summaryrefslogtreecommitdiff
path: root/src/lib/libssl/t1_lib.c
diff options
context:
space:
mode:
Diffstat (limited to '')
-rw-r--r--src/lib/libssl/t1_lib.c917
1 files changed, 877 insertions, 40 deletions
diff --git a/src/lib/libssl/t1_lib.c b/src/lib/libssl/t1_lib.c
index 9ce726996d..e8bc34c111 100644
--- a/src/lib/libssl/t1_lib.c
+++ b/src/lib/libssl/t1_lib.c
@@ -55,6 +55,59 @@
55 * copied and put under another distribution licence 55 * copied and put under another distribution licence
56 * [including the GNU Public Licence.] 56 * [including the GNU Public Licence.]
57 */ 57 */
58/* ====================================================================
59 * Copyright (c) 1998-2007 The OpenSSL Project. All rights reserved.
60 *
61 * Redistribution and use in source and binary forms, with or without
62 * modification, are permitted provided that the following conditions
63 * are met:
64 *
65 * 1. Redistributions of source code must retain the above copyright
66 * notice, this list of conditions and the following disclaimer.
67 *
68 * 2. Redistributions in binary form must reproduce the above copyright
69 * notice, this list of conditions and the following disclaimer in
70 * the documentation and/or other materials provided with the
71 * distribution.
72 *
73 * 3. All advertising materials mentioning features or use of this
74 * software must display the following acknowledgment:
75 * "This product includes software developed by the OpenSSL Project
76 * for use in the OpenSSL Toolkit. (http://www.openssl.org/)"
77 *
78 * 4. The names "OpenSSL Toolkit" and "OpenSSL Project" must not be used to
79 * endorse or promote products derived from this software without
80 * prior written permission. For written permission, please contact
81 * openssl-core@openssl.org.
82 *
83 * 5. Products derived from this software may not be called "OpenSSL"
84 * nor may "OpenSSL" appear in their names without prior written
85 * permission of the OpenSSL Project.
86 *
87 * 6. Redistributions of any form whatsoever must retain the following
88 * acknowledgment:
89 * "This product includes software developed by the OpenSSL Project
90 * for use in the OpenSSL Toolkit (http://www.openssl.org/)"
91 *
92 * THIS SOFTWARE IS PROVIDED BY THE OpenSSL PROJECT ``AS IS'' AND ANY
93 * EXPRESSED OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
94 * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
95 * PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE OpenSSL PROJECT OR
96 * ITS CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL,
97 * SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT
98 * NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES;
99 * LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION)
100 * HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT,
101 * STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE)
102 * ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED
103 * OF THE POSSIBILITY OF SUCH DAMAGE.
104 * ====================================================================
105 *
106 * This product includes cryptographic software written by Eric Young
107 * (eay@cryptsoft.com). This product includes software written by Tim
108 * Hudson (tjh@cryptsoft.com).
109 *
110 */
58 111
59#include <stdio.h> 112#include <stdio.h>
60#include <openssl/objects.h> 113#include <openssl/objects.h>
@@ -92,11 +145,6 @@ long tls1_default_timeout(void)
92 return(60*60*2); 145 return(60*60*2);
93 } 146 }
94 147
95IMPLEMENT_tls1_meth_func(tlsv1_base_method,
96 ssl_undefined_function,
97 ssl_undefined_function,
98 ssl_bad_method)
99
100int tls1_new(SSL *s) 148int tls1_new(SSL *s)
101 { 149 {
