1/* ssl/t1_lib.c */ 2/* Copyright (C) 1995-1998 Eric Young (eay@cryptsoft.com) 3 * All rights reserved. 4 * 5 * This package is an SSL implementation written 6 * by Eric Young (eay@cryptsoft.com). 7 * The implementation was written so as to conform with Netscapes SSL. 8 * 9 * This library is free for commercial and non-commercial use as long as 10 * the following conditions are aheared to. The following conditions 11 * apply to all code found in this distribution, be it the RC4, RSA, 12 * lhash, DES, etc., code; not just the SSL code. The SSL documentation 13 * included with this distribution is covered by the same copyright terms 14 * except that the holder is Tim Hudson (tjh@cryptsoft.com). 15 * 16 * Copyright remains Eric Young's, and as such any Copyright notices in 17 * the code are not to be removed. 18 * If this package is used in a product, Eric Young should be given attribution 19 * as the author of the parts of the library used. 20 * This can be in the form of a textual message at program startup or 21 * in documentation (online or textual) provided with the package. 22 * 23 * Redistribution and use in source and binary forms, with or without 24 * modification, are permitted provided that the following conditions 25 * are met: 26 * 1. Redistributions of source code must retain the copyright 27 * notice, this list of conditions and the following disclaimer. 28 * 2. Redistributions in binary form must reproduce the above copyright 29 * notice, this list of conditions and the following disclaimer in the 30 * documentation and/or other materials provided with the distribution. 31 * 3. All advertising materials mentioning features or use of this software 32 * must display the following acknowledgement: 33 * "This product includes cryptographic software written by 34 * Eric Young (eay@cryptsoft.com)" 35 * The word 'cryptographic' can be left out if the rouines from the library 36 * being used are not cryptographic related :-). 37 * 4. If you include any Windows specific code (or a derivative thereof) from 38 * the apps directory (application code) you must include an acknowledgement: 39 * "This product includes software written by Tim Hudson (tjh@cryptsoft.com)" 40 * 41 * THIS SOFTWARE IS PROVIDED BY ERIC YOUNG ``AS IS'' AND 42 * ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE 43 * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE 44 * ARE DISCLAIMED. IN NO EVENT SHALL THE AUTHOR OR CONTRIBUTORS BE LIABLE 45 * FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL 46 * DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS 47 * OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION) 48 * HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT 49 * LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY 50 * OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF 51 * SUCH DAMAGE. 52 * 53 * The licence and distribution terms for any publically available version or 54 * derivative of this code cannot be changed. i.e. this code cannot simply be 55 * copied and put under another distribution licence 56 * [including the GNU Public Licence.] 57 */ 58/* ==================================================================== 59 * Copyright (c) 1998-2007 The OpenSSL Project. All rights reserved. 60 * 61 * Redistribution and use in source and binary forms, with or without 62 * modification, are permitted provided that the following conditions 63 * are met: 64 * 65 * 1. Redistributions of source code must retain the above copyright 66 * notice, this list of conditions and the following disclaimer. 67 * 68 * 2. Redistributions in binary form must reproduce the above copyright 69 * notice, this list of conditions and the following disclaimer in 70 * the documentation and/or other materials provided with the 71 * distribution. 72 * 73 * 3. All advertising materials mentioning features or use of this 74 * software must display the following acknowledgment: 75 * "This product includes software developed by the OpenSSL Project 76 * for use in the OpenSSL Toolkit. (http://www.openssl.org/)" 77 * 78 * 4. The names "OpenSSL Toolkit" and "OpenSSL Project" must not be used to 79 * endorse or promote products derived from this software without 80 * prior written permission. For written permission, please contact 81 * openssl-core@openssl.org. 82 * 83 * 5. Products derived from this software may not be called "OpenSSL" 84 * nor may "OpenSSL" appear in their names without prior written 85 * permission of the OpenSSL Project. 86 * 87 * 6. Redistributions of any form whatsoever must retain the following 88 * acknowledgment: 89 * "This product includes software developed by the OpenSSL Project 90 * for use in the OpenSSL Toolkit (http://www.openssl.org/)" 91 * 92 * THIS SOFTWARE IS PROVIDED BY THE OpenSSL PROJECT ``AS IS'' AND ANY 93 * EXPRESSED OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE 94 * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR 95 * PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE OpenSSL PROJECT OR 96 * ITS CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, 97 * SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT 98 * NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; 99 * LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION) 100 * HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, 101 * STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) 102 * ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED 103 * OF THE POSSIBILITY OF SUCH DAMAGE. 104 * ==================================================================== 105 * 106 * This product includes cryptographic software written by Eric Young 107 * (eay@cryptsoft.com). This product includes software written by Tim 108 * Hudson (tjh@cryptsoft.com). 109 * 110 */ 111 112#include <stdio.h> 113#include <openssl/objects.h> 114#include <openssl/evp.h> 115#include <openssl/hmac.h> 116#include <openssl/ocsp.h> 117#include <openssl/rand.h> 118#include "ssl_locl.h" 119 120const char tls1_version_str[]="TLSv1" OPENSSL_VERSION_PTEXT; 121 122#ifndef OPENSSL_NO_TLSEXT 123static int tls_decrypt_ticket(SSL *s, const unsigned char *tick, int ticklen, 124 const unsigned char *sess_id, int sesslen, 125 SSL_SESSION **psess); 126#endif 127 128SSL3_ENC_METHOD TLSv1_enc_data={ 129 tls1_enc, 130 tls1_mac, 131 tls1_setup_key_block, 132 tls1_generate_master_secret, 133 tls1_change_cipher_state, 134 tls1_final_finish_mac, 135 TLS1_FINISH_MAC_LENGTH, 136 tls1_cert_verify_mac, 137 TLS_MD_CLIENT_FINISH_CONST,TLS_MD_CLIENT_FINISH_CONST_SIZE, 138 TLS_MD_SERVER_FINISH_CONST,TLS_MD_SERVER_FINISH_CONST_SIZE, 139 tls1_alert_code, 140 tls1_export_keying_material, 141 }; 142 143long tls1_default_timeout(void) 144 { 145 /* 2 hours, the 24 hours mentioned in the TLSv1 spec 146 * is way too long for http, the cache would over fill */ 147 return(60*60*2); 148 } 149 150int tls1_new(SSL *s) 151 { 152 if (!ssl3_new(s)) return(0); 153 s->method->ssl_clear(s); 154 return(1); 155 } 156 157void tls1_free(SSL *s) 158 { 159#ifndef OPENSSL_NO_TLSEXT 160 if (s->tlsext_session_ticket) 161 { 162 OPENSSL_free(s->tlsext_session_ticket); 163 } 164#endif /* OPENSSL_NO_TLSEXT */ 165 ssl3_free(s); 166 } 167 168void tls1_clear(SSL *s) 169 { 170 ssl3_clear(s); 171 s->version = s->method->version; 172 } 173 174#ifndef OPENSSL_NO_EC 175 176static int nid_list[] = 177 { 178 NID_sect163k1, /* sect163k1 (1) */ 179 NID_sect163r1, /* sect163r1 (2) */ 180 NID_sect163r2, /* sect163r2 (3) */ 181 NID_sect193r1, /* sect193r1 (4) */ 182 NID_sect193r2, /* sect193r2 (5) */ 183 NID_sect233k1, /* sect233k1 (6) */ 184 NID_sect233r1, /* sect233r1 (7) */ 185 NID_sect239k1, /* sect239k1 (8) */ 186 NID_sect283k1, /* sect283k1 (9) */ 187 NID_sect283r1, /* sect283r1 (10) */ 188 NID_sect409k1, /* sect409k1 (11) */ 189 NID_sect409r1, /* sect409r1 (12) */ 190 NID_sect571k1, /* sect571k1 (13) */ 191 NID_sect571r1, /* sect571r1 (14) */ 192 NID_secp160k1, /* secp160k1 (15) */ 193 NID_secp160r1, /* secp160r1 (16) */ 194 NID_secp160r2, /* secp160r2 (17) */ 195 NID_secp192k1, /* secp192k1 (18) */ 196 NID_X9_62_prime192v1, /* secp192r1 (19) */ 197 NID_secp224k1, /* secp224k1 (20) */ 198 NID_secp224r1, /* secp224r1 (21) */ 199 NID_secp256k1, /* secp256k1 (22) */ 200 NID_X9_62_prime256v1, /* secp256r1 (23) */ 201 NID_secp384r1, /* secp384r1 (24) */ 202 NID_secp521r1 /* secp521r1 (25) */ 203 }; 204 205/* We support only the elliptic curves that are also supported by NSS 206 * to improve compatibility with sites that don't accept large ClientHellos. 207 */ 208static int pref_list[] = 209 { 210 NID_secp521r1, /* secp521r1 (25) */ 211 NID_secp384r1, /* secp384r1 (24) */ 212 NID_X9_62_prime256v1, /* secp256r1 (23) */ 213 }; 214 215int tls1_ec_curve_id2nid(int curve_id) 216 { 217 /* ECC curves from draft-ietf-tls-ecc-12.txt (Oct. 17, 2005) */ 218 if ((curve_id < 1) || ((unsigned int)curve_id > 219 sizeof(nid_list)/sizeof(nid_list[0]))) 220 return 0; 221 return nid_list[curve_id-1]; 222 } 223 224int tls1_ec_nid2curve_id(int nid) 225 { 226 /* ECC curves from draft-ietf-tls-ecc-12.txt (Oct. 17, 2005) */ 227 switch (nid) 228 { 229 case NID_sect163k1: /* sect163k1 (1) */ 230 return 1; 231 case NID_sect163r1: /* sect163r1 (2) */ 232 return 2; 233 case NID_sect163r2: /* sect163r2 (3) */ 234 return 3; 235 case NID_sect193r1: /* sect193r1 (4) */ 236 return 4; 237 case NID_sect193r2: /* sect193r2 (5) */ 238 return 5; 239 case NID_sect233k1: /* sect233k1 (6) */ 240 return 6; 241 case NID_sect233r1: /* sect233r1 (7) */ 242 return 7; 243 case NID_sect239k1: /* sect239k1 (8) */ 244 return 8; 245 case NID_sect283k1: /* sect283k1 (9) */ 246 return 9; 247 case NID_sect283r1: /* sect283r1 (10) */ 248 return 10; 249 case NID_sect409k1: /* sect409k1 (11) */ 250 return 11; 251 case NID_sect409r1: /* sect409r1 (12) */ 252 return 12; 253 case NID_sect571k1: /* sect571k1 (13) */ 254 return 13; 255 case NID_sect571r1: /* sect571r1 (14) */ 256 return 14; 257 case NID_secp160k1: /* secp160k1 (15) */ 258 return 15; 259 case NID_secp160r1: /* secp160r1 (16) */ 260 return 16; 261 case NID_secp160r2: /* secp160r2 (17) */ 262 return 17; 263 case NID_secp192k1: /* secp192k1 (18) */ 264 return 18; 265 case NID_X9_62_prime192v1: /* secp192r1 (19) */ 266 return 19; 267 case NID_secp224k1: /* secp224k1 (20) */ 268 return 20; 269 case NID_secp224r1: /* secp224r1 (21) */ 270 return 21; 271 case NID_secp256k1: /* secp256k1 (22) */ 272 return 22; 273 case NID_X9_62_prime256v1: /* secp256r1 (23) */ 274 return 23; 275 case NID_secp384r1: /* secp384r1 (24) */ 276 return 24; 277 case NID_secp521r1: /* secp521r1 (25) */ 278 return 25; 279 default: 280 return 0; 281 } 282 } 283#endif /* OPENSSL_NO_EC */ 284 285#ifndef OPENSSL_NO_TLSEXT 286 287/* List of supported signature algorithms and hashes. Should make this 288 * customisable at some point, for now include everything we support. 