2 /* Copyright (C) 1995-1998 Eric Young (eay@cryptsoft.com)
5 * This package is an SSL implementation written
6 * by Eric Young (eay@cryptsoft.com).
7 * The implementation was written so as to conform with Netscapes SSL.
9 * This library is free for commercial and non-commercial use as long as
10 * the following conditions are aheared to. The following conditions
11 * apply to all code found in this distribution, be it the RC4, RSA,
12 * lhash, DES, etc., code; not just the SSL code. The SSL documentation
13 * included with this distribution is covered by the same copyright terms
14 * except that the holder is Tim Hudson (tjh@cryptsoft.com).
16 * Copyright remains Eric Young's, and as such any Copyright notices in
17 * the code are not to be removed.
18 * If this package is used in a product, Eric Young should be given attribution
19 * as the author of the parts of the library used.
20 * This can be in the form of a textual message at program startup or
21 * in documentation (online or textual) provided with the package.
23 * Redistribution and use in source and binary forms, with or without
24 * modification, are permitted provided that the following conditions
26 * 1. Redistributions of source code must retain the copyright
27 * notice, this list of conditions and the following disclaimer.
28 * 2. Redistributions in binary form must reproduce the above copyright
29 * notice, this list of conditions and the following disclaimer in the
30 * documentation and/or other materials provided with the distribution.
31 * 3. All advertising materials mentioning features or use of this software
32 * must display the following acknowledgement:
33 * "This product includes cryptographic software written by
34 * Eric Young (eay@cryptsoft.com)"
35 * The word 'cryptographic' can be left out if the rouines from the library
36 * being used are not cryptographic related :-).
37 * 4. If you include any Windows specific code (or a derivative thereof) from
38 * the apps directory (application code) you must include an acknowledgement:
39 * "This product includes software written by Tim Hudson (tjh@cryptsoft.com)"
41 * THIS SOFTWARE IS PROVIDED BY ERIC YOUNG ``AS IS'' AND
42 * ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
43 * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE
44 * ARE DISCLAIMED. IN NO EVENT SHALL THE AUTHOR OR CONTRIBUTORS BE LIABLE
45 * FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL
46 * DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS
47 * OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION)
48 * HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT
49 * LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY
50 * OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF
53 * The licence and distribution terms for any publically available version or
54 * derivative of this code cannot be changed. i.e. this code cannot simply be
55 * copied and put under another distribution licence
56 * [including the GNU Public Licence.]
58 /* ====================================================================
59 * Copyright (c) 1998-2007 The OpenSSL Project. All rights reserved.
61 * Redistribution and use in source and binary forms, with or without
62 * modification, are permitted provided that the following conditions
65 * 1. Redistributions of source code must retain the above copyright
66 * notice, this list of conditions and the following disclaimer.
68 * 2. Redistributions in binary form must reproduce the above copyright
69 * notice, this list of conditions and the following disclaimer in
70 * the documentation and/or other materials provided with the
73 * 3. All advertising materials mentioning features or use of this
74 * software must display the following acknowledgment:
75 * "This product includes software developed by the OpenSSL Project
76 * for use in the OpenSSL Toolkit. (http://www.openssl.org/)"
78 * 4. The names "OpenSSL Toolkit" and "OpenSSL Project" must not be used to
79 * endorse or promote products derived from this software without
80 * prior written permission. For written permission, please contact
81 * openssl-core@openssl.org.
83 * 5. Products derived from this software may not be called "OpenSSL"
84 * nor may "OpenSSL" appear in their names without prior written
85 * permission of the OpenSSL Project.
87 * 6. Redistributions of any form whatsoever must retain the following
89 * "This product includes software developed by the OpenSSL Project
90 * for use in the OpenSSL Toolkit (http://www.openssl.org/)"
92 * THIS SOFTWARE IS PROVIDED BY THE OpenSSL PROJECT ``AS IS'' AND ANY
93 * EXPRESSED OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
94 * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
95 * PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE OpenSSL PROJECT OR
96 * ITS CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL,
97 * SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT
98 * NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES;
99 * LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION)
100 * HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT,
101 * STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE)
102 * ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED
103 * OF THE POSSIBILITY OF SUCH DAMAGE.
104 * ====================================================================
106 * This product includes cryptographic software written by Eric Young
107 * (eay@cryptsoft.com). This product includes software written by Tim
108 * Hudson (tjh@cryptsoft.com).
113 #include <openssl/objects.h>
114 #include <openssl/evp.h>
115 #include <openssl/hmac.h>
116 #include <openssl/ocsp.h>
117 #include <openssl/rand.h>
118 #ifndef OPENSSL_NO_DH
119 #include <openssl/dh.h>
120 #include <openssl/bn.h>
122 #include "ssl_locl.h"
124 const char tls1_version_str[]="TLSv1" OPENSSL_VERSION_PTEXT;
126 #ifndef OPENSSL_NO_TLSEXT
127 static int tls_decrypt_ticket(SSL *s, const unsigned char *tick, int ticklen,
128 const unsigned char *sess_id, int sesslen,
129 SSL_SESSION **psess);
130 static int ssl_check_clienthello_tlsext_early(SSL *s);
131 int ssl_check_serverhello_tlsext(SSL *s);
134 SSL3_ENC_METHOD const TLSv1_enc_data={
137 tls1_setup_key_block,
138 tls1_generate_master_secret,
139 tls1_change_cipher_state,
140 tls1_final_finish_mac,
141 TLS1_FINISH_MAC_LENGTH,
142 tls1_cert_verify_mac,
143 TLS_MD_CLIENT_FINISH_CONST,TLS_MD_CLIENT_FINISH_CONST_SIZE,
144 TLS_MD_SERVER_FINISH_CONST,TLS_MD_SERVER_FINISH_CONST_SIZE,
146 tls1_export_keying_material,
148 SSL3_HM_HEADER_LENGTH,
149 ssl3_set_handshake_header,
153 SSL3_ENC_METHOD const TLSv1_1_enc_data={
156 tls1_setup_key_block,
157 tls1_generate_master_secret,
158 tls1_change_cipher_state,
159 tls1_final_finish_mac,
160 TLS1_FINISH_MAC_LENGTH,
161 tls1_cert_verify_mac,
162 TLS_MD_CLIENT_FINISH_CONST,TLS_MD_CLIENT_FINISH_CONST_SIZE,
163 TLS_MD_SERVER_FINISH_CONST,TLS_MD_SERVER_FINISH_CONST_SIZE,
165 tls1_export_keying_material,
166 SSL_ENC_FLAG_EXPLICIT_IV,
167 SSL3_HM_HEADER_LENGTH,
168 ssl3_set_handshake_header,
172 SSL3_ENC_METHOD const TLSv1_2_enc_data={
175 tls1_setup_key_block,
176 tls1_generate_master_secret,
177 tls1_change_cipher_state,
178 tls1_final_finish_mac,
179 TLS1_FINISH_MAC_LENGTH,
180 tls1_cert_verify_mac,
181 TLS_MD_CLIENT_FINISH_CONST,TLS_MD_CLIENT_FINISH_CONST_SIZE,
182 TLS_MD_SERVER_FINISH_CONST,TLS_MD_SERVER_FINISH_CONST_SIZE,
184 tls1_export_keying_material,
185 SSL_ENC_FLAG_EXPLICIT_IV|SSL_ENC_FLAG_SIGALGS|SSL_ENC_FLAG_SHA256_PRF
186 |SSL_ENC_FLAG_TLS1_2_CIPHERS,
187 SSL3_HM_HEADER_LENGTH,
188 ssl3_set_handshake_header,
192 long tls1_default_timeout(void)
194 /* 2 hours, the 24 hours mentioned in the TLSv1 spec
195 * is way too long for http, the cache would over fill */
201 if (!ssl3_new(s)) return(0);
202 s->method->ssl_clear(s);
206 void tls1_free(SSL *s)
208 #ifndef OPENSSL_NO_TLSEXT
209 if (s->tlsext_session_ticket)
211 OPENSSL_free(s->tlsext_session_ticket);
213 #endif /* OPENSSL_NO_TLSEXT */
217 void tls1_clear(SSL *s)
220 s->version = s->method->version;
223 #ifndef OPENSSL_NO_EC
227 int nid; /* Curve NID */
228 int secbits; /* Bits of security (from SP800-57) */
229 unsigned int flags; /* Flags: currently just field type */
232 #define TLS_CURVE_CHAR2 0x1
233 #define TLS_CURVE_PRIME 0x0
235 static const tls_curve_info nid_list[] =
237 {NID_sect163k1, 80, TLS_CURVE_CHAR2},/* sect163k1 (1) */
238 {NID_sect163r1, 80, TLS_CURVE_CHAR2},/* sect163r1 (2) */
239 {NID_sect163r2, 80, TLS_CURVE_CHAR2},/* sect163r2 (3) */
240 {NID_sect193r1, 80, TLS_CURVE_CHAR2},/* sect193r1 (4) */
241 {NID_sect193r2, 80, TLS_CURVE_CHAR2},/* sect193r2 (5) */
242 {NID_sect233k1, 112, TLS_CURVE_CHAR2},/* sect233k1 (6) */
243 {NID_sect233r1, 112, TLS_CURVE_CHAR2},/* sect233r1 (7) */
244 {NID_sect239k1, 112, TLS_CURVE_CHAR2},/* sect239k1 (8) */
245 {NID_sect283k1, 128, TLS_CURVE_CHAR2},/* sect283k1 (9) */
246 {NID_sect283r1, 128, TLS_CURVE_CHAR2},/* sect283r1 (10) */
247 {NID_sect409k1, 192, TLS_CURVE_CHAR2},/* sect409k1 (11) */
248 {NID_sect409r1, 192, TLS_CURVE_CHAR2},/* sect409r1 (12) */
249 {NID_sect571k1, 256, TLS_CURVE_CHAR2},/* sect571k1 (13) */
250 {NID_sect571r1, 256, TLS_CURVE_CHAR2},/* sect571r1 (14) */
251 {NID_secp160k1, 80, TLS_CURVE_PRIME},/* secp160k1 (15) */
252 {NID_secp160r1, 80, TLS_CURVE_PRIME},/* secp160r1 (16) */
253 {NID_secp160r2, 80, TLS_CURVE_PRIME},/* secp160r2 (17) */
254 {NID_secp192k1, 80, TLS_CURVE_PRIME},/* secp192k1 (18) */
255 {NID_X9_62_prime192v1, 80, TLS_CURVE_PRIME},/* secp192r1 (19) */
256 {NID_secp224k1, 112, TLS_CURVE_PRIME},/* secp224k1 (20) */
257 {NID_secp224r1, 112, TLS_CURVE_PRIME},/* secp224r1 (21) */
258 {NID_secp256k1, 128, TLS_CURVE_PRIME},/* secp256k1 (22) */
259 {NID_X9_62_prime256v1, 128, TLS_CURVE_PRIME},/* secp256r1 (23) */
260 {NID_secp384r1, 192, TLS_CURVE_PRIME},/* secp384r1 (24) */
261 {NID_secp521r1, 256, TLS_CURVE_PRIME},/* secp521r1 (25) */
262 {NID_brainpoolP256r1, 128, TLS_CURVE_PRIME}, /* brainpoolP256r1 (26) */
263 {NID_brainpoolP384r1, 192, TLS_CURVE_PRIME}, /* brainpoolP384r1 (27) */
264 {NID_brainpoolP512r1, 256, TLS_CURVE_PRIME},/* brainpool512r1 (28) */
268 static const unsigned char ecformats_default[] =
270 TLSEXT_ECPOINTFORMAT_uncompressed,
271 TLSEXT_ECPOINTFORMAT_ansiX962_compressed_prime,
272 TLSEXT_ECPOINTFORMAT_ansiX962_compressed_char2
275 static const unsigned char eccurves_default[] =
277 0,14, /* sect571r1 (14) */
278 0,13, /* sect571k1 (13) */
279 0,25, /* secp521r1 (25) */
280 0,28, /* brainpool512r1 (28) */
281 0,11, /* sect409k1 (11) */
282 0,12, /* sect409r1 (12) */
283 0,27, /* brainpoolP384r1 (27) */
284 0,24, /* secp384r1 (24) */
285 0,9, /* sect283k1 (9) */
286 0,10, /* sect283r1 (10) */
287 0,26, /* brainpoolP256r1 (26) */
288 0,22, /* secp256k1 (22) */
289 0,23, /* secp256r1 (23) */
290 0,8, /* sect239k1 (8) */
291 0,6, /* sect233k1 (6) */
292 0,7, /* sect233r1 (7) */
293 0,20, /* secp224k1 (20) */
294 0,21, /* secp224r1 (21) */
295 0,4, /* sect193r1 (4) */
296 0,5, /* sect193r2 (5) */
297 0,18, /* secp192k1 (18) */
298 0,19, /* secp192r1 (19) */
299 0,1, /* sect163k1 (1) */
300 0,2, /* sect163r1 (2) */
301 0,3, /* sect163r2 (3) */
302 0,15, /* secp160k1 (15) */
303 0,16, /* secp160r1 (16) */
304 0,17, /* secp160r2 (17) */
307 static const unsigned char suiteb_curves[] =
309 0, TLSEXT_curve_P_256,
310 0, TLSEXT_curve_P_384
313 int tls1_ec_curve_id2nid(int curve_id)
315 /* ECC curves from RFC 4492 and RFC 7027 */
316 if ((curve_id < 1) || ((unsigned int)curve_id >
317 sizeof(nid_list)/sizeof(nid_list[0])))
319 return nid_list[curve_id-1].nid;
322 int tls1_ec_nid2curve_id(int nid)
324 /* ECC curves from RFC 4492 and RFC 7027 */
327 case NID_sect163k1: /* sect163k1 (1) */
329 case NID_sect163r1: /* sect163r1 (2) */
331 case NID_sect163r2: /* sect163r2 (3) */
333 case NID_sect193r1: /* sect193r1 (4) */
335 case NID_sect193r2: /* sect193r2 (5) */
337 case NID_sect233k1: /* sect233k1 (6) */
339 case NID_sect233r1: /* sect233r1 (7) */
341 case NID_sect239k1: /* sect239k1 (8) */
343 case NID_sect283k1: /* sect283k1 (9) */
345 case NID_sect283r1: /* sect283r1 (10) */
347 case NID_sect409k1: /* sect409k1 (11) */
349 case NID_sect409r1: /* sect409r1 (12) */
351 case NID_sect571k1: /* sect571k1 (13) */
353 case NID_sect571r1: /* sect571r1 (14) */
355 case NID_secp160k1: /* secp160k1 (15) */
357 case NID_secp160r1: /* secp160r1 (16) */
359 case NID_secp160r2: /* secp160r2 (17) */
361 case NID_secp192k1: /* secp192k1 (18) */
363 case NID_X9_62_prime192v1: /* secp192r1 (19) */
365 case NID_secp224k1: /* secp224k1 (20) */
367 case NID_secp224r1: /* secp224r1 (21) */
369 case NID_secp256k1: /* secp256k1 (22) */
371 case NID_X9_62_prime256v1: /* secp256r1 (23) */
373 case NID_secp384r1: /* secp384r1 (24) */
375 case NID_secp521r1: /* secp521r1 (25) */
377 case NID_brainpoolP256r1: /* brainpoolP256r1 (26) */
379 case NID_brainpoolP384r1: /* brainpoolP384r1 (27) */
381 case NID_brainpoolP512r1: /* brainpool512r1 (28) */
387 /* Get curves list, if "sess" is set return client curves otherwise
390 static void tls1_get_curvelist(SSL *s, int sess,
391 const unsigned char **pcurves,
396 *pcurves = s->session->tlsext_ellipticcurvelist;
397 *pcurveslen = s->session->tlsext_ellipticcurvelist_length;
400 /* For Suite B mode only include P-256, P-384 */
401 switch (tls1_suiteb(s))
403 case SSL_CERT_FLAG_SUITEB_128_LOS:
404 *pcurves = suiteb_curves;
405 *pcurveslen = sizeof(suiteb_curves);
408 case SSL_CERT_FLAG_SUITEB_128_LOS_ONLY:
409 *pcurves = suiteb_curves;
413 case SSL_CERT_FLAG_SUITEB_192_LOS:
414 *pcurves = suiteb_curves + 2;
418 *pcurves = s->tlsext_ellipticcurvelist;
419 *pcurveslen = s->tlsext_ellipticcurvelist_length;
423 *pcurves = eccurves_default;
424 *pcurveslen = sizeof(eccurves_default);
428 /* See if curve is allowed by security callback */
429 static int tls_curve_allowed(SSL *s, const unsigned char *curve, int op)
431 const tls_curve_info *cinfo;
434 if ((curve[1] < 1) || ((size_t)curve[1] >
435 sizeof(nid_list)/sizeof(nid_list[0])))
437 cinfo = &nid_list[curve[1]-1];
438 #ifdef OPENSSL_NO_EC2M
439 if (cinfo->flags & TLS_CURVE_CHAR2)
442 return ssl_security(s, op, cinfo->secbits, cinfo->nid, (void *)curve);
445 /* Check a curve is one of our preferences */
446 int tls1_check_curve(SSL *s, const unsigned char *p, size_t len)
448 const unsigned char *curves;
450 unsigned int suiteb_flags = tls1_suiteb(s);
451 if (len != 3 || p[0] != NAMED_CURVE_TYPE)
453 /* Check curve matches Suite B preferences */
456 unsigned long cid = s->s3->tmp.new_cipher->id;
459 if (cid == TLS1_CK_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256)
461 if (p[2] != TLSEXT_curve_P_256)
464 else if (cid == TLS1_CK_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384)
466 if (p[2] != TLSEXT_curve_P_384)
469 else /* Should never happen */
472 tls1_get_curvelist(s, 0, &curves, &curveslen);
473 for (i = 0; i < curveslen; i += 2, curves += 2)
475 if (p[1] == curves[0] && p[2] == curves[1])
476 return tls_curve_allowed(s, p + 1, SSL_SECOP_CURVE_CHECK);
481 /* Return nth shared curve. If nmatch == -1 return number of
482 * matches. For nmatch == -2 return the NID of the curve to use for
486 int tls1_shared_curve(SSL *s, int nmatch)
488 const unsigned char *pref, *supp;
489 size_t preflen, supplen, i, j;
491 /* Can't do anything on client side */
498 /* For Suite B ciphersuite determines curve: we
499 * already know these are acceptable due to previous
502 unsigned long cid = s->s3->tmp.new_cipher->id;
503 if (cid == TLS1_CK_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256)
504 return NID_X9_62_prime256v1; /* P-256 */
505 if (cid == TLS1_CK_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384)
506 return NID_secp384r1; /* P-384 */
507 /* Should never happen */
510 /* If not Suite B just return first preference shared curve */
513 tls1_get_curvelist(s, !!(s->options & SSL_OP_CIPHER_SERVER_PREFERENCE),
515 tls1_get_curvelist(s, !(s->options & SSL_OP_CIPHER_SERVER_PREFERENCE),
520 for (i = 0; i < preflen; i++, pref+=2)
522 const unsigned char *tsupp = supp;
523 for (j = 0; j < supplen; j++, tsupp+=2)
525 if (pref[0] == tsupp[0] && pref[1] == tsupp[1])
527 if (!tls_curve_allowed(s, pref, SSL_SECOP_CURVE_SHARED))
531 int id = (pref[0] << 8) | pref[1];
532 return tls1_ec_curve_id2nid(id);
543 int tls1_set_curves(unsigned char **pext, size_t *pextlen,
544 int *curves, size_t ncurves)
546 unsigned char *clist, *p;
548 /* Bitmap of curves included to detect duplicates: only works
549 * while curve ids < 32
551 unsigned long dup_list = 0;
552 clist = OPENSSL_malloc(ncurves * 2);
555 for (i = 0, p = clist; i < ncurves; i++)
557 unsigned long idmask;
559 id = tls1_ec_nid2curve_id(curves[i]);
561 if (!id || (dup_list & idmask))
572 *pextlen = ncurves * 2;
576 #define MAX_CURVELIST 28
581 int nid_arr[MAX_CURVELIST];
584 static int nid_cb(const char *elem, int len, void *arg)
586 nid_cb_st *narg = arg;
590 if (narg->nidcnt == MAX_CURVELIST)
592 if (len > (int)(sizeof(etmp) - 1))
594 memcpy(etmp, elem, len);
596 nid = EC_curve_nist2nid(etmp);
597 if (nid == NID_undef)
598 nid = OBJ_sn2nid(etmp);
599 if (nid == NID_undef)
600 nid = OBJ_ln2nid(etmp);
601 if (nid == NID_undef)
603 for (i = 0; i < narg->nidcnt; i++)
604 if (narg->nid_arr[i] == nid)
606 narg->nid_arr[narg->nidcnt++] = nid;
609 /* Set curves based on a colon separate list */
610 int tls1_set_curves_list(unsigned char **pext, size_t *pextlen,
615 if (!CONF_parse_list(str, ':', 1, nid_cb, &ncb))
619 return tls1_set_curves(pext, pextlen, ncb.nid_arr, ncb.nidcnt);
621 /* For an EC key set TLS id and required compression based on parameters */
622 static int tls1_set_ec_id(unsigned char *curve_id, unsigned char *comp_id,
627 const EC_METHOD *meth;
630 /* Determine if it is a prime field */
631 grp = EC_KEY_get0_group(ec);
634 meth = EC_GROUP_method_of(grp);
637 if (EC_METHOD_get_field_type(meth) == NID_X9_62_prime_field)
641 /* Determine curve ID */
642 id = EC_GROUP_get_curve_name(grp);
643 id = tls1_ec_nid2curve_id(id);
644 /* If we have an ID set it, otherwise set arbitrary explicit curve */
648 curve_id[1] = (unsigned char)id;
660 if (EC_KEY_get0_public_key(ec) == NULL)
662 if (EC_KEY_get_conv_form(ec) == POINT_CONVERSION_COMPRESSED)
665 *comp_id = TLSEXT_ECPOINTFORMAT_ansiX962_compressed_prime;
667 *comp_id = TLSEXT_ECPOINTFORMAT_ansiX962_compressed_char2;
670 *comp_id = TLSEXT_ECPOINTFORMAT_uncompressed;
674 /* Check an EC key is compatible with extensions */
675 static int tls1_check_ec_key(SSL *s,
676 unsigned char *curve_id, unsigned char *comp_id)
678 const unsigned char *p;
681 /* If point formats extension present check it, otherwise everything
682 * is supported (see RFC4492).