102 if (!ssl3_new(s)) return(0); 150 if (!ssl3_new(s)) return(0);
@@ -106,6 +154,12 @@ int tls1_new(SSL *s)
106 154
107void tls1_free(SSL *s) 155void tls1_free(SSL *s)
108 { 156 {
157#ifndef OPENSSL_NO_TLSEXT
158 if (s->tlsext_session_ticket)
159 {
160 OPENSSL_free(s->tlsext_session_ticket);
161 }
162#endif /* OPENSSL_NO_TLSEXT */
109 ssl3_free(s); 163 ssl3_free(s);
110 } 164 }
111 165
@@ -115,17 +169,105 @@ void tls1_clear(SSL *s)
115 s->version=TLS1_VERSION; 169 s->version=TLS1_VERSION;
116 } 170 }
117 171
118#if 0 172#ifndef OPENSSL_NO_EC
119long tls1_ctrl(SSL *s, int cmd, long larg, char *parg) 173static int nid_list[] =
120 { 174 {
121 return(0); 175 NID_sect163k1, /* sect163k1 (1) */
176 NID_sect163r1, /* sect163r1 (2) */
177 NID_sect163r2, /* sect163r2 (3) */
178 NID_sect193r1, /* sect193r1 (4) */
179 NID_sect193r2, /* sect193r2 (5) */
180 NID_sect233k1, /* sect233k1 (6) */
181 NID_sect233r1, /* sect233r1 (7) */
182 NID_sect239k1, /* sect239k1 (8) */
183 NID_sect283k1, /* sect283k1 (9) */
184 NID_sect283r1, /* sect283r1 (10) */
185 NID_sect409k1, /* sect409k1 (11) */
186 NID_sect409r1, /* sect409r1 (12) */
187 NID_sect571k1, /* sect571k1 (13) */
188 NID_sect571r1, /* sect571r1 (14) */
189 NID_secp160k1, /* secp160k1 (15) */
190 NID_secp160r1, /* secp160r1 (16) */
191 NID_secp160r2, /* secp160r2 (17) */
192 NID_secp192k1, /* secp192k1 (18) */
193 NID_X9_62_prime192v1, /* secp192r1 (19) */
194 NID_secp224k1, /* secp224k1 (20) */
195 NID_secp224r1, /* secp224r1 (21) */
196 NID_secp256k1, /* secp256k1 (22) */
197 NID_X9_62_prime256v1, /* secp256r1 (23) */
198 NID_secp384r1, /* secp384r1 (24) */
199 NID_secp521r1 /* secp521r1 (25) */
200 };
201
202int tls1_ec_curve_id2nid(int curve_id)
203 {
204 /* ECC curves from draft-ietf-tls-ecc-12.txt (Oct. 17, 2005) */
205 if ((curve_id < 1) || ((unsigned int)curve_id >
206 sizeof(nid_list)/sizeof(nid_list[0])))
207 return 0;
208 return nid_list[curve_id-1];
122 } 209 }
123 210
124long tls1_callback_ctrl(SSL *s, int cmd, void *(*fp)()) 211int tls1_ec_nid2curve_id(int nid)
125 { 212 {
126 return(0); 213 /* ECC curves from draft-ietf-tls-ecc-12.txt (Oct. 17, 2005) */
214 switch (nid)
215 {
216 case NID_sect163k1: /* sect163k1 (1) */
217 return 1;
218 case NID_sect163r1: /* sect163r1 (2) */
219 return 2;
220 case NID_sect163r2: /* sect163r2 (3) */
221 return 3;
222 case NID_sect193r1: /* sect193r1 (4) */
223 return 4;
224 case NID_sect193r2: /* sect193r2 (5) */
225 return 5;
226 case NID_sect233k1: /* sect233k1 (6) */
227 return 6;
228 case NID_sect233r1: /* sect233r1 (7) */
229 return 7;
230 case NID_sect239k1: /* sect239k1 (8) */
231 return 8;
232 case NID_sect283k1: /* sect283k1 (9) */
233 return 9;
234 case NID_sect283r1: /* sect283r1 (10) */
235 return 10;
236 case NID_sect409k1: /* sect409k1 (11) */
237 return 11;
238 case NID_sect409r1: /* sect409r1 (12) */
239 return 12;
240 case NID_sect571k1: /* sect571k1 (13) */
241 return 13;
242 case NID_sect571r1: /* sect571r1 (14) */
243 return 14;
244 case NID_secp160k1: /* secp160k1 (15) */
245 return 15;
246 case NID_secp160r1: /* secp160r1 (16) */
247 return 16;
248 case NID_secp160r2: /* secp160r2 (17) */
249 return 17;
250 case NID_secp192k1: /* secp192k1 (18) */
251 return 18;
252 case NID_X9_62_prime192v1: /* secp192r1 (19) */
253 return 19;
254 case NID_secp224k1: /* secp224k1 (20) */
255 return 20;
256 case NID_secp224r1: /* secp224r1 (21) */
257 return 21;
258 case NID_secp256k1: /* secp256k1 (22) */
259 return 22;
260 case NID_X9_62_prime256v1: /* secp256r1 (23) */
261 return 23;
262 case NID_secp384r1: /* secp384r1 (24) */
263 return 24;
264 case NID_secp521r1: /* secp521r1 (25) */
265 return 25;