289 */ 290 291#ifdef OPENSSL_NO_RSA 292#define tlsext_sigalg_rsa(md) /* */ 293#else 294#define tlsext_sigalg_rsa(md) md, TLSEXT_signature_rsa, 295#endif 296 297#ifdef OPENSSL_NO_DSA 298#define tlsext_sigalg_dsa(md) /* */ 299#else 300#define tlsext_sigalg_dsa(md) md, TLSEXT_signature_dsa, 301#endif 302 303#ifdef OPENSSL_NO_ECDSA 304#define tlsext_sigalg_ecdsa(md) /* */ 305#else 306#define tlsext_sigalg_ecdsa(md) md, TLSEXT_signature_ecdsa, 307#endif 308 309#define tlsext_sigalg(md) \ 310 tlsext_sigalg_rsa(md) \ 311 tlsext_sigalg_dsa(md) \ 312 tlsext_sigalg_ecdsa(md) 313 314static unsigned char tls12_sigalgs[] = { 315#ifndef OPENSSL_NO_SHA512 316 tlsext_sigalg(TLSEXT_hash_sha512) 317 tlsext_sigalg(TLSEXT_hash_sha384) 318#endif 319#ifndef OPENSSL_NO_SHA256 320 tlsext_sigalg(TLSEXT_hash_sha256) 321 tlsext_sigalg(TLSEXT_hash_sha224) 322#endif 323#ifndef OPENSSL_NO_SHA 324 tlsext_sigalg(TLSEXT_hash_sha1) 325#endif 326#ifndef OPENSSL_NO_MD5 327 tlsext_sigalg_rsa(TLSEXT_hash_md5) 328#endif 329}; 330 331int tls12_get_req_sig_algs(SSL *s, unsigned char *p) 332 { 333 size_t slen = sizeof(tls12_sigalgs); 334#ifdef OPENSSL_FIPS 335 /* If FIPS mode don't include MD5 which is last */ 336 if (FIPS_mode()) 337 slen -= 2; 338#endif 339 if (p) 340 memcpy(p, tls12_sigalgs, slen); 341 return (int)slen; 342 } 343 344/* header_len is the length of the ClientHello header written so far, used to 345 * compute padding. It does not include the record header. Pass 0 if no padding 346 * is to be done. */ 347unsigned char *ssl_add_clienthello_tlsext(SSL *s, unsigned char *buf, unsigned char *limit, size_t header_len) 348 { 349 int extdatalen=0; 350 unsigned char *orig = buf; 351 unsigned char *ret = buf; 352 353 /* don't add extensions for SSLv3 unless doing secure renegotiation */ 354 if (s->client_version == SSL3_VERSION 355 && !s->s3->send_connection_binding) 356 return orig; 357 358 ret+=2; 359 360 if (ret>=limit) return NULL; /* this really never occurs, but ... */ 361 362 if (s->tlsext_hostname != NULL) 363 { 364 /* Add TLS extension servername to the Client Hello message */ 365 unsigned long size_str; 366 long lenmax; 367 368 /* check for enough space. 369 4 for the servername type and entension length 370 2 for servernamelist length 371 1 for the hostname type 372 2 for hostname length 373 + hostname length 374 */ 375 376 if ((lenmax = limit - ret - 9) < 0 377 || (size_str = strlen(s->tlsext_hostname)) > (unsigned long)lenmax) 378 return NULL; 379 380 /* extension type and length */ 381 s2n(TLSEXT_TYPE_server_name,ret); 382 s2n(size_str+5,ret); 383 384 /* length of servername list */ 385 s2n(size_str+3,ret); 386 387 /* hostname type, length and hostname */ 388 *(ret++) = (unsigned char) TLSEXT_NAMETYPE_host_name; 389 s2n(size_str,ret); 390 memcpy(ret, s->tlsext_hostname, size_str); 391 ret+=size_str; 392 } 393 394 /* Add RI if renegotiating */ 395 if (s->renegotiate) 396 { 397 int el; 398 399 if(!ssl_add_clienthello_renegotiate_ext(s, 0, &el, 0)) 400 { 401 SSLerr(SSL_F_SSL_ADD_CLIENTHELLO_TLSEXT, ERR_R_INTERNAL_ERROR); 402 return NULL; 403 } 404 405 if((limit - ret - 4 - el) < 0) return NULL; 406 407 s2n(TLSEXT_TYPE_renegotiate,ret); 408 s2n(el,ret); 409 410 if(!ssl_add_clienthello_renegotiate_ext(s, ret, &el, el)) 411 { 412 SSLerr(SSL_F_SSL_ADD_CLIENTHELLO_TLSEXT, ERR_R_INTERNAL_ERROR); 413 return NULL; 414 } 415 416 ret += el; 417 } 418 419#ifndef OPENSSL_NO_SRP 420 /* Add SRP username if there is one */ 421 if (s->srp_ctx.login != NULL) 422 { /* Add TLS extension SRP username to the Client Hello message */ 423 424 int login_len = strlen(s->srp_ctx.login); 425 if (login_len > 255 || login_len == 0) 426 { 427 SSLerr(SSL_F_SSL_ADD_CLIENTHELLO_TLSEXT, ERR_R_INTERNAL_ERROR); 428 return NULL; 429 } 430 431 /* check for enough space. 432 4 for the srp type type and entension length 433 1 for the srp user identity 434 + srp user identity length 435 */ 436 if ((limit - ret - 5 - login_len) < 0) return NULL; 437 438 /* fill in the extension */ 439 s2n(TLSEXT_TYPE_srp,ret); 440 s2n(login_len+1,ret); 441 (*ret++) = (unsigned char) login_len; 442 memcpy(ret, s->srp_ctx.login, login_len); 443 ret+=login_len; 444 } 445#endif 446 447 if (!(SSL_get_options(s) & SSL_OP_NO_TICKET)) 448 { 449 int ticklen; 450 if (!s->new_session && s->session && s->session->tlsext_tick) 451 ticklen = s->session->tlsext_ticklen; 452 else if (s->session && s->tlsext_session_ticket && 453 s->tlsext_session_ticket->data) 454 { 455 ticklen = s->tlsext_session_ticket->length; 456 s->session->tlsext_tick = OPENSSL_malloc(ticklen); 457 if (!s->session->tlsext_tick) 458 return NULL; 459 memcpy(s->session->tlsext_tick, 460 s->tlsext_session_ticket->data, 461 ticklen); 462 s->session->tlsext_ticklen = ticklen; 463 } 464 else 465 ticklen = 0; 466 if (ticklen == 0 && s->tlsext_session_ticket && 467 s->tlsext_session_ticket->data == NULL) 468 goto skip_ext; 469 /* Check for enough room 2 for extension type, 2 for len 470 * rest for ticket 471 */ 472 if ((long)(limit - ret - 4 - ticklen) < 0) return NULL; 473 s2n(TLSEXT_TYPE_session_ticket,ret); 474 s2n(ticklen,ret); 475 if (ticklen) 476 { 477 memcpy(ret, s->session->tlsext_tick, ticklen); 478 ret += ticklen; 479 } 480 } 481 skip_ext: 482 483 if (TLS1_get_client_version(s) >= TLS1_2_VERSION) 484 { 485 if ((size_t)(limit - ret) < sizeof(tls12_sigalgs) + 6) 486 return NULL; 487 s2n(TLSEXT_TYPE_signature_algorithms,ret); 488 s2n(sizeof(tls12_sigalgs) + 2, ret); 489 s2n(sizeof(tls12_sigalgs), ret); 490 memcpy(ret, tls12_sigalgs, sizeof(tls12_sigalgs)); 491 ret += sizeof(tls12_sigalgs); 492 } 493 494#ifdef TLSEXT_TYPE_opaque_prf_input 495 if (s->s3->client_opaque_prf_input != NULL && 496 s->version != DTLS1_VERSION) 497 { 498 size_t col = s->s3->client_opaque_prf_input_len; 499 500 if ((long)(limit - ret - 6 - col < 0)) 501 return NULL; 502 if (col > 0xFFFD) /* can't happen */ 503 return NULL; 504 505 s2n(TLSEXT_TYPE_opaque_prf_input, ret); 506 s2n(col + 2, ret); 507 s2n(col, ret); 508 memcpy(ret, s->s3->client_opaque_prf_input, col); 509 ret += col; 510 } 511#endif 512 513 if (s->tlsext_status_type == TLSEXT_STATUSTYPE_ocsp && 514 s->version != DTLS1_VERSION) 515 { 516 int i; 517 long extlen, idlen, itmp; 518 OCSP_RESPID *id; 519 520 idlen = 0; 521 for (i = 0; i < sk_OCSP_RESPID_num(s->tlsext_ocsp_ids); i++) 522 { 523 id = sk_OCSP_RESPID_value(s->tlsext_ocsp_ids, i); 524 itmp = i2d_OCSP_RESPID(id, NULL); 525 if (itmp <= 0) 526 return NULL; 527 idlen += itmp + 2; 528 } 529 530 if (s->tlsext_ocsp_exts) 531 { 532 extlen = i2d_X509_EXTENSIONS(s->tlsext_ocsp_exts, NULL); 533 if (extlen < 0) 534 return NULL; 535 } 536 else 537 extlen = 0; 538 539 if ((long)(limit - ret - 7 - extlen - idlen) < 0) return NULL; 540 s2n(TLSEXT_TYPE_status_request, ret); 541 if (extlen + idlen > 0xFFF0) 542 return NULL; 543 s2n(extlen + idlen + 5, ret); 544 *(ret++) = TLSEXT_STATUSTYPE_ocsp; 545 s2n(idlen, ret); 546 for (i = 0; i < sk_OCSP_RESPID_num(s->tlsext_ocsp_ids); i++) 547 { 548 /* save position of id len */ 549 unsigned char *q = ret; 550 id = sk_OCSP_RESPID_value(s->tlsext_ocsp_ids, i); 551 /* skip over id len */ 552 ret += 2; 553 itmp = i2d_OCSP_RESPID(id, &ret); 554 /* write id len */ 555 s2n(itmp, q); 556 } 557 s2n(extlen, ret); 558 if (extlen > 0) 559 i2d_X509_EXTENSIONS(s->tlsext_ocsp_exts, &ret); 560 } 561 562#ifndef OPENSSL_NO_HEARTBEATS 563 /* Add Heartbeat extension */ 564 s2n(TLSEXT_TYPE_heartbeat,ret); 565 s2n(1,ret); 566 /* Set mode: 567 * 1: peer may send requests 568 * 2: peer not allowed to send requests 569 */ 570 if (s->tlsext_heartbeat & SSL_TLSEXT_HB_DONT_RECV_REQUESTS) 571 *(ret++) = SSL_TLSEXT_HB_DONT_SEND_REQUESTS; 572 else 573 *(ret++) = SSL_TLSEXT_HB_ENABLED; 574#endif 575 576#ifndef OPENSSL_NO_NEXTPROTONEG 577 if (s->ctx->next_proto_select_cb && !s->s3->tmp.finish_md_len) 578 { 579 /* The client advertises an emtpy extension to indicate its 580 * support for Next Protocol Negotiation */ 581 if (limit - ret - 4 < 0) 582 return NULL; 583 s2n(TLSEXT_TYPE_next_proto_neg,ret); 584 s2n(0,ret); 585 } 586#endif 587 588 if (s->tlsext_channel_id_enabled) 589 { 590 /* The client advertises an emtpy extension to indicate its 591 * support for Channel ID. */ 592 if (limit - ret - 4 < 0) 593 return NULL; 594 s2n(TLSEXT_TYPE_channel_id,ret); 595 s2n(0,ret); 596 } 597 598#ifndef OPENSSL_NO_SRTP 599 if(SSL_get_srtp_profiles(s)) 600 { 601 int el; 602 603 ssl_add_clienthello_use_srtp_ext(s, 0, &el, 0); 604 605 if((limit - ret - 4 - el) < 0) return NULL; 606 607 s2n(TLSEXT_TYPE_use_srtp,ret); 608 s2n(el,ret); 609 610 if(ssl_add_clienthello_use_srtp_ext(s, ret, &el, el)) 611 { 612 SSLerr(SSL_F_SSL_ADD_CLIENTHELLO_TLSEXT, ERR_R_INTERNAL_ERROR); 613 return NULL; 614 } 615 ret += el; 616 } 617#endif 618 619#ifndef OPENSSL_NO_EC 620 /* WebSphere Application Server 7.0 is intolerant to the last extension 621 * being zero-length. ECC extensions are non-empty and not dropped until 622 * fallback to SSL3, at which point all extensions are gone. */ 623 if (s->tlsext_ecpointformatlist != NULL && 624 s->version != DTLS1_VERSION) 625 { 626 /* Add TLS extension ECPointFormats to the ClientHello message */ 627 long lenmax; 628 629 if ((lenmax = limit - ret - 5) < 0) return NULL; 630 if (s->tlsext_ecpointformatlist_length > (unsigned long)lenmax) return NULL; 631 if (s->tlsext_ecpointformatlist_length > 255) 632 { 633 SSLerr(SSL_F_SSL_ADD_CLIENTHELLO_TLSEXT, ERR_R_INTERNAL_ERROR); 634 return NULL; 635 } 636 637 s2n(TLSEXT_TYPE_ec_point_formats,ret); 638 s2n(s->tlsext_ecpointformatlist_length + 1,ret); 639 *(ret++) = (unsigned char) s->tlsext_ecpointformatlist_length; 640 memcpy(ret, s->tlsext_ecpointformatlist, s->tlsext_ecpointformatlist_length); 641 ret+=s->tlsext_ecpointformatlist_length; 642 } 643 if (s->tlsext_ellipticcurvelist != NULL && 644 s->version != DTLS1_VERSION) 645 { 646 /* Add TLS extension EllipticCurves to the ClientHello message */ 647 long lenmax; 648 649 if ((lenmax = limit - ret - 6) < 0) return NULL; 650 if (s->tlsext_ellipticcurvelist_length > (unsigned long)lenmax) return NULL; 651 if (s->tlsext_ellipticcurvelist_length > 65532) 652 { 653 SSLerr(SSL_F_SSL_ADD_CLIENTHELLO_TLSEXT, ERR_R_INTERNAL_ERROR); 654 return NULL; 655 } 656 657 s2n(TLSEXT_TYPE_elliptic_curves,ret); 658 s2n(s->tlsext_ellipticcurvelist_length + 2, ret); 659 660 /* NB: draft-ietf-tls-ecc-12.txt uses a one-byte prefix for 661 * elliptic_curve_list, but the examples use two bytes. 