another distribution licence
  56  * [including the GNU Public Licence.]
  57  */
  58
  59 #include <stdio.h>
  60 #include <openssl/objects.h>
  61 #include <openssl/evp.h>
  62 #include <openssl/hmac.h>
  63 #include <openssl/ocsp.h>
  64 #include "ssl_locl.h"
  65
  66 const char tls1_version_str[]="TLSv1" OPENSSL_VERSION_PTEXT;
  67
  68 #ifndef OPENSSL_NO_TLSEXT
  69 static int tls_decrypt_ticket(SSL *s, const unsigned char *tick, int ticklen,
  70                                 const unsigned char *sess_id, int sesslen,
  71                                 SSL_SESSION **psess);
  72 #endif
  73
  74 SSL3_ENC_METHOD TLSv1_enc_data={
  75         tls1_enc,
  76         tls1_mac,
  77         tls1_setup_key_block,
  78         tls1_generate_master_secret,
  79         tls1_change_cipher_state,
  80         tls1_final_finish_mac,
  81         TLS1_FINISH_MAC_LENGTH,
  82         tls1_cert_verify_mac,
  83         TLS_MD_CLIENT_FINISH_CONST,TLS_MD_CLIENT_FINISH_CONST_SIZE,
  84         TLS_MD_SERVER_FINISH_CONST,TLS_MD_SERVER_FINISH_CONST_SIZE,
  85         tls1_alert_code,
  86         };
  87
  88 long tls1_default_timeout(void)
  89         {
  90         /* 2 hours, the 24 hours mentioned in the TLSv1 spec
  91          * is way too long for http, the cache would over fill */
  92         return(60*60*2);
  93         }
  94
  95 IMPLEMENT_tls1_meth_func(tlsv1_base_method,
  96                         ssl_undefined_function,
  97                         ssl_undefined_function,
  98                         ssl_bad_method)
  99
 100 int tls1_new(SSL *s)
 101         {
 102         if (!ssl3_new(s)) return(0);
 103         s->method->ssl_clear(s);
 104         return(1);
 105         }
 106
 107 void tls1_free(SSL *s)
 108         {
 109         ssl3_free(s);
 110         }
 111
 112 void tls1_clear(SSL *s)
 113         {
 114         ssl3_clear(s);
 115         s->version=TLS1_VERSION;
 116         }
 117
 118 #if 0
 119 long tls1_ctrl(SSL *s, int cmd, long larg, char *parg)
 120         {
 121         return(0);
 122         }
 123
 124 long tls1_callback_ctrl(SSL *s, int cmd, void *(*fp)())
 125         {
 126         return(0);
 127         }
 128 #endif
 129
 130 #ifndef OPENSSL_NO_TLSEXT
 131 unsigned char *ssl_add_clienthello_tlsext(SSL *s, unsigned char *p, unsigned char *limit)
 132         {
 133         int extdatalen=0;
 134         unsigned char *ret = p;
 135
 136         /* don't add extensions for SSLv3 unless doing secure renegotiation */
 137         if (s->client_version == SSL3_VERSION
 138                                         && !s->s3->send_connection_binding)
 139                 return p;
 140
 141         ret+=2;
 142
 143         if (ret>=limit) return NULL; /* this really never occurs, but ... */
 144
 145         if (s->tlsext_hostname != NULL)
 146                 {
 147                 /* Add TLS extension servername to the Client Hello message */
 148                 unsigned long size_str;
 149                 long lenmax;
 150
 151                 /* check for enough space.