266 default:
267 return 0;
268 }
127 } 269 }
128#endif 270#endif /* OPENSSL_NO_EC */
129 271
130#ifndef OPENSSL_NO_TLSEXT 272#ifndef OPENSSL_NO_TLSEXT
131unsigned char *ssl_add_clienthello_tlsext(SSL *s, unsigned char *p, unsigned char *limit) 273unsigned char *ssl_add_clienthello_tlsext(SSL *s, unsigned char *p, unsigned char *limit)
@@ -133,6 +275,11 @@ unsigned char *ssl_add_clienthello_tlsext(SSL *s, unsigned char *p, unsigned cha
133 int extdatalen=0; 275 int extdatalen=0;
134 unsigned char *ret = p; 276 unsigned char *ret = p;
135 277
278 /* don't add extensions for SSLv3 unless doing secure renegotiation */
279 if (s->client_version == SSL3_VERSION
280 && !s->s3->send_connection_binding)
281 return p;
282
136 ret+=2; 283 ret+=2;
137 284
138 if (ret>=limit) return NULL; /* this really never occurs, but ... */ 285 if (ret>=limit) return NULL; /* this really never occurs, but ... */
@@ -152,7 +299,7 @@ unsigned char *ssl_add_clienthello_tlsext(SSL *s, unsigned char *p, unsigned cha
152 */ 299 */
153 300
154 if ((lenmax = limit - ret - 9) < 0 301 if ((lenmax = limit - ret - 9) < 0
155 || (size_str = strlen(s->tlsext_hostname)) > (unsigned long)lenmax) 302 || (size_str = strlen(s->tlsext_hostname)) > (unsigned long)lenmax)
156 return NULL; 303 return NULL;
157 304
158 /* extension type and length */ 305 /* extension type and length */
@@ -167,21 +314,108 @@ unsigned char *ssl_add_clienthello_tlsext(SSL *s, unsigned char *p, unsigned cha
167 s2n(size_str,ret); 314 s2n(size_str,ret);
168 memcpy(ret, s->tlsext_hostname, size_str); 315 memcpy(ret, s->tlsext_hostname, size_str);
169 ret+=size_str; 316 ret+=size_str;
317 }
170 318
319 /* Add RI if renegotiating */
320 if (s->new_session)
321 {
322 int el;
323
324 if(!ssl_add_clienthello_renegotiate_ext(s, 0, &el, 0))
325 {
326 SSLerr(SSL_F_SSL_ADD_CLIENTHELLO_TLSEXT, ERR_R_INTERNAL_ERROR);
327 return NULL;
328 }
329
330 if((limit - p - 4 - el) < 0) return NULL;
331
332 s2n(TLSEXT_TYPE_renegotiate,ret);
333 s2n(el,ret);
334
335 if(!ssl_add_clienthello_renegotiate_ext(s, ret, &el, el))
336 {
337 SSLerr(SSL_F_SSL_ADD_CLIENTHELLO_TLSEXT, ERR_R_INTERNAL_ERROR);
338 return NULL;
339 }
340
341 ret += el;
342 }
343
344#ifndef OPENSSL_NO_EC
345 if (s->tlsext_ecpointformatlist != NULL &&
346 s->version != DTLS1_VERSION)
347 {
348 /* Add TLS extension ECPointFormats to the ClientHello message */
349 long lenmax;
350
351 if ((lenmax = limit - ret - 5) < 0) return NULL;
352 if (s->tlsext_ecpointformatlist_length > (unsigned long)lenmax) return NULL;
353 if (s->tlsext_ecpointformatlist_length > 255)
354 {
355 SSLerr(SSL_F_SSL_ADD_CLIENTHELLO_TLSEXT, ERR_R_INTERNAL_ERROR);
356 return NULL;
357 }
358
359 s2n(TLSEXT_TYPE_ec_point_formats,ret);
360 s2n(s->tlsext_ecpointformatlist_length + 1,ret);
361 *(ret++) = (unsigned char) s->tlsext_ecpointformatlist_length;
362 memcpy(ret, s->tlsext_ecpointformatlist, s->tlsext_ecpointformatlist_length);
363 ret+=s->tlsext_ecpointformatlist_length;
364 }
365 if (s->tlsext_ellipticcurvelist != NULL &&
366 s->version != DTLS1_VERSION)
367 {
368 /* Add TLS extension EllipticCurves to the ClientHello message */
369 long lenmax;
370
371 if ((lenmax = limit - ret - 6) < 0) return NULL;
372 if (s->tlsext_ellipticcurvelist_length > (unsigned long)lenmax) return NULL;
373 if (s->tlsext_ellipticcurvelist_length > 65532)
374 {
375 SSLerr(SSL_F_SSL_ADD_CLIENTHELLO_TLSEXT, ERR_R_INTERNAL_ERROR);
376 return NULL;
377 }
378
379 s2n(TLSEXT_TYPE_elliptic_curves,ret);
380 s2n(s->tlsext_ellipticcurvelist_length + 2, ret);
381
382 /* NB: draft-ietf-tls-ecc-12.txt uses a one-byte prefix for
383 * elliptic_curve_list, but the examples use two bytes.