662 * http://www1.ietf.org/mail-archive/web/tls/current/msg00538.html 663 * resolves this to two bytes. 664 */ 665 s2n(s->tlsext_ellipticcurvelist_length, ret); 666 memcpy(ret, s->tlsext_ellipticcurvelist, s->tlsext_ellipticcurvelist_length); 667 ret+=s->tlsext_ellipticcurvelist_length; 668 } 669#endif /* OPENSSL_NO_EC */ 670 671 /* Add padding to workaround bugs in F5 terminators. 672 * See https://tools.ietf.org/html/draft-agl-tls-padding-02 */ 673 if (header_len > 0) 674 { 675 header_len += ret - orig; 676 if (header_len > 0xff && header_len < 0x200) 677 { 678 size_t padding_len = 0x200 - header_len; 679 /* Extensions take at least four bytes to encode. Always 680 * include least one byte of data if including the 681 * extension. WebSphere Application Server 7.0 is 682 * intolerant to the last extension being zero-length. */ 683 if (padding_len >= 4 + 1) 684 padding_len -= 4; 685 else 686 padding_len = 1; 687 if (limit - ret - 4 - (long)padding_len < 0) 688 return NULL; 689 690 s2n(TLSEXT_TYPE_padding, ret); 691 s2n(padding_len, ret); 692 memset(ret, 0, padding_len); 693 ret += padding_len; 694 } 695 } 696 697 698 if ((extdatalen = ret-orig-2)== 0) 699 return orig; 700 701 s2n(extdatalen, orig); 702 return ret; 703 } 704 705unsigned char *ssl_add_serverhello_tlsext(SSL *s, unsigned char *buf, unsigned char *limit) 706 { 707 int extdatalen=0; 708 unsigned char *orig = buf; 709 unsigned char *ret = buf; 710#ifndef OPENSSL_NO_NEXTPROTONEG 711 int next_proto_neg_seen; 712#endif 713 714 /* don't add extensions for SSLv3, unless doing secure renegotiation */ 715 if (s->version == SSL3_VERSION && !s->s3->send_connection_binding) 716 return orig; 717 718 ret+=2; 719 if (ret>=limit) return NULL; /* this really never occurs, but ... */ 720 721 if (!s->hit && s->servername_done == 1 && s->session->tlsext_hostname != NULL) 722 { 723 if ((long)(limit - ret - 4) < 0) return NULL; 724 725 s2n(TLSEXT_TYPE_server_name,ret); 726 s2n(0,ret); 727 } 728 729 if(s->s3->send_connection_binding) 730 { 731 int el; 732 733 if(!ssl_add_serverhello_renegotiate_ext(s, 0, &el, 0)) 734 { 735 SSLerr(SSL_F_SSL_ADD_SERVERHELLO_TLSEXT, ERR_R_INTERNAL_ERROR); 736 return NULL; 737 } 738 739 if((limit - ret - 4 - el) < 0) return NULL; 740 741 s2n(TLSEXT_TYPE_renegotiate,ret); 742 s2n(el,ret); 743 744 if(!ssl_add_serverhello_renegotiate_ext(s, ret, &el, el)) 745 { 746 SSLerr(SSL_F_SSL_ADD_SERVERHELLO_TLSEXT, ERR_R_INTERNAL_ERROR); 747 return NULL; 748 } 749 750 ret += el; 751 } 752 753#ifndef OPENSSL_NO_EC 754 if (s->tlsext_ecpointformatlist != NULL && 755 s->version != DTLS1_VERSION) 756 { 757 /* Add TLS extension ECPointFormats to the ServerHello message */ 758 long lenmax; 759 760 if ((lenmax = limit - ret - 5) < 0) return NULL; 761 if (s->tlsext_ecpointformatlist_length > (unsigned long)lenmax) return NULL; 762 if (s->tlsext_ecpointformatlist_length > 255) 763 { 764 SSLerr(SSL_F_SSL_ADD_SERVERHELLO_TLSEXT, ERR_R_INTERNAL_ERROR); 765 return NULL; 766 } 767 768 s2n(TLSEXT_TYPE_ec_point_formats,ret); 769 s2n(s->tlsext_ecpointformatlist_length + 1,ret); 770 *(ret++) = (unsigned char) s->tlsext_ecpointformatlist_length; 771 memcpy(ret, s->tlsext_ecpointformatlist, s->tlsext_ecpointformatlist_length); 772 ret+=s->tlsext_ecpointformatlist_length; 773 774 } 775 /* Currently the server should not respond with a SupportedCurves extension */ 776#endif /* OPENSSL_NO_EC */ 777 778 if (s->tlsext_ticket_expected 779 && !(SSL_get_options(s) & SSL_OP_NO_TICKET)) 780 { 781 if ((long)(limit - ret - 4) < 0) return NULL; 782 s2n(TLSEXT_TYPE_session_ticket,ret); 783 s2n(0,ret); 784 } 785 786 if (s->tlsext_status_expected) 787 { 788 if ((long)(limit - ret - 4) < 0) return NULL; 789 s2n(TLSEXT_TYPE_status_request,ret); 790 s2n(0,ret); 791 } 792 793#ifdef TLSEXT_TYPE_opaque_prf_input 794 if (s->s3->server_opaque_prf_input != NULL && 795 s->version != DTLS1_VERSION) 796 { 797 size_t sol = s->s3->server_opaque_prf_input_len; 798 799 if ((long)(limit - ret - 6 - sol) < 0) 800 return NULL; 801 if (sol > 0xFFFD) /* can't happen */ 802 return NULL; 803 804 s2n(TLSEXT_TYPE_opaque_prf_input, ret); 805 s2n(sol + 2, ret); 806 s2n(sol, ret); 807 memcpy(ret, s->s3->server_opaque_prf_input, sol); 808 ret += sol; 809 } 810#endif 811 812#ifndef OPENSSL_NO_SRTP 813 if(s->srtp_profile) 814 { 815 int el; 816 817 ssl_add_serverhello_use_srtp_ext(s, 0, &el, 0); 818 819 if((limit - ret - 4 - el) < 0) return NULL; 820 821 s2n(TLSEXT_TYPE_use_srtp,ret); 822 s2n(el,ret); 823 824 if(ssl_add_serverhello_use_srtp_ext(s, ret, &el, el)) 825 { 826 SSLerr(SSL_F_SSL_ADD_SERVERHELLO_TLSEXT, ERR_R_INTERNAL_ERROR); 827 return NULL; 828 } 829 ret+=el; 830 } 831#endif 832 833 if (((s->s3->tmp.new_cipher->id & 0xFFFF)==0x80 || (s->s3->tmp.new_cipher->id & 0xFFFF)==0x81) 834 && (SSL_get_options(s) & SSL_OP_CRYPTOPRO_TLSEXT_BUG)) 835 { const unsigned char cryptopro_ext[36] = { 836 0xfd, 0xe8, /*65000*/ 837 0x00, 0x20, /*32 bytes length*/ 838 0x30, 0x1e, 0x30, 0x08, 0x06, 0x06, 0x2a, 0x85, 839 0x03, 0x02, 0x02, 0x09, 0x30, 0x08, 0x06, 0x06, 840 0x2a, 0x85, 0x03, 0x02, 0x02, 0x16, 0x30, 0x08, 841 0x06, 0x06, 0x2a, 0x85, 0x03, 0x02, 0x02, 0x17}; 842 if (limit-ret<36) return NULL; 843 memcpy(ret,cryptopro_ext,36); 844 ret+=36; 845 846 } 847 848#ifndef OPENSSL_NO_HEARTBEATS 849 /* Add Heartbeat extension if we've received one */ 850 if (s->tlsext_heartbeat & SSL_TLSEXT_HB_ENABLED) 851 { 852 s2n(TLSEXT_TYPE_heartbeat,ret); 853 s2n(1,ret); 854 /* Set mode: 855 * 1: peer may send requests 856 * 2: peer not allowed to send requests 857 */ 858 if (s->tlsext_heartbeat & SSL_TLSEXT_HB_DONT_RECV_REQUESTS) 859 *(ret++) = SSL_TLSEXT_HB_DONT_SEND_REQUESTS; 860 else 861 *(ret++) = SSL_TLSEXT_HB_ENABLED; 862 863 } 864#endif 865 866#ifndef OPENSSL_NO_NEXTPROTONEG 867 next_proto_neg_seen = s->s3->next_proto_neg_seen; 868 s->s3->next_proto_neg_seen = 0; 869 if (next_proto_neg_seen && s->ctx->next_protos_advertised_cb) 870 { 871 const unsigned char *npa; 872 unsigned int npalen; 873 int r; 874 875 r = s->ctx->next_protos_advertised_cb(s, &npa, &npalen, s->ctx->next_protos_advertised_cb_arg); 876 if (r == SSL_TLSEXT_ERR_OK) 877 { 878 if ((long)(limit - ret - 4 - npalen) < 0) return NULL; 879 s2n(TLSEXT_TYPE_next_proto_neg,ret); 880 s2n(npalen,ret); 881 memcpy(ret, npa, npalen); 882 ret += npalen; 883 s->s3->next_proto_neg_seen = 1; 884 } 885 } 886#endif 887 888 /* If the client advertised support for Channel ID, and we have it 889 * enabled, then we want to echo it back. */ 890 if (s->s3->tlsext_channel_id_valid) 891 { 892 if (limit - ret - 4 < 0) 893 return NULL; 894 s2n(TLSEXT_TYPE_channel_id,ret); 895 s2n(0,ret); 896 } 897 898 if ((extdatalen = ret-orig-2)== 0) 899 return orig; 900 901 s2n(extdatalen, orig); 902 return ret; 903 } 904 905int ssl_parse_clienthello_tlsext(SSL *s, unsigned char **p, unsigned char *d, int n, int *al) 906 { 907 unsigned short type; 908 unsigned short size; 909 unsigned short len; 910 unsigned char *data = *p; 911 int renegotiate_seen = 0; 912 int sigalg_seen = 0; 913 914 s->servername_done = 0; 915 s->tlsext_status_type = -1; 916#ifndef OPENSSL_NO_NEXTPROTONEG 917 s->s3->next_proto_neg_seen = 0; 918#endif 919 920#ifndef OPENSSL_NO_HEARTBEATS 921 s->tlsext_heartbeat &= ~(SSL_TLSEXT_HB_ENABLED | 922 SSL_TLSEXT_HB_DONT_SEND_REQUESTS); 923#endif 924 925 if (data >= (d+n-2)) 926 goto ri_check; 927 n2s(data,len); 928 929 if (data > (d+n-len)) 930 goto ri_check; 931 932 while (data <= (d+n-4)) 933 { 934 n2s(data,type); 935 n2s(data,size); 936 937 if (data+size > (d+n)) 938 goto ri_check; 939#if 0 940 fprintf(stderr,"Received extension type %d size %d\n",type,size); 941#endif 942 if (s->tlsext_debug_cb) 943 s->tlsext_debug_cb(s, 0, type, data, size, 944 s->tlsext_debug_arg); 945/* The servername extension is treated as follows: 946 947 - Only the hostname type is supported with a maximum length of 255. 948 - The servername is rejected if too long or if it contains zeros, 949 in which case an fatal alert is generated. 950 - The servername field is maintained together with the session cache. 951 - When a session is resumed, the servername call back invoked in order 952 to allow the application to position itself to the right context. 953 - The servername is acknowledged if it is new for a session or when 954 it is identical to a previously used for the same session. 955 Applications can control the behaviour. They can at any time 956 set a 'desirable' servername for a new SSL object. This can be the 957 case for example with HTTPS when a Host: header field is received and 958 a renegotiation is requested. In this case, a possible servername 959 presented in the new client hello is only acknowledged if it matches 960 the value of the Host: field. 961 - Applications must use SSL_OP_NO_SESSION_RESUMPTION_ON_RENEGOTIATION 962 if they provide for changing an explicit servername context for the session, 963 i.e. when the session has been established with a servername extension. 964 - On session reconnect, the servername extension may be absent. 