ssl/t1_lib.c

   1 /* ssl/t1_lib.c */
   2 /* Copyright (C) 1995-1998 Eric Young (eay@cryptsoft.com)
   3  * All rights reserved.
   4  *
   5  * This package is an SSL implementation written
   6  * by Eric Young (eay@cryptsoft.com).
   7  * The implementation was written so as to conform with Netscapes SSL.
   8  *
   9  * This library is free for commercial and non-commercial use as long as
  10  * the following conditions are aheared to.  The following conditions
  11  * apply to all code found in this distribution, be it the RC4, RSA,
  12  * lhash, DES, etc., code; not just the SSL code.  The SSL documentation
  13  * included with this distribution is covered by the same copyright terms
  14  * except that the holder is Tim Hudson (tjh@cryptsoft.com).
  15  *
  16  * Copyright remains Eric Young's, and as such any Copyright notices in
  17  * the code are not to be removed.
  18  * If this package is used in a product, Eric Young should be given attribution
  19  * as the author of the parts of the library used.
  20  * This can be in the form of a textual message at program startup or
  21  * in documentation (online or textual) provided with the package.
  22  *
  23  * Redistribution and use in source and binary forms, with or without
  24  * modification, are permitted provided that the following conditions
  25  * are met:
  26  * 1. Redistributions of source code must retain the copyright
  27  *    notice, this list of conditions and the following disclaimer.
  28  * 2. Redistributions in binary form must reproduce the above copyright
  29  *    notice, this list of conditions and the following disclaimer in the
  30  *    documentation and/or other materials provided with the distribution.
  31  * 3. All advertising materials mentioning features or use of this software
  32  *    must display the following acknowledgement:
  33  *    "This product includes cryptographic software written by
  34  *     Eric Young (eay@cryptsoft.com)"
  35  *    The word 'cryptographic' can be left out if the rouines from the library
  36  *    being used are not cryptographic related :-).
  37  * 4. If you include any Windows specific code (or a derivative thereof) from
  38  *    the apps directory (application code) you must include an acknowledgement:
  39  *    "This product includes software written by Tim Hudson (tjh@cryptsoft.com)"
  40  *
  41  * THIS SOFTWARE IS PROVIDED BY ERIC YOUNG ``AS IS'' AND
  42  * ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
  43  * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE
  44  * ARE DISCLAIMED.  IN NO EVENT SHALL THE AUTHOR OR CONTRIBUTORS BE LIABLE
  45  * FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL
  46  * DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS
  47  * OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION)
  48  * HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT
  49  * LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY
  50  * OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF
  51  * SUCH DAMAGE.
  52  *
  53  * The licence and distribution terms for any publically available version or
  54  * derivative of this code cannot be changed.  i.e. this code cannot simply be
  55  * copied and put under another distribution licence
  56  * [including the GNU Public Licence.]
  57  */
  58 /* ====================================================================
  59  * Copyright (c) 1998-2007 The OpenSSL Project.  All rights reserved.
  60  *
  61  * Redistribution and use in source and binary forms, with or without
  62  * modification, are permitted provided that the following conditions
  63  * are met:
  64  *
  65  * 1. Redistributions of source code must retain the above copyright
  66  *    notice, this list of conditions and the following disclaimer.
  67  *
  68  * 2. Redistributions in binary form must reproduce the above copyright
  69  *    notice, this list of conditions and the following disclaimer in
  70  *    the documentation and/or other materials provided with the
  71  *    distribution.
  72  *
  73  * 3. All advertising materials mentioning features or use of this
  74  *    software must display the following acknowledgment:
  75  *    "This product includes software developed by the OpenSSL Project
  76  *    for use in the OpenSSL Toolkit. (http://www.openssl.org/)"
  77  *
  78  * 4. The names "OpenSSL Toolkit" and "OpenSSL Project" must not be used to
  79  *    endorse or promote products derived from this software without
  80  *    prior written permission. For written permission, please contact
  81  *    openssl-core@openssl.org.
  82  *
  83  * 5. Products derived from this software may not be called "OpenSSL"
  84  *    nor may "OpenSSL" appear in their names without prior written
  85  *    permission of the OpenSSL Project.
  86  *
  87  * 6. Redistributions of any form whatsoever must retain the following
  88  *    acknowledgment:
  89  *    "This product includes software developed by the OpenSSL Project
  90  *    for use in the OpenSSL Toolkit (http://www.openssl.org/)"
  91  *
  92  * THIS SOFTWARE IS PROVIDED BY THE OpenSSL PROJECT ``AS IS'' AND ANY
  93  * EXPRESSED OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
  94  * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
  95  * PURPOSE ARE DISCLAIMED.  IN NO EVENT SHALL THE OpenSSL PROJECT OR
  96  * ITS CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL,
  97  * SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT
  98  * NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES;
  99  * LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION)
 100  * HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT,
 101  * STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE)
 102  * ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED
 103  * OF THE POSSIBILITY OF SUCH DAMAGE.
 104  * ====================================================================
 105  *
 106  * This product includes cryptographic software written by Eric Young
 107  * (eay@cryptsoft.com).  This product includes software written by Tim
 108  * Hudson (tjh@cryptsoft.com).
 109  *
 110  */
 111
 112 #include <stdio.h>
 113 #include <openssl/objects.h>
 114 #include <openssl/evp.h>
 115 #include <openssl/hmac.h>
 116 #include <openssl/ocsp.h>
 117 #include "ssl_locl.h"
 118
 119 const char tls1_version_str[]="TLSv1" OPENSSL_VERSION_PTEXT;
 120
 121 #ifndef OPENSSL_NO_TLSEXT
 122 static int tls_decrypt_ticket(SSL *s, const unsigned char *tick, int ticklen,
 123                                 const unsigned char *sess_id, int sesslen,
 124                                 SSL_SESSION **psess);
 125 #endif
 126
 127 SSL3_ENC_METHOD TLSv1_enc_data={
 128         tls1_enc,
 129         tls1_mac,
 130         tls1_setup_key_block,
 131         tls1_generate_master_secret,
 132         tls1_change_cipher_state,
 133         tls1_final_finish_mac,
 134         TLS1_FINISH_MAC_LENGTH,
 135         tls1_cert_verify_mac,
 136         TLS_MD_CLIENT_FINISH_CONST,TLS_MD_CLIENT_FINISH_CONST_SIZE,
 137         TLS_MD_SERVER_FINISH_CONST,TLS_MD_SERVER_FINISH_CONST_SIZE,
 138         tls1_alert_code,
 139         };
 140
 141 long tls1_default_timeout(void)
 142         {
 143         /* 2 hours, the 24 hours mentioned in the TLSv1 spec
 144          * is way too long for http, the cache would over fill */
 145         return(60*60*2);
 146         }
 147
 148 int tls1_new(SSL *s)
 149         {
 150         if (!ssl3_new(s)) return(0);
 151         s->method->ssl_clear(s);
 152         return(1);
 153         }
 154
 155 void tls1_free(SSL *s)
 156         {
 157 #ifndef OPENSSL_NO_TLSEXT
 158         if (s->tlsext_session_ticket)
 159                 {
 160                 OPENSSL_free(s->tlsext_session_ticket);
 161                 }
 162 #endif /* OPENSSL_NO_TLSEXT */
 163         ssl3_free(s);
 164         }
 165
 166 void tls1_clear(SSL *s)
 167         {
 168         ssl3_clear(s);
 169         s->version=TLS1_VERSION;
 170         }
 171
 172 #ifndef OPENSSL_NO_EC
 173 static int nid_list[] =
 174         {
 175                 NID_sect163k1, /* sect163k1 (1) */
 176                 NID_sect163r1, /* sect163r1 (2) */
 177                 NID_sect163r2, /* sect163r2 (3) */
 178                 NID_sect193r1, /* sect193r1 (4) */
 179                 NID_sect193r2, /* sect193r2 (5) */
 180                 NID_sect233k1, /* sect233k1 (6) */
 181                 NID_sect233r1, /* sect233r1 (7) */
 182                 NID_sect239k1, /* sect239k1 (8) */
 183                 NID_sect283k1, /* sect283k1 (9) */