384 * http://www1.ietf.org/mail-archive/web/tls/current/msg00538.html
385 * resolves this to two bytes.
386 */
387 s2n(s->tlsext_ellipticcurvelist_length, ret);
388 memcpy(ret, s->tlsext_ellipticcurvelist, s->tlsext_ellipticcurvelist_length);
389 ret+=s->tlsext_ellipticcurvelist_length;
171 } 390 }
391#endif /* OPENSSL_NO_EC */
172 392
173 if (!(SSL_get_options(s) & SSL_OP_NO_TICKET)) 393 if (!(SSL_get_options(s) & SSL_OP_NO_TICKET))
174 { 394 {
175 int ticklen; 395 int ticklen;
176 if (s->session && s->session->tlsext_tick) 396 if (!s->new_session && s->session && s->session->tlsext_tick)
177 ticklen = s->session->tlsext_ticklen; 397 ticklen = s->session->tlsext_ticklen;
398 else if (s->session && s->tlsext_session_ticket &&
399 s->tlsext_session_ticket->data)
400 {
401 ticklen = s->tlsext_session_ticket->length;
402 s->session->tlsext_tick = OPENSSL_malloc(ticklen);
403 if (!s->session->tlsext_tick)
404 return NULL;
405 memcpy(s->session->tlsext_tick,
406 s->tlsext_session_ticket->data,
407 ticklen);
408 s->session->tlsext_ticklen = ticklen;
409 }
178 else 410 else
179 ticklen = 0; 411 ticklen = 0;
412 if (ticklen == 0 && s->tlsext_session_ticket &&
413 s->tlsext_session_ticket->data == NULL)
414 goto skip_ext;
180 /* Check for enough room 2 for extension type, 2 for len 415 /* Check for enough room 2 for extension type, 2 for len
181 * rest for ticket 416 * rest for ticket
182 */ 417 */
183 if (limit - ret - 4 - ticklen < 0) 418 if ((long)(limit - ret - 4 - ticklen) < 0) return NULL;
184 return NULL;
185 s2n(TLSEXT_TYPE_session_ticket,ret); 419 s2n(TLSEXT_TYPE_session_ticket,ret);
186 s2n(ticklen,ret); 420 s2n(ticklen,ret);
187 if (ticklen) 421 if (ticklen)
@@ -190,8 +424,29 @@ unsigned char *ssl_add_clienthello_tlsext(SSL *s, unsigned char *p, unsigned cha
190 ret += ticklen; 424 ret += ticklen;
191 } 425 }
192 } 426 }
427 skip_ext:
193 428
194 if (s->tlsext_status_type == TLSEXT_STATUSTYPE_ocsp) 429#ifdef TLSEXT_TYPE_opaque_prf_input
430 if (s->s3->client_opaque_prf_input != NULL &&
431 s->version != DTLS1_VERSION)
432 {
433 size_t col = s->s3->client_opaque_prf_input_len;
434
435 if ((long)(limit - ret - 6 - col < 0))
436 return NULL;
437 if (col > 0xFFFD) /* can't happen */
438 return NULL;
439
440 s2n(TLSEXT_TYPE_opaque_prf_input, ret);
441 s2n(col + 2, ret);
442 s2n(col, ret);
443 memcpy(ret, s->s3->client_opaque_prf_input, col);
444 ret += col;
445 }
446#endif
447
448 if (s->tlsext_status_type == TLSEXT_STATUSTYPE_ocsp &&
449 s->version != DTLS1_VERSION)
195 { 450 {
196 int i; 451 int i;
197 long extlen, idlen, itmp; 452 long extlen, idlen, itmp;
@@ -251,21 +506,74 @@ unsigned char *ssl_add_serverhello_tlsext(SSL *s, unsigned char *p, unsigned cha
251 int extdatalen=0; 506 int extdatalen=0;
252 unsigned char *ret = p; 507 unsigned char *ret = p;
253 508
509 /* don't add extensions for SSLv3, unless doing secure renegotiation */
510 if (s->version == SSL3_VERSION && !s->s3->send_connection_binding)
511 return p;
512
254 ret+=2; 513 ret+=2;