965 966*/ 967 968 if (type == TLSEXT_TYPE_server_name) 969 { 970 unsigned char *sdata; 971 int servname_type; 972 int dsize; 973 974 if (size < 2) 975 { 976 *al = SSL_AD_DECODE_ERROR; 977 return 0; 978 } 979 n2s(data,dsize); 980 size -= 2; 981 if (dsize > size ) 982 { 983 *al = SSL_AD_DECODE_ERROR; 984 return 0; 985 } 986 987 sdata = data; 988 while (dsize > 3) 989 { 990 servname_type = *(sdata++); 991 n2s(sdata,len); 992 dsize -= 3; 993 994 if (len > dsize) 995 { 996 *al = SSL_AD_DECODE_ERROR; 997 return 0; 998 } 999 if (s->servername_done == 0) 1000 switch (servname_type) 1001 { 1002 case TLSEXT_NAMETYPE_host_name: 1003 if (!s->hit) 1004 { 1005 if(s->session->tlsext_hostname) 1006 { 1007 *al = SSL_AD_DECODE_ERROR; 1008 return 0; 1009 } 1010 if (len > TLSEXT_MAXLEN_host_name) 1011 { 1012 *al = TLS1_AD_UNRECOGNIZED_NAME; 1013 return 0; 1014 } 1015 if ((s->session->tlsext_hostname = OPENSSL_malloc(len+1)) == NULL) 1016 { 1017 *al = TLS1_AD_INTERNAL_ERROR; 1018 return 0; 1019 } 1020 memcpy(s->session->tlsext_hostname, sdata, len); 1021 s->session->tlsext_hostname[len]='\0'; 1022 if (strlen(s->session->tlsext_hostname) != len) { 1023 OPENSSL_free(s->session->tlsext_hostname); 1024 s->session->tlsext_hostname = NULL; 1025 *al = TLS1_AD_UNRECOGNIZED_NAME; 1026 return 0; 1027 } 1028 s->servername_done = 1; 1029 1030 } 1031 else 1032 s->servername_done = s->session->tlsext_hostname 1033 && strlen(s->session->tlsext_hostname) == len 1034 && strncmp(s->session->tlsext_hostname, (char *)sdata, len) == 0; 1035 1036 break; 1037 1038 default: 1039 break; 1040 } 1041 1042 dsize -= len; 1043 } 1044 if (dsize != 0) 1045 { 1046 *al = SSL_AD_DECODE_ERROR; 1047 return 0; 1048 } 1049 1050 } 1051#ifndef OPENSSL_NO_SRP 1052 else if (type == TLSEXT_TYPE_srp) 1053 { 1054 if (size <= 0 || ((len = data[0])) != (size -1)) 1055 { 1056 *al = SSL_AD_DECODE_ERROR; 1057 return 0; 1058 } 1059 if (s->srp_ctx.login != NULL) 1060 { 1061 *al = SSL_AD_DECODE_ERROR; 1062 return 0; 1063 } 1064 if ((s->srp_ctx.login = OPENSSL_malloc(len+1)) == NULL) 1065 return -1; 1066 memcpy(s->srp_ctx.login, &data[1], len); 1067 s->srp_ctx.login[len]='\0'; 1068 1069 if (strlen(s->srp_ctx.login) != len) 1070 { 1071 *al = SSL_AD_DECODE_ERROR; 1072 return 0; 1073 } 1074 } 1075#endif 1076 1077#ifndef OPENSSL_NO_EC 1078 else if (type == TLSEXT_TYPE_ec_point_formats && 1079 s->version != DTLS1_VERSION) 1080 { 1081 unsigned char *sdata = data; 1082 int ecpointformatlist_length = *(sdata++); 1083 1084 if (ecpointformatlist_length != size - 1) 1085 { 1086 *al = TLS1_AD_DECODE_ERROR; 1087 return 0; 1088 } 1089 if (!s->hit) 1090 { 1091 if(s->session->tlsext_ecpointformatlist) 1092 { 1093 OPENSSL_free(s->session->tlsext_ecpointformatlist); 1094 s->session->tlsext_ecpointformatlist = NULL; 1095 } 1096 s->session->tlsext_ecpointformatlist_length = 0; 1097 if ((s->session->tlsext_ecpointformatlist = OPENSSL_malloc(ecpointformatlist_length)) == NULL) 1098 { 1099 *al = TLS1_AD_INTERNAL_ERROR; 1100 return 0; 1101 } 1102 s->session->tlsext_ecpointformatlist_length = ecpointformatlist_length; 1103 memcpy(s->session->tlsext_ecpointformatlist, sdata, ecpointformatlist_length); 1104 } 1105#if 0 1106 fprintf(stderr,"ssl_parse_clienthello_tlsext s->session->tlsext_ecpointformatlist (length=%i) ", s->session->tlsext_ecpointformatlist_length); 1107 sdata = s->session->tlsext_ecpointformatlist; 1108 for (i = 0; i < s->session->tlsext_ecpointformatlist_length; i++) 1109 fprintf(stderr,"%i ",*(sdata++)); 1110 fprintf(stderr,"\n"); 1111#endif 1112 } 1113 else if (type == TLSEXT_TYPE_elliptic_curves && 1114 s->version != DTLS1_VERSION) 1115 { 1116 unsigned char *sdata = data; 1117 int ellipticcurvelist_length = (*(sdata++) << 8); 1118 ellipticcurvelist_length += (*(sdata++)); 1119 1120 if (ellipticcurvelist_length != size - 2 || 1121 ellipticcurvelist_length < 1) 1122 { 1123 *al = TLS1_AD_DECODE_ERROR; 1124 return 0; 1125 } 1126 if (!s->hit) 1127 { 1128 if(s->session->tlsext_ellipticcurvelist) 1129 { 1130 *al = TLS1_AD_DECODE_ERROR; 1131 return 0; 1132 } 1133 s->session->tlsext_ellipticcurvelist_length = 0; 1134 if ((s->session->tlsext_ellipticcurvelist = OPENSSL_malloc(ellipticcurvelist_length)) == NULL) 1135 { 1136 *al = TLS1_AD_INTERNAL_ERROR; 1137 return 0; 1138 } 1139 s->session->tlsext_ellipticcurvelist_length = ellipticcurvelist_length; 1140 memcpy(s->session->tlsext_ellipticcurvelist, sdata, ellipticcurvelist_length); 1141 } 1142#if 0 1143 fprintf(stderr,"ssl_parse_clienthello_tlsext s->session->tlsext_ellipticcurvelist (length=%i) ", s->session->tlsext_ellipticcurvelist_length); 1144 sdata = s->session->tlsext_ellipticcurvelist; 1145 for (i = 0; i < s->session->tlsext_ellipticcurvelist_length; i++) 1146 fprintf(stderr,"%i ",*(sdata++)); 1147 fprintf(stderr,"\n"); 1148#endif 1149 } 1150#endif /* OPENSSL_NO_EC */ 1151#ifdef TLSEXT_TYPE_opaque_prf_input 1152 else if (type == TLSEXT_TYPE_opaque_prf_input && 1153 s->version != DTLS1_VERSION) 1154 { 1155 unsigned char *sdata = data; 1156 1157 if (size < 2) 1158 { 1159 *al = SSL_AD_DECODE_ERROR; 1160 return 0; 1161 } 1162 n2s(sdata, s->s3->client_opaque_prf_input_len); 1163 if (s->s3->client_opaque_prf_input_len != size - 2) 1164 { 1165 *al = SSL_AD_DECODE_ERROR; 1166 return 0; 1167 } 1168 1169 if (s->s3->client_opaque_prf_input != NULL) /* shouldn't really happen */ 1170 OPENSSL_free(s->s3->client_opaque_prf_input); 1171 if (s->s3->client_opaque_prf_input_len == 0) 1172 s->s3->client_opaque_prf_input = OPENSSL_malloc(1); /* dummy byte just to get non-NULL */ 1173 else 1174 s->s3->client_opaque_prf_input = BUF_memdup(sdata, s->s3->client_opaque_prf_input_len); 1175 if (s->s3->client_opaque_prf_input == NULL) 1176 { 1177 *al = TLS1_AD_INTERNAL_ERROR; 1178 return 0; 1179 } 1180 } 1181#endif 1182 else if (type == TLSEXT_TYPE_session_ticket) 1183 { 1184 if (s->tls_session_ticket_ext_cb && 1185 !s->tls_session_ticket_ext_cb(s, data, size, s->tls_session_ticket_ext_cb_arg)) 1186 { 1187 *al = TLS1_AD_INTERNAL_ERROR; 1188 return 0; 1189 } 1190 } 1191 else if (type == TLSEXT_TYPE_renegotiate) 1192 { 1193 if(!ssl_parse_clienthello_renegotiate_ext(s, data, size, al)) 1194 return 0; 1195 renegotiate_seen = 1; 1196 } 1197 else if (type == TLSEXT_TYPE_signature_algorithms) 1198 { 1199 int dsize; 1200 if (sigalg_seen || size < 2) 1201 { 1202 *al = SSL_AD_DECODE_ERROR; 1203 return 0; 1204 } 1205 sigalg_seen = 1; 1206 n2s(data,dsize); 1207 size -= 2; 1208 if (dsize != size || dsize & 1) 1209 { 1210 *al = SSL_AD_DECODE_ERROR; 1211 return 0; 1212 } 1213 if (!tls1_process_sigalgs(s, data, dsize)) 1214 { 1215 *al = SSL_AD_DECODE_ERROR; 1216 return 0; 1217 } 1218 } 1219 else if (type == TLSEXT_TYPE_status_request && 1220 s->version != DTLS1_VERSION && s->ctx->tlsext_status_cb) 1221 { 1222 1223 if (size < 5) 1224 { 1225 *al = SSL_AD_DECODE_ERROR; 1226 return 0; 1227 } 1228 1229 s->tlsext_status_type = *data++; 1230 size--; 1231 if (s->tlsext_status_type == TLSEXT_STATUSTYPE_ocsp) 1232 { 1233 const unsigned char *sdata; 1234 int dsize; 1235 /* Read in responder_id_list */ 1236 n2s(data,dsize); 1237 size -= 2; 1238 if (dsize > size ) 1239 { 1240 *al = SSL_AD_DECODE_ERROR; 1241 return 0; 1242 } 1243 while (dsize > 0) 1244 { 1245 OCSP_RESPID *id; 1246 int idsize; 1247 if (dsize < 4) 1248 { 1249 *al = SSL_AD_DECODE_ERROR; 1250 return 0; 1251 } 1252 n2s(data, idsize); 1253 dsize -= 2 + idsize; 1254 size -= 2 + idsize; 1255 if (dsize < 0) 1256 { 1257 *al = SSL_AD_DECODE_ERROR; 1258 return 0; 1259 } 1260 sdata = data; 1261 data += idsize; 1262 id = d2i_OCSP_RESPID(NULL, 1263 &sdata, idsize); 1264 if (!id) 1265 { 1266 *al = SSL_AD_DECODE_ERROR; 1267 return 0; 1268 } 1269 if (data != sdata) 1270 { 1271 OCSP_RESPID_free(id); 1272 *al = SSL_AD_DECODE_ERROR; 1273 return 0; 1274 } 1275 if (!s->tlsext_ocsp_ids 1276 && !(s->tlsext_ocsp_ids = 1277 sk_OCSP_RESPID_new_null())) 1278 { 1279 OCSP_RESPID_free(id); 1280 *al = SSL_AD_INTERNAL_ERROR; 1281 return 0; 1282 } 1283 if (!sk_OCSP_RESPID_push( 1284 s->tlsext_ocsp_ids, id)) 1285 { 1286 OCSP_RESPID_free(id); 1287 *al = SSL_AD_INTERNAL_ERROR; 1288 return 0; 1289 } 1290 } 1291 1292 /* Read in request_extensions */ 1293 if (size < 2) 1294 { 1295 *al = SSL_AD_DECODE_ERROR; 1296 return 0; 1297 } 1298 n2s(data,dsize); 1299 size -= 2; 1300 if (dsize != size) 1301 { 1302 *al = SSL_AD_DECODE_ERROR; 1303 return 0; 1304 } 1305 sdata = data; 1306 if (dsize > 0) 1307 { 1308 if (s->tlsext_ocsp_exts) 1309 { 1310 sk_X509_EXTENSION_pop_free(s->tlsext_ocsp_exts, 1311 X509_EXTENSION_free); 1312 } 1313 1314 s->tlsext_ocsp_exts = 1315 d2i_X509_EXTENSIONS(NULL, 1316 &sdata, dsize); 1317 if (!s->tlsext_ocsp_exts 1318 || (data + dsize != sdata)) 1319 { 1320 *al = SSL_AD_DECODE_ERROR; 1321 return 0; 1322 } 1323 } 1324 } 1325 /* We don't know what to do with any other type 1326 * so ignore it. 1327 */ 1328 else 1329 s->tlsext_status_type = -1; 1330 } 1331#ifndef OPENSSL_NO_HEARTBEATS 1332 else if (type == TLSEXT_TYPE_heartbeat) 1333 { 1334 switch(data[0]) 1335 { 1336 case 0x01: /* Client allows us to send HB requests */ 1337 s->tlsext_heartbeat |= SSL_TLSEXT_HB_ENABLED; 1338 break; 1339 case 0x02: /* Client doesn't accept HB requests */ 1340 s->tlsext_heartbeat |= SSL_TLSEXT_HB_ENABLED; 1341 s->tlsext_heartbeat |= SSL_TLSEXT_HB_DONT_SEND_REQUESTS; 1342 break; 1343 default: *al = SSL_AD_ILLEGAL_PARAMETER; 1344 return 0; 1345 } 1346 } 1347#endif 1348#ifndef OPENSSL_NO_NEXTPROTONEG 1349 else if (type == TLSEXT_TYPE_next_proto_neg && 1350 s->s3->tmp.finish_md_len == 0) 1351 { 1352 /* We shouldn't accept this extension on a 1353 * renegotiation. 1354 * 1355 * s->new_session will be set on renegotiation, but we 1356 * probably shouldn't rely that it couldn't be set on 1357 * the initial renegotation too in certain cases (when 1358 * there's some other reason to disallow resuming an 1359 * earlier session -- the current code won't be doing 1360 * anything like that, but this might change). 