 184                 NID_sect283r1, /* sect283r1 (10) */
 185                 NID_sect409k1, /* sect409k1 (11) */
 186                 NID_sect409r1, /* sect409r1 (12) */
 187                 NID_sect571k1, /* sect571k1 (13) */
 188                 NID_sect571r1, /* sect571r1 (14) */
 189                 NID_secp160k1, /* secp160k1 (15) */
 190                 NID_secp160r1, /* secp160r1 (16) */
 191                 NID_secp160r2, /* secp160r2 (17) */
 192                 NID_secp192k1, /* secp192k1 (18) */
 193                 NID_X9_62_prime192v1, /* secp192r1 (19) */
 194                 NID_secp224k1, /* secp224k1 (20) */
 195                 NID_secp224r1, /* secp224r1 (21) */
 196                 NID_secp256k1, /* secp256k1 (22) */
 197                 NID_X9_62_prime256v1, /* secp256r1 (23) */
 198                 NID_secp384r1, /* secp384r1 (24) */
 199                 NID_secp521r1  /* secp521r1 (25) */
 200         };
 201
 202 int tls1_ec_curve_id2nid(int curve_id)
 203         {
 204         /* ECC curves from draft-ietf-tls-ecc-12.txt (Oct. 17, 2005) */
 205         if ((curve_id < 1) || ((unsigned int)curve_id >
 206                                 sizeof(nid_list)/sizeof(nid_list[0])))
 207                 return 0;
 208         return nid_list[curve_id-1];
 209         }
 210
 211 int tls1_ec_nid2curve_id(int nid)
 212         {
 213         /* ECC curves from draft-ietf-tls-ecc-12.txt (Oct. 17, 2005) */
 214         switch (nid)
 215                 {
 216         case NID_sect163k1: /* sect163k1 (1) */
 217                 return 1;
 218         case NID_sect163r1: /* sect163r1 (2) */
 219                 return 2;
 220         case NID_sect163r2: /* sect163r2 (3) */
 221                 return 3;
 222         case NID_sect193r1: /* sect193r1 (4) */
 223                 return 4;
 224         case NID_sect193r2: /* sect193r2 (5) */
 225                 return 5;
 226         case NID_sect233k1: /* sect233k1 (6) */
 227                 return 6;
 228         case NID_sect233r1: /* sect233r1 (7) */
 229                 return 7;
 230         case NID_sect239k1: /* sect239k1 (8) */
 231                 return 8;
 232         case NID_sect283k1: /* sect283k1 (9) */
 233                 return 9;
 234         case NID_sect283r1: /* sect283r1 (10) */
 235                 return 10;
 236         case NID_sect409k1: /* sect409k1 (11) */
 237                 return 11;
 238         case NID_sect409r1: /* sect409r1 (12) */
 239                 return 12;
 240         case NID_sect571k1: /* sect571k1 (13) */
 241                 return 13;
 242         case NID_sect571r1: /* sect571r1 (14) */
 243                 return 14;
 244         case NID_secp160k1: /* secp160k1 (15) */
 245                 return 15;
 246         case NID_secp160r1: /* secp160r1 (16) */
 247                 return 16;
 248         case NID_secp160r2: /* secp160r2 (17) */
 249                 return 17;
 250         case NID_secp192k1: /* secp192k1 (18) */
 251                 return 18;
 252         case NID_X9_62_prime192v1: /* secp192r1 (19) */
 253                 return 19;
 254         case NID_secp224k1: /* secp224k1 (20) */
 255                 return 20;
 256         case NID_secp224r1: /* secp224r1 (21) */
 257                 return 21;
 258         case NID_secp256k1: /* secp256k1 (22) */
 259                 return 22;
 260         case NID_X9_62_prime256v1: /* secp256r1 (23) */
 261                 return 23;
 262         case NID_secp384r1: /* secp384r1 (24) */
 263                 return 24;
 264         case NID_secp521r1:  /* secp521r1 (25) */
 265                 return 25;
 266         default:
 267                 return 0;
 268                 }
 269         }
 270 #endif /* OPENSSL_NO_EC */
 271
 272 #ifndef OPENSSL_NO_TLSEXT
 273 unsigned char *ssl_add_clienthello_tlsext(SSL *s, unsigned char *p, unsigned char *limit)
 274         {
 275         int extdatalen=0;
 276         unsigned char *ret = p;
 277
 278         /* don't add extensions for SSLv3 unless doing secure renegotiation */
 279         if (s->client_version == SSL3_VERSION
 280                                         && !s->s3->send_connection_binding)
 281                 return p;
 282
 283         ret+=2;
 284
 285         if (ret>=limit) return NULL; /* this really never occurs, but ... */
 286
 287         if (s->tlsext_hostname != NULL)
 288                 {
 289                 /* Add TLS extension servername to the Client Hello message */
 290                 unsigned long size_str;
 291                 long lenmax;
 292
 293                 /* check for enough space.
 294                    4 for the servername type and entension length
 295                    2 for servernamelist length
 296                    1 for the hostname type
 297                    2 for hostname length
 298                    + hostname length
 299                 */
 300
 301                 if ((lenmax = limit - ret - 9) < 0
 302                     || (size_str = strlen(s->tlsext_hostname)) > (unsigned long)lenmax)
 303                         return NULL;
 304
 305                 /* extension type and length */
 306                 s2n(TLSEXT_TYPE_server_name,ret);
 307                 s2n(size_str+5,ret);
 308
 309                 /* length of servername list */
 310                 s2n(size_str+3,ret);
 311
 312                 /* hostname type, length and hostname */
 313                 *(ret++) = (unsigned char) TLSEXT_NAMETYPE_host_name;
 314                 s2n(size_str,ret);
 315                 memcpy(ret, s->tlsext_hostname, size_str);
 316                 ret+=size_str;
 317                 }
 318
 319         /* Add RI if renegotiating */
 320         if (s->new_session)
 321           {
 322           int el;
 323
 324           if(!ssl_add_clienthello_renegotiate_ext(s, 0, &el, 0))
 325               {
 326               SSLerr(SSL_F_SSL_ADD_CLIENTHELLO_TLSEXT, ERR_R_INTERNAL_ERROR);
 327               return NULL;
 328               }
 329
 330           if((limit - p - 4 - el) < 0) return NULL;
 331
 332           s2n(TLSEXT_TYPE_renegotiate,ret);
 333           s2n(el,ret);
 334
 335           if(!ssl_add_clienthello_renegotiate_ext(s, ret, &el, el))
 336               {
 337               SSLerr(SSL_F_SSL_ADD_CLIENTHELLO_TLSEXT, ERR_R_INTERNAL_ERROR);
 338               return NULL;
 339               }
 340
 341           ret += el;
 342         }
 343
 344 #ifndef OPENSSL_NO_EC
 345         if (s->tlsext_ecpointformatlist != NULL &&
 346             s->version != DTLS1_VERSION)
 347                 {
 348                 /* Add TLS extension ECPointFormats to the ClientHello message */
 349                 long lenmax;
 350
 351                 if ((lenmax = limit - ret - 5) < 0) return NULL;
 352                 if (s->tlsext_ecpointformatlist_length > (unsigned long)lenmax) return NULL;
 353                 if (s->tlsext_ecpointformatlist_length > 255)
 354                         {
 355                         SSLerr(SSL_F_SSL_ADD_CLIENTHELLO_TLSEXT, ERR_R_INTERNAL_ERROR);
 356                         return NULL;
 357                         }
 358
 359                 s2n(TLSEXT_TYPE_ec_point_formats,ret);
 360                 s2n(s->tlsext_ecpointformatlist_length + 1,ret);
 361                 *(ret++) = (unsigned char) s->tlsext_ecpointformatlist_length;
 362                 memcpy(ret, s->tlsext_ecpointformatlist, s->tlsext_ecpointformatlist_length);
 363                 ret+=s->tlsext_ecpointformatlist_length;
 364                 }
 365         if (s->tlsext_ellipticcurvelist != NULL &&
 366             s->version != DTLS1_VERSION)
 367                 {
 368                 /* Add TLS extension EllipticCurves to the ClientHello message */
 369                 long lenmax;
 370
 371                 if ((lenmax = limit - ret - 6) < 0) return NULL;
 372                 if (s->tlsext_ellipticcurvelist_length > (unsigned long)lenmax) return NULL;
 373                 if (s->tlsext_ellipticcurvelist_length > 65532)
 374                         {
 375                         SSLerr(SSL_F_SSL_ADD_CLIENTHELLO_TLSEXT, ERR_R_INTERNAL_ERROR);
 376                         return NULL;
 377                         }
 378
 379                 s2n(TLSEXT_TYPE_elliptic_curves,ret);
 380                 s2n(s->tlsext_ellipticcurvelist_length + 2, ret);
 381
 382                 /* NB: draft-ietf-tls-ecc-12.txt uses a one-byte prefix for
 383                  * elliptic_curve_list, but the examples use two bytes.
 384                  * http://www1.ietf.org/mail-archive/web/tls/current/msg00538.html
 385                  * resolves this to two bytes.