255 if (ret>=limit) return NULL; /* this really never occurs, but ... */ 514 if (ret>=limit) return NULL; /* this really never occurs, but ... */
256 515
257 if (!s->hit && s->servername_done == 1 && s->session->tlsext_hostname != NULL) 516 if (!s->hit && s->servername_done == 1 && s->session->tlsext_hostname != NULL)
258 { 517 {
259 if (limit - ret - 4 < 0) return NULL; 518 if ((long)(limit - ret - 4) < 0) return NULL;
260 519
261 s2n(TLSEXT_TYPE_server_name,ret); 520 s2n(TLSEXT_TYPE_server_name,ret);
262 s2n(0,ret); 521 s2n(0,ret);
263 } 522 }
264 523
524 if(s->s3->send_connection_binding)
525 {
526 int el;
527
528 if(!ssl_add_serverhello_renegotiate_ext(s, 0, &el, 0))
529 {
530 SSLerr(SSL_F_SSL_ADD_SERVERHELLO_TLSEXT, ERR_R_INTERNAL_ERROR);
531 return NULL;
532 }
533
534 if((limit - p - 4 - el) < 0) return NULL;
535
536 s2n(TLSEXT_TYPE_renegotiate,ret);
537 s2n(el,ret);
538
539 if(!ssl_add_serverhello_renegotiate_ext(s, ret, &el, el))
540 {
541 SSLerr(SSL_F_SSL_ADD_SERVERHELLO_TLSEXT, ERR_R_INTERNAL_ERROR);
542 return NULL;
543 }
544
545 ret += el;
546 }
547
548#ifndef OPENSSL_NO_EC
549 if (s->tlsext_ecpointformatlist != NULL &&
550 s->version != DTLS1_VERSION)
551 {
552 /* Add TLS extension ECPointFormats to the ServerHello message */
553 long lenmax;
554
555 if ((lenmax = limit - ret - 5) < 0) return NULL;
556 if (s->tlsext_ecpointformatlist_length > (unsigned long)lenmax) return NULL;
557 if (s->tlsext_ecpointformatlist_length > 255)
558 {
559 SSLerr(SSL_F_SSL_ADD_SERVERHELLO_TLSEXT, ERR_R_INTERNAL_ERROR);
560 return NULL;
561 }
562
563 s2n(TLSEXT_TYPE_ec_point_formats,ret);
564 s2n(s->tlsext_ecpointformatlist_length + 1,ret);
565 *(ret++) = (unsigned char) s->tlsext_ecpointformatlist_length;
566 memcpy(ret, s->tlsext_ecpointformatlist, s->tlsext_ecpointformatlist_length);
567 ret+=s->tlsext_ecpointformatlist_length;
568
569 }
570 /* Currently the server should not respond with a SupportedCurves extension */
571#endif /* OPENSSL_NO_EC */
572
265 if (s->tlsext_ticket_expected 573 if (s->tlsext_ticket_expected
266 && !(SSL_get_options(s) & SSL_OP_NO_TICKET)) 574 && !(SSL_get_options(s) & SSL_OP_NO_TICKET))
267 { 575 {
268 if (limit - ret - 4 < 0) return NULL; 576 if ((long)(limit - ret - 4) < 0) return NULL;
269 s2n(TLSEXT_TYPE_session_ticket,ret); 577 s2n(TLSEXT_TYPE_session_ticket,ret);
270 s2n(0,ret); 578 s2n(0,ret);
271 } 579 }
@@ -277,6 +585,39 @@ unsigned char *ssl_add_serverhello_tlsext(SSL *s, unsigned char *p, unsigned cha
277 s2n(0,ret); 585 s2n(0,ret);
278 } 586 }
279 587
588#ifdef TLSEXT_TYPE_opaque_prf_input
589 if (s->s3->server_opaque_prf_input != NULL &&
590 s->version != DTLS1_VERSION)
591 {
592 size_t sol = s->s3->server_opaque_prf_input_len;
593
594 if ((long)(limit - ret - 6 - sol) < 0)
595 return NULL;
596 if (sol > 0xFFFD) /* can't happen */
597 return NULL;
598
599 s2n(TLSEXT_TYPE_opaque_prf_input, ret);
600 s2n(sol + 2, ret);
601 s2n(sol, ret);
602 memcpy(ret, s->s3->server_opaque_prf_input, sol);
603 ret += sol;
604 }
605#endif