 152                    4 for the servername type and entension length
 153                    2 for servernamelist length
 154                    1 for the hostname type
 155                    2 for hostname length
 156                    + hostname length
 157                 */
 158
 159                 if ((lenmax = limit - ret - 9) < 0
 160                 || (size_str = strlen(s->tlsext_hostname)) > (unsigned long)lenmax)
 161                         return NULL;
 162
 163                 /* extension type and length */
 164                 s2n(TLSEXT_TYPE_server_name,ret);
 165                 s2n(size_str+5,ret);
 166
 167                 /* length of servername list */
 168                 s2n(size_str+3,ret);
 169
 170                 /* hostname type, length and hostname */
 171                 *(ret++) = (unsigned char) TLSEXT_NAMETYPE_host_name;
 172                 s2n(size_str,ret);
 173                 memcpy(ret, s->tlsext_hostname, size_str);
 174                 ret+=size_str;
 175
 176                 }
 177
 178         /* Add the renegotiation option: TODOEKR switch */
 179         {
 180           int el;
 181
 182           if(!ssl_add_clienthello_renegotiate_ext(s, 0, &el, 0))
 183               {
 184               SSLerr(SSL_F_SSL_ADD_CLIENTHELLO_TLSEXT, ERR_R_INTERNAL_ERROR);
 185               return NULL;
 186               }
 187
 188           if((limit - p - 4 - el) < 0) return NULL;
 189
 190           s2n(TLSEXT_TYPE_renegotiate,ret);
 191           s2n(el,ret);
 192
 193           if(!ssl_add_clienthello_renegotiate_ext(s, ret, &el, el))
 194               {
 195               SSLerr(SSL_F_SSL_ADD_CLIENTHELLO_TLSEXT, ERR_R_INTERNAL_ERROR);
 196               return NULL;
 197               }
 198
 199           ret += el;
 200         }
 201
 202
 203         if (!(SSL_get_options(s) & SSL_OP_NO_TICKET))
 204                 {
 205                 int ticklen;
 206                 if (!s->new_session && s->session && s->session->tlsext_tick)
 207                         ticklen = s->session->tlsext_ticklen;
 208                 else
 209                         ticklen = 0;
 210                 /* Check for enough room 2 for extension type, 2 for len
 211                  * rest for ticket
 212                  */
 213                 if (limit - ret - 4 - ticklen < 0)
 214                         return NULL;
 215                 s2n(TLSEXT_TYPE_session_ticket,ret);
 216                 s2n(ticklen,ret);
 217                 if (ticklen)
 218                         {
 219                         memcpy(ret, s->session->tlsext_tick, ticklen);
 220                         ret += ticklen;
 221                         }
 222                 }
 223
 224         if (s->tlsext_status_type == TLSEXT_STATUSTYPE_ocsp &&
 225             s->version != DTLS1_VERSION)
 226                 {
 227                 int i;
 228                 long extlen, idlen, itmp;
 229                 OCSP_RESPID *id;
 230
 231                 idlen = 0;
 232                 for (i = 0; i < sk_OCSP_RESPID_num(s->tlsext_ocsp_ids); i++)
 233                         {
 234                         id = sk_OCSP_RESPID_value(s->tlsext_ocsp_ids, i);
 235                         itmp = i2d_OCSP_RESPID(id, NULL);
 236                         if (itmp <= 0)
 237                                 return NULL;
 238                         idlen += itmp + 2;
 239                         }
 240
 241                 if (s->tlsext_ocsp_exts)
 242                         {
 243                         extlen = i2d_X509_EXTENSIONS(s->tlsext_ocsp_exts, NULL);
 244                         if (extlen < 0)
 245                                 return NULL;
 246                         }
 247                 else
 248                         extlen = 0;
 249
 250                 if ((long)(limit - ret - 7 - extlen - idlen) < 0) return NULL;
 251                 s2n(TLSEXT_TYPE_status_request, ret);
 252                 if (extlen + idlen > 0xFFF0)
 253                         return NULL;
 254                 s2n(extlen + idlen + 5, ret);
 255                 *(ret++) = TLSEXT_STATUSTYPE_ocsp;
 256                 s2n(idlen, ret);
 257                 for (i = 0; i < sk_OCSP_RESPID_num(s->tlsext_ocsp_ids); i++)
 258                         {
 259                         /* save position of id len */
 260                         unsigned char *q = ret;
 261                         id = sk_OCSP_RESPID_value(s->tlsext_ocsp_ids, i);
 262                         /* skip over id len */
 263                         ret += 2;
 264                         itmp = i2d_OCSP_RESPID(id, &ret);
 265                         /* write id len */
 266                         s2n(itmp, q);
 267                         }
 268                 s2n(extlen, ret);
 269                 if (extlen > 0)
 270                         i2d_X509_EXTENSIONS(s->tlsext_ocsp_exts, &ret);
 271                 }
 272
 273         if ((extdatalen = ret-p-2)== 0)
 274                 return p;
 275
 276         s2n(extdatalen,p);
 277         return ret;
 278         }
 279
 280 unsigned char *ssl_add_serverhello_tlsext(SSL *s, unsigned char *p, unsigned char *limit)
 281         {
 282         int extdatalen=0;