684 if (comp_id && s->session->tlsext_ecpointformatlist)
686 p = s->session->tlsext_ecpointformatlist;
687 plen = s->session->tlsext_ecpointformatlist_length;
688 for (i = 0; i < plen; i++, p++)
698 /* Check curve is consistent with client and server preferences */
699 for (j = 0; j <= 1; j++)
701 tls1_get_curvelist(s, j, &p, &plen);
702 for (i = 0; i < plen; i+=2, p+=2)
704 if (p[0] == curve_id[0] && p[1] == curve_id[1])
709 /* For clients can only check sent curve list */
716 static void tls1_get_formatlist(SSL *s, const unsigned char **pformats,
719 /* If we have a custom point format list use it otherwise
721 if (s->tlsext_ecpointformatlist)
723 *pformats = s->tlsext_ecpointformatlist;
724 *pformatslen = s->tlsext_ecpointformatlist_length;
728 *pformats = ecformats_default;
729 /* For Suite B we don't support char2 fields */
731 *pformatslen = sizeof(ecformats_default) - 1;
733 *pformatslen = sizeof(ecformats_default);
737 /* Check cert parameters compatible with extensions: currently just checks
738 * EC certificates have compatible curves and compression.
740 static int tls1_check_cert_param(SSL *s, X509 *x, int set_ee_md)
742 unsigned char comp_id, curve_id[2];
745 pkey = X509_get_pubkey(x);
748 /* If not EC nothing to do */
749 if (pkey->type != EVP_PKEY_EC)
754 rv = tls1_set_ec_id(curve_id, &comp_id, pkey->pkey.ec);
758 /* Can't check curve_id for client certs as we don't have a
759 * supported curves extension.
761 rv = tls1_check_ec_key(s, s->server ? curve_id : NULL, &comp_id);
764 /* Special case for suite B. We *MUST* sign using SHA256+P-256 or
765 * SHA384+P-384, adjust digest if necessary.
767 if (set_ee_md && tls1_suiteb(s))
774 /* Check to see we have necessary signing algorithm */
775 if (curve_id[1] == TLSEXT_curve_P_256)
776 check_md = NID_ecdsa_with_SHA256;
777 else if (curve_id[1] == TLSEXT_curve_P_384)
778 check_md = NID_ecdsa_with_SHA384;
780 return 0; /* Should never happen */
781 for (i = 0; i < c->shared_sigalgslen; i++)
782 if (check_md == c->shared_sigalgs[i].signandhash_nid)
784 if (i == c->shared_sigalgslen)
788 if (check_md == NID_ecdsa_with_SHA256)
789 c->pkeys[SSL_PKEY_ECC].digest = EVP_sha256();
791 c->pkeys[SSL_PKEY_ECC].digest = EVP_sha384();
796 /* Check EC temporary key is compatible with client extensions */
797 int tls1_check_ec_tmp_key(SSL *s, unsigned long cid)
799 unsigned char curve_id[2];
800 EC_KEY *ec = s->cert->ecdh_tmp;
801 #ifdef OPENSSL_SSL_DEBUG_BROKEN_PROTOCOL
802 /* Allow any curve: not just those peer supports */
803 if (s->cert->cert_flags & SSL_CERT_FLAG_BROKEN_PROTOCOL)
806 /* If Suite B, AES128 MUST use P-256 and AES256 MUST use P-384,
807 * no other curves permitted.
811 /* Curve to check determined by ciphersuite */
812 if (cid == TLS1_CK_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256)
813 curve_id[1] = TLSEXT_curve_P_256;
814 else if (cid == TLS1_CK_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384)
815 curve_id[1] = TLSEXT_curve_P_384;
819 /* Check this curve is acceptable */
820 if (!tls1_check_ec_key(s, curve_id, NULL))
822 /* If auto or setting curve from callback assume OK */
823 if (s->cert->ecdh_tmp_auto || s->cert->ecdh_tmp_cb)
825 /* Otherwise check curve is acceptable */
828 unsigned char curve_tmp[2];
831 if (!tls1_set_ec_id(curve_tmp, NULL, ec))
833 if (!curve_tmp[0] || curve_tmp[1] == curve_id[1])
839 if (s->cert->ecdh_tmp_auto)
841 /* Need a shared curve */
842 if (tls1_shared_curve(s, 0))
848 if (s->cert->ecdh_tmp_cb)
853 if (!tls1_set_ec_id(curve_id, NULL, ec))
855 /* Set this to allow use of invalid curves for testing */
859 return tls1_check_ec_key(s, curve_id, NULL);
865 static int tls1_check_cert_param(SSL *s, X509 *x, int set_ee_md)
870 #endif /* OPENSSL_NO_EC */
872 #ifndef OPENSSL_NO_TLSEXT
874 /* List of supported signature algorithms and hashes. Should make this
875 * customisable at some point, for now include everything we support.
878 #ifdef OPENSSL_NO_RSA
879 #define tlsext_sigalg_rsa(md) /* */
881 #define tlsext_sigalg_rsa(md) md, TLSEXT_signature_rsa,
884 #ifdef OPENSSL_NO_DSA
885 #define tlsext_sigalg_dsa(md) /* */
887 #define tlsext_sigalg_dsa(md) md, TLSEXT_signature_dsa,
890 #ifdef OPENSSL_NO_ECDSA
891 #define tlsext_sigalg_ecdsa(md) /* */
893 #define tlsext_sigalg_ecdsa(md) md, TLSEXT_signature_ecdsa,
896 #define tlsext_sigalg(md) \
897 tlsext_sigalg_rsa(md) \
898 tlsext_sigalg_dsa(md) \
899 tlsext_sigalg_ecdsa(md)
901 static unsigned char tls12_sigalgs[] = {
902 #ifndef OPENSSL_NO_SHA512
903 tlsext_sigalg(TLSEXT_hash_sha512)
904 tlsext_sigalg(TLSEXT_hash_sha384)
906 #ifndef OPENSSL_NO_SHA256
907 tlsext_sigalg(TLSEXT_hash_sha256)
908 tlsext_sigalg(TLSEXT_hash_sha224)
910 #ifndef OPENSSL_NO_SHA
911 tlsext_sigalg(TLSEXT_hash_sha1)
914 #ifndef OPENSSL_NO_ECDSA
915 static unsigned char suiteb_sigalgs[] = {
916 tlsext_sigalg_ecdsa(TLSEXT_hash_sha256)
917 tlsext_sigalg_ecdsa(TLSEXT_hash_sha384)
920 size_t tls12_get_psigalgs(SSL *s, const unsigned char **psigs)
922 /* If Suite B mode use Suite B sigalgs only, ignore any other
925 #ifndef OPENSSL_NO_EC
926 switch (tls1_suiteb(s))
928 case SSL_CERT_FLAG_SUITEB_128_LOS:
929 *psigs = suiteb_sigalgs;
930 return sizeof(suiteb_sigalgs);
932 case SSL_CERT_FLAG_SUITEB_128_LOS_ONLY:
933 *psigs = suiteb_sigalgs;
936 case SSL_CERT_FLAG_SUITEB_192_LOS:
937 *psigs = suiteb_sigalgs + 2;
941 /* If server use client authentication sigalgs if not NULL */
942 if (s->server && s->cert->client_sigalgs)
944 *psigs = s->cert->client_sigalgs;
945 return s->cert->client_sigalgslen;
947 else if (s->cert->conf_sigalgs)
949 *psigs = s->cert->conf_sigalgs;
950 return s->cert->conf_sigalgslen;
954 *psigs = tls12_sigalgs;
955 return sizeof(tls12_sigalgs);
958 /* Check signature algorithm is consistent with sent supported signature
959 * algorithms and if so return relevant digest.
961 int tls12_check_peer_sigalg(const EVP_MD **pmd, SSL *s,
962 const unsigned char *sig, EVP_PKEY *pkey)
964 const unsigned char *sent_sigs;
965 size_t sent_sigslen, i;
966 int sigalg = tls12_get_sigid(pkey);
967 /* Should never happen */
970 /* Check key type is consistent with signature */
971 if (sigalg != (int)sig[1])
973 SSLerr(SSL_F_TLS12_CHECK_PEER_SIGALG,SSL_R_WRONG_SIGNATURE_TYPE);
976 #ifndef OPENSSL_NO_EC
977 if (pkey->type == EVP_PKEY_EC)
979 unsigned char curve_id[2], comp_id;
980 /* Check compression and curve matches extensions */
981 if (!tls1_set_ec_id(curve_id, &comp_id, pkey->pkey.ec))
983 if (!s->server && !tls1_check_ec_key(s, curve_id, &comp_id))
985 SSLerr(SSL_F_TLS12_CHECK_PEER_SIGALG,SSL_R_WRONG_CURVE);
988 /* If Suite B only P-384+SHA384 or P-256+SHA-256 allowed */
993 if (curve_id[1] == TLSEXT_curve_P_256)
995 if (sig[0] != TLSEXT_hash_sha256)
997 SSLerr(SSL_F_TLS12_CHECK_PEER_SIGALG,
998 SSL_R_ILLEGAL_SUITEB_DIGEST);
1002 else if (curve_id[1] == TLSEXT_curve_P_384)
1004 if (sig[0] != TLSEXT_hash_sha384)
1006 SSLerr(SSL_F_TLS12_CHECK_PEER_SIGALG,
1007 SSL_R_ILLEGAL_SUITEB_DIGEST);
1015 else if (tls1_suiteb(s))
1019 /* Check signature matches a type we sent */
1020 sent_sigslen = tls12_get_psigalgs(s, &sent_sigs);
1021 for (i = 0; i < sent_sigslen; i+=2, sent_sigs+=2)
1023 if (sig[0] == sent_sigs[0] && sig[1] == sent_sigs[1])
1026 /* Allow fallback to SHA1 if not strict mode */
1027 if (i == sent_sigslen && (sig[0] != TLSEXT_hash_sha1 || s->cert->cert_flags & SSL_CERT_FLAGS_CHECK_TLS_STRICT))
1029 SSLerr(SSL_F_TLS12_CHECK_PEER_SIGALG,SSL_R_WRONG_SIGNATURE_TYPE);
1032 *pmd = tls12_get_hash(sig[0]);
1035 SSLerr(SSL_F_TLS12_CHECK_PEER_SIGALG,SSL_R_UNKNOWN_DIGEST);
1038 /* Make sure security callback allows algorithm */
1039 if (!ssl_security(s, SSL_SECOP_SIGALG_CHECK,
1040 EVP_MD_size(*pmd) * 4, EVP_MD_type(*pmd),
1043 SSLerr(SSL_F_TLS12_CHECK_PEER_SIGALG,SSL_R_WRONG_SIGNATURE_TYPE);
1046 /* Store the digest used so applications can retrieve it if they
1049 if (s->session && s->session->sess_cert)
1050 s->session->sess_cert->peer_key->digest = *pmd;
1054 /* Get a mask of disabled algorithms: an algorithm is disabled
1055 * if it isn't supported or doesn't appear in supported signature
1056 * algorithms. Unlike ssl_cipher_get_disabled this applies to a specific
1057 * session and not global settings.
1060 void ssl_set_client_disabled(SSL *s)
1065 /* Don't allow TLS 1.2 only ciphers if we don't suppport them */
1066 if (!SSL_CLIENT_USE_TLS1_2_CIPHERS(s))
1067 c->mask_ssl = SSL_TLSV1_2;
1070 ssl_set_sig_mask(&c->mask_a, s, SSL_SECOP_SIGALG_MASK);
1071 /* Disable static DH if we don't include any appropriate
1072 * signature algorithms.