606 if (((s->s3->tmp.new_cipher->id & 0xFFFF)==0x80 || (s->s3->tmp.new_cipher->id & 0xFFFF)==0x81)
607 && (SSL_get_options(s) & SSL_OP_CRYPTOPRO_TLSEXT_BUG))
608 { const unsigned char cryptopro_ext[36] = {
609 0xfd, 0xe8, /*65000*/
610 0x00, 0x20, /*32 bytes length*/
611 0x30, 0x1e, 0x30, 0x08, 0x06, 0x06, 0x2a, 0x85,
612 0x03, 0x02, 0x02, 0x09, 0x30, 0x08, 0x06, 0x06,
613 0x2a, 0x85, 0x03, 0x02, 0x02, 0x16, 0x30, 0x08,
614 0x06, 0x06, 0x2a, 0x85, 0x03, 0x02, 0x02, 0x17};
615 if (limit-ret<36) return NULL;
616 memcpy(ret,cryptopro_ext,36);
617 ret+=36;
618
619 }
620
280 if ((extdatalen = ret-p-2)== 0) 621 if ((extdatalen = ret-p-2)== 0)
281 return p; 622 return p;
282 623
@@ -290,15 +631,17 @@ int ssl_parse_clienthello_tlsext(SSL *s, unsigned char **p, unsigned char *d, in
290 unsigned short size; 631 unsigned short size;
291 unsigned short len; 632 unsigned short len;
292 unsigned char *data = *p; 633 unsigned char *data = *p;
634 int renegotiate_seen = 0;
635
293 s->servername_done = 0; 636 s->servername_done = 0;
294 s->tlsext_status_type = -1; 637 s->tlsext_status_type = -1;
295 638
296 if (data >= (d+n-2)) 639 if (data >= (d+n-2))
297 return 1; 640 goto ri_check;
298 n2s(data,len); 641 n2s(data,len);
299 642
300 if (data > (d+n-len)) 643 if (data > (d+n-len))
301 return 1; 644 goto ri_check;
302 645
303 while (data <= (d+n-4)) 646 while (data <= (d+n-4))
304 { 647 {
@@ -306,8 +649,10 @@ int ssl_parse_clienthello_tlsext(SSL *s, unsigned char **p, unsigned char *d, in
306 n2s(data,size); 649 n2s(data,size);
307 650
308 if (data+size > (d+n)) 651 if (data+size > (d+n))
309 return 1; 652 goto ri_check;
310 653#if 0
654 fprintf(stderr,"Received extension type %d size %d\n",type,size);
655#endif
311 if (s->tlsext_debug_cb) 656 if (s->tlsext_debug_cb)
312 s->tlsext_debug_cb(s, 0, type, data, size, 657 s->tlsext_debug_cb(s, 0, type, data, size,
313 s->tlsext_debug_arg); 658 s->tlsext_debug_arg);
@@ -407,8 +752,114 @@ int ssl_parse_clienthello_tlsext(SSL *s, unsigned char **p, unsigned char *d, in
407 } 752 }
408 753
409 } 754 }
410 else if (type == TLSEXT_TYPE_status_request 755
411 && s->ctx->tlsext_status_cb) 756#ifndef OPENSSL_NO_EC
757 else if (type == TLSEXT_TYPE_ec_point_formats &&
758 s->version != DTLS1_VERSION)
759 {
760 unsigned char *sdata = data;
761 int ecpointformatlist_length = *(sdata++);
762
763 if (ecpointformatlist_length != size - 1)
764 {
765 *al = TLS1_AD_DECODE_ERROR;
766 return 0;
767 }
768 s->session->tlsext_ecpointformatlist_length = 0;
769 if (s->session->tlsext_ecpointformatlist != NULL) OPENSSL_free(s->session->tlsext_ecpointformatlist);
770 if ((s->session->tlsext_ecpointformatlist = OPENSSL_malloc(ecpointformatlist_length)) == NULL)
771 {
772 *al = TLS1_AD_INTERNAL_ERROR;
773 return 0;
774 }
775 s->session->tlsext_ecpointformatlist_length = ecpointformatlist_length;
776 memcpy(s->session->tlsext_ecpointformatlist, sdata, ecpointformatlist_length);
777#if 0
778 fprintf(stderr,"ssl_parse_clienthello_tlsext s->session->tlsext_ecpointformatlist (length=%i) ", s->session->tlsext_ecpointformatlist_length);