 283         unsigned char *ret = p;
 284
 285         /* don't add extensions for SSLv3, unless doing secure renegotiation */
 286         if (s->version == SSL3_VERSION && !s->s3->send_connection_binding)
 287                 return p;
 288
 289         ret+=2;
 290         if (ret>=limit) return NULL; /* this really never occurs, but ... */
 291
 292         if (!s->hit && s->servername_done == 1 && s->session->tlsext_hostname != NULL)
 293                 {
 294                 if (limit - ret - 4 < 0) return NULL;
 295
 296                 s2n(TLSEXT_TYPE_server_name,ret);
 297                 s2n(0,ret);
 298                 }
 299
 300         if(s->s3->send_connection_binding)
 301         {
 302           int el;
 303
 304           if(!ssl_add_serverhello_renegotiate_ext(s, 0, &el, 0))
 305               {
 306               SSLerr(SSL_F_SSL_ADD_SERVERHELLO_TLSEXT, ERR_R_INTERNAL_ERROR);
 307               return NULL;
 308               }
 309
 310           if((limit - p - 4 - el) < 0) return NULL;
 311
 312           s2n(TLSEXT_TYPE_renegotiate,ret);
 313           s2n(el,ret);
 314
 315           if(!ssl_add_serverhello_renegotiate_ext(s, ret, &el, el))
 316               {
 317               SSLerr(SSL_F_SSL_ADD_SERVERHELLO_TLSEXT, ERR_R_INTERNAL_ERROR);
 318               return NULL;
 319               }
 320
 321           ret += el;
 322         }
 323
 324         if (s->tlsext_ticket_expected
 325                 && !(SSL_get_options(s) & SSL_OP_NO_TICKET))
 326                 {
 327                 if (limit - ret - 4 < 0) return NULL;
 328                 s2n(TLSEXT_TYPE_session_ticket,ret);
 329                 s2n(0,ret);
 330                 }
 331
 332         if (s->tlsext_status_expected)
 333                 {
 334                 if ((long)(limit - ret - 4) < 0) return NULL;
 335                 s2n(TLSEXT_TYPE_status_request,ret);
 336                 s2n(0,ret);
 337                 }
 338
 339         if ((extdatalen = ret-p-2)== 0)
 340                 return p;
 341
 342         s2n(extdatalen,p);
 343         return ret;
 344         }
 345
 346 int ssl_parse_clienthello_tlsext(SSL *s, unsigned char **p, unsigned char *d, int n, int *al)
 347         {
 348         unsigned short type;
 349         unsigned short size;
 350         unsigned short len;
 351         unsigned char *data = *p;
 352         int renegotiate_seen = 0;
 353         int need_ri;
 354
 355         s->servername_done = 0;
 356         s->tlsext_status_type = -1;
 357         /* Need RI if renegotiating unless legacy renegotiation allowed */
 358         if (s->options & SSL_OP_ALLOW_UNSAFE_LEGACY_RENEGOTIATION
 359                 || !s->new_session)
 360                 need_ri = 0;
 361         else
 362                 need_ri = 1;
 363
 364         if (data >= (d+n-2))
 365                 {
 366                 if (!need_ri)
 367                         return 1;
 368                 /* We need to see at least one extension: RI */
 369                 /* FIXME: Spec currently doesn't give alert to use */
 370                 *al = SSL_AD_ILLEGAL_PARAMETER;
 371                 SSLerr(SSL_F_SSL_PARSE_SERVERHELLO_TLSEXT,
 372                                 SSL_R_UNSAFE_LEGACY_RENEGOTIATION_DISABLED);
 373                 return 0;
 374                 }
 375         n2s(data,len);
 376
 377         if (data > (d+n-len))
 378                 return 1;
 379
 380         while (data <= (d+n-4))
 381                 {
 382                 n2s(data,type);
 383                 n2s(data,size);
 384
 385                 if (data+size > (d+n))
 386                         return 1;
 387
 388                 if (s->tlsext_debug_cb)
 389                         s->tlsext_debug_cb(s, 0, type, data, size,
 390                                                 s->tlsext_debug_arg);
 391 /* The servername extension is treated as follows:
 392
 393    - Only the hostname type is supported with a maximum length of 255.
 394    - The servername is rejected if too long or if it contains zeros,
 395      in which case an fatal alert is generated.
 396    - The servername field is maintained together with the session cache.
 397    - When a session is resumed, the servername call back invoked in order
 398      to allow the application to position itself to the right context.
 399    - The servername is acknowledged if it is new for a session or when
 400      it is identical to a previously used for the same session.
 401      Applications can control the behaviour.  They can at any time
 402      set a 'desirable' servername for a new SSL object. This can be the
 403      case for example with HTTPS when a Host: header field is received and
 404      a renegotiation is requested. In this case, a possible servername
 405      presented in the new client hello is only acknowledged if it matches
 406      the value of the Host: field.
 407    - Applications must  use SSL_OP_NO_SESSION_RESUMPTION_ON_RENEGOTIATION
 408      if they provide for changing an explicit servername context for the session,
 409      i.e. when the session has been established with a servername extension.
 410    - On session reconnect, the servername extension may be absent.