1074 if (c->mask_a & SSL_aRSA)
1075 c->mask_k |= SSL_kDHr|SSL_kECDHr;
1076 if (c->mask_a & SSL_aDSS)
1077 c->mask_k |= SSL_kDHd;
1078 if (c->mask_a & SSL_aECDSA)
1079 c->mask_k |= SSL_kECDHe;
1080 #ifndef OPENSSL_NO_KRB5
1081 if (!kssl_tgt_is_available(s->kssl_ctx))
1083 c->mask_a |= SSL_aKRB5;
1084 c->mask_k |= SSL_kKRB5;
1087 #ifndef OPENSSL_NO_PSK
1088 /* with PSK there must be client callback set */
1089 if (!s->psk_client_callback)
1091 c->mask_a |= SSL_aPSK;
1092 c->mask_k |= SSL_kPSK;
1094 #endif /* OPENSSL_NO_PSK */
1095 #ifndef OPENSSL_NO_SRP
1096 if (!(s->srp_ctx.srp_Mask & SSL_kSRP))
1098 c->mask_a |= SSL_aSRP;
1099 c->mask_k |= SSL_kSRP;
1105 int ssl_cipher_disabled(SSL *s, const SSL_CIPHER *c, int op)
1108 if (c->algorithm_ssl & ct->mask_ssl || c->algorithm_mkey & ct->mask_k || c->algorithm_auth & ct->mask_a)
1110 return !ssl_security(s, op, c->strength_bits, 0, (void *)c);
1113 static int tls_use_ticket(SSL *s)
1115 if (s->options & SSL_OP_NO_TICKET)
1117 return ssl_security(s, SSL_SECOP_TICKET, 0, 0, NULL);
1120 unsigned char *ssl_add_clienthello_tlsext(SSL *s, unsigned char *buf, unsigned char *limit, int *al)
1123 unsigned char *orig = buf;
1124 unsigned char *ret = buf;
1125 #ifndef OPENSSL_NO_EC
1126 /* See if we support any ECC ciphersuites */
1128 if (s->version >= TLS1_VERSION || SSL_IS_DTLS(s))
1131 unsigned long alg_k, alg_a;
1132 STACK_OF(SSL_CIPHER) *cipher_stack = SSL_get_ciphers(s);
1134 for (i = 0; i < sk_SSL_CIPHER_num(cipher_stack); i++)
1136 SSL_CIPHER *c = sk_SSL_CIPHER_value(cipher_stack, i);
1138 alg_k = c->algorithm_mkey;
1139 alg_a = c->algorithm_auth;
1140 if ((alg_k & (SSL_kECDHE|SSL_kECDHr|SSL_kECDHe)
1141 || (alg_a & SSL_aECDSA)))
1152 if (ret>=limit) return NULL; /* this really never occurs, but ... */
1154 /* Add RI if renegotiating */
1159 if(!ssl_add_clienthello_renegotiate_ext(s, 0, &el, 0))
1161 SSLerr(SSL_F_SSL_ADD_CLIENTHELLO_TLSEXT, ERR_R_INTERNAL_ERROR);
1165 if((limit - ret - 4 - el) < 0) return NULL;
1167 s2n(TLSEXT_TYPE_renegotiate,ret);
1170 if(!ssl_add_clienthello_renegotiate_ext(s, ret, &el, el))
1172 SSLerr(SSL_F_SSL_ADD_CLIENTHELLO_TLSEXT, ERR_R_INTERNAL_ERROR);
1178 /* Only add RI for SSLv3 */
1179 if (s->client_version == SSL3_VERSION)
1182 if (s->tlsext_hostname != NULL)
1184 /* Add TLS extension servername to the Client Hello message */
1185 unsigned long size_str;
1188 /* check for enough space.
1189 4 for the servername type and entension length
1190 2 for servernamelist length
1191 1 for the hostname type
1192 2 for hostname length
1196 if ((lenmax = limit - ret - 9) < 0
1197 || (size_str = strlen(s->tlsext_hostname)) > (unsigned long)lenmax)
1200 /* extension type and length */
1201 s2n(TLSEXT_TYPE_server_name,ret);
1202 s2n(size_str+5,ret);
1204 /* length of servername list */
1205 s2n(size_str+3,ret);
1207 /* hostname type, length and hostname */
1208 *(ret++) = (unsigned char) TLSEXT_NAMETYPE_host_name;
1210 memcpy(ret, s->tlsext_hostname, size_str);
1214 #ifndef OPENSSL_NO_SRP
1215 /* Add SRP username if there is one */
1216 if (s->srp_ctx.login != NULL)
1217 { /* Add TLS extension SRP username to the Client Hello message */
1219 int login_len = strlen(s->srp_ctx.login);
1220 if (login_len > 255 || login_len == 0)
1222 SSLerr(SSL_F_SSL_ADD_CLIENTHELLO_TLSEXT, ERR_R_INTERNAL_ERROR);
1226 /* check for enough space.
1227 4 for the srp type type and entension length
1228 1 for the srp user identity
1229 + srp user identity length
1231 if ((limit - ret - 5 - login_len) < 0) return NULL;
1233 /* fill in the extension */
1234 s2n(TLSEXT_TYPE_srp,ret);
1235 s2n(login_len+1,ret);
1236 (*ret++) = (unsigned char) login_len;
1237 memcpy(ret, s->srp_ctx.login, login_len);
1242 #ifndef OPENSSL_NO_EC
1245 /* Add TLS extension ECPointFormats to the ClientHello message */
1247 const unsigned char *plist;
1250 unsigned char *etmp;
1252 tls1_get_formatlist(s, &plist, &plistlen);
1254 if ((lenmax = limit - ret - 5) < 0) return NULL;
1255 if (plistlen > (size_t)lenmax) return NULL;
1258 SSLerr(SSL_F_SSL_ADD_CLIENTHELLO_TLSEXT, ERR_R_INTERNAL_ERROR);
1262 s2n(TLSEXT_TYPE_ec_point_formats,ret);
1263 s2n(plistlen + 1,ret);
1264 *(ret++) = (unsigned char)plistlen ;
1265 memcpy(ret, plist, plistlen);
1268 /* Add TLS extension EllipticCurves to the ClientHello message */
1269 plist = s->tlsext_ellipticcurvelist;
1270 tls1_get_curvelist(s, 0, &plist, &plistlen);
1272 if ((lenmax = limit - ret - 6) < 0) return NULL;
1273 if (plistlen > (size_t)lenmax) return NULL;
1274 if (plistlen > 65532)
1276 SSLerr(SSL_F_SSL_ADD_CLIENTHELLO_TLSEXT, ERR_R_INTERNAL_ERROR);
1281 s2n(TLSEXT_TYPE_elliptic_curves,ret);
1283 /* Copy curve ID if supported */
1284 for (i = 0; i < plistlen; i += 2, plist += 2)
1286 if (tls_curve_allowed(s, plist, SSL_SECOP_CURVE_SUPPORTED))
1293 plistlen = etmp - ret - 4;
1295 s2n(plistlen + 2, ret);
1299 #endif /* OPENSSL_NO_EC */
1301 if (tls_use_ticket(s))
1304 if (!s->new_session && s->session && s->session->tlsext_tick)
1305 ticklen = s->session->tlsext_ticklen;
1306 else if (s->session && s->tlsext_session_ticket &&
1307 s->tlsext_session_ticket->data)
1309 ticklen = s->tlsext_session_ticket->length;
1310 s->session->tlsext_tick = OPENSSL_malloc(ticklen);
1311 if (!s->session->tlsext_tick)
1313 memcpy(s->session->tlsext_tick,
1314 s->tlsext_session_ticket->data,
1316 s->session->tlsext_ticklen = ticklen;
1320 if (ticklen == 0 && s->tlsext_session_ticket &&
1321 s->tlsext_session_ticket->data == NULL)
1323 /* Check for enough room 2 for extension type, 2 for len
1326 if ((long)(limit - ret - 4 - ticklen) < 0) return NULL;
1327 s2n(TLSEXT_TYPE_session_ticket,ret);
1331 memcpy(ret, s->session->tlsext_tick, ticklen);
1337 if (SSL_USE_SIGALGS(s))
1340 const unsigned char *salg;
1341 unsigned char *etmp;
1342 salglen = tls12_get_psigalgs(s, &salg);
1343 if ((size_t)(limit - ret) < salglen + 6)
1345 s2n(TLSEXT_TYPE_signature_algorithms,ret);
1347 /* Skip over lengths for now */
1349 salglen = tls12_copy_sigalgs(s, ret, salg, salglen);
1350 /* Fill in lengths */
1351 s2n(salglen + 2, etmp);
1356 #ifdef TLSEXT_TYPE_opaque_prf_input
1357 if (s->s3->client_opaque_prf_input != NULL)
1359 size_t col = s->s3->client_opaque_prf_input_len;
1361 if ((long)(limit - ret - 6 - col) < 0)
1363 if (col > 0xFFFD) /* can't happen */
1366 s2n(TLSEXT_TYPE_opaque_prf_input, ret);
1369 memcpy(ret, s->s3->client_opaque_prf_input, col);
1374 if (s->tlsext_status_type == TLSEXT_STATUSTYPE_ocsp)
1377 long extlen, idlen, itmp;
1381 for (i = 0; i < sk_OCSP_RESPID_num(s->tlsext_ocsp_ids); i++)
1383 id = sk_OCSP_RESPID_value(s->tlsext_ocsp_ids, i);
1384 itmp = i2d_OCSP_RESPID(id, NULL);
1390 if (s->tlsext_ocsp_exts)
1392 extlen = i2d_X509_EXTENSIONS(s->tlsext_ocsp_exts, NULL);
1399 if ((long)(limit - ret - 7 - extlen - idlen) < 0) return NULL;
1400 s2n(TLSEXT_TYPE_status_request, ret);
1401 if (extlen + idlen > 0xFFF0)
1403 s2n(extlen + idlen + 5, ret);
1404 *(ret++) = TLSEXT_STATUSTYPE_ocsp;
1406 for (i = 0; i < sk_OCSP_RESPID_num(s->tlsext_ocsp_ids); i++)
1408 /* save position of id len */
1409 unsigned char *q = ret;
1410 id = sk_OCSP_RESPID_value(s->tlsext_ocsp_ids, i);
1411 /* skip over id len */
1413 itmp = i2d_OCSP_RESPID(id, &ret);
1419 i2d_X509_EXTENSIONS(s->tlsext_ocsp_exts, &ret);
1422 #ifndef OPENSSL_NO_HEARTBEATS
1423 /* Add Heartbeat extension */
1424 if ((limit - ret - 4 - 1) < 0)
1426 s2n(TLSEXT_TYPE_heartbeat,ret);
1429 * 1: peer may send requests
1430 * 2: peer not allowed to send requests
1432 if (s->tlsext_heartbeat & SSL_TLSEXT_HB_DONT_RECV_REQUESTS)
1433 *(ret++) = SSL_TLSEXT_HB_DONT_SEND_REQUESTS;
1435 *(ret++) = SSL_TLSEXT_HB_ENABLED;
1438 #ifndef OPENSSL_NO_NEXTPROTONEG
1439 if (s->ctx->next_proto_select_cb && !s->s3->tmp.finish_md_len)
1441 /* The client advertises an emtpy extension to indicate its
1442 * support for Next Protocol Negotiation */
1443 if (limit - ret - 4 < 0)
1445 s2n(TLSEXT_TYPE_next_proto_neg,ret);
1450 if (s->alpn_client_proto_list && !s->s3->tmp.finish_md_len)
1452 if ((size_t)(limit - ret) < 6 + s->alpn_client_proto_list_len)
1454 s2n(TLSEXT_TYPE_application_layer_protocol_negotiation,ret);
1455 s2n(2 + s->alpn_client_proto_list_len,ret);
1456 s2n(s->alpn_client_proto_list_len,ret);
1457 memcpy(ret, s->alpn_client_proto_list,
1458 s->alpn_client_proto_list_len);
1459 ret += s->alpn_client_proto_list_len;
1462 if(SSL_IS_DTLS(s) && SSL_get_srtp_profiles(s))
1466 ssl_add_clienthello_use_srtp_ext(s, 0, &el, 0);
1468 if((limit - ret - 4 - el) < 0) return NULL;
1470 s2n(TLSEXT_TYPE_use_srtp,ret);
1473 if(ssl_add_clienthello_use_srtp_ext(s, ret, &el, el))
1475 SSLerr(SSL_F_SSL_ADD_CLIENTHELLO_TLSEXT, ERR_R_INTERNAL_ERROR);
1480 custom_ext_init(&s->cert->cli_ext);
1481 /* Add custom TLS Extensions to ClientHello */
1482 if (!custom_ext_add(s, 0, &ret, limit, al))
1484 #ifdef TLSEXT_TYPE_encrypt_then_mac
1485 s2n(TLSEXT_TYPE_encrypt_then_mac,ret);
1489 /* Add padding to workaround bugs in F5 terminators.
1490 * See https://tools.ietf.org/html/draft-agl-tls-padding-03
1492 * NB: because this code works out the length of all existing
1493 * extensions it MUST always appear last.
1495 if (s->options & SSL_OP_TLSEXT_PADDING)
1497 int hlen = ret - (unsigned char *)s->init_buf->data;
1498 /* The code in s23_clnt.c to build ClientHello messages
1499 * includes the 5-byte record header in the buffer, while
1500 * the code in s3_clnt.c does not.
1502 if (s->state == SSL23_ST_CW_CLNT_HELLO_A)
1504 if (hlen > 0xff && hlen < 0x200)
1506 hlen = 0x200 - hlen;
1512 s2n(TLSEXT_TYPE_padding, ret);
1514 memset(ret, 0, hlen);
1521 if ((extdatalen = ret-orig-2)== 0)
1524 s2n(extdatalen, orig);
1528 unsigned char *ssl_add_serverhello_tlsext(SSL *s, unsigned char *buf, unsigned char *limit, int *al)
1531 unsigned char *orig = buf;
1532 unsigned char *ret = buf;
1533 #ifndef OPENSSL_NO_NEXTPROTONEG
1534 int next_proto_neg_seen;
1536 #ifndef OPENSSL_NO_EC
1537 unsigned long alg_k = s->s3->tmp.new_cipher->algorithm_mkey;
1538 unsigned long alg_a = s->s3->tmp.new_cipher->algorithm_auth;
1539 int using_ecc = (alg_k & (SSL_kECDHE|SSL_kECDHr|SSL_kECDHe)) || (alg_a & SSL_aECDSA);
1540 using_ecc = using_ecc && (s->session->tlsext_ecpointformatlist != NULL);
1544 if (ret>=limit) return NULL; /* this really never occurs, but ... */
1546 if(s->s3->send_connection_binding)
1550 if(!ssl_add_serverhello_renegotiate_ext(s, 0, &el, 0))
1552 SSLerr(SSL_F_SSL_ADD_SERVERHELLO_TLSEXT, ERR_R_INTERNAL_ERROR);
1556 if((limit - ret - 4 - el) < 0) return NULL;
1558 s2n(TLSEXT_TYPE_renegotiate,ret);
1561 if(!ssl_add_serverhello_renegotiate_ext(s, ret, &el, el))
1563 SSLerr(SSL_F_SSL_ADD_SERVERHELLO_TLSEXT, ERR_R_INTERNAL_ERROR);
1570 /* Only add RI for SSLv3 */
1571 if (s->version == SSL3_VERSION)
1574 if (!s->hit && s->servername_done == 1 && s->session->tlsext_hostname != NULL)
1576 if ((long)(limit - ret - 4) < 0) return NULL;
1578 s2n(TLSEXT_TYPE_server_name,ret);
1582 #ifndef OPENSSL_NO_EC
1585 const unsigned char *plist;
1587 /* Add TLS extension ECPointFormats to the ServerHello message */
1590 tls1_get_formatlist(s, &plist, &plistlen);
1592 if ((lenmax = limit - ret - 5) < 0) return NULL;
1593 if (plistlen > (size_t)lenmax) return NULL;
1596 SSLerr(SSL_F_SSL_ADD_SERVERHELLO_TLSEXT, ERR_R_INTERNAL_ERROR);
1600 s2n(TLSEXT_TYPE_ec_point_formats,ret);
1601 s2n(plistlen + 1,ret);
1602 *(ret++) = (unsigned char) plistlen;
1603 memcpy(ret, plist, plistlen);
1607 /* Currently the server should not respond with a SupportedCurves extension */
1608 #endif /* OPENSSL_NO_EC */
1610 if (s->tlsext_ticket_expected && tls_use_ticket(s))
1612 if ((long)(limit - ret - 4) < 0) return NULL;
1613 s2n(TLSEXT_TYPE_session_ticket,ret);
1617 if (s->tlsext_status_expected)
1619 if ((long)(limit - ret - 4) < 0) return NULL;
1620 s2n(TLSEXT_TYPE_status_request,ret);
1624 #ifdef TLSEXT_TYPE_opaque_prf_input
1625 if (s->s3->server_opaque_prf_input != NULL)
1627 size_t sol = s->s3->server_opaque_prf_input_len;
1629 if ((long)(limit - ret - 6 - sol) < 0)
1631 if (sol > 0xFFFD) /* can't happen */
1634 s2n(TLSEXT_TYPE_opaque_prf_input, ret);
1637 memcpy(ret, s->s3->server_opaque_prf_input, sol);
1642 if(SSL_IS_DTLS(s) && s->srtp_profile)
1646 ssl_add_serverhello_use_srtp_ext(s, 0, &el, 0);
1648 if((limit - ret - 4 - el) < 0) return NULL;
1650 s2n(TLSEXT_TYPE_use_srtp,ret);
1653 if(ssl_add_serverhello_use_srtp_ext(s, ret, &el, el))
1655 SSLerr(SSL_F_SSL_ADD_SERVERHELLO_TLSEXT, ERR_R_INTERNAL_ERROR);
1661 if (((s->s3->tmp.new_cipher->id & 0xFFFF)==0x80 || (s->s3->tmp.new_cipher->id & 0xFFFF)==0x81)
1662 && (SSL_get_options(s) & SSL_OP_CRYPTOPRO_TLSEXT_BUG))
1663 { const unsigned char cryptopro_ext[36] = {
1664 0xfd, 0xe8, /*65000*/
1665 0x00, 0x20, /*32 bytes length*/
1666 0x30, 0x1e, 0x30, 0x08, 0x06, 0x06, 0x2a, 0x85,
1667 0x03, 0x02, 0x02, 0x09, 0x30, 0x08, 0x06, 0x06,
1668 0x2a, 0x85, 0x03, 0x02, 0x02, 0x16, 0x30, 0x08,
1669 0x06, 0x06, 0x2a, 0x85, 0x03, 0x02, 0x02, 0x17};
1670 if (limit-ret<36) return NULL;
1671 memcpy(ret,cryptopro_ext,36);
1676 #ifndef OPENSSL_NO_HEARTBEATS
1677 /* Add Heartbeat extension if we've received one */
1678 if (s->tlsext_heartbeat & SSL_TLSEXT_HB_ENABLED)
1680 if ((limit - ret - 4 - 1) < 0)
1682 s2n(TLSEXT_TYPE_heartbeat,ret);
1685 * 1: peer may send requests
1686 * 2: peer not allowed to send requests
1688 if (s->tlsext_heartbeat & SSL_TLSEXT_HB_DONT_RECV_REQUESTS)
1689 *(ret++) = SSL_TLSEXT_HB_DONT_SEND_REQUESTS;
1691 *(ret++) = SSL_TLSEXT_HB_ENABLED;
1696 #ifndef OPENSSL_NO_NEXTPROTONEG
1697 next_proto_neg_seen = s->s3->next_proto_neg_seen;
1698 s->s3->next_proto_neg_seen = 0;
1699 if (next_proto_neg_seen && s->ctx->next_protos_advertised_cb)
1701 const unsigned char *npa;
1702 unsigned int npalen;
1705 r = s->ctx->next_protos_advertised_cb(s, &npa, &npalen, s->ctx->next_protos_advertised_cb_arg);
1706 if (r == SSL_TLSEXT_ERR_OK)
1708 if ((long)(limit - ret - 4 - npalen) < 0) return NULL;
1709 s2n(TLSEXT_TYPE_next_proto_neg,ret);
1711 memcpy(ret, npa, npalen);
1713 s->s3->next_proto_neg_seen = 1;
1717 if (!custom_ext_add(s, 1, &ret, limit, al))
1719 #ifdef TLSEXT_TYPE_encrypt_then_mac
1720 if (s->s3->flags & TLS1_FLAGS_ENCRYPT_THEN_MAC)
1722 /* Don't use encrypt_then_mac if AEAD or RC4
1723 * might want to disable for other cases too.