779 sdata = s->session->tlsext_ecpointformatlist;
780 for (i = 0; i < s->session->tlsext_ecpointformatlist_length; i++)
781 fprintf(stderr,"%i ",*(sdata++));
782 fprintf(stderr,"\n");
783#endif
784 }
785 else if (type == TLSEXT_TYPE_elliptic_curves &&
786 s->version != DTLS1_VERSION)
787 {
788 unsigned char *sdata = data;
789 int ellipticcurvelist_length = (*(sdata++) << 8);
790 ellipticcurvelist_length += (*(sdata++));
791
792 if (ellipticcurvelist_length != size - 2)
793 {
794 *al = TLS1_AD_DECODE_ERROR;
795 return 0;
796 }
797 s->session->tlsext_ellipticcurvelist_length = 0;
798 if (s->session->tlsext_ellipticcurvelist != NULL) OPENSSL_free(s->session->tlsext_ellipticcurvelist);
799 if ((s->session->tlsext_ellipticcurvelist = OPENSSL_malloc(ellipticcurvelist_length)) == NULL)
800 {
801 *al = TLS1_AD_INTERNAL_ERROR;
802 return 0;
803 }
804 s->session->tlsext_ellipticcurvelist_length = ellipticcurvelist_length;
805 memcpy(s->session->tlsext_ellipticcurvelist, sdata, ellipticcurvelist_length);
806#if 0
807 fprintf(stderr,"ssl_parse_clienthello_tlsext s->session->tlsext_ellipticcurvelist (length=%i) ", s->session->tlsext_ellipticcurvelist_length);
808 sdata = s->session->tlsext_ellipticcurvelist;
809 for (i = 0; i < s->session->tlsext_ellipticcurvelist_length; i++)
810 fprintf(stderr,"%i ",*(sdata++));
811 fprintf(stderr,"\n");
812#endif
813 }
814#endif /* OPENSSL_NO_EC */
815#ifdef TLSEXT_TYPE_opaque_prf_input
816 else if (type == TLSEXT_TYPE_opaque_prf_input &&
817 s->version != DTLS1_VERSION)
818 {
819 unsigned char *sdata = data;
820
821 if (size < 2)
822 {
823 *al = SSL_AD_DECODE_ERROR;
824 return 0;
825 }
826 n2s(sdata, s->s3->client_opaque_prf_input_len);
827 if (s->s3->client_opaque_prf_input_len != size - 2)
828 {
829 *al = SSL_AD_DECODE_ERROR;
830 return 0;
831 }
832
833 if (s->s3->client_opaque_prf_input != NULL) /* shouldn't really happen */
834 OPENSSL_free(s->s3->client_opaque_prf_input);
835 if (s->s3->client_opaque_prf_input_len == 0)
836 s->s3->client_opaque_prf_input = OPENSSL_malloc(1); /* dummy byte just to get non-NULL */
837 else
838 s->s3->client_opaque_prf_input = BUF_memdup(sdata, s->s3->client_opaque_prf_input_len);
839 if (s->s3->client_opaque_prf_input == NULL)
840 {
841 *al = TLS1_AD_INTERNAL_ERROR;
842 return 0;
843 }
844 }
845#endif
846 else if (type == TLSEXT_TYPE_session_ticket)
847 {
848 if (s->tls_session_ticket_ext_cb &&
849 !s->tls_session_ticket_ext_cb(s, data, size, s->tls_session_ticket_ext_cb_arg))
850 {
851 *al = TLS1_AD_INTERNAL_ERROR;
852 return 0;
853 }
854 }
855 else if (type == TLSEXT_TYPE_renegotiate)
856 {
857 if(!ssl_parse_clienthello_renegotiate_ext(s, data, size, al))
858 return 0;
859 renegotiate_seen = 1;
860 }
861 else if (type == TLSEXT_TYPE_status_request &&
862 s->version != DTLS1_VERSION && s->ctx->tlsext_status_cb)
412 { 863 {
413 864
414 if (size < 5) 865 if (size < 5)
@@ -507,12 +958,26 @@ int ssl_parse_clienthello_tlsext(SSL *s, unsigned char **p, unsigned char *d, in