1361 1362 * A valid sign that there's been a previous handshake 1363 * in this connection is if s->s3->tmp.finish_md_len > 1364 * 0. (We are talking about a check that will happen 1365 * in the Hello protocol round, well before a new 1366 * Finished message could have been computed.) */ 1367 s->s3->next_proto_neg_seen = 1; 1368 } 1369#endif 1370 1371 else if (type == TLSEXT_TYPE_channel_id && s->tlsext_channel_id_enabled) 1372 s->s3->tlsext_channel_id_valid = 1; 1373 1374 /* session ticket processed earlier */ 1375#ifndef OPENSSL_NO_SRTP 1376 else if (type == TLSEXT_TYPE_use_srtp) 1377 { 1378 if(ssl_parse_clienthello_use_srtp_ext(s, data, size, 1379 al)) 1380 return 0; 1381 } 1382#endif 1383 1384 data+=size; 1385 } 1386 1387 *p = data; 1388 1389 ri_check: 1390 1391 /* Need RI if renegotiating */ 1392 1393 if (!renegotiate_seen && s->renegotiate && 1394 !(s->options & SSL_OP_ALLOW_UNSAFE_LEGACY_RENEGOTIATION)) 1395 { 1396 *al = SSL_AD_HANDSHAKE_FAILURE; 1397 SSLerr(SSL_F_SSL_PARSE_CLIENTHELLO_TLSEXT, 1398 SSL_R_UNSAFE_LEGACY_RENEGOTIATION_DISABLED); 1399 return 0; 1400 } 1401 1402 return 1; 1403 } 1404 1405#ifndef OPENSSL_NO_NEXTPROTONEG 1406/* ssl_next_proto_validate validates a Next Protocol Negotiation block. No 1407 * elements of zero length are allowed and the set of elements must exactly fill 1408 * the length of the block. */ 1409static char ssl_next_proto_validate(unsigned char *d, unsigned len) 1410 { 1411 unsigned int off = 0; 1412 1413 while (off < len) 1414 { 1415 if (d[off] == 0) 1416 return 0; 1417 off += d[off]; 1418 off++; 1419 } 1420 1421 return off == len; 1422 } 1423#endif 1424 1425int ssl_parse_serverhello_tlsext(SSL *s, unsigned char **p, unsigned char *d, int n, int *al) 1426 { 1427 unsigned short length; 1428 unsigned short type; 1429 unsigned short size; 1430 unsigned char *data = *p; 1431 int tlsext_servername = 0; 1432 int renegotiate_seen = 0; 1433 1434#ifndef OPENSSL_NO_NEXTPROTONEG 1435 s->s3->next_proto_neg_seen = 0; 1436#endif 1437 1438#ifndef OPENSSL_NO_HEARTBEATS 1439 s->tlsext_heartbeat &= ~(SSL_TLSEXT_HB_ENABLED | 1440 SSL_TLSEXT_HB_DONT_SEND_REQUESTS); 1441#endif 1442 1443 if (data >= (d+n-2)) 1444 goto ri_check; 1445 1446 n2s(data,length); 1447 if (data+length != d+n) 1448 { 1449 *al = SSL_AD_DECODE_ERROR; 1450 return 0; 1451 } 1452 1453 while(data <= (d+n-4)) 1454 { 1455 n2s(data,type); 1456 n2s(data,size); 1457 1458 if (data+size > (d+n)) 1459 goto ri_check; 1460 1461 if (s->tlsext_debug_cb) 1462 s->tlsext_debug_cb(s, 1, type, data, size, 1463 s->tlsext_debug_arg); 1464 1465 if (type == TLSEXT_TYPE_server_name) 1466 { 1467 if (s->tlsext_hostname == NULL || size > 0) 1468 { 1469 *al = TLS1_AD_UNRECOGNIZED_NAME; 1470 return 0; 1471 } 1472 tlsext_servername = 1; 1473 } 1474 1475#ifndef OPENSSL_NO_EC 1476 else if (type == TLSEXT_TYPE_ec_point_formats && 1477 s->version != DTLS1_VERSION) 1478 { 1479 unsigned char *sdata = data; 1480 int ecpointformatlist_length = *(sdata++); 1481 1482 if (ecpointformatlist_length != size - 1 || 1483 ecpointformatlist_length < 1) 1484 { 1485 *al = TLS1_AD_DECODE_ERROR; 1486 return 0; 1487 } 1488 s->session->tlsext_ecpointformatlist_length = 0; 1489 if (s->session->tlsext_ecpointformatlist != NULL) OPENSSL_free(s->session->tlsext_ecpointformatlist); 1490 if ((s->session->tlsext_ecpointformatlist = OPENSSL_malloc(ecpointformatlist_length)) == NULL) 1491 { 1492 *al = TLS1_AD_INTERNAL_ERROR; 1493 return 0; 1494 } 1495 s->session->tlsext_ecpointformatlist_length = ecpointformatlist_length; 1496 memcpy(s->session->tlsext_ecpointformatlist, sdata, ecpointformatlist_length); 1497#if 0 1498 fprintf(stderr,"ssl_parse_serverhello_tlsext s->session->tlsext_ecpointformatlist "); 1499 sdata = s->session->tlsext_ecpointformatlist; 1500 for (i = 0; i < s->session->tlsext_ecpointformatlist_length; i++) 1501 fprintf(stderr,"%i ",*(sdata++)); 1502 fprintf(stderr,"\n"); 1503#endif 1504 } 1505#endif /* OPENSSL_NO_EC */ 1506 1507 else if (type == TLSEXT_TYPE_session_ticket) 1508 { 1509 if (s->tls_session_ticket_ext_cb && 1510 !s->tls_session_ticket_ext_cb(s, data, size, s->tls_session_ticket_ext_cb_arg)) 1511 { 1512 *al = TLS1_AD_INTERNAL_ERROR; 1513 return 0; 1514 } 1515 if ((SSL_get_options(s) & SSL_OP_NO_TICKET) 1516 || (size > 0)) 1517 { 1518 *al = TLS1_AD_UNSUPPORTED_EXTENSION; 1519 return 0; 1520 } 1521 s->tlsext_ticket_expected = 1; 1522 } 1523#ifdef TLSEXT_TYPE_opaque_prf_input 1524 else if (type == TLSEXT_TYPE_opaque_prf_input && 1525 s->version != DTLS1_VERSION) 1526 { 1527 unsigned char *sdata = data; 1528 1529 if (size < 2) 1530 { 1531 *al = SSL_AD_DECODE_ERROR; 1532 return 0; 1533 } 1534 n2s(sdata, s->s3->server_opaque_prf_input_len); 1535 if (s->s3->server_opaque_prf_input_len != size - 2) 1536 { 1537 *al = SSL_AD_DECODE_ERROR; 1538 return 0; 1539 } 1540 1541 if (s->s3->server_opaque_prf_input != NULL) /* shouldn't really happen */ 1542 OPENSSL_free(s->s3->server_opaque_prf_input); 1543 if (s->s3->server_opaque_prf_input_len == 0) 1544 s->s3->server_opaque_prf_input = OPENSSL_malloc(1); /* dummy byte just to get non-NULL */ 1545 else 1546 s->s3->server_opaque_prf_input = BUF_memdup(sdata, s->s3->server_opaque_prf_input_len); 1547 1548 if (s->s3->server_opaque_prf_input == NULL) 1549 { 1550 *al = TLS1_AD_INTERNAL_ERROR; 1551 return 0; 1552 } 1553 } 1554#endif 1555 else if (type == TLSEXT_TYPE_status_request && 1556 s->version != DTLS1_VERSION) 1557 { 1558 /* MUST be empty and only sent if we've requested 1559 * a status request message. 1560 */ 1561 if ((s->tlsext_status_type == -1) || (size > 0)) 1562 { 1563 *al = TLS1_AD_UNSUPPORTED_EXTENSION; 1564 return 0; 1565 } 1566 /* Set flag to expect CertificateStatus message */ 1567 s->tlsext_status_expected = 1; 1568 } 1569#ifndef OPENSSL_NO_NEXTPROTONEG 1570 else if (type == TLSEXT_TYPE_next_proto_neg && 1571 s->s3->tmp.finish_md_len == 0) 1572 { 1573 unsigned char *selected; 1574 unsigned char selected_len; 1575 1576 /* We must have requested it. */ 1577 if (s->ctx->next_proto_select_cb == NULL) 1578 { 1579 *al = TLS1_AD_UNSUPPORTED_EXTENSION; 1580 return 0; 1581 } 1582 /* The data must be valid */ 1583 if (!ssl_next_proto_validate(data, size)) 1584 { 1585 *al = TLS1_AD_DECODE_ERROR; 1586 return 0; 1587 } 1588 if (s->ctx->next_proto_select_cb(s, &selected, &selected_len, data, size, s->ctx->next_proto_select_cb_arg) != SSL_TLSEXT_ERR_OK) 1589 { 1590 *al = TLS1_AD_INTERNAL_ERROR; 1591 return 0; 1592 } 1593 s->next_proto_negotiated = OPENSSL_malloc(selected_len); 1594 if (!s->next_proto_negotiated) 1595 { 1596 *al = TLS1_AD_INTERNAL_ERROR; 1597 return 0; 1598 } 1599 memcpy(s->next_proto_negotiated, selected, selected_len); 1600 s->next_proto_negotiated_len = selected_len; 1601 s->s3->next_proto_neg_seen = 1; 1602 } 1603#endif 1604 else if (type == TLSEXT_TYPE_channel_id) 1605 s->s3->tlsext_channel_id_valid = 1; 1606 1607 else if (type == TLSEXT_TYPE_renegotiate) 1608 { 1609 if(!ssl_parse_serverhello_renegotiate_ext(s, data, size, al)) 1610 return 0; 1611 renegotiate_seen = 1; 1612 } 1613#ifndef OPENSSL_NO_HEARTBEATS 1614 else if (type == TLSEXT_TYPE_heartbeat) 1615 { 1616 switch(data[0]) 1617 { 1618 case 0x01: /* Server allows us to send HB requests */ 1619 s->tlsext_heartbeat |= SSL_TLSEXT_HB_ENABLED; 1620 break; 1621 case 0x02: /* Server doesn't accept HB requests */ 1622 s->tlsext_heartbeat |= SSL_TLSEXT_HB_ENABLED; 1623 s->tlsext_heartbeat |= SSL_TLSEXT_HB_DONT_SEND_REQUESTS; 1624 break; 1625 default: *al = SSL_AD_ILLEGAL_PARAMETER; 1626 return 0; 1627 } 1628 } 1629#endif 1630#ifndef OPENSSL_NO_SRTP 1631 else if (type == TLSEXT_TYPE_use_srtp) 1632 { 1633 if(ssl_parse_serverhello_use_srtp_ext(s, data, size, 1634 al)) 1635 return 0; 1636 } 1637#endif 1638 1639 data+=size; 1640 } 1641 1642 if (data != d+n) 1643 { 1644 *al = SSL_AD_DECODE_ERROR; 1645 return 0; 1646 } 1647 1648 if (!s->hit && tlsext_servername == 1) 1649 { 1650 if (s->tlsext_hostname) 1651 { 1652 if (s->session->tlsext_hostname == NULL) 1653 { 1654 s->session->tlsext_hostname = BUF_strdup(s->tlsext_hostname); 1655 if (!s->session->tlsext_hostname) 1656 { 1657 *al = SSL_AD_UNRECOGNIZED_NAME; 1658 return 0; 1659 } 1660 } 1661 else 1662 { 1663 *al = SSL_AD_DECODE_ERROR; 1664 return 0; 1665 } 1666 } 1667 } 1668 1669 *p = data; 1670 1671 ri_check: 1672 1673 /* Determine if we need to see RI. Strictly speaking if we want to 1674 * avoid an attack we should *always* see RI even on initial server 1675 * hello because the client doesn't see any renegotiation during an 1676 * attack. However this would mean we could not connect to any server 1677 * which doesn't support RI so for the immediate future tolerate RI 1678 * absence on initial connect only. 1679 */ 1680 if (!renegotiate_seen 1681 && !(s->options & SSL_OP_LEGACY_SERVER_CONNECT) 1682 && !(s->options & SSL_OP_ALLOW_UNSAFE_LEGACY_RENEGOTIATION)) 1683 { 1684 *al = SSL_AD_HANDSHAKE_FAILURE; 1685 SSLerr(SSL_F_SSL_PARSE_SERVERHELLO_TLSEXT, 1686 SSL_R_UNSAFE_LEGACY_RENEGOTIATION_DISABLED); 1687 return 0; 1688 } 1689 1690 return 1; 1691 } 1692 1693 1694int ssl_prepare_clienthello_tlsext(SSL *s) 1695 { 1696#ifndef OPENSSL_NO_EC 1697 /* If we are client and using an elliptic curve cryptography cipher suite, send the point formats 1698 * and elliptic curves we support. 1699 */ 1700 int using_ecc = 0; 1701 int i; 1702 unsigned char *j; 1703 unsigned long alg_k, alg_a; 1704 STACK_OF(SSL_CIPHER) *cipher_stack = SSL_get_ciphers(s); 1705 1706 for (i = 0; i < sk_SSL_CIPHER_num(cipher_stack); i++) 1707 { 1708 SSL_CIPHER *c = sk_SSL_CIPHER_value(cipher_stack, i); 1709 1710 alg_k = c->algorithm_mkey; 1711 alg_a = c->algorithm_auth; 1712 if ((alg_k & (SSL_kEECDH|SSL_kECDHr|SSL_kECDHe) || (alg_a & SSL_aECDSA))) 1713 { 1714 using_ecc = 1; 1715 break; 1716 } 1717 } 1718 using_ecc = using_ecc && (s->version >= TLS1_VERSION); 1719 if (using_ecc) 1720 { 1721 if (s->tlsext_ecpointformatlist != NULL) OPENSSL_free(s->tlsext_ecpointformatlist); 1722 /* To save an additional 2 bytes in the ClientHello, we only advertise support 1723 * for the only EC Point Format that NSS supports (instead of all 3). 