 411
 412 */
 413
 414                 if (type == TLSEXT_TYPE_server_name)
 415                         {
 416                         unsigned char *sdata;
 417                         int servname_type;
 418                         int dsize;
 419
 420                         if (size < 2)
 421                                 {
 422                                 *al = SSL_AD_DECODE_ERROR;
 423                                 return 0;
 424                                 }
 425                         n2s(data,dsize);
 426                         size -= 2;
 427                         if (dsize > size  )
 428                                 {
 429                                 *al = SSL_AD_DECODE_ERROR;
 430                                 return 0;
 431                                 }
 432
 433                         sdata = data;
 434                         while (dsize > 3)
 435                                 {
 436                                 servname_type = *(sdata++);
 437                                 n2s(sdata,len);
 438                                 dsize -= 3;
 439
 440                                 if (len > dsize)
 441                                         {
 442                                         *al = SSL_AD_DECODE_ERROR;
 443                                         return 0;
 444                                         }
 445                                 if (s->servername_done == 0)
 446                                 switch (servname_type)
 447                                         {
 448                                 case TLSEXT_NAMETYPE_host_name:
 449                                         if (s->session->tlsext_hostname == NULL)
 450                                                 {
 451                                                 if (len > TLSEXT_MAXLEN_host_name ||
 452                                                         ((s->session->tlsext_hostname = OPENSSL_malloc(len+1)) == NULL))
 453                                                         {
 454                                                         *al = TLS1_AD_UNRECOGNIZED_NAME;
 455                                                         return 0;
 456                                                         }
 457                                                 memcpy(s->session->tlsext_hostname, sdata, len);
 458                                                 s->session->tlsext_hostname[len]='\0';
 459                                                 if (strlen(s->session->tlsext_hostname) != len) {
 460                                                         OPENSSL_free(s->session->tlsext_hostname);
 461                                                         s->session->tlsext_hostname = NULL;
 462                                                         *al = TLS1_AD_UNRECOGNIZED_NAME;
 463                                                         return 0;
 464                                                 }
 465                                                 s->servername_done = 1;
 466
 467                                                 }
 468                                         else
 469                                                 s->servername_done = strlen(s->session->tlsext_hostname) == len
 470                                                         && strncmp(s->session->tlsext_hostname, (char *)sdata, len) == 0;
 471
 472                                         break;
 473
 474                                 default:
 475                                         break;
 476                                         }
 477
 478                                 dsize -= len;
 479                                 }
 480                         if (dsize != 0)
 481                                 {
 482                                 *al = SSL_AD_DECODE_ERROR;
 483                                 return 0;
 484                                 }
 485
 486                         }
 487                 else if (type == TLSEXT_TYPE_renegotiate)
 488                         {
 489                         if(!ssl_parse_clienthello_renegotiate_ext(s, data, size, al))
 490                                 return 0;
 491                         renegotiate_seen = 1;
 492                         }
 493                 else if (type == TLSEXT_TYPE_status_request &&
 494                          s->version != DTLS1_VERSION && s->ctx->tlsext_status_cb)
 495                         {
 496
 497                         if (size < 5)
 498                                 {
 499                                 *al = SSL_AD_DECODE_ERROR;
 500                                 return 0;
 501                                 }
 502
 503                         s->tlsext_status_type = *data++;
 504                         size--;
 505                         if (s->tlsext_status_type == TLSEXT_STATUSTYPE_ocsp)
 506                                 {
 507                                 const unsigned char *sdata;
 508                                 int dsize;
 509                                 /* Read in responder_id_list */
 510                                 n2s(data,dsize);
 511                                 size -= 2;
 512                                 if (dsize > size  )
 513                                         {
 514                                         *al = SSL_AD_DECODE_ERROR;
 515                                         return 0;
 516                                         }
 517                                 while (dsize > 0)
 518                                         {
 519                                         OCSP_RESPID *id;
 520                                         int idsize;
 521                                         if (dsize < 4)
 522                                                 {
 523                                                 *al = SSL_AD_DECODE_ERROR;
 524                                                 return 0;
 525                                                 }
 526                                         n2s(data, idsize);
 527                                         dsize -= 2 + idsize;
 528                                         if (dsize < 0)
 529                                                 {
 530                                                 *al = SSL_AD_DECODE_ERROR;
 531                                                 return 0;
 532                                                 }
 533                                         sdata = data;
 534                                         data += idsize;
 535                                         id = d2i_OCSP_RESPID(NULL,
 536                                                                 &sdata, idsize);
 537                                         if (!id)
 538                                                 {
 539                                                 *al = SSL_AD_DECODE_ERROR;
 540                                                 return 0;