 386                  */
 387                 s2n(s->tlsext_ellipticcurvelist_length, ret);
 388                 memcpy(ret, s->tlsext_ellipticcurvelist, s->tlsext_ellipticcurvelist_length);
 389                 ret+=s->tlsext_ellipticcurvelist_length;
 390                 }
 391 #endif /* OPENSSL_NO_EC */
 392
 393         if (!(SSL_get_options(s) & SSL_OP_NO_TICKET))
 394                 {
 395                 int ticklen;
 396                 if (!s->new_session && s->session && s->session->tlsext_tick)
 397                         ticklen = s->session->tlsext_ticklen;
 398                 else if (s->session && s->tlsext_session_ticket &&
 399                          s->tlsext_session_ticket->data)
 400                         {
 401                         ticklen = s->tlsext_session_ticket->length;
 402                         s->session->tlsext_tick = OPENSSL_malloc(ticklen);
 403                         if (!s->session->tlsext_tick)
 404                                 return NULL;
 405                         memcpy(s->session->tlsext_tick,
 406                                s->tlsext_session_ticket->data,
 407                                ticklen);
 408                         s->session->tlsext_ticklen = ticklen;
 409                         }
 410                 else
 411                         ticklen = 0;
 412                 if (ticklen == 0 && s->tlsext_session_ticket &&
 413                     s->tlsext_session_ticket->data == NULL)
 414                         goto skip_ext;
 415                 /* Check for enough room 2 for extension type, 2 for len
 416                  * rest for ticket
 417                  */
 418                 if ((long)(limit - ret - 4 - ticklen) < 0) return NULL;
 419                 s2n(TLSEXT_TYPE_session_ticket,ret);
 420                 s2n(ticklen,ret);
 421                 if (ticklen)
 422                         {
 423                         memcpy(ret, s->session->tlsext_tick, ticklen);
 424                         ret += ticklen;
 425                         }
 426                 }
 427                 skip_ext:
 428
 429 #ifdef TLSEXT_TYPE_opaque_prf_input
 430         if (s->s3->client_opaque_prf_input != NULL &&
 431             s->version != DTLS1_VERSION)
 432                 {
 433                 size_t col = s->s3->client_opaque_prf_input_len;
 434
 435                 if ((long)(limit - ret - 6 - col < 0))
 436                         return NULL;
 437                 if (col > 0xFFFD) /* can't happen */
 438                         return NULL;
 439
 440                 s2n(TLSEXT_TYPE_opaque_prf_input, ret);
 441                 s2n(col + 2, ret);
 442                 s2n(col, ret);
 443                 memcpy(ret, s->s3->client_opaque_prf_input, col);
 444                 ret += col;
 445                 }
 446 #endif
 447
 448         if (s->tlsext_status_type == TLSEXT_STATUSTYPE_ocsp &&
 449             s->version != DTLS1_VERSION)
 450                 {
 451                 int i;
 452                 long extlen, idlen, itmp;
 453                 OCSP_RESPID *id;
 454
 455                 idlen = 0;
 456                 for (i = 0; i < sk_OCSP_RESPID_num(s->tlsext_ocsp_ids); i++)
 457                         {
 458                         id = sk_OCSP_RESPID_value(s->tlsext_ocsp_ids, i);
 459                         itmp = i2d_OCSP_RESPID(id, NULL);
 460                         if (itmp <= 0)
 461                                 return NULL;
 462                         idlen += itmp + 2;
 463                         }
 464
 465                 if (s->tlsext_ocsp_exts)
 466                         {
 467                         extlen = i2d_X509_EXTENSIONS(s->tlsext_ocsp_exts, NULL);
 468                         if (extlen < 0)
 469                                 return NULL;
 470                         }
 471                 else
 472                         extlen = 0;
 473
 474                 if ((long)(limit - ret - 7 - extlen - idlen) < 0) return NULL;
 475                 s2n(TLSEXT_TYPE_status_request, ret);
 476                 if (extlen + idlen > 0xFFF0)
 477                         return NULL;
 478                 s2n(extlen + idlen + 5, ret);
 479                 *(ret++) = TLSEXT_STATUSTYPE_ocsp;
 480                 s2n(idlen, ret);
 481                 for (i = 0; i < sk_OCSP_RESPID_num(s->tlsext_ocsp_ids); i++)
 482                         {
 483                         /* save position of id len */
 484                         unsigned char *q = ret;
 485                         id = sk_OCSP_RESPID_value(s->tlsext_ocsp_ids, i);
 486                         /* skip over id len */
 487                         ret += 2;
 488                         itmp = i2d_OCSP_RESPID(id, &ret);
 489                         /* write id len */
 490                         s2n(itmp, q);
 491                         }
 492                 s2n(extlen, ret);
 493                 if (extlen > 0)
 494                         i2d_X509_EXTENSIONS(s->tlsext_ocsp_exts, &ret);
 495                 }
 496
 497         if ((extdatalen = ret-p-2)== 0)
 498                 return p;
 499
 500         s2n(extdatalen,p);
 501         return ret;
 502         }
 503
 504 unsigned char *ssl_add_serverhello_tlsext(SSL *s, unsigned char *p, unsigned char *limit)
 505         {
 506         int extdatalen=0;
 507         unsigned char *ret = p;
 508
 509         /* don't add extensions for SSLv3, unless doing secure renegotiation */
 510         if (s->version == SSL3_VERSION && !s->s3->send_connection_binding)
 511                 return p;
 512
 513         ret+=2;
 514         if (ret>=limit) return NULL; /* this really never occurs, but ... */
 515
 516         if (!s->hit && s->servername_done == 1 && s->session->tlsext_hostname != NULL)
 517                 {
 518                 if ((long)(limit - ret - 4) < 0) return NULL;
 519
 520                 s2n(TLSEXT_TYPE_server_name,ret);
 521                 s2n(0,ret);
 522                 }
 523
 524         if(s->s3->send_connection_binding)
 525         {
 526           int el;
 527
 528           if(!ssl_add_serverhello_renegotiate_ext(s, 0, &el, 0))
 529               {
 530               SSLerr(SSL_F_SSL_ADD_SERVERHELLO_TLSEXT, ERR_R_INTERNAL_ERROR);
 531               return NULL;
 532               }
 533
 534           if((limit - p - 4 - el) < 0) return NULL;
 535
 536           s2n(TLSEXT_TYPE_renegotiate,ret);
 537           s2n(el,ret);
 538
 539           if(!ssl_add_serverhello_renegotiate_ext(s, ret, &el, el))
 540               {
 541               SSLerr(SSL_F_SSL_ADD_SERVERHELLO_TLSEXT, ERR_R_INTERNAL_ERROR);
 542               return NULL;
 543               }
 544
 545           ret += el;
 546         }
 547
 548 #ifndef OPENSSL_NO_EC
 549         if (s->tlsext_ecpointformatlist != NULL &&
 550             s->version != DTLS1_VERSION)
 551                 {
 552                 /* Add TLS extension ECPointFormats to the ServerHello message */
 553                 long lenmax;
 554
 555                 if ((lenmax = limit - ret - 5) < 0) return NULL;
 556                 if (s->tlsext_ecpointformatlist_length > (unsigned long)lenmax) return NULL;
 557                 if (s->tlsext_ecpointformatlist_length > 255)
 558                         {
 559                         SSLerr(SSL_F_SSL_ADD_SERVERHELLO_TLSEXT, ERR_R_INTERNAL_ERROR);
 560                         return NULL;
 561                         }
 562
 563                 s2n(TLSEXT_TYPE_ec_point_formats,ret);
 564                 s2n(s->tlsext_ecpointformatlist_length + 1,ret);
 565                 *(ret++) = (unsigned char) s->tlsext_ecpointformatlist_length;
 566                 memcpy(ret, s->tlsext_ecpointformatlist, s->tlsext_ecpointformatlist_length);
 567                 ret+=s->tlsext_ecpointformatlist_length;
 568
 569                 }
 570         /* Currently the server should not respond with a SupportedCurves extension */
 571 #endif /* OPENSSL_NO_EC */
 572
 573         if (s->tlsext_ticket_expected
 574                 && !(SSL_get_options(s) & SSL_OP_NO_TICKET))
 575                 {
 576                 if ((long)(limit - ret - 4) < 0) return NULL;
 577                 s2n(TLSEXT_TYPE_session_ticket,ret);
 578                 s2n(0,ret);
 579                 }
 580
 581         if (s->tlsext_status_expected)
 582                 {
 583                 if ((long)(limit - ret - 4) < 0) return NULL;
 584                 s2n(TLSEXT_TYPE_status_request,ret);
 585                 s2n(0,ret);
 586                 }
 587
 588 #ifdef TLSEXT_TYPE_opaque_prf_input
 589         if (s->s3->server_opaque_prf_input != NULL &&
 590             s->version != DTLS1_VERSION)
 591                 {
 592                 size_t sol = s->s3->server_opaque_prf_input_len;
 593
 594                 if ((long)(limit - ret - 6 - sol) < 0)
 595                         return NULL;
 596                 if (sol > 0xFFFD) /* can't happen */
 597                         return NULL;
 598
 599                 s2n(TLSEXT_TYPE_opaque_prf_input, ret);
 600                 s2n(sol + 2, ret);
 601                 s2n(sol, ret);
 602                 memcpy(ret, s->s3->server_opaque_prf_input, sol);
 603                 ret += sol;
 604                 }
 605 #endif
 606         if (((s->s3->tmp.new_cipher->id & 0xFFFF)==0x80 || (s->s3->tmp.new_cipher->id & 0xFFFF)==0x81)
 607                 && (SSL_get_options(s) & SSL_OP_CRYPTOPRO_TLSEXT_BUG))
 608                 { const unsigned char cryptopro_ext[36] = {
 609                         0xfd, 0xe8, /*65000*/
 610                         0x00, 0x20, /*32 bytes length*/
 611                         0x30, 0x1e, 0x30, 0x08, 0x06, 0x06, 0x2a, 0x85,
 612                         0x03,   0x02, 0x02, 0x09, 0x30, 0x08, 0x06, 0x06,
 613                         0x2a, 0x85, 0x03, 0x02, 0x02, 0x16, 0x30, 0x08,
 614                         0x06, 0x06, 0x2a, 0x85, 0x03, 0x02, 0x02, 0x17};
 615                         if (limit-ret<36) return NULL;
 616                         memcpy(ret,cryptopro_ext,36);
 617                         ret+=36;
 618
 619                 }
 620
 621         if ((extdatalen = ret-p-2)== 0)
 622                 return p;
 623
 624         s2n(extdatalen,p);
 625         return ret;
 626         }
 627
 628 int ssl_parse_clienthello_tlsext(SSL *s, unsigned char **p, unsigned char *d, int n, int *al)
 629         {
 630         unsigned short type;
 631         unsigned short size;
 632         unsigned short len;
 633         unsigned char *data = *p;
 634         int renegotiate_seen = 0;
 635
 636         s->servername_done = 0;
 637         s->tlsext_status_type = -1;
 638
 639         if (data >= (d+n-2))
 640                 goto ri_check;
 641         n2s(data,len);
 642
 643         if (data > (d+n-len))
 644                 goto ri_check;
 645
 646         while (data <= (d+n-4))
 647                 {
 648                 n2s(data,type);
 649                 n2s(data,size);
 650
 651                 if (data+size > (d+n))
 652                         goto ri_check;
 653 #if 0
 654                 fprintf(stderr,"Received extension type %d size %d\n",type,size);
 655 #endif
 656                 if (s->tlsext_debug_cb)
 657                         s->tlsext_debug_cb(s, 0, type, data, size,
 658                                                 s->tlsext_debug_arg);
 659 /* The servername extension is treated as follows:
 660
 661    - Only the hostname type is supported with a maximum length of 255.
 662    - The servername is rejected if too long or if it contains zeros,
 663      in which case an fatal alert is generated.
 664    - The servername field is maintained together with the session cache.
 665    - When a session is resumed, the servername call back invoked in order
 666      to allow the application to position itself to the right context.