1725 if (s->s3->tmp.new_cipher->algorithm_mac == SSL_AEAD
1726 || s->s3->tmp.new_cipher->algorithm_enc == SSL_RC4)
1727 s->s3->flags &= ~TLS1_FLAGS_ENCRYPT_THEN_MAC;
1730 s2n(TLSEXT_TYPE_encrypt_then_mac,ret);
1736 if (s->s3->alpn_selected)
1738 const unsigned char *selected = s->s3->alpn_selected;
1739 unsigned len = s->s3->alpn_selected_len;
1741 if ((long)(limit - ret - 4 - 2 - 1 - len) < 0)
1743 s2n(TLSEXT_TYPE_application_layer_protocol_negotiation,ret);
1747 memcpy(ret, selected, len);
1753 if ((extdatalen = ret-orig-2)== 0)
1756 s2n(extdatalen, orig);
1760 /* tls1_alpn_handle_client_hello is called to process the ALPN extension in a
1762 * data: the contents of the extension, not including the type and length.
1763 * data_len: the number of bytes in |data|
1764 * al: a pointer to the alert value to send in the event of a non-zero
1767 * returns: 0 on success. */
1768 static int tls1_alpn_handle_client_hello(SSL *s, const unsigned char *data,
1769 unsigned data_len, int *al)
1773 const unsigned char *selected;
1774 unsigned char selected_len;
1777 if (s->ctx->alpn_select_cb == NULL)
1783 /* data should contain a uint16 length followed by a series of 8-bit,
1784 * length-prefixed strings. */
1785 i = ((unsigned) data[0]) << 8 |
1786 ((unsigned) data[1]);
1795 for (i = 0; i < data_len;)
1797 proto_len = data[i];
1803 if (i + proto_len < i || i + proto_len > data_len)
1809 r = s->ctx->alpn_select_cb(s, &selected, &selected_len, data, data_len,
1810 s->ctx->alpn_select_cb_arg);
1811 if (r == SSL_TLSEXT_ERR_OK) {
1812 if (s->s3->alpn_selected)
1813 OPENSSL_free(s->s3->alpn_selected);
1814 s->s3->alpn_selected = OPENSSL_malloc(selected_len);
1815 if (!s->s3->alpn_selected)
1817 *al = SSL_AD_INTERNAL_ERROR;
1820 memcpy(s->s3->alpn_selected, selected, selected_len);
1821 s->s3->alpn_selected_len = selected_len;
1826 *al = SSL_AD_DECODE_ERROR;
1830 #ifndef OPENSSL_NO_EC
1831 /* ssl_check_for_safari attempts to fingerprint Safari using OS X
1832 * SecureTransport using the TLS extension block in |d|, of length |n|.
1833 * Safari, since 10.6, sends exactly these extensions, in this order:
1838 * We wish to fingerprint Safari because they broke ECDHE-ECDSA support in 10.8,
1839 * but they advertise support. So enabling ECDHE-ECDSA ciphers breaks them.
1840 * Sadly we cannot differentiate 10.6, 10.7 and 10.8.4 (which work), from
1841 * 10.8..10.8.3 (which don't work).
1843 static void ssl_check_for_safari(SSL *s, const unsigned char *data, const unsigned char *d, int n) {
1844 unsigned short type, size;
1845 static const unsigned char kSafariExtensionsBlock[] = {
1846 0x00, 0x0a, /* elliptic_curves extension */
1847 0x00, 0x08, /* 8 bytes */
1848 0x00, 0x06, /* 6 bytes of curve ids */
1849 0x00, 0x17, /* P-256 */
1850 0x00, 0x18, /* P-384 */
1851 0x00, 0x19, /* P-521 */
1853 0x00, 0x0b, /* ec_point_formats */
1854 0x00, 0x02, /* 2 bytes */
1855 0x01, /* 1 point format */
1856 0x00, /* uncompressed */
1859 /* The following is only present in TLS 1.2 */
1860 static const unsigned char kSafariTLS12ExtensionsBlock[] = {
1861 0x00, 0x0d, /* signature_algorithms */
1862 0x00, 0x0c, /* 12 bytes */
1863 0x00, 0x0a, /* 10 bytes */
1864 0x05, 0x01, /* SHA-384/RSA */
1865 0x04, 0x01, /* SHA-256/RSA */
1866 0x02, 0x01, /* SHA-1/RSA */
1867 0x04, 0x03, /* SHA-256/ECDSA */
1868 0x02, 0x03, /* SHA-1/ECDSA */
1871 if (data >= (d+n-2))
1880 if (type != TLSEXT_TYPE_server_name)
1883 if (data+size > d+n)
1887 if (TLS1_get_client_version(s) >= TLS1_2_VERSION)
1889 const size_t len1 = sizeof(kSafariExtensionsBlock);
1890 const size_t len2 = sizeof(kSafariTLS12ExtensionsBlock);
1892 if (data + len1 + len2 != d+n)
1894 if (memcmp(data, kSafariExtensionsBlock, len1) != 0)
1896 if (memcmp(data + len1, kSafariTLS12ExtensionsBlock, len2) != 0)
1901 const size_t len = sizeof(kSafariExtensionsBlock);
1903 if (data + len != d+n)
1905 if (memcmp(data, kSafariExtensionsBlock, len) != 0)
1909 s->s3->is_probably_safari = 1;
1911 #endif /* !OPENSSL_NO_EC */
1914 static int ssl_scan_clienthello_tlsext(SSL *s, unsigned char **p, unsigned char *d, int n, int *al)
1916 unsigned short type;
1917 unsigned short size;
1919 unsigned char *data = *p;
1920 int renegotiate_seen = 0;
1922 s->servername_done = 0;
1923 s->tlsext_status_type = -1;
1924 #ifndef OPENSSL_NO_NEXTPROTONEG
1925 s->s3->next_proto_neg_seen = 0;
1928 if (s->s3->alpn_selected)
1930 OPENSSL_free(s->s3->alpn_selected);
1931 s->s3->alpn_selected = NULL;
1934 #ifndef OPENSSL_NO_HEARTBEATS
1935 s->tlsext_heartbeat &= ~(SSL_TLSEXT_HB_ENABLED |
1936 SSL_TLSEXT_HB_DONT_SEND_REQUESTS);
1939 #ifndef OPENSSL_NO_EC
1940 if (s->options & SSL_OP_SAFARI_ECDHE_ECDSA_BUG)
1941 ssl_check_for_safari(s, data, d, n);
1942 #endif /* !OPENSSL_NO_EC */
1944 /* Clear any signature algorithms extension received */
1945 if (s->cert->peer_sigalgs)
1947 OPENSSL_free(s->cert->peer_sigalgs);
1948 s->cert->peer_sigalgs = NULL;
1951 #ifdef TLSEXT_TYPE_encrypt_then_mac
1952 s->s3->flags &= ~TLS1_FLAGS_ENCRYPT_THEN_MAC;
1955 if (data >= (d+n-2))
1959 if (data > (d+n-len))
1962 while (data <= (d+n-4))
1967 if (data+size > (d+n))
1970 fprintf(stderr,"Received extension type %d size %d\n",type,size);
1972 if (s->tlsext_debug_cb)
1973 s->tlsext_debug_cb(s, 0, type, data, size,
1974 s->tlsext_debug_arg);
1975 if (type == TLSEXT_TYPE_renegotiate)
1977 if(!ssl_parse_clienthello_renegotiate_ext(s, data, size, al))
1979 renegotiate_seen = 1;
1981 else if (s->version == SSL3_VERSION)
1983 /* The servername extension is treated as follows:
1985 - Only the hostname type is supported with a maximum length of 255.
1986 - The servername is rejected if too long or if it contains zeros,
1987 in which case an fatal alert is generated.
1988 - The servername field is maintained together with the session cache.
1989 - When a session is resumed, the servername call back invoked in order
1990 to allow the application to position itself to the right context.
1991 - The servername is acknowledged if it is new for a session or when
1992 it is identical to a previously used for the same session.
1993 Applications can control the behaviour. They can at any time
1994 set a 'desirable' servername for a new SSL object. This can be the
1995 case for example with HTTPS when a Host: header field is received and
1996 a renegotiation is requested. In this case, a possible servername
1997 presented in the new client hello is only acknowledged if it matches
1998 the value of the Host: field.
1999 - Applications must use SSL_OP_NO_SESSION_RESUMPTION_ON_RENEGOTIATION
2000 if they provide for changing an explicit servername context for the session,
2001 i.e. when the session has been established with a servername extension.
2002 - On session reconnect, the servername extension may be absent.
2006 else if (type == TLSEXT_TYPE_server_name)
2008 unsigned char *sdata;
2014 *al = SSL_AD_DECODE_ERROR;
2021 *al = SSL_AD_DECODE_ERROR;
2028 servname_type = *(sdata++);
2034 *al = SSL_AD_DECODE_ERROR;
2037 if (s->servername_done == 0)
2038 switch (servname_type)
2040 case TLSEXT_NAMETYPE_host_name:
2043 if(s->session->tlsext_hostname)
2045 *al = SSL_AD_DECODE_ERROR;
2048 if (len > TLSEXT_MAXLEN_host_name)
2050 *al = TLS1_AD_UNRECOGNIZED_NAME;
2053 if ((s->session->tlsext_hostname = OPENSSL_malloc(len+1)) == NULL)
2055 *al = TLS1_AD_INTERNAL_ERROR;
2058 memcpy(s->session->tlsext_hostname, sdata, len);
2059 s->session->tlsext_hostname[len]='\0';
2060 if (strlen(s->session->tlsext_hostname) != len) {
2061 OPENSSL_free(s->session->tlsext_hostname);
2062 s->session->tlsext_hostname = NULL;
2063 *al = TLS1_AD_UNRECOGNIZED_NAME;
2066 s->servername_done = 1;
2070 s->servername_done = s->session->tlsext_hostname
2071 && strlen(s->session->tlsext_hostname) == len
2072 && strncmp(s->session->tlsext_hostname, (char *)sdata, len) == 0;
2084 *al = SSL_AD_DECODE_ERROR;
2089 #ifndef OPENSSL_NO_SRP
2090 else if (type == TLSEXT_TYPE_srp)
2092 if (size <= 0 || ((len = data[0])) != (size -1))
2094 *al = SSL_AD_DECODE_ERROR;
2097 if (s->srp_ctx.login != NULL)
2099 *al = SSL_AD_DECODE_ERROR;
2102 if ((s->srp_ctx.login = OPENSSL_malloc(len+1)) == NULL)
2104 memcpy(s->srp_ctx.login, &data[1], len);
2105 s->srp_ctx.login[len]='\0';
2107 if (strlen(s->srp_ctx.login) != len)
2109 *al = SSL_AD_DECODE_ERROR;
2115 #ifndef OPENSSL_NO_EC
2116 else if (type == TLSEXT_TYPE_ec_point_formats)
2118 unsigned char *sdata = data;
2119 int ecpointformatlist_length = *(sdata++);
2121 if (ecpointformatlist_length != size - 1 ||
2122 ecpointformatlist_length < 1)
2124 *al = TLS1_AD_DECODE_ERROR;
2129 if(s->session->tlsext_ecpointformatlist)
2131 OPENSSL_free(s->session->tlsext_ecpointformatlist);
2132 s->session->tlsext_ecpointformatlist = NULL;
2134 s->session->tlsext_ecpointformatlist_length = 0;
2135 if ((s->session->tlsext_ecpointformatlist = OPENSSL_malloc(ecpointformatlist_length)) == NULL)
2137 *al = TLS1_AD_INTERNAL_ERROR;
2140 s->session->tlsext_ecpointformatlist_length = ecpointformatlist_length;
2141 memcpy(s->session->tlsext_ecpointformatlist, sdata, ecpointformatlist_length);
2144 fprintf(stderr,"ssl_parse_clienthello_tlsext s->session->tlsext_ecpointformatlist (length=%i) ", s->session->tlsext_ecpointformatlist_length);
2145 sdata = s->session->tlsext_ecpointformatlist;
2146 for (i = 0; i < s->session->tlsext_ecpointformatlist_length; i++)
2147 fprintf(stderr,"%i ",*(sdata++));
2148 fprintf(stderr,"\n");
2151 else if (type == TLSEXT_TYPE_elliptic_curves)
2153 unsigned char *sdata = data;
2154 int ellipticcurvelist_length = (*(sdata++) << 8);
2155 ellipticcurvelist_length += (*(sdata++));
2157 if (ellipticcurvelist_length != size - 2 ||
2158 ellipticcurvelist_length < 1)
2160 *al = TLS1_AD_DECODE_ERROR;
2165 if(s->session->tlsext_ellipticcurvelist)
2167 *al = TLS1_AD_DECODE_ERROR;
2170 s->session->tlsext_ellipticcurvelist_length = 0;
2171 if ((s->session->tlsext_ellipticcurvelist = OPENSSL_malloc(ellipticcurvelist_length)) == NULL)
2173 *al = TLS1_AD_INTERNAL_ERROR;
2176 s->session->tlsext_ellipticcurvelist_length = ellipticcurvelist_length;
2177 memcpy(s->session->tlsext_ellipticcurvelist, sdata, ellipticcurvelist_length);
2180 fprintf(stderr,"ssl_parse_clienthello_tlsext s->session->tlsext_ellipticcurvelist (length=%i) ", s->session->tlsext_ellipticcurvelist_length);
2181 sdata = s->session->tlsext_ellipticcurvelist;
2182 for (i = 0; i < s->session->tlsext_ellipticcurvelist_length; i++)
2183 fprintf(stderr,"%i ",*(sdata++));
2184 fprintf(stderr,"\n");
2187 #endif /* OPENSSL_NO_EC */
2188 #ifdef TLSEXT_TYPE_opaque_prf_input
2189 else if (type == TLSEXT_TYPE_opaque_prf_input)
2191 unsigned char *sdata = data;
2195 *al = SSL_AD_DECODE_ERROR;
2198 n2s(sdata, s->s3->client_opaque_prf_input_len);
2199 if (s->s3->client_opaque_prf_input_len != size - 2)
2201 *al = SSL_AD_DECODE_ERROR;
2205 if (s->s3->client_opaque_prf_input != NULL) /* shouldn't really happen */
2206 OPENSSL_free(s->s3->client_opaque_prf_input);
2207 if (s->s3->client_opaque_prf_input_len == 0)
2208 s->s3->client_opaque_prf_input = OPENSSL_malloc(1); /* dummy byte just to get non-NULL */
2210 s->s3->client_opaque_prf_input = BUF_memdup(sdata, s->s3->client_opaque_prf_input_len);
2211 if (s->s3->client_opaque_prf_input == NULL)
2213 *al = TLS1_AD_INTERNAL_ERROR;
2218 else if (type == TLSEXT_TYPE_session_ticket)
2220 if (s->tls_session_ticket_ext_cb &&
2221 !s->tls_session_ticket_ext_cb(s, data, size, s->tls_session_ticket_ext_cb_arg))
2223 *al = TLS1_AD_INTERNAL_ERROR;
2227 else if (type == TLSEXT_TYPE_signature_algorithms)
2230 if (s->cert->peer_sigalgs || size < 2)
2232 *al = SSL_AD_DECODE_ERROR;
2237 if (dsize != size || dsize & 1 || !dsize)
2239 *al = SSL_AD_DECODE_ERROR;
2242 if (!tls1_save_sigalgs(s, data, dsize))
2244 *al = SSL_AD_DECODE_ERROR;
2248 else if (type == TLSEXT_TYPE_status_request)
2253 *al = SSL_AD_DECODE_ERROR;
2257 s->tlsext_status_type = *data++;
2259 if (s->tlsext_status_type == TLSEXT_STATUSTYPE_ocsp)
2261 const unsigned char *sdata;
2263 /* Read in responder_id_list */
2268 *al = SSL_AD_DECODE_ERROR;
2277 *al = SSL_AD_DECODE_ERROR;
2281 dsize -= 2 + idsize;
2285 *al = SSL_AD_DECODE_ERROR;
2290 id = d2i_OCSP_RESPID(NULL,
2294 *al = SSL_AD_DECODE_ERROR;
2299 OCSP_RESPID_free(id);
2300 *al = SSL_AD_DECODE_ERROR;
2303 if (!s->tlsext_ocsp_ids
2304 && !(s->tlsext_ocsp_ids =
2305 sk_OCSP_RESPID_new_null()))
2307 OCSP_RESPID_free(id);
2308 *al = SSL_AD_INTERNAL_ERROR;
2311 if (!sk_OCSP_RESPID_push(
2312 s->tlsext_ocsp_ids, id))
2314 OCSP_RESPID_free(id);
2315 *al = SSL_AD_INTERNAL_ERROR;
2320 /* Read in request_extensions */
2323 *al = SSL_AD_DECODE_ERROR;
2330 *al = SSL_AD_DECODE_ERROR;
2336 if (s->tlsext_ocsp_exts)
2338 sk_X509_EXTENSION_pop_free(s->tlsext_ocsp_exts,
2339 X509_EXTENSION_free);
2342 s->tlsext_ocsp_exts =
2343 d2i_X509_EXTENSIONS(NULL,
2345 if (!s->tlsext_ocsp_exts
2346 || (data + dsize != sdata))
2348 *al = SSL_AD_DECODE_ERROR;
2353 /* We don't know what to do with any other type
2357 s->tlsext_status_type = -1;
2359 #ifndef OPENSSL_NO_HEARTBEATS
2360 else if (type == TLSEXT_TYPE_heartbeat)
2364 case 0x01: /* Client allows us to send HB requests */
2365 s->tlsext_heartbeat |= SSL_TLSEXT_HB_ENABLED;
2367 case 0x02: /* Client doesn't accept HB requests */
2368 s->tlsext_heartbeat |= SSL_TLSEXT_HB_ENABLED;
2369 s->tlsext_heartbeat |= SSL_TLSEXT_HB_DONT_SEND_REQUESTS;
2371 default: *al = SSL_AD_ILLEGAL_PARAMETER;
2376 #ifndef OPENSSL_NO_NEXTPROTONEG
2377 else if (type == TLSEXT_TYPE_next_proto_neg &&
2378 s->s3->tmp.finish_md_len == 0 &&
2379 s->s3->alpn_selected == NULL)
2381 /* We shouldn't accept this extension on a
2384 * s->new_session will be set on renegotiation, but we
2385 * probably shouldn't rely that it couldn't be set on
2386 * the initial renegotation too in certain cases (when
2387 * there's some other reason to disallow resuming an
2388 * earlier session -- the current code won't be doing
2389 * anything like that, but this might change).