 541                                                 }
 542                                         if (data != sdata)
 543                                                 {
 544                                                 OCSP_RESPID_free(id);
 545                                                 *al = SSL_AD_DECODE_ERROR;
 546                                                 return 0;
 547                                                 }
 548                                         if (!s->tlsext_ocsp_ids
 549                                                 && !(s->tlsext_ocsp_ids =
 550                                                 sk_OCSP_RESPID_new_null()))
 551                                                 {
 552                                                 OCSP_RESPID_free(id);
 553                                                 *al = SSL_AD_INTERNAL_ERROR;
 554                                                 return 0;
 555                                                 }
 556                                         if (!sk_OCSP_RESPID_push(
 557                                                         s->tlsext_ocsp_ids, id))
 558                                                 {
 559                                                 OCSP_RESPID_free(id);
 560                                                 *al = SSL_AD_INTERNAL_ERROR;
 561                                                 return 0;
 562                                                 }
 563                                         }
 564
 565                                 /* Read in request_extensions */
 566                                 n2s(data,dsize);
 567                                 size -= 2;
 568                                 if (dsize > size)
 569                                         {
 570                                         *al = SSL_AD_DECODE_ERROR;
 571                                         return 0;
 572                                         }
 573                                 sdata = data;
 574                                 if (dsize > 0)
 575                                         {
 576                                         s->tlsext_ocsp_exts =
 577                                                 d2i_X509_EXTENSIONS(NULL,
 578                                                         &sdata, dsize);
 579                                         if (!s->tlsext_ocsp_exts
 580                                                 || (data + dsize != sdata))
 581                                                 {
 582                                                 *al = SSL_AD_DECODE_ERROR;
 583                                                 return 0;
 584                                                 }
 585                                         }
 586                                 }
 587                                 /* We don't know what to do with any other type
 588                                 * so ignore it.
 589                                 */
 590                                 else
 591                                         s->tlsext_status_type = -1;
 592                         }
 593
 594                 /* session ticket processed earlier */
 595
 596                 data+=size;
 597                 }
 598
 599         if (need_ri && !renegotiate_seen)
 600                 {
 601                 /* FIXME: Spec currently doesn't give alert to use */
 602                 *al = SSL_AD_ILLEGAL_PARAMETER;
 603                 SSLerr(SSL_F_SSL_PARSE_CLIENTHELLO_TLSEXT,
 604                                 SSL_R_UNSAFE_LEGACY_RENEGOTIATION_DISABLED);
 605                 return 0;
 606                 }
 607
 608         *p = data;
 609         return 1;
 610         }
 611
 612 int ssl_parse_serverhello_tlsext(SSL *s, unsigned char **p, unsigned char *d, int n, int *al)
 613         {
 614         unsigned short type;
 615         unsigned short size;
 616         unsigned short len;
 617         unsigned char *data = *p;
 618         int tlsext_servername = 0;
 619         int renegotiate_seen = 0;
 620         int need_ri;
 621         /* Determine if we need to see RI. Strictly speaking if we want to
 622          * avoid an attack we should *always* see RI even on initial server
 623          * hello because the client doesn't see any renegotiation during an
 624          * attack. However this would mean we could not connect to any server
 625          * which doesn't support RI so for the immediate future tolerate RI
 626          * absence on initial connect only.
 627          */
 628         if (s->options & SSL_OP_ALLOW_UNSAFE_LEGACY_RENEGOTIATION ||
 629                 !s->new_session)
 630                 need_ri = 0;
 631         else
 632                 need_ri = 1;
 633
 634         if (data >= (d+n-2))
 635                 {
 636                 if (!need_ri)
 637                         return 1;
 638                 /* We need to see at least one extension: RI */
 639                 /* FIXME: Spec currently doesn't give alert to use */
 640                 *al = SSL_AD_ILLEGAL_PARAMETER;
 641                 SSLerr(SSL_F_SSL_PARSE_SERVERHELLO_TLSEXT,
 642                                 SSL_R_UNSAFE_LEGACY_RENEGOTIATION_DISABLED);
 643                 return 0;
 644                 }
 645
 646         n2s(data,len);
 647
 648         while(data <= (d+n-4))
 649                 {
 650                 n2s(data,type);
 651                 n2s(data,size);
 652
 653                 if (data+size > (d+n))
 654                         return 1;
 655
 656                 if (s->tlsext_debug_cb)
 657                         s->tlsext_debug_cb(s, 1, type, data, size,
 658                                                 s->tlsext_debug_arg);
 659
 660                 if (type == TLSEXT_TYPE_server_name)
 661                         {
 662                         if (s->tlsext_hostname == NULL || size > 0)
 663                                 {
 664                                 *al = TLS1_AD_UNRECOGNIZED_NAME;
 665                                 return 0;
 666                                 }
 667                         tlsext_servername = 1;
 668                         }
 669                 else if (type == TLSEXT_TYPE_session_ticket)
 670                         {
 671                         if ((SSL_get_options(s) & SSL_OP_NO_TICKET)
 672                                 || (size > 0))
 673                                 {
 674                                 *al = TLS1_AD_UNSUPPORTED_EXTENSION;
 675                                 return 0;
 676                                 }
 677                         s->tlsext_ticket_expected = 1;
 678                         }
 679                 else if (type == TLSEXT_TYPE_status_request &&
 680                          s->version != DTLS1_VERSION)
 681                         {
 682                         /* MUST be empty and only sent if we've requested
 683                          * a status request message.