 667    - The servername is acknowledged if it is new for a session or when
 668      it is identical to a previously used for the same session.
 669      Applications can control the behaviour.  They can at any time
 670      set a 'desirable' servername for a new SSL object. This can be the
 671      case for example with HTTPS when a Host: header field is received and
 672      a renegotiation is requested. In this case, a possible servername
 673      presented in the new client hello is only acknowledged if it matches
 674      the value of the Host: field.
 675    - Applications must  use SSL_OP_NO_SESSION_RESUMPTION_ON_RENEGOTIATION
 676      if they provide for changing an explicit servername context for the session,
 677      i.e. when the session has been established with a servername extension.
 678    - On session reconnect, the servername extension may be absent.
 679
 680 */
 681
 682                 if (type == TLSEXT_TYPE_server_name)
 683                         {
 684                         unsigned char *sdata;
 685                         int servname_type;
 686                         int dsize;
 687
 688                         if (size < 2)
 689                                 {
 690                                 *al = SSL_AD_DECODE_ERROR;
 691                                 return 0;
 692                                 }
 693                         n2s(data,dsize);
 694                         size -= 2;
 695                         if (dsize > size  )
 696                                 {
 697                                 *al = SSL_AD_DECODE_ERROR;
 698                                 return 0;
 699                                 }
 700
 701                         sdata = data;
 702                         while (dsize > 3)
 703                                 {
 704                                 servname_type = *(sdata++);
 705                                 n2s(sdata,len);
 706                                 dsize -= 3;
 707
 708                                 if (len > dsize)
 709                                         {
 710                                         *al = SSL_AD_DECODE_ERROR;
 711                                         return 0;
 712                                         }
 713                                 if (s->servername_done == 0)
 714                                 switch (servname_type)
 715                                         {
 716                                 case TLSEXT_NAMETYPE_host_name:
 717                                         if (!s->hit)
 718                                                 {
 719                                                 if(s->session->tlsext_hostname)
 720                                                         {
 721                                                         *al = SSL_AD_DECODE_ERROR;
 722                                                         return 0;
 723                                                         }
 724                                                 if (len > TLSEXT_MAXLEN_host_name)
 725                                                         {
 726                                                         *al = TLS1_AD_UNRECOGNIZED_NAME;
 727                                                         return 0;
 728                                                         }
 729                                                 if ((s->session->tlsext_hostname = OPENSSL_malloc(len+1)) == NULL)
 730                                                         {
 731                                                         *al = TLS1_AD_INTERNAL_ERROR;
 732                                                         return 0;
 733                                                         }
 734                                                 memcpy(s->session->tlsext_hostname, sdata, len);
 735                                                 s->session->tlsext_hostname[len]='\0';
 736                                                 if (strlen(s->session->tlsext_hostname) != len) {
 737                                                         OPENSSL_free(s->session->tlsext_hostname);
 738                                                         s->session->tlsext_hostname = NULL;
 739                                                         *al = TLS1_AD_UNRECOGNIZED_NAME;
 740                                                         return 0;
 741                                                 }
 742                                                 s->servername_done = 1;
 743
 744                                                 }
 745                                         else
 746                                                 s->servername_done = s->session->tlsext_hostname
 747                                                         && strlen(s->session->tlsext_hostname) == len
 748                                                         && strncmp(s->session->tlsext_hostname, (char *)sdata, len) == 0;
 749
 750                                         break;
 751
 752                                 default:
 753                                         break;
 754                                         }
 755
 756                                 dsize -= len;
 757                                 }
 758                         if (dsize != 0)
 759                                 {
 760                                 *al = SSL_AD_DECODE_ERROR;
 761                                 return 0;
 762                                 }
 763
 764                         }
 765
 766 #ifndef OPENSSL_NO_EC
 767                 else if (type == TLSEXT_TYPE_ec_point_formats &&
 768                      s->version != DTLS1_VERSION)
 769                         {
 770                         unsigned char *sdata = data;
 771                         int ecpointformatlist_length = *(sdata++);
 772
 773                         if (ecpointformatlist_length != size - 1)
 774                                 {
 775                                 *al = TLS1_AD_DECODE_ERROR;
 776                                 return 0;
 777                                 }
 778                         if (!s->hit)
 779                                 {
 780                                 if(s->session->tlsext_ecpointformatlist)
 781                                         {
 782                                         OPENSSL_free(s->session->tlsext_ecpointformatlist);
 783                                         s->session->tlsext_ecpointformatlist = NULL;
 784                                         }
 785                                 s->session->tlsext_ecpointformatlist_length = 0;
 786                                 if ((s->session->tlsext_ecpointformatlist = OPENSSL_malloc(ecpointformatlist_length)) == NULL)
 787                                         {
 788                                         *al = TLS1_AD_INTERNAL_ERROR;
 789                                         return 0;
 790                                         }
 791                                 s->session->tlsext_ecpointformatlist_length = ecpointformatlist_length;
 792                                 memcpy(s->session->tlsext_ecpointformatlist, sdata, ecpointformatlist_length);
 793                                 }
 794 #if 0
 795                         fprintf(stderr,"ssl_parse_clienthello_tlsext s->session->tlsext_ecpointformatlist (length=%i) ", s->session->tlsext_ecpointformatlist_length);
 796                         sdata = s->session->tlsext_ecpointformatlist;
 797                         for (i = 0; i < s->session->tlsext_ecpointformatlist_length; i++)
 798                                 fprintf(stderr,"%i ",*(sdata++));
 799                         fprintf(stderr,"\n");
 800 #endif
 801                         }
 802                 else if (type == TLSEXT_TYPE_elliptic_curves &&
 803                      s->version != DTLS1_VERSION)
 804                         {
 805                         unsigned char *sdata = data;
 806                         int ellipticcurvelist_length = (*(sdata++) << 8);
 807                         ellipticcurvelist_length += (*(sdata++));
 808
 809                         if (ellipticcurvelist_length != size - 2 ||
 810                                 ellipticcurvelist_length < 1)
 811                                 {
 812                                 *al = TLS1_AD_DECODE_ERROR;
 813                                 return 0;
 814                                 }
 815                         if (!s->hit)
 816                                 {
 817                                 if(s->session->tlsext_ellipticcurvelist)
 818                                         {
 819                                         *al = TLS1_AD_DECODE_ERROR;
 820                                         return 0;
 821                                         }
 822                                 s->session->tlsext_ellipticcurvelist_length = 0;
 823                                 if ((s->session->tlsext_ellipticcurvelist = OPENSSL_malloc(ellipticcurvelist_length)) == NULL)
 824                                         {
 825                                         *al = TLS1_AD_INTERNAL_ERROR;
 826                                         return 0;
 827                                         }
 828                                 s->session->tlsext_ellipticcurvelist_length = ellipticcurvelist_length;
 829                                 memcpy(s->session->tlsext_ellipticcurvelist, sdata, ellipticcurvelist_length);
 830                                 }
 831 #if 0
 832                         fprintf(stderr,"ssl_parse_clienthello_tlsext s->session->tlsext_ellipticcurvelist (length=%i) ", s->session->tlsext_ellipticcurvelist_length);
 833                         sdata = s->session->tlsext_ellipticcurvelist;
 834                         for (i = 0; i < s->session->tlsext_ellipticcurvelist_length; i++)
 835                                 fprintf(stderr,"%i ",*(sdata++));
 836                         fprintf(stderr,"\n");
 837 #endif
 838                         }
 839 #endif /* OPENSSL_NO_EC */
 840 #ifdef TLSEXT_TYPE_opaque_prf_input
 841                 else if (type == TLSEXT_TYPE_opaque_prf_input &&
 842                      s->version != DTLS1_VERSION)
 843                         {
 844                         unsigned char *sdata = data;
 845
 846                         if (size < 2)
 847                                 {
 848                                 *al = SSL_AD_DECODE_ERROR;
 849                                 return 0;
 850                                 }
 851                         n2s(sdata, s->s3->client_opaque_prf_input_len);
 852                         if (s->s3->client_opaque_prf_input_len != size - 2)
 853                                 {
 854                                 *al = SSL_AD_DECODE_ERROR;
 855                                 return 0;
 856                                 }
 857
 858                         if (s->s3->client_opaque_prf_input != NULL) /* shouldn't really happen */
 859                                 OPENSSL_free(s->s3->client_opaque_prf_input);
 860                         if (s->s3->client_opaque_prf_input_len == 0)
 861                                 s->s3->client_opaque_prf_input = OPENSSL_malloc(1); /* dummy byte just to get non-NULL */
 862                         else
 863                                 s->s3->client_opaque_prf_input = BUF_memdup(sdata, s->s3->client_opaque_prf_input_len);
 864                         if (s->s3->client_opaque_prf_input == NULL)
 865                                 {
 866                                 *al = TLS1_AD_INTERNAL_ERROR;
 867                                 return 0;
 868                                 }
 869                         }
 870 #endif
 871                 else if (type == TLSEXT_TYPE_session_ticket)
 872                         {
 873                         if (s->tls_session_ticket_ext_cb &&
 874                             !s->tls_session_ticket_ext_cb(s, data, size, s->tls_session_ticket_ext_cb_arg))
 875                                 {
 876                                 *al = TLS1_AD_INTERNAL_ERROR;
 877                                 return 0;
 878                                 }
 879                         }
 880                 else if (type == TLSEXT_TYPE_renegotiate)
 881                         {
 882                         if(!ssl_parse_clienthello_renegotiate_ext(s, data, size, al))
 883                                 return 0;
 884                         renegotiate_seen = 1;
 885                         }
 886                 else if (type == TLSEXT_TYPE_status_request &&
 887                          s->version != DTLS1_VERSION && s->ctx->tlsext_status_cb)
 888                         {
 889
 890                         if (size < 5)
 891                                 {
 892                                 *al = SSL_AD_DECODE_ERROR;
 893                                 return 0;
 894                                 }
 895