2391 * A valid sign that there's been a previous handshake
2392 * in this connection is if s->s3->tmp.finish_md_len >
2393 * 0. (We are talking about a check that will happen
2394 * in the Hello protocol round, well before a new
2395 * Finished message could have been computed.) */
2396 s->s3->next_proto_neg_seen = 1;
2400 else if (type == TLSEXT_TYPE_application_layer_protocol_negotiation &&
2401 s->ctx->alpn_select_cb &&
2402 s->s3->tmp.finish_md_len == 0)
2404 if (tls1_alpn_handle_client_hello(s, data, size, al) != 0)
2406 #ifndef OPENSSL_NO_NEXTPROTONEG
2407 /* ALPN takes precedence over NPN. */
2408 s->s3->next_proto_neg_seen = 0;
2412 /* session ticket processed earlier */
2413 else if (SSL_IS_DTLS(s) && SSL_get_srtp_profiles(s)
2414 && type == TLSEXT_TYPE_use_srtp)
2416 if(ssl_parse_clienthello_use_srtp_ext(s, data, size,
2420 #ifdef TLSEXT_TYPE_encrypt_then_mac
2421 else if (type == TLSEXT_TYPE_encrypt_then_mac)
2422 s->s3->flags |= TLS1_FLAGS_ENCRYPT_THEN_MAC;
2424 /* If this ClientHello extension was unhandled and this is
2425 * a nonresumed connection, check whether the extension is a
2426 * custom TLS Extension (has a custom_srv_ext_record), and if
2427 * so call the callback and record the extension number so that
2428 * an appropriate ServerHello may be later returned.
2432 if (custom_ext_parse(s, 1, type, data, size, al) <= 0)
2443 /* Need RI if renegotiating */
2445 if (!renegotiate_seen && s->renegotiate &&
2446 !(s->options & SSL_OP_ALLOW_UNSAFE_LEGACY_RENEGOTIATION))
2448 *al = SSL_AD_HANDSHAKE_FAILURE;
2449 SSLerr(SSL_F_SSL_SCAN_CLIENTHELLO_TLSEXT,
2450 SSL_R_UNSAFE_LEGACY_RENEGOTIATION_DISABLED);
2457 int ssl_parse_clienthello_tlsext(SSL *s, unsigned char **p, unsigned char *d, int n)
2460 custom_ext_init(&s->cert->srv_ext);
2461 if (ssl_scan_clienthello_tlsext(s, p, d, n, &al) <= 0)
2463 ssl3_send_alert(s,SSL3_AL_FATAL,al);
2467 if (ssl_check_clienthello_tlsext_early(s) <= 0)
2469 SSLerr(SSL_F_SSL_PARSE_CLIENTHELLO_TLSEXT,SSL_R_CLIENTHELLO_TLSEXT);
2475 #ifndef OPENSSL_NO_NEXTPROTONEG
2476 /* ssl_next_proto_validate validates a Next Protocol Negotiation block. No
2477 * elements of zero length are allowed and the set of elements must exactly fill
2478 * the length of the block. */
2479 static char ssl_next_proto_validate(unsigned char *d, unsigned len)
2481 unsigned int off = 0;
2495 static int ssl_scan_serverhello_tlsext(SSL *s, unsigned char **p, unsigned char *d, int n, int *al)
2497 unsigned short length;
2498 unsigned short type;
2499 unsigned short size;
2500 unsigned char *data = *p;
2501 int tlsext_servername = 0;
2502 int renegotiate_seen = 0;
2504 #ifndef OPENSSL_NO_NEXTPROTONEG
2505 s->s3->next_proto_neg_seen = 0;
2507 s->tlsext_ticket_expected = 0;
2509 if (s->s3->alpn_selected)
2511 OPENSSL_free(s->s3->alpn_selected);
2512 s->s3->alpn_selected = NULL;
2515 #ifndef OPENSSL_NO_HEARTBEATS
2516 s->tlsext_heartbeat &= ~(SSL_TLSEXT_HB_ENABLED |
2517 SSL_TLSEXT_HB_DONT_SEND_REQUESTS);
2520 #ifdef TLSEXT_TYPE_encrypt_then_mac
2521 s->s3->flags &= ~TLS1_FLAGS_ENCRYPT_THEN_MAC;
2524 if (data >= (d+n-2))
2528 if (data+length != d+n)
2530 *al = SSL_AD_DECODE_ERROR;
2534 while(data <= (d+n-4))
2539 if (data+size > (d+n))
2542 if (s->tlsext_debug_cb)
2543 s->tlsext_debug_cb(s, 1, type, data, size,
2544 s->tlsext_debug_arg);
2547 if (type == TLSEXT_TYPE_renegotiate)
2549 if(!ssl_parse_serverhello_renegotiate_ext(s, data, size, al))
2551 renegotiate_seen = 1;
2553 else if (s->version == SSL3_VERSION)
2555 else if (type == TLSEXT_TYPE_server_name)
2557 if (s->tlsext_hostname == NULL || size > 0)
2559 *al = TLS1_AD_UNRECOGNIZED_NAME;
2562 tlsext_servername = 1;
2565 #ifndef OPENSSL_NO_EC
2566 else if (type == TLSEXT_TYPE_ec_point_formats)
2568 unsigned char *sdata = data;
2569 int ecpointformatlist_length = *(sdata++);
2571 if (ecpointformatlist_length != size - 1)
2573 *al = TLS1_AD_DECODE_ERROR;
2578 s->session->tlsext_ecpointformatlist_length = 0;
2579 if (s->session->tlsext_ecpointformatlist != NULL) OPENSSL_free(s->session->tlsext_ecpointformatlist);
2580 if ((s->session->tlsext_ecpointformatlist = OPENSSL_malloc(ecpointformatlist_length)) == NULL)
2582 *al = TLS1_AD_INTERNAL_ERROR;
2585 s->session->tlsext_ecpointformatlist_length = ecpointformatlist_length;
2586 memcpy(s->session->tlsext_ecpointformatlist, sdata, ecpointformatlist_length);
2589 fprintf(stderr,"ssl_parse_serverhello_tlsext s->session->tlsext_ecpointformatlist ");
2590 sdata = s->session->tlsext_ecpointformatlist;
2591 for (i = 0; i < s->session->tlsext_ecpointformatlist_length; i++)
2592 fprintf(stderr,"%i ",*(sdata++));
2593 fprintf(stderr,"\n");
2596 #endif /* OPENSSL_NO_EC */
2598 else if (type == TLSEXT_TYPE_session_ticket)
2600 if (s->tls_session_ticket_ext_cb &&
2601 !s->tls_session_ticket_ext_cb(s, data, size, s->tls_session_ticket_ext_cb_arg))
2603 *al = TLS1_AD_INTERNAL_ERROR;
2606 if (!tls_use_ticket(s) || (size > 0))
2608 *al = TLS1_AD_UNSUPPORTED_EXTENSION;
2611 s->tlsext_ticket_expected = 1;
2613 #ifdef TLSEXT_TYPE_opaque_prf_input
2614 else if (type == TLSEXT_TYPE_opaque_prf_input)
2616 unsigned char *sdata = data;
2620 *al = SSL_AD_DECODE_ERROR;
2623 n2s(sdata, s->s3->server_opaque_prf_input_len);
2624 if (s->s3->server_opaque_prf_input_len != size - 2)
2626 *al = SSL_AD_DECODE_ERROR;
2630 if (s->s3->server_opaque_prf_input != NULL) /* shouldn't really happen */
2631 OPENSSL_free(s->s3->server_opaque_prf_input);
2632 if (s->s3->server_opaque_prf_input_len == 0)
2633 s->s3->server_opaque_prf_input = OPENSSL_malloc(1); /* dummy byte just to get non-NULL */
2635 s->s3->server_opaque_prf_input = BUF_memdup(sdata, s->s3->server_opaque_prf_input_len);
2637 if (s->s3->server_opaque_prf_input == NULL)
2639 *al = TLS1_AD_INTERNAL_ERROR;
2644 else if (type == TLSEXT_TYPE_status_request)
2646 /* MUST be empty and only sent if we've requested
2647 * a status request message.
2649 if ((s->tlsext_status_type == -1) || (size > 0))
2651 *al = TLS1_AD_UNSUPPORTED_EXTENSION;
2654 /* Set flag to expect CertificateStatus message */
2655 s->tlsext_status_expected = 1;
2657 #ifndef OPENSSL_NO_NEXTPROTONEG
2658 else if (type == TLSEXT_TYPE_next_proto_neg &&
2659 s->s3->tmp.finish_md_len == 0)
2661 unsigned char *selected;
2662 unsigned char selected_len;
2664 /* We must have requested it. */
2665 if (s->ctx->next_proto_select_cb == NULL)
2667 *al = TLS1_AD_UNSUPPORTED_EXTENSION;
2670 /* The data must be valid */
2671 if (!ssl_next_proto_validate(data, size))
2673 *al = TLS1_AD_DECODE_ERROR;
2676 if (s->ctx->next_proto_select_cb(s, &selected, &selected_len, data, size, s->ctx->next_proto_select_cb_arg) != SSL_TLSEXT_ERR_OK)
2678 *al = TLS1_AD_INTERNAL_ERROR;
2681 s->next_proto_negotiated = OPENSSL_malloc(selected_len);
2682 if (!s->next_proto_negotiated)
2684 *al = TLS1_AD_INTERNAL_ERROR;
2687 memcpy(s->next_proto_negotiated, selected, selected_len);
2688 s->next_proto_negotiated_len = selected_len;
2689 s->s3->next_proto_neg_seen = 1;
2693 else if (type == TLSEXT_TYPE_application_layer_protocol_negotiation)
2697 /* We must have requested it. */
2698 if (s->alpn_client_proto_list == NULL)
2700 *al = TLS1_AD_UNSUPPORTED_EXTENSION;
2705 *al = TLS1_AD_DECODE_ERROR;
2708 /* The extension data consists of:
2709 * uint16 list_length
2710 * uint8 proto_length;
2711 * uint8 proto[proto_length]; */
2715 if (len != (unsigned) size - 2)
2717 *al = TLS1_AD_DECODE_ERROR;
2721 if (len != (unsigned) size - 3)
2723 *al = TLS1_AD_DECODE_ERROR;
2726 if (s->s3->alpn_selected)
2727 OPENSSL_free(s->s3->alpn_selected);
2728 s->s3->alpn_selected = OPENSSL_malloc(len);
2729 if (!s->s3->alpn_selected)
2731 *al = TLS1_AD_INTERNAL_ERROR;
2734 memcpy(s->s3->alpn_selected, data + 3, len);
2735 s->s3->alpn_selected_len = len;
2737 #ifndef OPENSSL_NO_HEARTBEATS
2738 else if (type == TLSEXT_TYPE_heartbeat)
2742 case 0x01: /* Server allows us to send HB requests */
2743 s->tlsext_heartbeat |= SSL_TLSEXT_HB_ENABLED;
2745 case 0x02: /* Server doesn't accept HB requests */
2746 s->tlsext_heartbeat |= SSL_TLSEXT_HB_ENABLED;
2747 s->tlsext_heartbeat |= SSL_TLSEXT_HB_DONT_SEND_REQUESTS;
2749 default: *al = SSL_AD_ILLEGAL_PARAMETER;
2754 else if (SSL_IS_DTLS(s) && type == TLSEXT_TYPE_use_srtp)
2756 if(ssl_parse_serverhello_use_srtp_ext(s, data, size,
2760 #ifdef TLSEXT_TYPE_encrypt_then_mac
2761 else if (type == TLSEXT_TYPE_encrypt_then_mac)
2763 /* Ignore if inappropriate ciphersuite */
2764 if (s->s3->tmp.new_cipher->algorithm_mac != SSL_AEAD
2765 && s->s3->tmp.new_cipher->algorithm_enc != SSL_RC4)
2766 s->s3->flags |= TLS1_FLAGS_ENCRYPT_THEN_MAC;
2769 /* If this extension type was not otherwise handled, but
2770 * matches a custom_cli_ext_record, then send it to the c
2772 else if (custom_ext_parse(s, 0, type, data, size, al) <= 0)
2780 *al = SSL_AD_DECODE_ERROR;
2784 if (!s->hit && tlsext_servername == 1)
2786 if (s->tlsext_hostname)
2788 if (s->session->tlsext_hostname == NULL)
2790 s->session->tlsext_hostname = BUF_strdup(s->tlsext_hostname);
2791 if (!s->session->tlsext_hostname)
2793 *al = SSL_AD_UNRECOGNIZED_NAME;
2799 *al = SSL_AD_DECODE_ERROR;
2809 /* Determine if we need to see RI. Strictly speaking if we want to
2810 * avoid an attack we should *always* see RI even on initial server
2811 * hello because the client doesn't see any renegotiation during an
2812 * attack. However this would mean we could not connect to any server
2813 * which doesn't support RI so for the immediate future tolerate RI
2814 * absence on initial connect only.
2816 if (!renegotiate_seen
2817 && !(s->options & SSL_OP_LEGACY_SERVER_CONNECT)
2818 && !(s->options & SSL_OP_ALLOW_UNSAFE_LEGACY_RENEGOTIATION))
2820 *al = SSL_AD_HANDSHAKE_FAILURE;
2821 SSLerr(SSL_F_SSL_SCAN_SERVERHELLO_TLSEXT,
2822 SSL_R_UNSAFE_LEGACY_RENEGOTIATION_DISABLED);
2830 int ssl_prepare_clienthello_tlsext(SSL *s)
2833 #ifdef TLSEXT_TYPE_opaque_prf_input
2837 if (s->ctx->tlsext_opaque_prf_input_callback != 0)
2839 r = s->ctx->tlsext_opaque_prf_input_callback(s, NULL, 0, s->ctx->tlsext_opaque_prf_input_callback_arg);
2844 if (s->tlsext_opaque_prf_input != NULL)
2846 if (s->s3->client_opaque_prf_input != NULL) /* shouldn't really happen */
2847 OPENSSL_free(s->s3->client_opaque_prf_input);
2849 if (s->tlsext_opaque_prf_input_len == 0)
2850 s->s3->client_opaque_prf_input = OPENSSL_malloc(1); /* dummy byte just to get non-NULL */
2852 s->s3->client_opaque_prf_input = BUF_memdup(s->tlsext_opaque_prf_input, s->tlsext_opaque_prf_input_len);
2853 if (s->s3->client_opaque_prf_input == NULL)
2855 SSLerr(SSL_F_SSL_PREPARE_CLIENTHELLO_TLSEXT,ERR_R_MALLOC_FAILURE);
2858 s->s3->client_opaque_prf_input_len = s->tlsext_opaque_prf_input_len;
2862 /* at callback's request, insist on receiving an appropriate server opaque PRF input */
2863 s->s3->server_opaque_prf_input_len = s->tlsext_opaque_prf_input_len;
2870 int ssl_prepare_serverhello_tlsext(SSL *s)
2875 static int ssl_check_clienthello_tlsext_early(SSL *s)
2877 int ret=SSL_TLSEXT_ERR_NOACK;
2878 int al = SSL_AD_UNRECOGNIZED_NAME;
2880 #ifndef OPENSSL_NO_EC
2881 /* The handling of the ECPointFormats extension is done elsewhere, namely in
2882 * ssl3_choose_cipher in s3_lib.c.
2884 /* The handling of the EllipticCurves extension is done elsewhere, namely in
2885 * ssl3_choose_cipher in s3_lib.c.