 684                          */
 685                         if ((s->tlsext_status_type == -1) || (size > 0))
 686                                 {
 687                                 *al = TLS1_AD_UNSUPPORTED_EXTENSION;
 688                                 return 0;
 689                                 }
 690                         /* Set flag to expect CertificateStatus message */
 691                         s->tlsext_status_expected = 1;
 692                         }
 693                 else if (type == TLSEXT_TYPE_renegotiate)
 694                         {
 695                         if(!ssl_parse_serverhello_renegotiate_ext(s, data, size, al))
 696                                 return 0;
 697                         renegotiate_seen = 1;
 698                         }
 699                 data+=size;
 700                 }
 701
 702         if (data != d+n)
 703                 {
 704                 *al = SSL_AD_DECODE_ERROR;
 705                 return 0;
 706                 }
 707
 708         if (!renegotiate_seen && need_ri)
 709                 {
 710                 /* FIXME: Spec currently doesn't give alert to use */
 711                 *al = SSL_AD_ILLEGAL_PARAMETER;
 712                 SSLerr(SSL_F_SSL_PARSE_SERVERHELLO_TLSEXT,
 713                                 SSL_R_UNSAFE_LEGACY_RENEGOTIATION_DISABLED);
 714                 return 0;
 715                 }
 716
 717         if (!s->hit && tlsext_servername == 1)
 718                 {
 719                 if (s->tlsext_hostname)
 720                         {
 721                         if (s->session->tlsext_hostname == NULL)
 722                                 {
 723                                 s->session->tlsext_hostname = BUF_strdup(s->tlsext_hostname);
 724                                 if (!s->session->tlsext_hostname)
 725                                         {
 726                                         *al = SSL_AD_UNRECOGNIZED_NAME;
 727                                         return 0;
 728                                         }
 729                                 }
 730                         else
 731                                 {
 732                                 *al = SSL_AD_DECODE_ERROR;
 733                                 return 0;
 734                                 }
 735                         }
 736                 }
 737
 738         *p = data;
 739         return 1;
 740         }
 741
 742 int ssl_check_clienthello_tlsext(SSL *s)
 743         {
 744         int ret=SSL_TLSEXT_ERR_NOACK;
 745         int al = SSL_AD_UNRECOGNIZED_NAME;
 746
 747         if (s->ctx != NULL && s->ctx->tlsext_servername_callback != 0)
 748                 ret = s->ctx->tlsext_servername_callback(s, &al, s->ctx->tlsext_servername_arg);
 749         else if (s->initial_ctx != NULL && s->initial_ctx->tlsext_servername_callback != 0)
 750                 ret = s->initial_ctx->tlsext_servername_callback(s, &al, s->initial_ctx->tlsext_servername_arg);
 751
 752         /* If status request then ask callback what to do.
 753          * Note: this must be called after servername callbacks in case
 754          * the certificate has changed.
 755          */
 756         if ((s->tlsext_status_type != -1) && s->ctx->tlsext_status_cb)
 757                 {
 758                 int r;
 759                 r = s->ctx->tlsext_status_cb(s, s->ctx->tlsext_status_arg);
 760                 switch (r)
 761                         {
 762                         /* We don't want to send a status request response */
 763                         case SSL_TLSEXT_ERR_NOACK:
 764                                 s->tlsext_status_expected = 0;
 765                                 break;
 766                         /* status request response should be sent */
 767                         case SSL_TLSEXT_ERR_OK:
 768                                 if (s->tlsext_ocsp_resp)
 769                                         s->tlsext_status_expected = 1;
 770                                 else
 771                                         s->tlsext_status_expected = 0;
 772                                 break;
 773                         /* something bad happened */
 774                         case SSL_TLSEXT_ERR_ALERT_FATAL:
 775                                 ret = SSL_TLSEXT_ERR_ALERT_FATAL;
 776                                 al = SSL_AD_INTERNAL_ERROR;
 777                                 goto err;
 778                         }
 779                 }
 780         else
 781                 s->tlsext_status_expected = 0;
 782         err:
 783         switch (ret)
 784                 {
 785                 case SSL_TLSEXT_ERR_ALERT_FATAL:
 786                         ssl3_send_alert(s,SSL3_AL_FATAL,al);
 787                         return -1;
 788
 789                 case SSL_TLSEXT_ERR_ALERT_WARNING:
 790                         ssl3_send_alert(s,SSL3_AL_WARNING,al);
 791                         return 1;
 792
 793                 case SSL_TLSEXT_ERR_NOACK:
 794                         s->servername_done=0;
 795                         default:
 796                 return 1;
 797                 }
 798         }
 799
 800 int ssl_check_serverhello_tlsext(SSL *s)
 801         {
 802         int ret=SSL_TLSEXT_ERR_NOACK;
 803         int al = SSL_AD_UNRECOGNIZED_NAME;
 804
 805         if (s->ctx != NULL && s->ctx->tlsext_servername_callback != 0)
 806                 ret = s->ctx->tlsext_servername_callback(s, &al, s->ctx->tlsext_servername_arg);
 807         else if (s->initial_ctx != NULL && s->initial_ctx->tlsext_servername_callback != 0)
 808                 ret = s->initial_ctx->tlsext_servername_callback(s, &al, s->initial_ctx->tlsext_servername_arg);
 809
 810         /* If we've requested certificate status and we wont get one
 811          * tell the callback
 812          */
 813         if ((s->tlsext_status_type != -1) && !(s->tlsext_status_expected)
 814                         && s->ctx->tlsext_status_cb)
 815                 {
 816                 int r;
 817                 /* Set resp to NULL, resplen to -1 so callback knows
 818                  * there is no response.