 896                         s->tlsext_status_type = *data++;
 897                         size--;
 898                         if (s->tlsext_status_type == TLSEXT_STATUSTYPE_ocsp)
 899                                 {
 900                                 const unsigned char *sdata;
 901                                 int dsize;
 902                                 /* Read in responder_id_list */
 903                                 n2s(data,dsize);
 904                                 size -= 2;
 905                                 if (dsize > size  )
 906                                         {
 907                                         *al = SSL_AD_DECODE_ERROR;
 908                                         return 0;
 909                                         }
 910                                 while (dsize > 0)
 911                                         {
 912                                         OCSP_RESPID *id;
 913                                         int idsize;
 914                                         if (dsize < 4)
 915                                                 {
 916                                                 *al = SSL_AD_DECODE_ERROR;
 917                                                 return 0;
 918                                                 }
 919                                         n2s(data, idsize);
 920                                         dsize -= 2 + idsize;
 921                                         size -= 2 + idsize;
 922                                         if (dsize < 0)
 923                                                 {
 924                                                 *al = SSL_AD_DECODE_ERROR;
 925                                                 return 0;
 926                                                 }
 927                                         sdata = data;
 928                                         data += idsize;
 929                                         id = d2i_OCSP_RESPID(NULL,
 930                                                                 &sdata, idsize);
 931                                         if (!id)
 932                                                 {
 933                                                 *al = SSL_AD_DECODE_ERROR;
 934                                                 return 0;
 935                                                 }
 936                                         if (data != sdata)
 937                                                 {
 938                                                 OCSP_RESPID_free(id);
 939                                                 *al = SSL_AD_DECODE_ERROR;
 940                                                 return 0;
 941                                                 }
 942                                         if (!s->tlsext_ocsp_ids
 943                                                 && !(s->tlsext_ocsp_ids =
 944                                                 sk_OCSP_RESPID_new_null()))
 945                                                 {
 946                                                 OCSP_RESPID_free(id);
 947                                                 *al = SSL_AD_INTERNAL_ERROR;
 948                                                 return 0;
 949                                                 }
 950                                         if (!sk_OCSP_RESPID_push(
 951                                                         s->tlsext_ocsp_ids, id))
 952                                                 {
 953                                                 OCSP_RESPID_free(id);
 954                                                 *al = SSL_AD_INTERNAL_ERROR;
 955                                                 return 0;
 956                                                 }
 957                                         }
 958
 959                                 /* Read in request_extensions */
 960                                 if (size < 2)
 961                                         {
 962                                         *al = SSL_AD_DECODE_ERROR;
 963                                         return 0;
 964                                         }
 965                                 n2s(data,dsize);
 966                                 size -= 2;
 967                                 if (dsize != size)
 968                                         {
 969                                         *al = SSL_AD_DECODE_ERROR;
 970                                         return 0;
 971                                         }
 972                                 sdata = data;
 973                                 if (dsize > 0)
 974                                         {
 975                                         if (s->tlsext_ocsp_exts)
 976                                                 {
 977                                                 sk_X509_EXTENSION_pop_free(s->tlsext_ocsp_exts,
 978                                                                            X509_EXTENSION_free);
 979                                                 }
 980
 981                                         s->tlsext_ocsp_exts =
 982                                                 d2i_X509_EXTENSIONS(NULL,
 983                                                         &sdata, dsize);
 984                                         if (!s->tlsext_ocsp_exts
 985                                                 || (data + dsize != sdata))
 986                                                 {
 987                                                 *al = SSL_AD_DECODE_ERROR;
 988                                                 return 0;
 989                                                 }
 990                                         }
 991                                 }
 992                                 /* We don't know what to do with any other type
 993                                 * so ignore it.
 994                                 */
 995                                 else
 996                                         s->tlsext_status_type = -1;
 997                         }
 998
 999                 /* session ticket processed earlier */
1000                 data+=size;
1001                 }
1002
1003         *p = data;
1004
1005         ri_check:
1006
1007         /* Need RI if renegotiating */
1008
1009         if (!renegotiate_seen && s->new_session &&
1010                 !(s->options & SSL_OP_ALLOW_UNSAFE_LEGACY_RENEGOTIATION))
1011                 {
1012                 *al = SSL_AD_HANDSHAKE_FAILURE;
1013                 SSLerr(SSL_F_SSL_PARSE_CLIENTHELLO_TLSEXT,
1014                                 SSL_R_UNSAFE_LEGACY_RENEGOTIATION_DISABLED);
1015                 return 0;
1016                 }
1017
1018         return 1;
1019         }
1020
1021 int ssl_parse_serverhello_tlsext(SSL *s, unsigned char **p, unsigned char *d, int n, int *al)
1022         {
1023         unsigned short length;
1024         unsigned short type;
1025         unsigned short size;
1026         unsigned char *data = *p;
1027         int tlsext_servername = 0;
1028         int renegotiate_seen = 0;
1029
1030         if (data >= (d+n-2))
1031                 goto ri_check;
1032
1033         n2s(data,length);
1034         if (data+length != d+n)
1035                 {
1036                 *al = SSL_AD_DECODE_ERROR;
1037                 return 0;
1038                 }
1039
1040         while(data <= (d+n-4))
1041                 {
1042                 n2s(data,type);
1043                 n2s(data,size);
1044
1045                 if (data+size > (d+n))
1046                         goto ri_check;
1047
1048                 if (s->tlsext_debug_cb)
1049                         s->tlsext_debug_cb(s, 1, type, data, size,
1050                                                 s->tlsext_debug_arg);
1051
1052                 if (type == TLSEXT_TYPE_server_name)
1053                         {
1054                         if (s->tlsext_hostname == NULL || size > 0)
1055                                 {
1056                                 *al = TLS1_AD_UNRECOGNIZED_NAME;
1057                                 return 0;
1058                                 }
1059                         tlsext_servername = 1;
1060                         }
1061
1062 #ifndef OPENSSL_NO_EC
1063                 else if (type == TLSEXT_TYPE_ec_point_formats &&
1064                      s->version != DTLS1_VERSION)
1065                         {
1066                         unsigned char *sdata = data;
1067                         int ecpointformatlist_length = *(sdata++);
1068
1069                         if (ecpointformatlist_length != size - 1 ||
1070                                 ecpointformatlist_length < 1)
1071                                 {
1072                                 *al = TLS1_AD_DECODE_ERROR;
1073                                 return 0;
1074                                 }
1075                         s->session->tlsext_ecpointformatlist_length = 0;
1076                         if (s->session->tlsext_ecpointformatlist != NULL) OPENSSL_free(s->session->tlsext_ecpointformatlist);
1077                         if ((s->session->tlsext_ecpointformatlist = OPENSSL_malloc(ecpointformatlist_length)) == NULL)
1078                                 {
1079                                 *al = TLS1_AD_INTERNAL_ERROR;
1080                                 return 0;
1081                                 }
1082                         s->session->tlsext_ecpointformatlist_length = ecpointformatlist_length;
1083                         memcpy(s->session->tlsext_ecpointformatlist, sdata, ecpointformatlist_length);
1084 #if 0
1085                         fprintf(stderr,"ssl_parse_serverhello_tlsext s->session->tlsext_ecpointformatlist ");
1086                         sdata = s->session->tlsext_ecpointformatlist;
1087                         for (i = 0; i < s->session->tlsext_ecpointformatlist_length; i++)
1088                                 fprintf(stderr,"%i ",*(sdata++));
1089                         fprintf(stderr,"\n");
1090 #endif
1091                         }
1092 #endif /* OPENSSL_NO_EC */
1093
1094                 else if (type == TLSEXT_TYPE_session_ticket)
1095                         {
1096                         if (s->tls_session_ticket_ext_cb &&
1097                             !s->tls_session_ticket_ext_cb(s, data, size, s->tls_session_ticket_ext_cb_arg))
1098                                 {
1099                                 *al = TLS1_AD_INTERNAL_ERROR;
1100                                 return 0;
1101                                 }
1102                         if ((SSL_get_options(s) & SSL_OP_NO_TICKET)
1103                                 || (size > 0))
1104                                 {
1105                                 *al = TLS1_AD_UNSUPPORTED_EXTENSION;
1106                                 return 0;
1107                                 }
1108                         s->tlsext_ticket_expected = 1;
1109                         }
1110 #ifdef TLSEXT_TYPE_opaque_prf_input
1111                 else if (type == TLSEXT_TYPE_opaque_prf_input &&
1112                      s->version != DTLS1_VERSION)
1113                         {
1114                         unsigned char *sdata = data;
1115
1116                         if (size < 2)
1117                                 {
1118                                 *al = SSL_AD_DECODE_ERROR;
1119                                 return 0;
1120                                 }
1121                         n2s(sdata, s->s3->server_opaque_prf_input_len);
1122                         if (s->s3->server_opaque_prf_input_len != size - 2)
1123                                 {
1124                                 *al = SSL_AD_DECODE_ERROR;
1125                                 return 0;
1126                                 }
1127
1128                         if (s->s3->server_opaque_prf_input != NULL) /* shouldn't really happen */
1129                                 OPENSSL_free(s->s3->server_opaque_prf_input);
1130                         if (s->s3->server_opaque_prf_input_len == 0)
1131                                 s->s3->server_opaque_prf_input = OPENSSL_malloc(1); /* dummy byte just to get non-NULL */
1132                         else
1133                                 s->s3->server_opaque_prf_input = BUF_memdup(sdata, s->s3->server_opaque_prf_input_len);
1134
1135                         if (s->s3->server_opaque_prf_input == NULL)
1136                                 {
1137                                 *al = TLS1_AD_INTERNAL_ERROR;
1138                                 return 0;
1139                                 }
1140                         }
1141 #endif
1142                 else if (type == TLSEXT_TYPE_status_request &&
1143                          s->version != DTLS1_VERSION)
1144                         {
1145                         /* MUST be empty and only sent if we've requested
1146                          * a status request message.