1724 */ 1725 if ((s->tlsext_ecpointformatlist = OPENSSL_malloc(1)) == NULL) 1726 { 1727 SSLerr(SSL_F_SSL_PREPARE_CLIENTHELLO_TLSEXT,ERR_R_MALLOC_FAILURE); 1728 return -1; 1729 } 1730 s->tlsext_ecpointformatlist_length = 1; 1731 s->tlsext_ecpointformatlist[0] = TLSEXT_ECPOINTFORMAT_uncompressed; 1732 1733 /* we only advertise support for elliptic curves in NSA Suite B */ 1734 if (s->tlsext_ellipticcurvelist != NULL) OPENSSL_free(s->tlsext_ellipticcurvelist); 1735 s->tlsext_ellipticcurvelist_length = sizeof(pref_list)/sizeof(pref_list[0]) * 2; 1736 if ((s->tlsext_ellipticcurvelist = OPENSSL_malloc(s->tlsext_ellipticcurvelist_length)) == NULL) 1737 { 1738 s->tlsext_ellipticcurvelist_length = 0; 1739 SSLerr(SSL_F_SSL_PREPARE_CLIENTHELLO_TLSEXT,ERR_R_MALLOC_FAILURE); 1740 return -1; 1741 } 1742 for (i = 0, j = s->tlsext_ellipticcurvelist; (unsigned int)i < 1743 sizeof(pref_list)/sizeof(pref_list[0]); i++) 1744 { 1745 int id = tls1_ec_nid2curve_id(pref_list[i]); 1746 s2n(id,j); 1747 } 1748 } 1749#endif /* OPENSSL_NO_EC */ 1750 1751#ifdef TLSEXT_TYPE_opaque_prf_input 1752 { 1753 int r = 1; 1754 1755 if (s->ctx->tlsext_opaque_prf_input_callback != 0) 1756 { 1757 r = s->ctx->tlsext_opaque_prf_input_callback(s, NULL, 0, s->ctx->tlsext_opaque_prf_input_callback_arg); 1758 if (!r) 1759 return -1; 1760 } 1761 1762 if (s->tlsext_opaque_prf_input != NULL) 1763 { 1764 if (s->s3->client_opaque_prf_input != NULL) /* shouldn't really happen */ 1765 OPENSSL_free(s->s3->client_opaque_prf_input); 1766 1767 if (s->tlsext_opaque_prf_input_len == 0) 1768 s->s3->client_opaque_prf_input = OPENSSL_malloc(1); /* dummy byte just to get non-NULL */ 1769 else 1770 s->s3->client_opaque_prf_input = BUF_memdup(s->tlsext_opaque_prf_input, s->tlsext_opaque_prf_input_len); 1771 if (s->s3->client_opaque_prf_input == NULL) 1772 { 1773 SSLerr(SSL_F_SSL_PREPARE_CLIENTHELLO_TLSEXT,ERR_R_MALLOC_FAILURE); 1774 return -1; 1775 } 1776 s->s3->client_opaque_prf_input_len = s->tlsext_opaque_prf_input_len; 1777 } 1778 1779 if (r == 2) 1780 /* at callback's request, insist on receiving an appropriate server opaque PRF input */ 1781 s->s3->server_opaque_prf_input_len = s->tlsext_opaque_prf_input_len; 1782 } 1783#endif 1784 1785 return 1; 1786 } 1787 1788int ssl_prepare_serverhello_tlsext(SSL *s) 1789 { 1790#ifndef OPENSSL_NO_EC 1791 /* If we are server and using an ECC cipher suite, send the point formats we support 1792 * if the client sent us an ECPointsFormat extension. Note that the server is not 1793 * supposed to send an EllipticCurves extension. 1794 */ 1795 1796 unsigned long alg_k = s->s3->tmp.new_cipher->algorithm_mkey; 1797 unsigned long alg_a = s->s3->tmp.new_cipher->algorithm_auth; 1798 int using_ecc = (alg_k & (SSL_kEECDH|SSL_kECDHr|SSL_kECDHe)) || (alg_a & SSL_aECDSA); 1799 using_ecc = using_ecc && (s->session->tlsext_ecpointformatlist != NULL); 1800 1801 if (using_ecc) 1802 { 1803 if (s->tlsext_ecpointformatlist != NULL) OPENSSL_free(s->tlsext_ecpointformatlist); 1804 if ((s->tlsext_ecpointformatlist = OPENSSL_malloc(3)) == NULL) 1805 { 1806 SSLerr(SSL_F_SSL_PREPARE_SERVERHELLO_TLSEXT,ERR_R_MALLOC_FAILURE); 1807 return -1; 1808 } 1809 s->tlsext_ecpointformatlist_length = 3; 1810 s->tlsext_ecpointformatlist[0] = TLSEXT_ECPOINTFORMAT_uncompressed; 1811 s->tlsext_ecpointformatlist[1] = TLSEXT_ECPOINTFORMAT_ansiX962_compressed_prime; 1812 s->tlsext_ecpointformatlist[2] = TLSEXT_ECPOINTFORMAT_ansiX962_compressed_char2; 1813 } 1814#endif /* OPENSSL_NO_EC */ 1815 1816 return 1; 1817 } 1818 1819int ssl_check_clienthello_tlsext_early(SSL *s) 1820 { 1821 int ret=SSL_TLSEXT_ERR_NOACK; 1822 int al = SSL_AD_UNRECOGNIZED_NAME; 1823 1824#ifndef OPENSSL_NO_EC 1825 /* The handling of the ECPointFormats extension is done elsewhere, namely in 1826 * ssl3_choose_cipher in s3_lib.c. 1827 */ 1828 /* The handling of the EllipticCurves extension is done elsewhere, namely in 1829 * ssl3_choose_cipher in s3_lib.c. 1830 */ 1831#endif 1832 1833 if (s->ctx != NULL && s->ctx->tlsext_servername_callback != 0) 1834 ret = s->ctx->tlsext_servername_callback(s, &al, s->ctx->tlsext_servername_arg); 1835 else if (s->initial_ctx != NULL && s->initial_ctx->tlsext_servername_callback != 0) 1836 ret = s->initial_ctx->tlsext_servername_callback(s, &al, s->initial_ctx->tlsext_servername_arg); 1837 1838#ifdef TLSEXT_TYPE_opaque_prf_input 1839 { 1840 /* This sort of belongs into ssl_prepare_serverhello_tlsext(), 1841 * but we might be sending an alert in response to the client hello, 1842 * so this has to happen here in 1843 * ssl_check_clienthello_tlsext_early(). */ 1844 1845 int r = 1; 1846 1847 if (s->ctx->tlsext_opaque_prf_input_callback != 0) 1848 { 1849 r = s->ctx->tlsext_opaque_prf_input_callback(s, NULL, 0, s->ctx->tlsext_opaque_prf_input_callback_arg); 1850 if (!r) 1851 { 1852 ret = SSL_TLSEXT_ERR_ALERT_FATAL; 1853 al = SSL_AD_INTERNAL_ERROR; 1854 goto err; 1855 } 1856 } 1857 1858 if (s->s3->server_opaque_prf_input != NULL) /* shouldn't really happen */ 1859 OPENSSL_free(s->s3->server_opaque_prf_input); 1860 s->s3->server_opaque_prf_input = NULL; 1861 1862 if (s->tlsext_opaque_prf_input != NULL) 1863 { 1864 if (s->s3->client_opaque_prf_input != NULL && 1865 s->s3->client_opaque_prf_input_len == s->tlsext_opaque_prf_input_len) 1866 { 1867 /* can only use this extension if we have a server opaque PRF input 1868 * of the same length as the client opaque PRF input! */ 1869 1870 if (s->tlsext_opaque_prf_input_len == 0) 1871 s->s3->server_opaque_prf_input = OPENSSL_malloc(1); /* dummy byte just to get non-NULL */ 1872 else 1873 s->s3->server_opaque_prf_input = BUF_memdup(s->tlsext_opaque_prf_input, s->tlsext_opaque_prf_input_len); 1874 if (s->s3->server_opaque_prf_input == NULL) 1875 { 1876 ret = SSL_TLSEXT_ERR_ALERT_FATAL; 1877 al = SSL_AD_INTERNAL_ERROR; 1878 goto err; 1879 } 1880 s->s3->server_opaque_prf_input_len = s->tlsext_opaque_prf_input_len; 1881 } 1882 } 1883 1884 if (r == 2 && s->s3->server_opaque_prf_input == NULL) 1885 { 1886 /* The callback wants to enforce use of the extension, 1887 * but we can't do that with the client opaque PRF input; 1888 * abort the handshake. 1889 */ 1890 ret = SSL_TLSEXT_ERR_ALERT_FATAL; 1891 al = SSL_AD_HANDSHAKE_FAILURE; 1892 } 1893 } 1894 1895 err: 1896#endif 1897 switch (ret) 1898 { 1899 case SSL_TLSEXT_ERR_ALERT_FATAL: 1900 ssl3_send_alert(s,SSL3_AL_FATAL,al); 1901 return -1; 1902 1903 case SSL_TLSEXT_ERR_ALERT_WARNING: 1904 ssl3_send_alert(s,SSL3_AL_WARNING,al); 1905 return 1; 1906 1907 case SSL_TLSEXT_ERR_NOACK: 1908 s->servername_done=0; 1909 default: 1910 return 1; 1911 } 1912 } 1913 1914int ssl_check_clienthello_tlsext_late(SSL *s) 1915 { 1916 int ret = SSL_TLSEXT_ERR_OK; 1917 int al; 1918 1919 /* If status request then ask callback what to do. 1920 * Note: this must be called after servername callbacks in case 1921 * the certificate has changed, and must be called after the cipher 1922 * has been chosen because this may influence which certificate is sent 1923 */ 1924 if ((s->tlsext_status_type != -1) && s->ctx && s->ctx->tlsext_status_cb) 1925 { 1926 int r; 1927 CERT_PKEY *certpkey; 1928 certpkey = ssl_get_server_send_pkey(s); 1929 /* If no certificate can't return certificate status */ 1930 if (certpkey == NULL) 1931 { 1932 s->tlsext_status_expected = 0; 1933 return 1; 1934 } 1935 /* Set current certificate to one we will use so 1936 * SSL_get_certificate et al can pick it up. 1937 */ 1938 s->cert->key = certpkey; 1939 r = s->ctx->tlsext_status_cb(s, s->ctx->tlsext_status_arg); 1940 switch (r) 1941 { 1942 /* We don't want to send a status request response */ 1943 case SSL_TLSEXT_ERR_NOACK: 1944 s->tlsext_status_expected = 0; 1945 break; 1946 /* status request response should be sent */ 1947 case SSL_TLSEXT_ERR_OK: 1948 if (s->tlsext_ocsp_resp) 1949 s->tlsext_status_expected = 1; 1950 else 1951 s->tlsext_status_expected = 0; 1952 break; 1953 /* something bad happened */ 1954 case SSL_TLSEXT_ERR_ALERT_FATAL: 1955 ret = SSL_TLSEXT_ERR_ALERT_FATAL; 1956 al = SSL_AD_INTERNAL_ERROR; 1957 goto err; 1958 } 1959 } 1960 else 1961 s->tlsext_status_expected = 0; 1962 1963 err: 1964 switch (ret) 1965 { 1966 case SSL_TLSEXT_ERR_ALERT_FATAL: 1967 ssl3_send_alert(s,SSL3_AL_FATAL,al); 1968 return -1; 1969 1970 case SSL_TLSEXT_ERR_ALERT_WARNING: 1971 ssl3_send_alert(s,SSL3_AL_WARNING,al); 1972 return 1; 1973 1974 default: 1975 return 1; 1976 } 1977 } 1978 1979int ssl_check_serverhello_tlsext(SSL *s) 1980 { 1981 int ret=SSL_TLSEXT_ERR_NOACK; 1982 int al = SSL_AD_UNRECOGNIZED_NAME; 1983 1984#ifndef OPENSSL_NO_EC 1985 /* If we are client and using an elliptic curve cryptography cipher 1986 * suite, then if server returns an EC point formats lists extension 1987 * it must contain uncompressed. 1988 */ 1989 unsigned long alg_k = s->s3->tmp.new_cipher->algorithm_mkey; 1990 unsigned long alg_a = s->s3->tmp.new_cipher->algorithm_auth; 1991 if ((s->tlsext_ecpointformatlist != NULL) && (s->tlsext_ecpointformatlist_length > 0) && 1992 (s->session->tlsext_ecpointformatlist != NULL) && (s->session->tlsext_ecpointformatlist_length > 0) && 1993 ((alg_k & (SSL_kEECDH|SSL_kECDHr|SSL_kECDHe)) || (alg_a & SSL_aECDSA))) 1994 { 1995 /* we are using an ECC cipher */ 1996 size_t i; 1997 unsigned char *list; 1998 int found_uncompressed = 0; 1999 list = s->session->tlsext_ecpointformatlist; 2000 for (i = 0; i < s->session->tlsext_ecpointformatlist_length; i++) 2001 { 2002 if (*(list++) == TLSEXT_ECPOINTFORMAT_uncompressed) 2003 { 2004 found_uncompressed = 1; 2005 break; 2006 } 2007 } 2008 if (!found_uncompressed) 2009 { 2010 SSLerr(SSL_F_SSL_CHECK_SERVERHELLO_TLSEXT,SSL_R_TLS_INVALID_ECPOINTFORMAT_LIST); 2011 return -1; 2012 } 2013 } 2014 ret = SSL_TLSEXT_ERR_OK; 2015#endif /* OPENSSL_NO_EC */ 2016 2017 if (s->ctx != NULL && s->ctx->tlsext_servername_callback != 0) 2018 ret = s->ctx->tlsext_servername_callback(s, &al, s->ctx->tlsext_servername_arg); 2019 else if (s->initial_ctx != NULL && s->initial_ctx->tlsext_servername_callback != 0) 2020 ret = s->initial_ctx->tlsext_servername_callback(s, &al, s->initial_ctx->tlsext_servername_arg); 2021 2022#ifdef TLSEXT_TYPE_opaque_prf_input 2023 if (s->s3->server_opaque_prf_input_len > 0) 2024 { 2025 /* This case may indicate that we, as a client, want to insist on using opaque PRF inputs. 