 819                  */
 820                 if (s->tlsext_ocsp_resp)
 821                         {
 822                         OPENSSL_free(s->tlsext_ocsp_resp);
 823                         s->tlsext_ocsp_resp = NULL;
 824                         }
 825                 s->tlsext_ocsp_resplen = -1;
 826                 r = s->ctx->tlsext_status_cb(s, s->ctx->tlsext_status_arg);
 827                 if (r == 0)
 828                         {
 829                         al = SSL_AD_BAD_CERTIFICATE_STATUS_RESPONSE;
 830                         ret = SSL_TLSEXT_ERR_ALERT_FATAL;
 831                         }
 832                 if (r < 0)
 833                         {
 834                         al = SSL_AD_INTERNAL_ERROR;
 835                         ret = SSL_TLSEXT_ERR_ALERT_FATAL;
 836                         }
 837                 }
 838
 839         switch (ret)
 840                 {
 841                 case SSL_TLSEXT_ERR_ALERT_FATAL:
 842                         ssl3_send_alert(s,SSL3_AL_FATAL,al);
 843                         return -1;
 844
 845                 case SSL_TLSEXT_ERR_ALERT_WARNING:
 846                         ssl3_send_alert(s,SSL3_AL_WARNING,al);
 847                         return 1;
 848
 849                 case SSL_TLSEXT_ERR_NOACK:
 850                         s->servername_done=0;
 851                         default:
 852                 return 1;
 853                 }
 854         }
 855
 856 /* Since the server cache lookup is done early on in the processing of client
 857  * hello and other operations depend on the result we need to handle any TLS
 858  * session ticket extension at the same time.
 859  */
 860
 861 int tls1_process_ticket(SSL *s, unsigned char *session_id, int len,
 862                                 const unsigned char *limit, SSL_SESSION **ret)
 863         {
 864         /* Point after session ID in client hello */
 865         const unsigned char *p = session_id + len;
 866         unsigned short i;
 867
 868         /* If tickets disabled behave as if no ticket present
 869          * to permit stateful resumption.