2889 if (s->ctx != NULL && s->ctx->tlsext_servername_callback != 0)
2890 ret = s->ctx->tlsext_servername_callback(s, &al, s->ctx->tlsext_servername_arg);
2891 else if (s->initial_ctx != NULL && s->initial_ctx->tlsext_servername_callback != 0)
2892 ret = s->initial_ctx->tlsext_servername_callback(s, &al, s->initial_ctx->tlsext_servername_arg);
2894 #ifdef TLSEXT_TYPE_opaque_prf_input
2896 /* This sort of belongs into ssl_prepare_serverhello_tlsext(),
2897 * but we might be sending an alert in response to the client hello,
2898 * so this has to happen here in
2899 * ssl_check_clienthello_tlsext_early(). */
2903 if (s->ctx->tlsext_opaque_prf_input_callback != 0)
2905 r = s->ctx->tlsext_opaque_prf_input_callback(s, NULL, 0, s->ctx->tlsext_opaque_prf_input_callback_arg);
2908 ret = SSL_TLSEXT_ERR_ALERT_FATAL;
2909 al = SSL_AD_INTERNAL_ERROR;
2914 if (s->s3->server_opaque_prf_input != NULL) /* shouldn't really happen */
2915 OPENSSL_free(s->s3->server_opaque_prf_input);
2916 s->s3->server_opaque_prf_input = NULL;
2918 if (s->tlsext_opaque_prf_input != NULL)
2920 if (s->s3->client_opaque_prf_input != NULL &&
2921 s->s3->client_opaque_prf_input_len == s->tlsext_opaque_prf_input_len)
2923 /* can only use this extension if we have a server opaque PRF input
2924 * of the same length as the client opaque PRF input! */
2926 if (s->tlsext_opaque_prf_input_len == 0)
2927 s->s3->server_opaque_prf_input = OPENSSL_malloc(1); /* dummy byte just to get non-NULL */
2929 s->s3->server_opaque_prf_input = BUF_memdup(s->tlsext_opaque_prf_input, s->tlsext_opaque_prf_input_len);
2930 if (s->s3->server_opaque_prf_input == NULL)
2932 ret = SSL_TLSEXT_ERR_ALERT_FATAL;
2933 al = SSL_AD_INTERNAL_ERROR;
2936 s->s3->server_opaque_prf_input_len = s->tlsext_opaque_prf_input_len;
2940 if (r == 2 && s->s3->server_opaque_prf_input == NULL)
2942 /* The callback wants to enforce use of the extension,
2943 * but we can't do that with the client opaque PRF input;
2944 * abort the handshake.
2946 ret = SSL_TLSEXT_ERR_ALERT_FATAL;
2947 al = SSL_AD_HANDSHAKE_FAILURE;
2955 case SSL_TLSEXT_ERR_ALERT_FATAL:
2956 ssl3_send_alert(s,SSL3_AL_FATAL,al);
2959 case SSL_TLSEXT_ERR_ALERT_WARNING:
2960 ssl3_send_alert(s,SSL3_AL_WARNING,al);
2963 case SSL_TLSEXT_ERR_NOACK:
2964 s->servername_done=0;
2970 int tls1_set_server_sigalgs(SSL *s)
2974 /* Clear any shared sigtnature algorithms */
2975 if (s->cert->shared_sigalgs)
2977 OPENSSL_free(s->cert->shared_sigalgs);
2978 s->cert->shared_sigalgs = NULL;
2980 /* Clear certificate digests and validity flags */
2981 for (i = 0; i < SSL_PKEY_NUM; i++)
2983 s->cert->pkeys[i].digest = NULL;
2984 s->cert->pkeys[i].valid_flags = 0;
2987 /* If sigalgs received process it. */
2988 if (s->cert->peer_sigalgs)
2990 if (!tls1_process_sigalgs(s))
2992 SSLerr(SSL_F_TLS1_SET_SERVER_SIGALGS,
2993 ERR_R_MALLOC_FAILURE);
2994 al = SSL_AD_INTERNAL_ERROR;
2997 /* Fatal error is no shared signature algorithms */
2998 if (!s->cert->shared_sigalgs)
3000 SSLerr(SSL_F_TLS1_SET_SERVER_SIGALGS,
3001 SSL_R_NO_SHARED_SIGATURE_ALGORITHMS);
3002 al = SSL_AD_ILLEGAL_PARAMETER;
3007 ssl_cert_set_default_md(s->cert);
3010 ssl3_send_alert(s, SSL3_AL_FATAL, al);
3014 int ssl_check_clienthello_tlsext_late(SSL *s)
3016 int ret = SSL_TLSEXT_ERR_OK;
3019 /* If status request then ask callback what to do.
3020 * Note: this must be called after servername callbacks in case
3021 * the certificate has changed, and must be called after the cipher
3022 * has been chosen because this may influence which certificate is sent
3024 if ((s->tlsext_status_type != -1) && s->ctx && s->ctx->tlsext_status_cb)
3027 CERT_PKEY *certpkey;
3028 certpkey = ssl_get_server_send_pkey(s);
3029 /* If no certificate can't return certificate status */
3030 if (certpkey == NULL)
3032 s->tlsext_status_expected = 0;
3035 /* Set current certificate to one we will use so
3036 * SSL_get_certificate et al can pick it up.
3038 s->cert->key = certpkey;
3039 r = s->ctx->tlsext_status_cb(s, s->ctx->tlsext_status_arg);
3042 /* We don't want to send a status request response */
3043 case SSL_TLSEXT_ERR_NOACK:
3044 s->tlsext_status_expected = 0;
3046 /* status request response should be sent */
3047 case SSL_TLSEXT_ERR_OK:
3048 if (s->tlsext_ocsp_resp)
3049 s->tlsext_status_expected = 1;
3051 s->tlsext_status_expected = 0;
3053 /* something bad happened */
3054 case SSL_TLSEXT_ERR_ALERT_FATAL:
3055 ret = SSL_TLSEXT_ERR_ALERT_FATAL;
3056 al = SSL_AD_INTERNAL_ERROR;
3061 s->tlsext_status_expected = 0;
3066 case SSL_TLSEXT_ERR_ALERT_FATAL:
3067 ssl3_send_alert(s, SSL3_AL_FATAL, al);
3070 case SSL_TLSEXT_ERR_ALERT_WARNING:
3071 ssl3_send_alert(s, SSL3_AL_WARNING, al);
3079 int ssl_check_serverhello_tlsext(SSL *s)
3081 int ret=SSL_TLSEXT_ERR_NOACK;
3082 int al = SSL_AD_UNRECOGNIZED_NAME;
3084 #ifndef OPENSSL_NO_EC
3085 /* If we are client and using an elliptic curve cryptography cipher
3086 * suite, then if server returns an EC point formats lists extension
3087 * it must contain uncompressed.
3089 unsigned long alg_k = s->s3->tmp.new_cipher->algorithm_mkey;
3090 unsigned long alg_a = s->s3->tmp.new_cipher->algorithm_auth;
3091 if ((s->tlsext_ecpointformatlist != NULL) && (s->tlsext_ecpointformatlist_length > 0) &&
3092 (s->session->tlsext_ecpointformatlist != NULL) && (s->session->tlsext_ecpointformatlist_length > 0) &&
3093 ((alg_k & (SSL_kECDHE|SSL_kECDHr|SSL_kECDHe)) || (alg_a & SSL_aECDSA)))
3095 /* we are using an ECC cipher */
3097 unsigned char *list;
3098 int found_uncompressed = 0;
3099 list = s->session->tlsext_ecpointformatlist;
3100 for (i = 0; i < s->session->tlsext_ecpointformatlist_length; i++)
3102 if (*(list++) == TLSEXT_ECPOINTFORMAT_uncompressed)
3104 found_uncompressed = 1;
3108 if (!found_uncompressed)
3110 SSLerr(SSL_F_SSL_CHECK_SERVERHELLO_TLSEXT,SSL_R_TLS_INVALID_ECPOINTFORMAT_LIST);
3114 ret = SSL_TLSEXT_ERR_OK;
3115 #endif /* OPENSSL_NO_EC */
3117 if (s->ctx != NULL && s->ctx->tlsext_servername_callback != 0)
3118 ret = s->ctx->tlsext_servername_callback(s, &al, s->ctx->tlsext_servername_arg);
3119 else if (s->initial_ctx != NULL && s->initial_ctx->tlsext_servername_callback != 0)
3120 ret = s->initial_ctx->tlsext_servername_callback(s, &al, s->initial_ctx->tlsext_servername_arg);
3122 #ifdef TLSEXT_TYPE_opaque_prf_input
3123 if (s->s3->server_opaque_prf_input_len > 0)
3125 /* This case may indicate that we, as a client, want to insist on using opaque PRF inputs.
3126 * So first verify that we really have a value from the server too. */
3128 if (s->s3->server_opaque_prf_input == NULL)
3130 ret = SSL_TLSEXT_ERR_ALERT_FATAL;
3131 al = SSL_AD_HANDSHAKE_FAILURE;
3134 /* Anytime the server *has* sent an opaque PRF input, we need to check
3135 * that we have a client opaque PRF input of the same size. */
3136 if (s->s3->client_opaque_prf_input == NULL ||
3137 s->s3->client_opaque_prf_input_len != s->s3->server_opaque_prf_input_len)
3139 ret = SSL_TLSEXT_ERR_ALERT_FATAL;
3140 al = SSL_AD_ILLEGAL_PARAMETER;
3145 /* If we've requested certificate status and we wont get one
3148 if ((s->tlsext_status_type != -1) && !(s->tlsext_status_expected)
3149 && s->ctx && s->ctx->tlsext_status_cb)
3152 /* Set resp to NULL, resplen to -1 so callback knows
3153 * there is no response.
3155 if (s->tlsext_ocsp_resp)
3157 OPENSSL_free(s->tlsext_ocsp_resp);
3158 s->tlsext_ocsp_resp = NULL;
3160 s->tlsext_ocsp_resplen = -1;
3161 r = s->ctx->tlsext_status_cb(s, s->ctx->tlsext_status_arg);
3164 al = SSL_AD_BAD_CERTIFICATE_STATUS_RESPONSE;
3165 ret = SSL_TLSEXT_ERR_ALERT_FATAL;
3169 al = SSL_AD_INTERNAL_ERROR;
3170 ret = SSL_TLSEXT_ERR_ALERT_FATAL;
3176 case SSL_TLSEXT_ERR_ALERT_FATAL:
3177 ssl3_send_alert(s,SSL3_AL_FATAL,al);
3180 case SSL_TLSEXT_ERR_ALERT_WARNING:
3181 ssl3_send_alert(s,SSL3_AL_WARNING,al);
3184 case SSL_TLSEXT_ERR_NOACK:
3185 s->servername_done=0;
3191 int ssl_parse_serverhello_tlsext(SSL *s, unsigned char **p, unsigned char *d, int n)
3194 if (s->version < SSL3_VERSION)
3196 if (ssl_scan_serverhello_tlsext(s, p, d, n, &al) <= 0)
3198 ssl3_send_alert(s,SSL3_AL_FATAL,al);
3202 if (ssl_check_serverhello_tlsext(s) <= 0)
3204 SSLerr(SSL_F_SSL_PARSE_SERVERHELLO_TLSEXT,SSL_R_SERVERHELLO_TLSEXT);
3210 /* Since the server cache lookup is done early on in the processing of the
3211 * ClientHello, and other operations depend on the result, we need to handle
3212 * any TLS session ticket extension at the same time.
3214 * session_id: points at the session ID in the ClientHello. This code will
3215 * read past the end of this in order to parse out the session ticket
3216 * extension, if any.
3217 * len: the length of the session ID.
3218 * limit: a pointer to the first byte after the ClientHello.
3219 * ret: (output) on return, if a ticket was decrypted, then this is set to
3220 * point to the resulting session.
3222 * If s->tls_session_secret_cb is set then we are expecting a pre-shared key
3223 * ciphersuite, in which case we have no use for session tickets and one will
3224 * never be decrypted, nor will s->tlsext_ticket_expected be set to 1.
3227 * -1: fatal error, either from parsing or decrypting the ticket.
3228 * 0: no ticket was found (or was ignored, based on settings).
3229 * 1: a zero length extension was found, indicating that the client supports
3230 * session tickets but doesn't currently have one to offer.
3231 * 2: either s->tls_session_secret_cb was set, or a ticket was offered but
3232 * couldn't be decrypted because of a non-fatal error.
3233 * 3: a ticket was successfully decrypted and *ret was set.
3236 * Sets s->tlsext_ticket_expected to 1 if the server will have to issue
3237 * a new session ticket to the client because the client indicated support
3238 * (and s->tls_session_secret_cb is NULL) but the client either doesn't have
3239 * a session ticket or we couldn't use the one it gave us, or if
3240 * s->ctx->tlsext_ticket_key_cb asked to renew the client's ticket.
3241 * Otherwise, s->tlsext_ticket_expected is set to 0.
3243 int tls1_process_ticket(SSL *s, unsigned char *session_id, int len,
3244 const unsigned char *limit, SSL_SESSION **ret)
3246 /* Point after session ID in client hello */
3247 const unsigned char *p = session_id + len;
3251 s->tlsext_ticket_expected = 0;
3253 /* If tickets disabled behave as if no ticket present
3254 * to permit stateful resumption.
3256 if (!tls_use_ticket(s))
3258 if ((s->version <= SSL3_VERSION) || !limit)
3262 /* Skip past DTLS cookie */
3270 /* Skip past cipher list */
3275 /* Skip past compression algorithm list */
3280 /* Now at start of extensions */
3281 if ((p + 2) >= limit)
3284 while ((p + 4) <= limit)
3286 unsigned short type, size;
3289 if (p + size > limit)
3291 if (type == TLSEXT_TYPE_session_ticket)
3296 /* The client will accept a ticket but doesn't
3297 * currently have one. */
3298 s->tlsext_ticket_expected = 1;
3301 if (s->tls_session_secret_cb)
3303 /* Indicate that the ticket couldn't be
3304 * decrypted rather than generating the session
3305 * from ticket now, trigger abbreviated
3306 * handshake based on external mechanism to
3307 * calculate the master secret later. */
3310 r = tls_decrypt_ticket(s, p, size, session_id, len, ret);
3313 case 2: /* ticket couldn't be decrypted */
3314 s->tlsext_ticket_expected = 1;
3316 case 3: /* ticket was decrypted */
3318 case 4: /* ticket decrypted but need to renew */
3319 s->tlsext_ticket_expected = 1;
3321 default: /* fatal error */
3330 /* tls_decrypt_ticket attempts to decrypt a session ticket.
3332 * etick: points to the body of the session ticket extension.
3333 * eticklen: the length of the session tickets extenion.
3334 * sess_id: points at the session ID.
3335 * sesslen: the length of the session ID.
3336 * psess: (output) on return, if a ticket was decrypted, then this is set to
3337 * point to the resulting session.
3340 * -1: fatal error, either from parsing or decrypting the ticket.
3341 * 2: the ticket couldn't be decrypted.
3342 * 3: a ticket was successfully decrypted and *psess was set.
3343 * 4: same as 3, but the ticket needs to be renewed.
3345 static int tls_decrypt_ticket(SSL *s, const unsigned char *etick, int eticklen,
3346 const unsigned char *sess_id, int sesslen,
3347 SSL_SESSION **psess)
3350 unsigned char *sdec;
3351 const unsigned char *p;
3352 int slen, mlen, renew_ticket = 0;
3353 unsigned char tick_hmac[EVP_MAX_MD_SIZE];
3356 SSL_CTX *tctx = s->initial_ctx;
3357 /* Need at least keyname + iv + some encrypted data */
3360 /* Initialize session ticket encryption and HMAC contexts */
3361 HMAC_CTX_init(&hctx);
3362 EVP_CIPHER_CTX_init(&ctx);
3363 if (tctx->tlsext_ticket_key_cb)
3365 unsigned char *nctick = (unsigned char *)etick;
3366 int rv = tctx->tlsext_ticket_key_cb(s, nctick, nctick + 16,
3377 /* Check key name matches */
3378 if (memcmp(etick, tctx->tlsext_tick_key_name, 16))
3380 HMAC_Init_ex(&hctx, tctx->tlsext_tick_hmac_key, 16,
3381 tlsext_tick_md(), NULL);
3382 EVP_DecryptInit_ex(&ctx, EVP_aes_128_cbc(), NULL,
3383 tctx->tlsext_tick_aes_key, etick + 16);
3385 /* Attempt to process session ticket, first conduct sanity and
3386 * integrity checks on ticket.
3388 mlen = HMAC_size(&hctx);
3391 EVP_CIPHER_CTX_cleanup(&ctx);
3395 /* Check HMAC of encrypted ticket */
3396 HMAC_Update(&hctx, etick, eticklen);
3397 HMAC_Final(&hctx, tick_hmac, NULL);
3398 HMAC_CTX_cleanup(&hctx);
3399 if (CRYPTO_memcmp(tick_hmac, etick + eticklen, mlen))
3401 EVP_CIPHER_CTX_cleanup(&ctx);
3404 /* Attempt to decrypt session data */
3405 /* Move p after IV to start of encrypted ticket, update length */
3406 p = etick + 16 + EVP_CIPHER_CTX_iv_length(&ctx);
3407 eticklen -= 16 + EVP_CIPHER_CTX_iv_length(&ctx);
3408 sdec = OPENSSL_malloc(eticklen);
3411 EVP_CIPHER_CTX_cleanup(&ctx);
3414 EVP_DecryptUpdate(&ctx, sdec, &slen, p, eticklen);
3415 if (EVP_DecryptFinal(&ctx, sdec + slen, &mlen) <= 0)
3417 EVP_CIPHER_CTX_cleanup(&ctx);
3422 EVP_CIPHER_CTX_cleanup(&ctx);
3425 sess = d2i_SSL_SESSION(NULL, &p, slen);
3429 /* The session ID, if non-empty, is used by some clients to
3430 * detect that the ticket has been accepted. So we copy it to
3431 * the session structure. If it is empty set length to zero
3432 * as required by standard.