1147                          */
1148                         if ((s->tlsext_status_type == -1) || (size > 0))
1149                                 {
1150                                 *al = TLS1_AD_UNSUPPORTED_EXTENSION;
1151                                 return 0;
1152                                 }
1153                         /* Set flag to expect CertificateStatus message */
1154                         s->tlsext_status_expected = 1;
1155                         }
1156                 else if (type == TLSEXT_TYPE_renegotiate)
1157                         {
1158                         if(!ssl_parse_serverhello_renegotiate_ext(s, data, size, al))
1159                                 return 0;
1160                         renegotiate_seen = 1;
1161                         }
1162                 data+=size;
1163                 }
1164
1165         if (data != d+n)
1166                 {
1167                 *al = SSL_AD_DECODE_ERROR;
1168                 return 0;
1169                 }
1170
1171         if (!s->hit && tlsext_servername == 1)
1172                 {
1173                 if (s->tlsext_hostname)
1174                         {
1175                         if (s->session->tlsext_hostname == NULL)
1176                                 {
1177                                 s->session->tlsext_hostname = BUF_strdup(s->tlsext_hostname);
1178                                 if (!s->session->tlsext_hostname)
1179                                         {
1180                                         *al = SSL_AD_UNRECOGNIZED_NAME;
1181                                         return 0;
1182                                         }
1183                                 }
1184                         else
1185                                 {
1186                                 *al = SSL_AD_DECODE_ERROR;
1187                                 return 0;
1188                                 }
1189                         }
1190                 }
1191
1192         *p = data;
1193
1194         ri_check:
1195
1196         /* Determine if we need to see RI. Strictly speaking if we want to
1197          * avoid an attack we should *always* see RI even on initial server
1198          * hello because the client doesn't see any renegotiation during an
1199          * attack. However this would mean we could not connect to any server
1200          * which doesn't support RI so for the immediate future tolerate RI
1201          * absence on initial connect only.
1202          */
1203         if (!renegotiate_seen
1204                 && !(s->options & SSL_OP_LEGACY_SERVER_CONNECT)
1205                 && !(s->options & SSL_OP_ALLOW_UNSAFE_LEGACY_RENEGOTIATION))
1206                 {
1207                 *al = SSL_AD_HANDSHAKE_FAILURE;
1208                 SSLerr(SSL_F_SSL_PARSE_SERVERHELLO_TLSEXT,
1209                                 SSL_R_UNSAFE_LEGACY_RENEGOTIATION_DISABLED);
1210                 return 0;
1211                 }
1212
1213         return 1;
1214         }
1215
1216
1217 int ssl_prepare_clienthello_tlsext(SSL *s)
1218         {
1219 #ifndef OPENSSL_NO_EC
1220         /* If we are client and using an elliptic curve cryptography cipher suite, send the point formats
1221          * and elliptic curves we support.
1222          */
1223         int using_ecc = 0;
1224         int i;
1225         unsigned char *j;
1226         unsigned long alg_k, alg_a;
1227         STACK_OF(SSL_CIPHER) *cipher_stack = SSL_get_ciphers(s);
1228
1229         for (i = 0; i < sk_SSL_CIPHER_num(cipher_stack); i++)
1230                 {
1231                 SSL_CIPHER *c = sk_SSL_CIPHER_value(cipher_stack, i);
1232
1233                 alg_k = c->algorithm_mkey;
1234                 alg_a = c->algorithm_auth;
1235                 if ((alg_k & (SSL_kEECDH|SSL_kECDHr|SSL_kECDHe) || (alg_a & SSL_aECDSA)))
1236                         {
1237                         using_ecc = 1;
1238                         break;
1239                         }
1240                 }
1241         using_ecc = using_ecc && (s->version == TLS1_VERSION);
1242         if (using_ecc)
1243                 {
1244                 if (s->tlsext_ecpointformatlist != NULL) OPENSSL_free(s->tlsext_ecpointformatlist);
1245                 if ((s->tlsext_ecpointformatlist = OPENSSL_malloc(3)) == NULL)
1246                         {
1247                         SSLerr(SSL_F_SSL_PREPARE_CLIENTHELLO_TLSEXT,ERR_R_MALLOC_FAILURE);
1248                         return -1;
1249                         }
1250                 s->tlsext_ecpointformatlist_length = 3;
1251                 s->tlsext_ecpointformatlist[0] = TLSEXT_ECPOINTFORMAT_uncompressed;
1252                 s->tlsext_ecpointformatlist[1] = TLSEXT_ECPOINTFORMAT_ansiX962_compressed_prime;
1253                 s->tlsext_ecpointformatlist[2] = TLSEXT_ECPOINTFORMAT_ansiX962_compressed_char2;
1254
1255                 /* we support all named elliptic curves in draft-ietf-tls-ecc-12 */
1256                 if (s->tlsext_ellipticcurvelist != NULL) OPENSSL_free(s->tlsext_ellipticcurvelist);
1257                 s->tlsext_ellipticcurvelist_length = sizeof(nid_list)/sizeof(nid_list[0]) * 2;
1258                 if ((s->tlsext_ellipticcurvelist = OPENSSL_malloc(s->tlsext_ellipticcurvelist_length)) == NULL)
1259                         {
1260                         s->tlsext_ellipticcurvelist_length = 0;
1261                         SSLerr(SSL_F_SSL_PREPARE_CLIENTHELLO_TLSEXT,ERR_R_MALLOC_FAILURE);
1262                         return -1;
1263                         }
1264                 for (i = 1, j = s->tlsext_ellipticcurvelist; (unsigned int)i <=
1265                                 sizeof(nid_list)/sizeof(nid_list[0]); i++)
1266                         s2n(i,j);
1267                 }
1268 #endif /* OPENSSL_NO_EC */
1269
1270 #ifdef TLSEXT_TYPE_opaque_prf_input
1271         {
1272                 int r = 1;
1273
1274                 if (s->ctx->tlsext_opaque_prf_input_callback != 0)
1275                         {
1276                         r = s->ctx->tlsext_opaque_prf_input_callback(s, NULL, 0, s->ctx->tlsext_opaque_prf_input_callback_arg);
1277                         if (!r)
1278                                 return -1;
1279                         }
1280
1281                 if (s->tlsext_opaque_prf_input != NULL)
1282                         {
1283                         if (s->s3->client_opaque_prf_input != NULL) /* shouldn't really happen */
1284                                 OPENSSL_free(s->s3->client_opaque_prf_input);
1285
1286                         if (s->tlsext_opaque_prf_input_len == 0)
1287                                 s->s3->client_opaque_prf_input = OPENSSL_malloc(1); /* dummy byte just to get non-NULL */
1288                         else
1289                                 s->s3->client_opaque_prf_input = BUF_memdup(s->tlsext_opaque_prf_input, s->tlsext_opaque_prf_input_len);
1290                         if (s->s3->client_opaque_prf_input == NULL)
1291                                 {
1292                                 SSLerr(SSL_F_SSL_PREPARE_CLIENTHELLO_TLSEXT,ERR_R_MALLOC_FAILURE);
1293                                 return -1;
1294                                 }
1295                         s->s3->client_opaque_prf_input_len = s->tlsext_opaque_prf_input_len;
1296                         }
1297
1298                 if (r == 2)
1299                         /* at callback's request, insist on receiving an appropriate server opaque PRF input */
1300                         s->s3->server_opaque_prf_input_len = s->tlsext_opaque_prf_input_len;
1301         }
1302 #endif
1303
1304         return 1;
1305         }
1306
1307 int ssl_prepare_serverhello_tlsext(SSL *s)
1308         {
1309 #ifndef OPENSSL_NO_EC
1310         /* If we are server and using an ECC cipher suite, send the point formats we support
1311          * if the client sent us an ECPointsFormat extension.  Note that the server is not
1312          * supposed to send an EllipticCurves extension.
1313          */
1314
1315         unsigned long alg_k = s->s3->tmp.new_cipher->algorithm_mkey;
1316         unsigned long alg_a = s->s3->tmp.new_cipher->algorithm_auth;
1317         int using_ecc = (alg_k & (SSL_kEECDH|SSL_kECDHr|SSL_kECDHe)) || (alg_a & SSL_aECDSA);
1318         using_ecc = using_ecc && (s->session->tlsext_ecpointformatlist != NULL);
1319
1320         if (using_ecc)
1321                 {
1322                 if (s->tlsext_ecpointformatlist != NULL) OPENSSL_free(s->tlsext_ecpointformatlist);
1323                 if ((s->tlsext_ecpointformatlist = OPENSSL_malloc(3)) == NULL)
1324                         {
1325                         SSLerr(SSL_F_SSL_PREPARE_SERVERHELLO_TLSEXT,ERR_R_MALLOC_FAILURE);
1326                         return -1;
1327                         }
1328                 s->tlsext_ecpointformatlist_length = 3;
1329                 s->tlsext_ecpointformatlist[0] = TLSEXT_ECPOINTFORMAT_uncompressed;
1330                 s->tlsext_ecpointformatlist[1] = TLSEXT_ECPOINTFORMAT_ansiX962_compressed_prime;
1331                 s->tlsext_ecpointformatlist[2] = TLSEXT_ECPOINTFORMAT_ansiX962_compressed_char2;
1332                 }
1333 #endif /* OPENSSL_NO_EC */
1334
1335         return 1;
1336         }
1337
1338 int ssl_check_clienthello_tlsext_early(SSL *s)
1339         {
1340         int ret=SSL_TLSEXT_ERR_NOACK;
1341         int al = SSL_AD_UNRECOGNIZED_NAME;
1342
1343 #ifndef OPENSSL_NO_EC
1344         /* The handling of the ECPointFormats extension is done elsewhere, namely in
1345          * ssl3_choose_cipher in s3_lib.c.