2026 * So first verify that we really have a value from the server too. */ 2027 2028 if (s->s3->server_opaque_prf_input == NULL) 2029 { 2030 ret = SSL_TLSEXT_ERR_ALERT_FATAL; 2031 al = SSL_AD_HANDSHAKE_FAILURE; 2032 } 2033 2034 /* Anytime the server *has* sent an opaque PRF input, we need to check 2035 * that we have a client opaque PRF input of the same size. */ 2036 if (s->s3->client_opaque_prf_input == NULL || 2037 s->s3->client_opaque_prf_input_len != s->s3->server_opaque_prf_input_len) 2038 { 2039 ret = SSL_TLSEXT_ERR_ALERT_FATAL; 2040 al = SSL_AD_ILLEGAL_PARAMETER; 2041 } 2042 } 2043#endif 2044 2045 /* If we've requested certificate status and we wont get one 2046 * tell the callback 2047 */ 2048 if ((s->tlsext_status_type != -1) && !(s->tlsext_status_expected) 2049 && s->ctx && s->ctx->tlsext_status_cb) 2050 { 2051 int r; 2052 /* Set resp to NULL, resplen to -1 so callback knows 2053 * there is no response. 2054 */ 2055 if (s->tlsext_ocsp_resp) 2056 { 2057 OPENSSL_free(s->tlsext_ocsp_resp); 2058 s->tlsext_ocsp_resp = NULL; 2059 } 2060 s->tlsext_ocsp_resplen = -1; 2061 r = s->ctx->tlsext_status_cb(s, s->ctx->tlsext_status_arg); 2062 if (r == 0) 2063 { 2064 al = SSL_AD_BAD_CERTIFICATE_STATUS_RESPONSE; 2065 ret = SSL_TLSEXT_ERR_ALERT_FATAL; 2066 } 2067 if (r < 0) 2068 { 2069 al = SSL_AD_INTERNAL_ERROR; 2070 ret = SSL_TLSEXT_ERR_ALERT_FATAL; 2071 } 2072 } 2073 2074 switch (ret) 2075 { 2076 case SSL_TLSEXT_ERR_ALERT_FATAL: 2077 ssl3_send_alert(s,SSL3_AL_FATAL,al); 2078 return -1; 2079 2080 case SSL_TLSEXT_ERR_ALERT_WARNING: 2081 ssl3_send_alert(s,SSL3_AL_WARNING,al); 2082 return 1; 2083 2084 case SSL_TLSEXT_ERR_NOACK: 2085 s->servername_done=0; 2086 default: 2087 return 1; 2088 } 2089 } 2090 2091/* Since the server cache lookup is done early on in the processing of the 2092 * ClientHello, and other operations depend on the result, we need to handle 2093 * any TLS session ticket extension at the same time. 2094 * 2095 * session_id: points at the session ID in the ClientHello. This code will 2096 * read past the end of this in order to parse out the session ticket 2097 * extension, if any. 2098 * len: the length of the session ID. 2099 * limit: a pointer to the first byte after the ClientHello. 2100 * ret: (output) on return, if a ticket was decrypted, then this is set to 2101 * point to the resulting session. 2102 * 2103 * If s->tls_session_secret_cb is set then we are expecting a pre-shared key 2104 * ciphersuite, in which case we have no use for session tickets and one will 2105 * never be decrypted, nor will s->tlsext_ticket_expected be set to 1. 2106 * 2107 * Returns: 2108 * -1: fatal error, either from parsing or decrypting the ticket. 2109 * 0: no ticket was found (or was ignored, based on settings). 2110 * 1: a zero length extension was found, indicating that the client supports 2111 * session tickets but doesn't currently have one to offer. 2112 * 2: either s->tls_session_secret_cb was set, or a ticket was offered but 2113 * couldn't be decrypted because of a non-fatal error. 2114 * 3: a ticket was successfully decrypted and *ret was set. 2115 * 2116 * Side effects: 2117 * Sets s->tlsext_ticket_expected to 1 if the server will have to issue 2118 * a new session ticket to the client because the client indicated support 2119 * (and s->tls_session_secret_cb is NULL) but the client either doesn't have 2120 * a session ticket or we couldn't use the one it gave us, or if 2121 * s->ctx->tlsext_ticket_key_cb asked to renew the client's ticket. 2122 * Otherwise, s->tlsext_ticket_expected is set to 0. 2123 */ 2124int tls1_process_ticket(SSL *s, unsigned char *session_id, int len, 2125 const unsigned char *limit, SSL_SESSION **ret) 2126 { 2127 /* Point after session ID in client hello */ 2128 const unsigned char *p = session_id + len; 2129 unsigned short i; 2130 2131 *ret = NULL; 2132 s->tlsext_ticket_expected = 0; 2133 2134 /* If tickets disabled behave as if no ticket present 2135 * to permit stateful resumption. 2136 */ 2137 if (SSL_get_options(s) & SSL_OP_NO_TICKET) 2138 return 0; 2139 if ((s->version <= SSL3_VERSION) || !limit) 2140 return 0; 2141 if (p >= limit) 2142 return -1; 2143 /* Skip past DTLS cookie */ 2144 if (s->version == DTLS1_VERSION || s->version == DTLS1_BAD_VER) 2145 { 2146 i = *(p++); 2147 p+= i; 2148 if (p >= limit) 2149 return -1; 2150 } 2151 /* Skip past cipher list */ 2152 n2s(p, i); 2153 p+= i; 2154 if (p >= limit) 2155 return -1; 2156 /* Skip past compression algorithm list */ 2157 i = *(p++); 2158 p += i; 2159 if (p > limit) 2160 return -1; 2161 /* Now at start of extensions */ 2162 if ((p + 2) >= limit) 2163 return 0; 2164 n2s(p, i); 2165 while ((p + 4) <= limit) 2166 { 2167 unsigned short type, size; 2168 n2s(p, type); 2169 n2s(p, size); 2170 if (p + size > limit) 2171 return 0; 2172 if (type == TLSEXT_TYPE_session_ticket) 2173 { 2174 int r; 2175 if (size == 0) 2176 { 2177 /* The client will accept a ticket but doesn't 2178 * currently have one. */ 2179 s->tlsext_ticket_expected = 1; 2180 return 1; 2181 } 2182 if (s->tls_session_secret_cb) 2183 { 2184 /* Indicate that the ticket couldn't be 2185 * decrypted rather than generating the session 2186 * from ticket now, trigger abbreviated 2187 * handshake based on external mechanism to 2188 * calculate the master secret later. */ 2189 return 2; 2190 } 2191 r = tls_decrypt_ticket(s, p, size, session_id, len, ret); 2192 switch (r) 2193 { 2194 case 2: /* ticket couldn't be decrypted */ 2195 s->tlsext_ticket_expected = 1; 2196 return 2; 2197 case 3: /* ticket was decrypted */ 2198 return r; 2199 case 4: /* ticket decrypted but need to renew */ 2200 s->tlsext_ticket_expected = 1; 2201 return 3; 2202 default: /* fatal error */ 2203 return -1; 2204 } 2205 } 2206 p += size; 2207 } 2208 return 0; 2209 } 2210 2211/* tls_decrypt_ticket attempts to decrypt a session ticket. 2212 * 2213 * etick: points to the body of the session ticket extension. 2214 * eticklen: the length of the session tickets extenion. 2215 * sess_id: points at the session ID. 2216 * sesslen: the length of the session ID. 2217 * psess: (output) on return, if a ticket was decrypted, then this is set to 2218 * point to the resulting session. 2219 * 2220 * Returns: 2221 * -1: fatal error, either from parsing or decrypting the ticket. 2222 * 2: the ticket couldn't be decrypted. 2223 * 3: a ticket was successfully decrypted and *psess was set. 2224 * 4: same as 3, but the ticket needs to be renewed. 2225 */ 2226static int tls_decrypt_ticket(SSL *s, const unsigned char *etick, int eticklen, 2227 const unsigned char *sess_id, int sesslen, 2228 SSL_SESSION **psess) 2229 { 2230 SSL_SESSION *sess; 2231 unsigned char *sdec; 2232 const unsigned char *p; 2233 int slen, mlen, renew_ticket = 0; 2234 unsigned char tick_hmac[EVP_MAX_MD_SIZE]; 2235 HMAC_CTX hctx; 2236 EVP_CIPHER_CTX ctx; 2237 SSL_CTX *tctx = s->initial_ctx; 2238 /* Need at least keyname + iv + some encrypted data */ 2239 if (eticklen < 48) 2240 return 2; 2241 /* Initialize session ticket encryption and HMAC contexts */ 2242 HMAC_CTX_init(&hctx); 2243 EVP_CIPHER_CTX_init(&ctx); 2244 if (tctx->tlsext_ticket_key_cb) 2245 { 2246 unsigned char *nctick = (unsigned char *)etick; 2247 int rv = tctx->tlsext_ticket_key_cb(s, nctick, nctick + 16, 2248 &ctx, &hctx, 0); 2249 if (rv < 0) 2250 return -1; 2251 if (rv == 0) 2252 return 2; 2253 if (rv == 2) 2254 renew_ticket = 1; 2255 } 2256 else 2257 { 2258 /* Check key name matches */ 2259 if (memcmp(etick, tctx->tlsext_tick_key_name, 16)) 2260 return 2; 2261 HMAC_Init_ex(&hctx, tctx->tlsext_tick_hmac_key, 16, 2262 tlsext_tick_md(), NULL); 2263 EVP_DecryptInit_ex(&ctx, EVP_aes_128_cbc(), NULL, 2264 tctx->tlsext_tick_aes_key, etick + 16); 2265 } 2266 /* Attempt to process session ticket, first conduct sanity and 2267 * integrity checks on ticket. 2268 */ 2269 mlen = HMAC_size(&hctx); 2270 if (mlen < 0) 2271 { 2272 EVP_CIPHER_CTX_cleanup(&ctx); 2273 return -1; 2274 } 2275 eticklen -= mlen; 2276 /* Check HMAC of encrypted ticket */ 2277 HMAC_Update(&hctx, etick, eticklen); 2278 HMAC_Final(&hctx, tick_hmac, NULL); 2279 HMAC_CTX_cleanup(&hctx); 2280 if (CRYPTO_memcmp(tick_hmac, etick + eticklen, mlen)) 2281 return 2; 2282 /* Attempt to decrypt session data */ 2283 /* Move p after IV to start of encrypted ticket, update length */ 2284 p = etick + 16 + EVP_CIPHER_CTX_iv_length(&ctx); 2285 eticklen -= 16 + EVP_CIPHER_CTX_iv_length(&ctx); 2286 sdec = OPENSSL_malloc(eticklen); 2287 if (!sdec) 2288 { 2289 EVP_CIPHER_CTX_cleanup(&ctx); 2290 return -1; 2291 } 2292 EVP_DecryptUpdate(&ctx, sdec, &slen, p, eticklen); 2293 if (EVP_DecryptFinal(&ctx, sdec + slen, &mlen) <= 0) 2294 return 2; 2295 slen += mlen; 2296 EVP_CIPHER_CTX_cleanup(&ctx); 2297 p = sdec; 2298 2299 sess = d2i_SSL_SESSION(NULL, &p, slen); 2300 OPENSSL_free(sdec); 2301 if (sess) 2302 { 2303 /* The session ID, if non-empty, is used by some clients to 2304 * detect that the ticket has been accepted. So we copy it to 2305 * the session structure. If it is empty set length to zero 2306 * as required by standard. 