3435 memcpy(sess->session_id, sess_id, sesslen);
3436 sess->session_id_length = sesslen;
3444 /* For session parse failure, indicate that we need to send a new
3449 /* Tables to translate from NIDs to TLS v1.2 ids */
3457 static tls12_lookup tls12_md[] = {
3458 {NID_md5, TLSEXT_hash_md5},
3459 {NID_sha1, TLSEXT_hash_sha1},
3460 {NID_sha224, TLSEXT_hash_sha224},
3461 {NID_sha256, TLSEXT_hash_sha256},
3462 {NID_sha384, TLSEXT_hash_sha384},
3463 {NID_sha512, TLSEXT_hash_sha512}
3466 static tls12_lookup tls12_sig[] = {
3467 {EVP_PKEY_RSA, TLSEXT_signature_rsa},
3468 {EVP_PKEY_DSA, TLSEXT_signature_dsa},
3469 {EVP_PKEY_EC, TLSEXT_signature_ecdsa}
3472 static int tls12_find_id(int nid, tls12_lookup *table, size_t tlen)
3475 for (i = 0; i < tlen; i++)
3477 if (table[i].nid == nid)
3483 static int tls12_find_nid(int id, tls12_lookup *table, size_t tlen)
3486 for (i = 0; i < tlen; i++)
3488 if ((table[i].id) == id)
3489 return table[i].nid;
3494 int tls12_get_sigandhash(unsigned char *p, const EVP_PKEY *pk, const EVP_MD *md)
3499 md_id = tls12_find_id(EVP_MD_type(md), tls12_md,
3500 sizeof(tls12_md)/sizeof(tls12_lookup));
3503 sig_id = tls12_get_sigid(pk);
3506 p[0] = (unsigned char)md_id;
3507 p[1] = (unsigned char)sig_id;
3511 int tls12_get_sigid(const EVP_PKEY *pk)
3513 return tls12_find_id(pk->type, tls12_sig,
3514 sizeof(tls12_sig)/sizeof(tls12_lookup));
3521 const EVP_MD *(*mfunc)(void);
3524 static const tls12_hash_info tls12_md_info[] = {
3525 #ifdef OPENSSL_NO_MD5
3528 {NID_md5, 64, EVP_md5},
3530 #ifdef OPENSSL_NO_SHA
3533 {NID_sha1, 80, EVP_sha1},
3535 #ifdef OPENSSL_NO_SHA256
3536 {NID_sha224, 112, 0},
3537 {NID_sha256, 128, 0},
3539 {NID_sha224, 112, EVP_sha224},
3540 {NID_sha256, 128, EVP_sha256},
3542 #ifdef OPENSSL_NO_SHA512
3543 {NID_sha384, 192, 0},
3544 {NID_sha512, 256, 0}
3546 {NID_sha384, 192, EVP_sha384},
3547 {NID_sha512, 256, EVP_sha512}
3551 static const tls12_hash_info *tls12_get_hash_info(unsigned char hash_alg)
3555 if (hash_alg > sizeof(tls12_md_info)/sizeof(tls12_md_info[0]))
3557 return tls12_md_info + hash_alg - 1;
3560 const EVP_MD *tls12_get_hash(unsigned char hash_alg)
3562 const tls12_hash_info *inf;
3563 #ifndef OPENSSL_FIPS
3564 if (hash_alg == TLSEXT_hash_md5 && FIPS_mode())
3567 inf = tls12_get_hash_info(hash_alg);
3568 if (!inf || !inf->mfunc)
3570 return inf->mfunc();
3573 static int tls12_get_pkey_idx(unsigned char sig_alg)
3577 #ifndef OPENSSL_NO_RSA
3578 case TLSEXT_signature_rsa:
3579 return SSL_PKEY_RSA_SIGN;
3581 #ifndef OPENSSL_NO_DSA
3582 case TLSEXT_signature_dsa:
3583 return SSL_PKEY_DSA_SIGN;
3585 #ifndef OPENSSL_NO_ECDSA
3586 case TLSEXT_signature_ecdsa:
3587 return SSL_PKEY_ECC;
3593 /* Convert TLS 1.2 signature algorithm extension values into NIDs */
3594 static void tls1_lookup_sigalg(int *phash_nid, int *psign_nid,
3595 int *psignhash_nid, const unsigned char *data)
3597 int sign_nid = 0, hash_nid = 0;
3598 if (!phash_nid && !psign_nid && !psignhash_nid)
3600 if (phash_nid || psignhash_nid)
3602 hash_nid = tls12_find_nid(data[0], tls12_md,
3603 sizeof(tls12_md)/sizeof(tls12_lookup));
3605 *phash_nid = hash_nid;
3607 if (psign_nid || psignhash_nid)
3609 sign_nid = tls12_find_nid(data[1], tls12_sig,
3610 sizeof(tls12_sig)/sizeof(tls12_lookup));
3612 *psign_nid = sign_nid;
3616 if (sign_nid && hash_nid)
3617 OBJ_find_sigid_by_algs(psignhash_nid,
3618 hash_nid, sign_nid);
3620 *psignhash_nid = NID_undef;
3623 /* Check to see if a signature algorithm is allowed */
3624 static int tls12_sigalg_allowed(SSL *s, int op, const unsigned char *ptmp)
3626 /* See if we have an entry in the hash table and it is enabled */
3627 const tls12_hash_info *hinf = tls12_get_hash_info(ptmp[0]);
3628 if (!hinf || !hinf->mfunc)
3630 /* See if public key algorithm allowed */
3631 if (tls12_get_pkey_idx(ptmp[1]) == -1)
3633 /* Finally see if security callback allows it */
3634 return ssl_security(s, op, hinf->secbits, hinf->nid, (void *)ptmp);
3637 /* Get a mask of disabled public key algorithms based on supported
3638 * signature algorithms. For example if no signature algorithm supports RSA
3639 * then RSA is disabled.
3642 void ssl_set_sig_mask(unsigned long *pmask_a, SSL *s, int op)
3644 const unsigned char *sigalgs;
3645 size_t i, sigalgslen;
3646 int have_rsa = 0, have_dsa = 0, have_ecdsa = 0;
3647 /* Now go through all signature algorithms seeing if we support
3648 * any for RSA, DSA, ECDSA. Do this for all versions not just
3649 * TLS 1.2. To keep down calls to security callback only check
3652 sigalgslen = tls12_get_psigalgs(s, &sigalgs);
3653 for (i = 0; i < sigalgslen; i += 2, sigalgs += 2)
3657 #ifndef OPENSSL_NO_RSA
3658 case TLSEXT_signature_rsa:
3659 if (!have_rsa && tls12_sigalg_allowed(s, op, sigalgs))
3663 #ifndef OPENSSL_NO_DSA
3664 case TLSEXT_signature_dsa:
3665 if (!have_dsa && tls12_sigalg_allowed(s, op, sigalgs))
3669 #ifndef OPENSSL_NO_ECDSA
3670 case TLSEXT_signature_ecdsa:
3671 if (!have_ecdsa && tls12_sigalg_allowed(s, op, sigalgs))
3678 *pmask_a |= SSL_aRSA;
3680 *pmask_a |= SSL_aDSS;
3682 *pmask_a |= SSL_aECDSA;
3685 size_t tls12_copy_sigalgs(SSL *s, unsigned char *out,
3686 const unsigned char *psig, size_t psiglen)
3688 unsigned char *tmpout = out;
3690 for (i = 0; i < psiglen; i += 2, psig += 2)
3692 if (tls12_sigalg_allowed(s, SSL_SECOP_SIGALG_SUPPORTED, psig))
3694 *tmpout++ = psig[0];
3695 *tmpout++ = psig[1];
3698 return tmpout - out;
3701 /* Given preference and allowed sigalgs set shared sigalgs */
3702 static int tls12_shared_sigalgs(SSL *s, TLS_SIGALGS *shsig,
3703 const unsigned char *pref, size_t preflen,
3704 const unsigned char *allow, size_t allowlen)
3706 const unsigned char *ptmp, *atmp;
3707 size_t i, j, nmatch = 0;
3708 for (i = 0, ptmp = pref; i < preflen; i+=2, ptmp+=2)
3710 /* Skip disabled hashes or signature algorithms */
3711 if (!tls12_sigalg_allowed(s, SSL_SECOP_SIGALG_SHARED, ptmp))
3713 for (j = 0, atmp = allow; j < allowlen; j+=2, atmp+=2)
3715 if (ptmp[0] == atmp[0] && ptmp[1] == atmp[1])
3720 shsig->rhash = ptmp[0];
3721 shsig->rsign = ptmp[1];
3722 tls1_lookup_sigalg(&shsig->hash_nid,
3724 &shsig->signandhash_nid,
3735 /* Set shared signature algorithms for SSL structures */
3736 static int tls1_set_shared_sigalgs(SSL *s)
3738 const unsigned char *pref, *allow, *conf;
3739 size_t preflen, allowlen, conflen;
3741 TLS_SIGALGS *salgs = NULL;
3743 unsigned int is_suiteb = tls1_suiteb(s);
3744 if (c->shared_sigalgs)
3746 OPENSSL_free(c->shared_sigalgs);
3747 c->shared_sigalgs = NULL;
3749 /* If client use client signature algorithms if not NULL */
3750 if (!s->server && c->client_sigalgs && !is_suiteb)
3752 conf = c->client_sigalgs;
3753 conflen = c->client_sigalgslen;
3755 else if (c->conf_sigalgs && !is_suiteb)
3757 conf = c->conf_sigalgs;
3758 conflen = c->conf_sigalgslen;
3761 conflen = tls12_get_psigalgs(s, &conf);
3762 if(s->options & SSL_OP_CIPHER_SERVER_PREFERENCE || is_suiteb)
3766 allow = c->peer_sigalgs;
3767 allowlen = c->peer_sigalgslen;
3773 pref = c->peer_sigalgs;
3774 preflen = c->peer_sigalgslen;
3776 nmatch = tls12_shared_sigalgs(s, NULL, pref, preflen, allow, allowlen);
3779 salgs = OPENSSL_malloc(nmatch * sizeof(TLS_SIGALGS));
3782 nmatch = tls12_shared_sigalgs(s, salgs, pref, preflen, allow, allowlen);
3783 c->shared_sigalgs = salgs;
3784 c->shared_sigalgslen = nmatch;
3789 /* Set preferred digest for each key type */
3791 int tls1_save_sigalgs(SSL *s, const unsigned char *data, int dsize)
3794 /* Extension ignored for inappropriate versions */
3795 if (!SSL_USE_SIGALGS(s))
3797 /* Should never happen */
3801 if (c->peer_sigalgs)
3802 OPENSSL_free(c->peer_sigalgs);
3803 c->peer_sigalgs = OPENSSL_malloc(dsize);
3804 if (!c->peer_sigalgs)
3806 c->peer_sigalgslen = dsize;
3807 memcpy(c->peer_sigalgs, data, dsize);
3811 int tls1_process_sigalgs(SSL *s)
3817 TLS_SIGALGS *sigptr;
3818 if (!tls1_set_shared_sigalgs(s))
3821 #ifdef OPENSSL_SSL_DEBUG_BROKEN_PROTOCOL
3822 if (s->cert->cert_flags & SSL_CERT_FLAG_BROKEN_PROTOCOL)
3824 /* Use first set signature preference to force message
3825 * digest, ignoring any peer preferences.
3827 const unsigned char *sigs = NULL;
3829 sigs = c->conf_sigalgs;
3831 sigs = c->client_sigalgs;
3834 idx = tls12_get_pkey_idx(sigs[1]);
3835 md = tls12_get_hash(sigs[0]);
3836 c->pkeys[idx].digest = md;
3837 c->pkeys[idx].valid_flags = CERT_PKEY_EXPLICIT_SIGN;
3838 if (idx == SSL_PKEY_RSA_SIGN)
3840 c->pkeys[SSL_PKEY_RSA_ENC].valid_flags = CERT_PKEY_EXPLICIT_SIGN;
3841 c->pkeys[SSL_PKEY_RSA_ENC].digest = md;
3847 for (i = 0, sigptr = c->shared_sigalgs;
3848 i < c->shared_sigalgslen; i++, sigptr++)
3850 idx = tls12_get_pkey_idx(sigptr->rsign);
3851 if (idx > 0 && c->pkeys[idx].digest == NULL)
3853 md = tls12_get_hash(sigptr->rhash);
3854 c->pkeys[idx].digest = md;
3855 c->pkeys[idx].valid_flags = CERT_PKEY_EXPLICIT_SIGN;
3856 if (idx == SSL_PKEY_RSA_SIGN)
3858 c->pkeys[SSL_PKEY_RSA_ENC].valid_flags = CERT_PKEY_EXPLICIT_SIGN;
3859 c->pkeys[SSL_PKEY_RSA_ENC].digest = md;
3864 /* In strict mode leave unset digests as NULL to indicate we can't
3865 * use the certificate for signing.
3867 if (!(s->cert->cert_flags & SSL_CERT_FLAGS_CHECK_TLS_STRICT))
3869 /* Set any remaining keys to default values. NOTE: if alg is
3870 * not supported it stays as NULL.
3872 #ifndef OPENSSL_NO_DSA
3873 if (!c->pkeys[SSL_PKEY_DSA_SIGN].digest)
3874 c->pkeys[SSL_PKEY_DSA_SIGN].digest = EVP_sha1();
3876 #ifndef OPENSSL_NO_RSA
3877 if (!c->pkeys[SSL_PKEY_RSA_SIGN].digest)
3879 c->pkeys[SSL_PKEY_RSA_SIGN].digest = EVP_sha1();
3880 c->pkeys[SSL_PKEY_RSA_ENC].digest = EVP_sha1();
3883 #ifndef OPENSSL_NO_ECDSA
3884 if (!c->pkeys[SSL_PKEY_ECC].digest)
3885 c->pkeys[SSL_PKEY_ECC].digest = EVP_sha1();
3892 int SSL_get_sigalgs(SSL *s, int idx,
3893 int *psign, int *phash, int *psignhash,
3894 unsigned char *rsig, unsigned char *rhash)
3896 const unsigned char *psig = s->cert->peer_sigalgs;
3902 if (idx >= (int)s->cert->peer_sigalgslen)
3909 tls1_lookup_sigalg(phash, psign, psignhash, psig);
3911 return s->cert->peer_sigalgslen / 2;
3914 int SSL_get_shared_sigalgs(SSL *s, int idx,
3915 int *psign, int *phash, int *psignhash,
3916 unsigned char *rsig, unsigned char *rhash)
3918 TLS_SIGALGS *shsigalgs = s->cert->shared_sigalgs;
3919 if (!shsigalgs || idx >= (int)s->cert->shared_sigalgslen)
3923 *phash = shsigalgs->hash_nid;
3925 *psign = shsigalgs->sign_nid;
3927 *psignhash = shsigalgs->signandhash_nid;
3929 *rsig = shsigalgs->rsign;
3931 *rhash = shsigalgs->rhash;
3932 return s->cert->shared_sigalgslen;
3936 #ifndef OPENSSL_NO_HEARTBEATS
3938 tls1_process_heartbeat(SSL *s)
3940 unsigned char *p = &s->s3->rrec.data[0], *pl;
3941 unsigned short hbtype;
3942 unsigned int payload;
3943 unsigned int padding = 16; /* Use minimum padding */
3945 if (s->msg_callback)
3946 s->msg_callback(0, s->version, TLS1_RT_HEARTBEAT,
3947 &s->s3->rrec.data[0], s->s3->rrec.length,
3948 s, s->msg_callback_arg);
3950 /* Read type and payload length first */
3951 if (1 + 2 + 16 > s->s3->rrec.length)
3952 return 0; /* silently discard */
3955 if (1 + 2 + payload + 16 > s->s3->rrec.length)
3956 return 0; /* silently discard per RFC 6520 sec. 4 */
3959 if (hbtype == TLS1_HB_REQUEST)
3961 unsigned char *buffer, *bp;
3964 /* Allocate memory for the response, size is 1 bytes
3965 * message type, plus 2 bytes payload length, plus
3966 * payload, plus padding
3968 buffer = OPENSSL_malloc(1 + 2 + payload + padding);
3971 /* Enter response type, length and copy payload */
3972 *bp++ = TLS1_HB_RESPONSE;
3974 memcpy(bp, pl, payload);
3976 /* Random padding */
3977 RAND_pseudo_bytes(bp, padding);
3979 r = ssl3_write_bytes(s, TLS1_RT_HEARTBEAT, buffer, 3 + payload + padding);
3981 if (r >= 0 && s->msg_callback)
3982 s->msg_callback(1, s->version, TLS1_RT_HEARTBEAT,
3983 buffer, 3 + payload + padding,
3984 s, s->msg_callback_arg);
3986 OPENSSL_free(buffer);
3991 else if (hbtype == TLS1_HB_RESPONSE)
3995 /* We only send sequence numbers (2 bytes unsigned int),
3996 * and 16 random bytes, so we just try to read the
3997 * sequence number */
4000 if (payload == 18 && seq == s->tlsext_hb_seq)
4003 s->tlsext_hb_pending = 0;
4011 tls1_heartbeat(SSL *s)
4013 unsigned char *buf, *p;
4015 unsigned int payload = 18; /* Sequence number + random bytes */
4016 unsigned int padding = 16; /* Use minimum padding */
4018 /* Only send if peer supports and accepts HB requests... */
4019 if (!(s->tlsext_heartbeat & SSL_TLSEXT_HB_ENABLED) ||
4020 s->tlsext_heartbeat & SSL_TLSEXT_HB_DONT_SEND_REQUESTS)
4022 SSLerr(SSL_F_TLS1_HEARTBEAT,SSL_R_TLS_HEARTBEAT_PEER_DOESNT_ACCEPT);
4026 /* ...and there is none in flight yet... */
4027 if (s->tlsext_hb_pending)
4029 SSLerr(SSL_F_TLS1_HEARTBEAT,SSL_R_TLS_HEARTBEAT_PENDING);
4033 /* ...and no handshake in progress. */
4034 if (SSL_in_init(s) || s->in_handshake)
4036 SSLerr(SSL_F_TLS1_HEARTBEAT,SSL_R_UNEXPECTED_MESSAGE);
4040 /* Check if padding is too long, payload and padding
4041 * must not exceed 2^14 - 3 = 16381 bytes in total.