1346          */
1347         /* The handling of the EllipticCurves extension is done elsewhere, namely in
1348          * ssl3_choose_cipher in s3_lib.c.
1349          */
1350 #endif
1351
1352         if (s->ctx != NULL && s->ctx->tlsext_servername_callback != 0)
1353                 ret = s->ctx->tlsext_servername_callback(s, &al, s->ctx->tlsext_servername_arg);
1354         else if (s->initial_ctx != NULL && s->initial_ctx->tlsext_servername_callback != 0)
1355                 ret = s->initial_ctx->tlsext_servername_callback(s, &al, s->initial_ctx->tlsext_servername_arg);
1356
1357 #ifdef TLSEXT_TYPE_opaque_prf_input
1358         {
1359                 /* This sort of belongs into ssl_prepare_serverhello_tlsext(),
1360                  * but we might be sending an alert in response to the client hello,
1361                  * so this has to happen here in
1362                  * ssl_check_clienthello_tlsext_early(). */
1363
1364                 int r = 1;
1365
1366                 if (s->ctx->tlsext_opaque_prf_input_callback != 0)
1367                         {
1368                         r = s->ctx->tlsext_opaque_prf_input_callback(s, NULL, 0, s->ctx->tlsext_opaque_prf_input_callback_arg);
1369                         if (!r)
1370                                 {
1371                                 ret = SSL_TLSEXT_ERR_ALERT_FATAL;
1372                                 al = SSL_AD_INTERNAL_ERROR;
1373                                 goto err;
1374                                 }
1375                         }
1376
1377                 if (s->s3->server_opaque_prf_input != NULL) /* shouldn't really happen */
1378                         OPENSSL_free(s->s3->server_opaque_prf_input);
1379                 s->s3->server_opaque_prf_input = NULL;
1380
1381                 if (s->tlsext_opaque_prf_input != NULL)
1382                         {
1383                         if (s->s3->client_opaque_prf_input != NULL &&
1384                                 s->s3->client_opaque_prf_input_len == s->tlsext_opaque_prf_input_len)
1385                                 {
1386                                 /* can only use this extension if we have a server opaque PRF input
1387                                  * of the same length as the client opaque PRF input! */
1388
1389                                 if (s->tlsext_opaque_prf_input_len == 0)
1390                                         s->s3->server_opaque_prf_input = OPENSSL_malloc(1); /* dummy byte just to get non-NULL */
1391                                 else
1392                                         s->s3->server_opaque_prf_input = BUF_memdup(s->tlsext_opaque_prf_input, s->tlsext_opaque_prf_input_len);
1393                                 if (s->s3->server_opaque_prf_input == NULL)
1394                                         {
1395                                         ret = SSL_TLSEXT_ERR_ALERT_FATAL;
1396                                         al = SSL_AD_INTERNAL_ERROR;
1397                                         goto err;
1398                                         }
1399                                 s->s3->server_opaque_prf_input_len = s->tlsext_opaque_prf_input_len;
1400                                 }
1401                         }
1402
1403                 if (r == 2 && s->s3->server_opaque_prf_input == NULL)
1404                         {
1405                         /* The callback wants to enforce use of the extension,
1406                          * but we can't do that with the client opaque PRF input;
1407                          * abort the handshake.
1408                          */
1409                         ret = SSL_TLSEXT_ERR_ALERT_FATAL;
1410                         al = SSL_AD_HANDSHAKE_FAILURE;
1411                         }
1412         }
1413
1414  err:
1415 #endif
1416         switch (ret)
1417                 {
1418                 case SSL_TLSEXT_ERR_ALERT_FATAL:
1419                         ssl3_send_alert(s,SSL3_AL_FATAL,al);
1420                         return -1;
1421
1422                 case SSL_TLSEXT_ERR_ALERT_WARNING:
1423                         ssl3_send_alert(s,SSL3_AL_WARNING,al);
1424                         return 1;
1425
1426                 case SSL_TLSEXT_ERR_NOACK:
1427                         s->servername_done=0;
1428                         default:
1429                 return 1;
1430                 }
1431         }
1432
1433 int ssl_check_clienthello_tlsext_late(SSL *s)
1434         {
1435         int ret = SSL_TLSEXT_ERR_OK;
1436         int al;
1437
1438         /* If status request then ask callback what to do.
1439          * Note: this must be called after servername callbacks in case
1440          * the certificate has changed, and must be called after the cipher
1441          * has been chosen because this may influence which certificate is sent
1442          */
1443         if (s->tlsext_status_type != -1 && s->ctx && s->ctx->tlsext_status_cb)
1444                 {
1445                 int r;
1446                 CERT_PKEY *certpkey;
1447                 certpkey = ssl_get_server_send_pkey(s);
1448                 /* If no certificate can't return certificate status */
1449                 if (certpkey == NULL)
1450                         {
1451                         s->tlsext_status_expected = 0;
1452                         return 1;
1453                         }
1454                 /* Set current certificate to one we will use so
1455                  * SSL_get_certificate et al can pick it up.
1456                  */
1457                 s->cert->key = certpkey;
1458                 r = s->ctx->tlsext_status_cb(s, s->ctx->tlsext_status_arg);
1459                 switch (r)
1460                         {
1461                         /* We don't want to send a status request response */
1462                         case SSL_TLSEXT_ERR_NOACK:
1463                                 s->tlsext_status_expected = 0;
1464                                 break;
1465                         /* status request response should be sent */
1466                         case SSL_TLSEXT_ERR_OK:
1467                                 if (s->tlsext_ocsp_resp)
1468                                         s->tlsext_status_expected = 1;
1469                                 else
1470                                         s->tlsext_status_expected = 0;
1471                                 break;
1472                         /* something bad happened */
1473                         case SSL_TLSEXT_ERR_ALERT_FATAL:
1474                                 ret = SSL_TLSEXT_ERR_ALERT_FATAL;
1475                                 al = SSL_AD_INTERNAL_ERROR;
1476                                 goto err;
1477                         }
1478                 }
1479         else
1480                 s->tlsext_status_expected = 0;
1481
1482  err:
1483         switch (ret)
1484                 {
1485                 case SSL_TLSEXT_ERR_ALERT_FATAL:
1486                         ssl3_send_alert(s, SSL3_AL_FATAL, al);
1487                         return -1;
1488
1489                 case SSL_TLSEXT_ERR_ALERT_WARNING:
1490                         ssl3_send_alert(s, SSL3_AL_WARNING, al);
1491                         return 1;
1492
1493                 default:
1494                         return 1;
1495                 }
1496         }
1497
1498 int ssl_check_serverhello_tlsext(SSL *s)
1499         {
1500         int ret=SSL_TLSEXT_ERR_NOACK;
1501         int al = SSL_AD_UNRECOGNIZED_NAME;
1502
1503 #ifndef OPENSSL_NO_EC
1504         /* If we are client and using an elliptic curve cryptography cipher
1505          * suite, then if server returns an EC point formats lists extension
1506          * it must contain uncompressed.
1507          */
1508         unsigned long alg_k = s->s3->tmp.new_cipher->algorithm_mkey;
1509         unsigned long alg_a = s->s3->tmp.new_cipher->algorithm_auth;
1510         if ((s->tlsext_ecpointformatlist != NULL) && (s->tlsext_ecpointformatlist_length > 0) &&
1511             (s->session->tlsext_ecpointformatlist != NULL) && (s->session->tlsext_ecpointformatlist_length > 0) &&
1512             ((alg_k & (SSL_kEECDH|SSL_kECDHr|SSL_kECDHe)) || (alg_a & SSL_aECDSA)))
1513                 {
1514                 /* we are using an ECC cipher */
1515                 size_t i;
1516                 unsigned char *list;
1517                 int found_uncompressed = 0;
1518                 list = s->session->tlsext_ecpointformatlist;
1519                 for (i = 0; i < s->session->tlsext_ecpointformatlist_length; i++)
1520                         {
1521                         if (*(list++) == TLSEXT_ECPOINTFORMAT_uncompressed)
1522                                 {
1523                                 found_uncompressed = 1;
1524                                 break;
1525                                 }
1526                         }
1527                 if (!found_uncompressed)
1528                         {
1529                         SSLerr(SSL_F_SSL_CHECK_SERVERHELLO_TLSEXT,SSL_R_TLS_INVALID_ECPOINTFORMAT_LIST);
1530                         return -1;
1531                         }
1532                 }
1533         ret = SSL_TLSEXT_ERR_OK;
1534 #endif /* OPENSSL_NO_EC */
1535
1536         if (s->ctx != NULL && s->ctx->tlsext_servername_callback != 0)
1537                 ret = s->ctx->tlsext_servername_callback(s, &al, s->ctx->tlsext_servername_arg);
1538         else if (s->initial_ctx != NULL && s->initial_ctx->tlsext_servername_callback != 0)
1539                 ret = s->initial_ctx->tlsext_servername_callback(s, &al, s->initial_ctx->tlsext_servername_arg);
1540
1541 #ifdef TLSEXT_TYPE_opaque_prf_input
1542         if (s->s3->server_opaque_prf_input_len > 0)
1543                 {
1544                 /* This case may indicate that we, as a client, want to insist on using opaque PRF inputs.