2307 */ 2308 if (sesslen) 2309 memcpy(sess->session_id, sess_id, sesslen); 2310 sess->session_id_length = sesslen; 2311 *psess = sess; 2312 if (renew_ticket) 2313 return 4; 2314 else 2315 return 3; 2316 } 2317 ERR_clear_error(); 2318 /* For session parse failure, indicate that we need to send a new 2319 * ticket. */ 2320 return 2; 2321 } 2322 2323/* Tables to translate from NIDs to TLS v1.2 ids */ 2324 2325typedef struct 2326 { 2327 int nid; 2328 int id; 2329 } tls12_lookup; 2330 2331static tls12_lookup tls12_md[] = { 2332#ifndef OPENSSL_NO_MD5 2333 {NID_md5, TLSEXT_hash_md5}, 2334#endif 2335#ifndef OPENSSL_NO_SHA 2336 {NID_sha1, TLSEXT_hash_sha1}, 2337#endif 2338#ifndef OPENSSL_NO_SHA256 2339 {NID_sha224, TLSEXT_hash_sha224}, 2340 {NID_sha256, TLSEXT_hash_sha256}, 2341#endif 2342#ifndef OPENSSL_NO_SHA512 2343 {NID_sha384, TLSEXT_hash_sha384}, 2344 {NID_sha512, TLSEXT_hash_sha512} 2345#endif 2346}; 2347 2348static tls12_lookup tls12_sig[] = { 2349#ifndef OPENSSL_NO_RSA 2350 {EVP_PKEY_RSA, TLSEXT_signature_rsa}, 2351#endif 2352#ifndef OPENSSL_NO_DSA 2353 {EVP_PKEY_DSA, TLSEXT_signature_dsa}, 2354#endif 2355#ifndef OPENSSL_NO_ECDSA 2356 {EVP_PKEY_EC, TLSEXT_signature_ecdsa} 2357#endif 2358}; 2359 2360static int tls12_find_id(int nid, tls12_lookup *table, size_t tlen) 2361 { 2362 size_t i; 2363 for (i = 0; i < tlen; i++) 2364 { 2365 if (table[i].nid == nid) 2366 return table[i].id; 2367 } 2368 return -1; 2369 } 2370#if 0 2371static int tls12_find_nid(int id, tls12_lookup *table, size_t tlen) 2372 { 2373 size_t i; 2374 for (i = 0; i < tlen; i++) 2375 { 2376 if (table[i].id == id) 2377 return table[i].nid; 2378 } 2379 return -1; 2380 } 2381#endif 2382 2383int tls12_get_sigandhash(unsigned char *p, const EVP_PKEY *pk, const EVP_MD *md) 2384 { 2385 int sig_id, md_id; 2386 if (!md) 2387 return 0; 2388 md_id = tls12_find_id(EVP_MD_type(md), tls12_md, 2389 sizeof(tls12_md)/sizeof(tls12_lookup)); 2390 if (md_id == -1) 2391 return 0; 2392 sig_id = tls12_get_sigid(pk); 2393 if (sig_id == -1) 2394 return 0; 2395 p[0] = (unsigned char)md_id; 2396 p[1] = (unsigned char)sig_id; 2397 return 1; 2398 } 2399 2400int tls12_get_sigid(const EVP_PKEY *pk) 2401 { 2402 return tls12_find_id(pk->type, tls12_sig, 2403 sizeof(tls12_sig)/sizeof(tls12_lookup)); 2404 } 2405 2406const EVP_MD *tls12_get_hash(unsigned char hash_alg) 2407 { 2408 switch(hash_alg) 2409 { 2410#ifndef OPENSSL_NO_MD5 2411 case TLSEXT_hash_md5: 2412#ifdef OPENSSL_FIPS 2413 if (FIPS_mode()) 2414 return NULL; 2415#endif 2416 return EVP_md5(); 2417#endif 2418#ifndef OPENSSL_NO_SHA 2419 case TLSEXT_hash_sha1: 2420 return EVP_sha1(); 2421#endif 2422#ifndef OPENSSL_NO_SHA256 2423 case TLSEXT_hash_sha224: 2424 return EVP_sha224(); 2425 2426 case TLSEXT_hash_sha256: 2427 return EVP_sha256(); 2428#endif 2429#ifndef OPENSSL_NO_SHA512 2430 case TLSEXT_hash_sha384: 2431 return EVP_sha384(); 2432 2433 case TLSEXT_hash_sha512: 2434 return EVP_sha512(); 2435#endif 2436 default: 2437 return NULL; 2438 2439 } 2440 } 2441 2442/* Set preferred digest for each key type */ 2443 2444int tls1_process_sigalgs(SSL *s, const unsigned char *data, int dsize) 2445 { 2446 int i, idx; 2447 const EVP_MD *md; 2448 CERT *c = s->cert; 2449 /* Extension ignored for TLS versions below 1.2 */ 2450 if (TLS1_get_version(s) < TLS1_2_VERSION) 2451 return 1; 2452 /* Should never happen */ 2453 if (!c) 2454 return 0; 2455 2456 c->pkeys[SSL_PKEY_DSA_SIGN].digest = NULL; 2457 c->pkeys[SSL_PKEY_RSA_SIGN].digest = NULL; 2458 c->pkeys[SSL_PKEY_RSA_ENC].digest = NULL; 2459 c->pkeys[SSL_PKEY_ECC].digest = NULL; 2460 2461 for (i = 0; i < dsize; i += 2) 2462 { 2463 unsigned char hash_alg = data[i], sig_alg = data[i+1]; 2464 2465 switch(sig_alg) 2466 { 2467#ifndef OPENSSL_NO_RSA 2468 case TLSEXT_signature_rsa: 2469 idx = SSL_PKEY_RSA_SIGN; 2470 break; 2471#endif 2472#ifndef OPENSSL_NO_DSA 2473 case TLSEXT_signature_dsa: 2474 idx = SSL_PKEY_DSA_SIGN; 2475 break; 2476#endif 2477#ifndef OPENSSL_NO_ECDSA 2478 case TLSEXT_signature_ecdsa: 2479 idx = SSL_PKEY_ECC; 2480 break; 2481#endif 2482 default: 2483 continue; 2484 } 2485 2486 if (c->pkeys[idx].digest == NULL) 2487 { 2488 md = tls12_get_hash(hash_alg); 2489 if (md) 2490 { 2491 c->pkeys[idx].digest = md; 2492 if (idx == SSL_PKEY_RSA_SIGN) 2493 c->pkeys[SSL_PKEY_RSA_ENC].digest = md; 2494 } 2495 } 2496 2497 } 2498 2499 2500 /* Set any remaining keys to default values. NOTE: if alg is not 2501 * supported it stays as NULL. 2502 */ 2503#ifndef OPENSSL_NO_DSA 2504 if (!c->pkeys[SSL_PKEY_DSA_SIGN].digest) 2505 c->pkeys[SSL_PKEY_DSA_SIGN].digest = EVP_sha1(); 2506#endif 2507#ifndef OPENSSL_NO_RSA 2508 if (!c->pkeys[SSL_PKEY_RSA_SIGN].digest) 2509 { 2510 c->pkeys[SSL_PKEY_RSA_SIGN].digest = EVP_sha1(); 2511 c->pkeys[SSL_PKEY_RSA_ENC].digest = EVP_sha1(); 2512 } 2513#endif 2514#ifndef OPENSSL_NO_ECDSA 2515 if (!c->pkeys[SSL_PKEY_ECC].digest) 2516 c->pkeys[SSL_PKEY_ECC].digest = EVP_sha1(); 2517#endif 2518 return 1; 2519 } 2520 2521#endif 2522 2523#ifndef OPENSSL_NO_HEARTBEATS 2524int 2525tls1_process_heartbeat(SSL *s) 2526 { 2527 unsigned char *p = &s->s3->rrec.data[0], *pl; 2528 unsigned short hbtype; 2529 unsigned int payload; 2530 unsigned int padding = 16; /* Use minimum padding */ 2531 2532 /* Read type and payload length first */ 2533 hbtype = *p++; 2534 n2s(p, payload); 2535 pl = p; 2536 2537 if (s->msg_callback) 2538 s->msg_callback(0, s->version, TLS1_RT_HEARTBEAT, 2539 &s->s3->rrec.data[0], s->s3->rrec.length, 2540 s, s->msg_callback_arg); 2541 2542 if (hbtype == TLS1_HB_REQUEST) 2543 { 2544 unsigned char *buffer, *bp; 2545 int r; 2546 2547 /* Allocate memory for the response, size is 1 bytes 2548 * message type, plus 2 bytes payload length, plus 2549 * payload, plus padding 2550 */ 2551 buffer = OPENSSL_malloc(1 + 2 + payload + padding); 2552 bp = buffer; 2553 2554 /* Enter response type, length and copy payload */ 2555 *bp++ = TLS1_HB_RESPONSE; 2556 s2n(payload, bp); 2557 memcpy(bp, pl, payload); 2558 bp += payload; 2559 /* Random padding */ 2560 RAND_pseudo_bytes(bp, padding); 2561 2562 r = ssl3_write_bytes(s, TLS1_RT_HEARTBEAT, buffer, 3 + payload + padding); 2563 2564 if (r >= 0 && s->msg_callback) 2565 s->msg_callback(1, s->version, TLS1_RT_HEARTBEAT, 2566 buffer, 3 + payload + padding, 2567 s, s->msg_callback_arg); 2568 2569 OPENSSL_free(buffer); 2570 2571 if (r < 0) 2572 return r; 2573 } 2574 else if (hbtype == TLS1_HB_RESPONSE) 2575 { 2576 unsigned int seq; 2577 2578 /* We only send sequence numbers (2 bytes unsigned int), 2579 * and 16 random bytes, so we just try to read the 2580 * sequence number */ 2581 n2s(pl, seq); 2582 2583 if (payload == 18 && seq == s->tlsext_hb_seq) 2584 { 2585 s->tlsext_hb_seq++; 2586 s->tlsext_hb_pending = 0; 2587 } 2588 } 2589 2590 return 0; 2591 } 2592 2593int 2594tls1_heartbeat(SSL *s) 2595 { 2596 unsigned char *buf, *p; 2597 int ret; 2598 unsigned int payload = 18; /* Sequence number + random bytes */ 2599 unsigned int padding = 16; /* Use minimum padding */ 2600 2601 /* Only send if peer supports and accepts HB requests... */ 2602 if (!(s->tlsext_heartbeat & SSL_TLSEXT_HB_ENABLED) || 2603 s->tlsext_heartbeat & SSL_TLSEXT_HB_DONT_SEND_REQUESTS) 2604 { 2605 SSLerr(SSL_F_TLS1_HEARTBEAT,SSL_R_TLS_HEARTBEAT_PEER_DOESNT_ACCEPT); 2606 return -1; 2607 } 2608 2609 /* ...and there is none in flight yet... */ 2610 if (s->tlsext_hb_pending) 2611 { 2612 SSLerr(SSL_F_TLS1_HEARTBEAT,SSL_R_TLS_HEARTBEAT_PENDING); 2613 return -1; 2614 } 2615 2616 /* ...and no handshake in progress. */ 2617 if (SSL_in_init(s) || s->in_handshake) 2618 { 2619 SSLerr(SSL_F_TLS1_HEARTBEAT,SSL_R_UNEXPECTED_MESSAGE); 2620 return -1; 2621 } 2622 2623 /* Check if padding is too long, payload and padding 2624 * must not exceed 2^14 - 3 = 16381 bytes in total. 2625 */ 2626 OPENSSL_assert(payload + padding <= 16381); 2627 2628 /* Create HeartBeat message, we just use a sequence number 2629 * as payload to distuingish different messages and add 2630 * some random stuff. 2631 * - Message Type, 1 byte 2632 * - Payload Length, 2 bytes (unsigned int) 2633 * - Payload, the sequence number (2 bytes uint) 2634 * - Payload, random bytes (16 bytes uint) 2635 * - Padding 2636 */ 2637 buf = OPENSSL_malloc(1 + 2 + payload + padding); 2638 p = buf; 2639 /* Message Type */ 2640 *p++ = TLS1_HB_REQUEST; 2641 /* Payload length (18 bytes here) */ 2642 s2n(payload, p); 2643 /* Sequence number */ 2644 s2n(s->tlsext_hb_seq, p); 2645 /* 16 random bytes */ 2646 RAND_pseudo_bytes(p, 16); 2647 p += 16; 2648 /* Random padding */ 2649 RAND_pseudo_bytes(p, padding); 2650 2651 ret = ssl3_write_bytes(s, TLS1_RT_HEARTBEAT, buf, 3 + payload + padding); 2652 if (ret >= 0) 2653 { 2654 if (s->msg_callback) 2655 s->msg_callback(1, s->version, TLS1_RT_HEARTBEAT, 2656 buf, 3 + payload + padding, 2657 s, s->msg_callback_arg); 2658 2659 s->tlsext_hb_pending = 1; 2660 } 2661 2662 OPENSSL_free(buf); 2663 2664 return ret; 2665 } 2666#endif 2667 2668#if !defined(OPENSSL_NO_TLSEXT) 2669/* tls1_channel_id_hash calculates the signed data for a Channel ID on the given 2670 * SSL connection and writes it to |md|. 2671 */ 2672int 2673tls1_channel_id_hash(EVP_MD_CTX *md, SSL *s) 2674 { 2675 EVP_MD_CTX ctx; 2676 unsigned char temp_digest[EVP_MAX_MD_SIZE]; 2677 unsigned temp_digest_len; 2678 int i; 2679 static const char kClientIDMagic[] = "TLS Channel ID signature"; 2680 2681 if (s->s3->handshake_buffer) 2682 if (!ssl3_digest_cached_records(s)) 2683 return 0; 2684 2685 EVP_DigestUpdate(md, kClientIDMagic, sizeof(kClientIDMagic)); 2686 2687 if (s->hit) 2688 { 2689 static const char kResumptionMagic[] = "Resumption"; 2690 EVP_DigestUpdate(md, kResumptionMagic, 2691 sizeof(kResumptionMagic)); 2692 if (s->session->original_handshake_hash_len == 0) 2693 return 0; 2694 EVP_DigestUpdate(md, s->session->original_handshake_hash, 2695 s->session->original_handshake_hash_len); 2696 } 2697 2698 EVP_MD_CTX_init(&ctx); 2699 for (i = 0; i < SSL_MAX_DIGEST; i++) 2700 { 2701 if (s->s3->handshake_dgst[i] == NULL) 2702 continue; 2703 EVP_MD_CTX_copy_ex(&ctx, s->s3->handshake_dgst[i]); 2704 EVP_DigestFinal_ex(&ctx, temp_digest, &temp_digest_len); 2705 EVP_DigestUpdate(md, temp_digest, temp_digest_len); 2706 } 2707 EVP_MD_CTX_cleanup(&ctx); 2708 2709 return 1; 2710 } 2711#endif 2712 2713/* tls1_record_handshake_hashes_for_channel_id records the current handshake 2714 * hashes in |s->session| so that Channel ID resumptions can sign that data. */ 2715int tls1_record_handshake_hashes_for_channel_id(SSL *s) 2716 { 2717 int digest_len; 2718 /* This function should never be called for a resumed session because 2719 * the handshake hashes that we wish to record are for the original, 2720 * full handshake. */ 2721 if (s->hit) 2722 return -1; 2723 /* It only makes sense to call this function if Channel IDs have been 2724 * negotiated. */ 2725 if (!s->s3->tlsext_channel_id_valid) 2726 return -1; 2727 2728 digest_len = tls1_handshake_digest( 2729 s, s->session->original_handshake_hash, 2730 sizeof(s->session->original_handshake_hash)); 2731 if (digest_len < 0) 2732 return -1; 2733 2734 s->session->original_handshake_hash_len = digest_len; 2735 2736 return 1; 2737 } 2738