4043 OPENSSL_assert(payload + padding <= 16381);
4045 /* Create HeartBeat message, we just use a sequence number
4046 * as payload to distuingish different messages and add
4047 * some random stuff.
4048 * - Message Type, 1 byte
4049 * - Payload Length, 2 bytes (unsigned int)
4050 * - Payload, the sequence number (2 bytes uint)
4051 * - Payload, random bytes (16 bytes uint)
4054 buf = OPENSSL_malloc(1 + 2 + payload + padding);
4057 *p++ = TLS1_HB_REQUEST;
4058 /* Payload length (18 bytes here) */
4060 /* Sequence number */
4061 s2n(s->tlsext_hb_seq, p);
4062 /* 16 random bytes */
4063 RAND_pseudo_bytes(p, 16);
4065 /* Random padding */
4066 RAND_pseudo_bytes(p, padding);
4068 ret = ssl3_write_bytes(s, TLS1_RT_HEARTBEAT, buf, 3 + payload + padding);
4071 if (s->msg_callback)
4072 s->msg_callback(1, s->version, TLS1_RT_HEARTBEAT,
4073 buf, 3 + payload + padding,
4074 s, s->msg_callback_arg);
4076 s->tlsext_hb_pending = 1;
4085 #define MAX_SIGALGLEN (TLSEXT_hash_num * TLSEXT_signature_num * 2)
4090 int sigalgs[MAX_SIGALGLEN];
4093 static int sig_cb(const char *elem, int len, void *arg)
4095 sig_cb_st *sarg = arg;
4098 int sig_alg, hash_alg;
4099 if (sarg->sigalgcnt == MAX_SIGALGLEN)
4101 if (len > (int)(sizeof(etmp) - 1))
4103 memcpy(etmp, elem, len);
4105 p = strchr(etmp, '+');
4113 if (!strcmp(etmp, "RSA"))
4114 sig_alg = EVP_PKEY_RSA;
4115 else if (!strcmp(etmp, "DSA"))
4116 sig_alg = EVP_PKEY_DSA;
4117 else if (!strcmp(etmp, "ECDSA"))
4118 sig_alg = EVP_PKEY_EC;
4121 hash_alg = OBJ_sn2nid(p);
4122 if (hash_alg == NID_undef)
4123 hash_alg = OBJ_ln2nid(p);
4124 if (hash_alg == NID_undef)
4127 for (i = 0; i < sarg->sigalgcnt; i+=2)
4129 if (sarg->sigalgs[i] == sig_alg
4130 && sarg->sigalgs[i + 1] == hash_alg)
4133 sarg->sigalgs[sarg->sigalgcnt++] = hash_alg;
4134 sarg->sigalgs[sarg->sigalgcnt++] = sig_alg;
4138 /* Set suppored signature algorithms based on a colon separated list
4139 * of the form sig+hash e.g. RSA+SHA512:DSA+SHA512 */
4140 int tls1_set_sigalgs_list(CERT *c, const char *str, int client)
4144 if (!CONF_parse_list(str, ':', 1, sig_cb, &sig))
4148 return tls1_set_sigalgs(c, sig.sigalgs, sig.sigalgcnt, client);
4151 int tls1_set_sigalgs(CERT *c, const int *psig_nids, size_t salglen, int client)
4153 unsigned char *sigalgs, *sptr;
4158 sigalgs = OPENSSL_malloc(salglen);
4159 if (sigalgs == NULL)
4161 for (i = 0, sptr = sigalgs; i < salglen; i+=2)
4163 rhash = tls12_find_id(*psig_nids++, tls12_md,
4164 sizeof(tls12_md)/sizeof(tls12_lookup));
4165 rsign = tls12_find_id(*psig_nids++, tls12_sig,
4166 sizeof(tls12_sig)/sizeof(tls12_lookup));
4168 if (rhash == -1 || rsign == -1)
4176 if (c->client_sigalgs)
4177 OPENSSL_free(c->client_sigalgs);
4178 c->client_sigalgs = sigalgs;
4179 c->client_sigalgslen = salglen;
4183 if (c->conf_sigalgs)
4184 OPENSSL_free(c->conf_sigalgs);
4185 c->conf_sigalgs = sigalgs;
4186 c->conf_sigalgslen = salglen;
4192 OPENSSL_free(sigalgs);
4196 static int tls1_check_sig_alg(CERT *c, X509 *x, int default_nid)
4200 if (default_nid == -1)
4202 sig_nid = X509_get_signature_nid(x);
4204 return sig_nid == default_nid ? 1 : 0;
4205 for (i = 0; i < c->shared_sigalgslen; i++)
4206 if (sig_nid == c->shared_sigalgs[i].signandhash_nid)
4210 /* Check to see if a certificate issuer name matches list of CA names */
4211 static int ssl_check_ca_name(STACK_OF(X509_NAME) *names, X509 *x)
4215 nm = X509_get_issuer_name(x);
4216 for (i = 0; i < sk_X509_NAME_num(names); i++)
4218 if(!X509_NAME_cmp(nm, sk_X509_NAME_value(names, i)))
4224 /* Check certificate chain is consistent with TLS extensions and is
4225 * usable by server. This servers two purposes: it allows users to
4226 * check chains before passing them to the server and it allows the
4227 * server to check chains before attempting to use them.
4230 /* Flags which need to be set for a certificate when stict mode not set */
4232 #define CERT_PKEY_VALID_FLAGS \
4233 (CERT_PKEY_EE_SIGNATURE|CERT_PKEY_EE_PARAM)
4234 /* Strict mode flags */
4235 #define CERT_PKEY_STRICT_FLAGS \
4236 (CERT_PKEY_VALID_FLAGS|CERT_PKEY_CA_SIGNATURE|CERT_PKEY_CA_PARAM \
4237 | CERT_PKEY_ISSUER_NAME|CERT_PKEY_CERT_TYPE)
4239 int tls1_check_chain(SSL *s, X509 *x, EVP_PKEY *pk, STACK_OF(X509) *chain,
4244 int check_flags = 0, strict_mode;
4245 CERT_PKEY *cpk = NULL;
4247 unsigned int suiteb_flags = tls1_suiteb(s);
4248 /* idx == -1 means checking server chains */
4251 /* idx == -2 means checking client certificate chains */
4255 idx = cpk - c->pkeys;
4258 cpk = c->pkeys + idx;
4260 pk = cpk->privatekey;
4262 strict_mode = c->cert_flags & SSL_CERT_FLAGS_CHECK_TLS_STRICT;
4263 /* If no cert or key, forget it */
4266 #ifdef OPENSSL_SSL_DEBUG_BROKEN_PROTOCOL
4267 /* Allow any certificate to pass test */
4268 if (s->cert->cert_flags & SSL_CERT_FLAG_BROKEN_PROTOCOL)
4270 rv = CERT_PKEY_STRICT_FLAGS|CERT_PKEY_EXPLICIT_SIGN|CERT_PKEY_VALID|CERT_PKEY_SIGN;
4271 cpk->valid_flags = rv;
4280 idx = ssl_cert_type(x, pk);
4283 cpk = c->pkeys + idx;
4284 if (c->cert_flags & SSL_CERT_FLAGS_CHECK_TLS_STRICT)
4285 check_flags = CERT_PKEY_STRICT_FLAGS;
4287 check_flags = CERT_PKEY_VALID_FLAGS;
4295 check_flags |= CERT_PKEY_SUITEB;
4296 ok = X509_chain_check_suiteb(NULL, x, chain, suiteb_flags);
4297 if (ok == X509_V_OK)
4298 rv |= CERT_PKEY_SUITEB;
4299 else if (!check_flags)
4303 /* Check all signature algorithms are consistent with
4304 * signature algorithms extension if TLS 1.2 or later
4307 if (TLS1_get_version(s) >= TLS1_2_VERSION && strict_mode)
4310 unsigned char rsign = 0;
4311 if (c->peer_sigalgs)
4313 /* If no sigalgs extension use defaults from RFC5246 */
4318 case SSL_PKEY_RSA_ENC:
4319 case SSL_PKEY_RSA_SIGN:
4320 case SSL_PKEY_DH_RSA:
4321 rsign = TLSEXT_signature_rsa;
4322 default_nid = NID_sha1WithRSAEncryption;
4325 case SSL_PKEY_DSA_SIGN:
4326 case SSL_PKEY_DH_DSA:
4327 rsign = TLSEXT_signature_dsa;
4328 default_nid = NID_dsaWithSHA1;
4332 rsign = TLSEXT_signature_ecdsa;
4333 default_nid = NID_ecdsa_with_SHA1;
4341 /* If peer sent no signature algorithms extension and we
4342 * have set preferred signature algorithms check we support
4345 if (default_nid > 0 && c->conf_sigalgs)
4348 const unsigned char *p = c->conf_sigalgs;
4349 for (j = 0; j < c->conf_sigalgslen; j += 2, p += 2)
4351 if (p[0] == TLSEXT_hash_sha1 && p[1] == rsign)
4354 if (j == c->conf_sigalgslen)
4362 /* Check signature algorithm of each cert in chain */
4363 if (!tls1_check_sig_alg(c, x, default_nid))
4365 if (!check_flags) goto end;
4368 rv |= CERT_PKEY_EE_SIGNATURE;
4369 rv |= CERT_PKEY_CA_SIGNATURE;
4370 for (i = 0; i < sk_X509_num(chain); i++)
4372 if (!tls1_check_sig_alg(c, sk_X509_value(chain, i),
4377 rv &= ~CERT_PKEY_CA_SIGNATURE;
4385 /* Else not TLS 1.2, so mark EE and CA signing algorithms OK */
4386 else if(check_flags)
4387 rv |= CERT_PKEY_EE_SIGNATURE|CERT_PKEY_CA_SIGNATURE;
4389 /* Check cert parameters are consistent */
4390 if (tls1_check_cert_param(s, x, check_flags ? 1 : 2))
4391 rv |= CERT_PKEY_EE_PARAM;
4392 else if (!check_flags)
4395 rv |= CERT_PKEY_CA_PARAM;
4396 /* In strict mode check rest of chain too */
4397 else if (strict_mode)
4399 rv |= CERT_PKEY_CA_PARAM;
4400 for (i = 0; i < sk_X509_num(chain); i++)
4402 X509 *ca = sk_X509_value(chain, i);
4403 if (!tls1_check_cert_param(s, ca, 0))
4407 rv &= ~CERT_PKEY_CA_PARAM;
4415 if (!s->server && strict_mode)
4417 STACK_OF(X509_NAME) *ca_dn;
4422 check_type = TLS_CT_RSA_SIGN;
4425 check_type = TLS_CT_DSS_SIGN;
4428 check_type = TLS_CT_ECDSA_SIGN;
4433 int cert_type = X509_certificate_type(x, pk);
4434 if (cert_type & EVP_PKS_RSA)
4435 check_type = TLS_CT_RSA_FIXED_DH;
4436 if (cert_type & EVP_PKS_DSA)
4437 check_type = TLS_CT_DSS_FIXED_DH;
4442 const unsigned char *ctypes;
4447 ctypelen = (int)c->ctype_num;
4451 ctypes = (unsigned char *)s->s3->tmp.ctype;
4452 ctypelen = s->s3->tmp.ctype_num;
4454 for (i = 0; i < ctypelen; i++)
4456 if (ctypes[i] == check_type)
4458 rv |= CERT_PKEY_CERT_TYPE;
4462 if (!(rv & CERT_PKEY_CERT_TYPE) && !check_flags)
4466 rv |= CERT_PKEY_CERT_TYPE;
4469 ca_dn = s->s3->tmp.ca_names;
4471 if (!sk_X509_NAME_num(ca_dn))
4472 rv |= CERT_PKEY_ISSUER_NAME;
4474 if (!(rv & CERT_PKEY_ISSUER_NAME))
4476 if (ssl_check_ca_name(ca_dn, x))
4477 rv |= CERT_PKEY_ISSUER_NAME;
4479 if (!(rv & CERT_PKEY_ISSUER_NAME))
4481 for (i = 0; i < sk_X509_num(chain); i++)
4483 X509 *xtmp = sk_X509_value(chain, i);
4484 if (ssl_check_ca_name(ca_dn, xtmp))
4486 rv |= CERT_PKEY_ISSUER_NAME;
4491 if (!check_flags && !(rv & CERT_PKEY_ISSUER_NAME))
4495 rv |= CERT_PKEY_ISSUER_NAME|CERT_PKEY_CERT_TYPE;
4497 if (!check_flags || (rv & check_flags) == check_flags)
4498 rv |= CERT_PKEY_VALID;
4502 if (TLS1_get_version(s) >= TLS1_2_VERSION)
4504 if (cpk->valid_flags & CERT_PKEY_EXPLICIT_SIGN)
4505 rv |= CERT_PKEY_EXPLICIT_SIGN|CERT_PKEY_SIGN;
4506 else if (cpk->digest)
4507 rv |= CERT_PKEY_SIGN;
4510 rv |= CERT_PKEY_SIGN|CERT_PKEY_EXPLICIT_SIGN;
4512 /* When checking a CERT_PKEY structure all flags are irrelevant
4513 * if the chain is invalid.
4517 if (rv & CERT_PKEY_VALID)
4518 cpk->valid_flags = rv;
4521 /* Preserve explicit sign flag, clear rest */
4522 cpk->valid_flags &= CERT_PKEY_EXPLICIT_SIGN;
4529 /* Set validity of certificates in an SSL structure */
4530 void tls1_set_cert_validity(SSL *s)
4532 tls1_check_chain(s, NULL, NULL, NULL, SSL_PKEY_RSA_ENC);
4533 tls1_check_chain(s, NULL, NULL, NULL, SSL_PKEY_RSA_SIGN);
4534 tls1_check_chain(s, NULL, NULL, NULL, SSL_PKEY_DSA_SIGN);
4535 tls1_check_chain(s, NULL, NULL, NULL, SSL_PKEY_DH_RSA);
4536 tls1_check_chain(s, NULL, NULL, NULL, SSL_PKEY_DH_DSA);
4537 tls1_check_chain(s, NULL, NULL, NULL, SSL_PKEY_ECC);
4539 /* User level utiity function to check a chain is suitable */
4540 int SSL_check_chain(SSL *s, X509 *x, EVP_PKEY *pk, STACK_OF(X509) *chain)
4542 return tls1_check_chain(s, x, pk, chain, -1);
4547 #ifndef OPENSSL_NO_DH
4548 DH *ssl_get_auto_dh(SSL *s)
4550 int dh_secbits = 80;
4551 if (s->cert->dh_tmp_auto == 2)
4552 return DH_get_1024_160();
4553 if (s->s3->tmp.new_cipher->algorithm_auth & SSL_aNULL)
4555 if (s->s3->tmp.new_cipher->strength_bits == 256)
4562 CERT_PKEY *cpk = ssl_get_server_send_pkey(s);
4563 dh_secbits = EVP_PKEY_security_bits(cpk->privatekey);
4566 if (dh_secbits >= 128)
4573 BN_set_word(dhp->g, 2);
4574 if (dh_secbits >= 192)
4575 dhp->p = get_rfc3526_prime_8192(NULL);
4577 dhp->p = get_rfc3526_prime_3072(NULL);
4578 if (!dhp->p || !dhp->g)
4585 if (dh_secbits >= 112)
4586 return DH_get_2048_224();
4587 return DH_get_1024_160();
4591 static int ssl_security_cert_key(SSL *s, SSL_CTX *ctx, X509 *x, int op)
4594 EVP_PKEY *pkey = X509_get_pubkey(x);
4597 secbits = EVP_PKEY_security_bits(pkey);
4598 EVP_PKEY_free(pkey);
4603 return ssl_security(s, op, secbits, 0, x);
4605 return ssl_ctx_security(ctx, op, secbits, 0, x);
4608 static int ssl_security_cert_sig(SSL *s, SSL_CTX *ctx, X509 *x, int op)
4610 /* Lookup signature algorithm digest */
4611 int secbits = -1, md_nid = NID_undef, sig_nid;
4612 sig_nid = X509_get_signature_nid(x);
4613 if (sig_nid && OBJ_find_sigid_algs(sig_nid, &md_nid, NULL))
4616 if (md_nid && (md = EVP_get_digestbynid(md_nid)))
4617 secbits = EVP_MD_size(md) * 4;
4620 return ssl_security(s, op, secbits, md_nid, x);
4622 return ssl_ctx_security(ctx, op, secbits, md_nid, x);
4625 int ssl_security_cert(SSL *s, SSL_CTX *ctx, X509 *x, int vfy, int is_ee)
4628 vfy = SSL_SECOP_PEER;
4631 if (!ssl_security_cert_key(s, ctx, x, SSL_SECOP_EE_KEY | vfy))
4632 return SSL_R_EE_KEY_TOO_SMALL;
4636 if (!ssl_security_cert_key(s, ctx, x, SSL_SECOP_CA_KEY | vfy))
4637 return SSL_R_CA_KEY_TOO_SMALL;
4639 if (!ssl_security_cert_sig(s, ctx, x, SSL_SECOP_CA_MD | vfy))
4640 return SSL_R_CA_MD_TOO_WEAK;
4644 /* Check security of a chain, if sk includes the end entity certificate
4645 * then x is NULL. If vfy is 1 then we are verifying a peer chain and
4646 * not sending one to the peer.
4647 * Return values: 1 if ok otherwise error code to use
4650 int ssl_security_cert_chain(SSL *s, STACK_OF(X509) *sk, X509 *x, int vfy)
4652 int rv, start_idx, i;
4655 x = sk_X509_value(sk, 0);
4661 rv = ssl_security_cert(s, NULL, x, vfy, 1);
4665 for (i = start_idx; i < sk_X509_num(sk); i++)
4667 x = sk_X509_value(sk, i);
4668 rv = ssl_security_cert(s, NULL, x, vfy, 0);