1545                  * So first verify that we really have a value from the server too. */
1546
1547                 if (s->s3->server_opaque_prf_input == NULL)
1548                         {
1549                         ret = SSL_TLSEXT_ERR_ALERT_FATAL;
1550                         al = SSL_AD_HANDSHAKE_FAILURE;
1551                         }
1552
1553                 /* Anytime the server *has* sent an opaque PRF input, we need to check
1554                  * that we have a client opaque PRF input of the same size. */
1555                 if (s->s3->client_opaque_prf_input == NULL ||
1556                     s->s3->client_opaque_prf_input_len != s->s3->server_opaque_prf_input_len)
1557                         {
1558                         ret = SSL_TLSEXT_ERR_ALERT_FATAL;
1559                         al = SSL_AD_ILLEGAL_PARAMETER;
1560                         }
1561                 }
1562 #endif
1563
1564         /* If we've requested certificate status and we wont get one
1565          * tell the callback
1566          */
1567         if ((s->tlsext_status_type != -1) && !(s->tlsext_status_expected)
1568                         && s->ctx && s->ctx->tlsext_status_cb)
1569                 {
1570                 int r;
1571                 /* Set resp to NULL, resplen to -1 so callback knows
1572                  * there is no response.
1573                  */
1574                 if (s->tlsext_ocsp_resp)
1575                         {
1576                         OPENSSL_free(s->tlsext_ocsp_resp);
1577                         s->tlsext_ocsp_resp = NULL;
1578                         }
1579                 s->tlsext_ocsp_resplen = -1;
1580                 r = s->ctx->tlsext_status_cb(s, s->ctx->tlsext_status_arg);
1581                 if (r == 0)
1582                         {
1583                         al = SSL_AD_BAD_CERTIFICATE_STATUS_RESPONSE;
1584                         ret = SSL_TLSEXT_ERR_ALERT_FATAL;
1585                         }
1586                 if (r < 0)
1587                         {
1588                         al = SSL_AD_INTERNAL_ERROR;
1589                         ret = SSL_TLSEXT_ERR_ALERT_FATAL;
1590                         }
1591                 }
1592
1593         switch (ret)
1594                 {
1595                 case SSL_TLSEXT_ERR_ALERT_FATAL:
1596                         ssl3_send_alert(s,SSL3_AL_FATAL,al);
1597                         return -1;
1598
1599                 case SSL_TLSEXT_ERR_ALERT_WARNING:
1600                         ssl3_send_alert(s,SSL3_AL_WARNING,al);
1601                         return 1;
1602
1603                 case SSL_TLSEXT_ERR_NOACK:
1604                         s->servername_done=0;
1605                         default:
1606                 return 1;
1607                 }
1608         }
1609
1610 /* Since the server cache lookup is done early on in the processing of client
1611  * hello and other operations depend on the result we need to handle any TLS
1612  * session ticket extension at the same time.
1613  */
1614
1615 int tls1_process_ticket(SSL *s, unsigned char *session_id, int len,
1616                                 const unsigned char *limit, SSL_SESSION **ret)
1617         {
1618         /* Point after session ID in client hello */
1619         const unsigned char *p = session_id + len;
1620         unsigned short i;
1621
1622         /* If tickets disabled behave as if no ticket present
1623          * to permit stateful resumption.
1624          */
1625         if (SSL_get_options(s) & SSL_OP_NO_TICKET)
1626                 return 1;
1627
1628         if ((s->version <= SSL3_VERSION) || !limit)
1629                 return 1;
1630         if (p >= limit)
1631                 return -1;
1632         /* Skip past DTLS cookie */
1633         if (s->version == DTLS1_VERSION || s->version == DTLS1_BAD_VER)
1634                 {
1635                 i = *(p++);
1636                 p+= i;
1637                 if (p >= limit)
1638                         return -1;
1639                 }
1640         /* Skip past cipher list */
1641         n2s(p, i);
1642         p+= i;
1643         if (p >= limit)
1644                 return -1;
1645         /* Skip past compression algorithm list */
1646         i = *(p++);
1647         p += i;
1648         if (p > limit)
1649                 return -1;
1650         /* Now at start of extensions */
1651         if ((p + 2) >= limit)
1652                 return 1;
1653         n2s(p, i);
1654         while ((p + 4) <= limit)
1655                 {
1656                 unsigned short type, size;
1657                 n2s(p, type);
1658                 n2s(p, size);
1659                 if (p + size > limit)
1660                         return 1;
1661                 if (type == TLSEXT_TYPE_session_ticket)
1662                         {
1663                         /* If tickets disabled indicate cache miss which will
1664                          * trigger a full handshake
1665                          */
1666                         if (SSL_get_options(s) & SSL_OP_NO_TICKET)
1667                                 return 1;
1668                         /* If zero length note client will accept a ticket
1669                          * and indicate cache miss to trigger full handshake
1670                          */
1671                         if (size == 0)
1672                                 {
1673                                 s->tlsext_ticket_expected = 1;
1674                                 return 0;       /* Cache miss */
1675                                 }
1676                         if (s->tls_session_secret_cb)
1677                                 {
1678                                 /* Indicate cache miss here and instead of
1679                                  * generating the session from ticket now,
1680                                  * trigger abbreviated handshake based on
1681                                  * external mechanism to calculate the master
1682                                  * secret later. */
1683                                 return 0;
1684                                 }
1685                         return tls_decrypt_ticket(s, p, size, session_id, len,
1686                                                                         ret);
1687                         }
1688                 p += size;
1689                 }
1690         return 1;
1691         }
1692
1693 static int tls_decrypt_ticket(SSL *s, const unsigned char *etick, int eticklen,
1694                                 const unsigned char *sess_id, int sesslen,
1695                                 SSL_SESSION **psess)
1696         {
1697         SSL_SESSION *sess;
1698         unsigned char *sdec;
1699         const unsigned char *p;
1700         int slen, mlen, renew_ticket = 0;
1701         unsigned char tick_hmac[EVP_MAX_MD_SIZE];
1702         HMAC_CTX hctx;
1703         EVP_CIPHER_CTX ctx;
1704         SSL_CTX *tctx = s->initial_ctx;
1705         /* Need at least keyname + iv + some encrypted data */
1706         if (eticklen < 48)
1707                 goto tickerr;
1708         /* Initialize session ticket encryption and HMAC contexts */
1709         HMAC_CTX_init(&hctx);
1710         EVP_CIPHER_CTX_init(&ctx);
1711         if (tctx->tlsext_ticket_key_cb)
1712                 {
1713                 unsigned char *nctick = (unsigned char *)etick;
1714                 int rv = tctx->tlsext_ticket_key_cb(s, nctick, nctick + 16,
1715                                                         &ctx, &hctx, 0);
1716                 if (rv < 0)
1717                         return -1;
1718                 if (rv == 0)
1719                         goto tickerr;
1720                 if (rv == 2)
1721                         renew_ticket = 1;
1722                 }
1723         else
1724                 {
1725                 /* Check key name matches */
1726                 if (memcmp(etick, tctx->tlsext_tick_key_name, 16))
1727                         goto tickerr;
1728                 HMAC_Init_ex(&hctx, tctx->tlsext_tick_hmac_key, 16,
1729                                         tlsext_tick_md(), NULL);
1730                 EVP_DecryptInit_ex(&ctx, EVP_aes_128_cbc(), NULL,
1731                                 tctx->tlsext_tick_aes_key, etick + 16);
1732                 }
1733         /* Attempt to process session ticket, first conduct sanity and
1734          * integrity checks on ticket.
1735          */
1736         mlen = HMAC_size(&hctx);
1737         if (mlen < 0)
1738                 {
1739                 EVP_CIPHER_CTX_cleanup(&ctx);
1740                 return -1;
1741                 }
1742         eticklen -= mlen;
1743         /* Check HMAC of encrypted ticket */
1744         HMAC_Update(&hctx, etick, eticklen);
1745         HMAC_Final(&hctx, tick_hmac, NULL);
1746         HMAC_CTX_cleanup(&hctx);
1747         if (CRYPTO_memcmp(tick_hmac, etick + eticklen, mlen))
1748                 goto tickerr;
1749         /* Attempt to decrypt session data */
1750         /* Move p after IV to start of encrypted ticket, update length */
1751         p = etick + 16 + EVP_CIPHER_CTX_iv_length(&ctx);
1752         eticklen -= 16 + EVP_CIPHER_CTX_iv_length(&ctx);
1753         sdec = OPENSSL_malloc(eticklen);
1754         if (!sdec)
1755                 {
1756                 EVP_CIPHER_CTX_cleanup(&ctx);
1757                 return -1;
1758                 }
1759         EVP_DecryptUpdate(&ctx, sdec, &slen, p, eticklen);
1760         if (EVP_DecryptFinal(&ctx, sdec + slen, &mlen) <= 0)
1761                 goto tickerr;
1762         slen += mlen;
1763         EVP_CIPHER_CTX_cleanup(&ctx);
1764         p = sdec;
1765
1766         sess = d2i_SSL_SESSION(NULL, &p, slen);
1767         OPENSSL_free(sdec);
1768         if (sess)
1769                 {
1770                 /* The session ID if non-empty is used by some clients to
1771                  * detect that the ticket has been accepted. So we copy it to
1772                  * the session structure. If it is empty set length to zero
1773                  * as required by standard.
1774                  */
1775                 if (sesslen)
1776                         memcpy(sess->session_id, sess_id, sesslen);
1777                 sess->session_id_length = sesslen;
1778                 *psess = sess;
1779                 s->tlsext_ticket_expected = renew_ticket;
1780                 return 1;
1781                 }
1782         /* If session decrypt failure indicate a cache miss and set state to
1783          * send a new ticket
1784          */
1785         tickerr:
1786         s->tlsext_ticket_expected = 1;
1787         return 0;
1788         }
1789
1790 #endif