 870          */
 871         if (SSL_get_options(s) & SSL_OP_NO_TICKET)
 872                 return 1;
 873
 874         if ((s->version <= SSL3_VERSION) || !limit)
 875                 return 1;
 876         if (p >= limit)
 877                 return -1;
 878         /* Skip past DTLS cookie */
 879         if (s->version == DTLS1_VERSION || s->version == DTLS1_BAD_VER)
 880                 {
 881                 i = *(p++);
 882                 p+= i;
 883                 if (p >= limit)
 884                         return -1;
 885                 }
 886         /* Skip past cipher list */
 887         n2s(p, i);
 888         p+= i;
 889         if (p >= limit)
 890                 return -1;
 891         /* Skip past compression algorithm list */
 892         i = *(p++);
 893         p += i;
 894         if (p > limit)
 895                 return -1;
 896         /* Now at start of extensions */
 897         if ((p + 2) >= limit)
 898                 return 1;
 899         n2s(p, i);
 900         while ((p + 4) <= limit)
 901                 {
 902                 unsigned short type, size;
 903                 n2s(p, type);
 904                 n2s(p, size);
 905                 if (p + size > limit)
 906                         return 1;
 907                 if (type == TLSEXT_TYPE_session_ticket)
 908                         {
 909                         /* If zero length note client will accept a ticket
 910                          * and indicate cache miss to trigger full handshake
 911                          */
 912                         if (size == 0)
 913                                 {
 914                                 s->tlsext_ticket_expected = 1;
 915                                 return 0;       /* Cache miss */
 916                                 }
 917                         return tls_decrypt_ticket(s, p, size, session_id, len,
 918                                                                         ret);
 919                         }
 920                 p += size;
 921                 }
 922         return 1;
 923         }
 924
 925 static int tls_decrypt_ticket(SSL *s, const unsigned char *etick, int eticklen,
 926                                 const unsigned char *sess_id, int sesslen,
 927                                 SSL_SESSION **psess)
 928         {
 929         SSL_SESSION *sess;
 930         unsigned char *sdec;
 931         const unsigned char *p;
 932         int slen, mlen, renew_ticket = 0;
 933         unsigned char tick_hmac[EVP_MAX_MD_SIZE];
 934         HMAC_CTX hctx;
 935         EVP_CIPHER_CTX ctx;
 936         SSL_CTX *tctx = s->initial_ctx;
 937         /* Need at least keyname + iv + some encrypted data */
 938         if (eticklen < 48)
 939                 goto tickerr;
 940         /* Initialize session ticket encryption and HMAC contexts */
 941         HMAC_CTX_init(&hctx);
 942         EVP_CIPHER_CTX_init(&ctx);
 943         if (tctx->tlsext_ticket_key_cb)
 944                 {
 945                 unsigned char *nctick = (unsigned char *)etick;
 946                 int rv = tctx->tlsext_ticket_key_cb(s, nctick, nctick + 16,
 947                                                         &ctx, &hctx, 0);
 948                 if (rv < 0)
 949                         return -1;
 950                 if (rv == 0)
 951                         goto tickerr;
 952                 if (rv == 2)
 953                         renew_ticket = 1;
 954                 }
 955         else
 956                 {
 957                 /* Check key name matches */
 958                 if (memcmp(etick, tctx->tlsext_tick_key_name, 16))
 959                         goto tickerr;
 960                 HMAC_Init_ex(&hctx, tctx->tlsext_tick_hmac_key, 16,
 961                                         tlsext_tick_md(), NULL);
 962                 EVP_DecryptInit_ex(&ctx, EVP_aes_128_cbc(), NULL,
 963                                 tctx->tlsext_tick_aes_key, etick + 16);
 964                 }
 965         /* Attempt to process session ticket, first conduct sanity and
 966          * integrity checks on ticket.
 967          */
 968         mlen = HMAC_size(&hctx);
 969         eticklen -= mlen;
 970         /* Check HMAC of encrypted ticket */
 971         HMAC_Update(&hctx, etick, eticklen);
 972         HMAC_Final(&hctx, tick_hmac, NULL);
 973         HMAC_CTX_cleanup(&hctx);
 974         if (memcmp(tick_hmac, etick + eticklen, mlen))
 975                 goto tickerr;
 976         /* Attempt to decrypt session data */
 977         /* Move p after IV to start of encrypted ticket, update length */
 978         p = etick + 16 + EVP_CIPHER_CTX_iv_length(&ctx);
 979         eticklen -= 16 + EVP_CIPHER_CTX_iv_length(&ctx);
 980         sdec = OPENSSL_malloc(eticklen);
 981         if (!sdec)
 982                 {
 983                 EVP_CIPHER_CTX_cleanup(&ctx);
 984                 return -1;
 985                 }
 986         EVP_DecryptUpdate(&ctx, sdec, &slen, p, eticklen);
 987         if (EVP_DecryptFinal(&ctx, sdec + slen, &mlen) <= 0)
 988                 goto tickerr;
 989         slen += mlen;
 990         EVP_CIPHER_CTX_cleanup(&ctx);
 991         p = sdec;
 992
 993         sess = d2i_SSL_SESSION(NULL, &p, slen);
 994         OPENSSL_free(sdec);
 995         if (sess)
 996                 {
 997                 /* The session ID if non-empty is used by some clients to
 998                  * detect that the ticket has been accepted. So we copy it to
 999                  * the session structure. If it is empty set length to zero
1000                  * as required by standard.
1001                  */
1002                 if (sesslen)
1003                         memcpy(sess->session_id, sess_id, sesslen);
1004                 sess->session_id_length = sesslen;
1005                 *psess = sess;
1006                 s->tlsext_ticket_expected = renew_ticket;
1007                 return 1;
1008                 }
1009         /* If session decrypt failure indicate a cache miss and set state to
1010          * send a new ticket
1011          */
1012         tickerr:
1013         s->tlsext_ticket_expected = 1;
1014         return 0;
1015         }
1016
1017 #endif