507 else 958 else
508 s->tlsext_status_type = -1; 959 s->tlsext_status_type = -1;
509 } 960 }
961
510 /* session ticket processed earlier */ 962 /* session ticket processed earlier */
963 data+=size;
964 }
965
966 *p = data;
511 967
512 data+=size; 968 ri_check:
969
970 /* Need RI if renegotiating */
971
972 if (!renegotiate_seen && s->new_session &&
973 !(s->options & SSL_OP_ALLOW_UNSAFE_LEGACY_RENEGOTIATION))
974 {
975 *al = SSL_AD_HANDSHAKE_FAILURE;
976 SSLerr(SSL_F_SSL_PARSE_CLIENTHELLO_TLSEXT,
977 SSL_R_UNSAFE_LEGACY_RENEGOTIATION_DISABLED);
978 return 0;
513 } 979 }
514 980
515 *p = data;
516 return 1; 981 return 1;
517 } 982 }
518 983
@@ -522,11 +987,11 @@ int ssl_parse_serverhello_tlsext(SSL *s, unsigned char **p, unsigned char *d, in
522 unsigned short size; 987 unsigned short size;
523 unsigned short len; 988 unsigned short len;
524 unsigned char *data = *p; 989 unsigned char *data = *p;
525
526 int tlsext_servername = 0; 990 int tlsext_servername = 0;
991 int renegotiate_seen = 0;
527 992
528 if (data >= (d+n-2)) 993 if (data >= (d+n-2))
529 return 1; 994 goto ri_check;
530 995
531 n2s(data,len); 996 n2s(data,len);
532 997
@@ -536,7 +1001,7 @@ int ssl_parse_serverhello_tlsext(SSL *s, unsigned char **p, unsigned char *d, in
536 n2s(data,size); 1001 n2s(data,size);
537 1002
538 if (data+size > (d+n)) 1003 if (data+size > (d+n))
539 return 1; 1004 goto ri_check;
540 1005
541 if (s->tlsext_debug_cb) 1006 if (s->tlsext_debug_cb)
542 s->tlsext_debug_cb(s, 1, type, data, size, 1007 s->tlsext_debug_cb(s, 1, type, data, size,
@@ -551,8 +1016,46 @@ int ssl_parse_serverhello_tlsext(SSL *s, unsigned char **p, unsigned char *d, in
551 } 1016 }
552 tlsext_servername = 1; 1017 tlsext_servername = 1;
553 } 1018 }
1019
1020#ifndef OPENSSL_NO_EC
1021 else if (type == TLSEXT_TYPE_ec_point_formats &&
1022 s->version != DTLS1_VERSION)
1023 {
1024 unsigned char *sdata = data;
1025 int ecpointformatlist_length = *(sdata++);
1026
1027 if (ecpointformatlist_length != size - 1)
1028 {
1029 *al = TLS1_AD_DECODE_ERROR;
1030 return 0;
1031 }
1032 s->session->tlsext_ecpointformatlist_length = 0;
1033 if (s->session->tlsext_ecpointformatlist != NULL) OPENSSL_free(s->session->tlsext_ecpointformatlist);
1034 if ((s->session->tlsext_ecpointformatlist = OPENSSL_malloc(ecpointformatlist_length)) == NULL)
1035 {
1036 *al = TLS1_AD_INTERNAL_ERROR;
1037 return 0;
1038 }
1039 s->session->tlsext_ecpointformatlist_length = ecpointformatlist_length;
1040 memcpy(s->session->tlsext_ecpointformatlist, sdata, ecpointformatlist_length);
1041#if 0
1042 fprintf(stderr,"ssl_parse_serverhello_tlsext s->session->tlsext_ecpointformatlist ");
1043 sdata = s->session->tlsext_ecpointformatlist;
1044 for (i = 0; i < s->session->tlsext_ecpointformatlist_length; i++)
1045 fprintf(stderr,"%i ",*(sdata++));
1046 fprintf(stderr,"\n");
1047#endif
1048 }
1049#endif /* OPENSSL_NO_EC */
1050
554 else if (type == TLSEXT_TYPE_session_ticket) 1051 else if (type == TLSEXT_TYPE_session_ticket)
555 { 1052 {
1053 if (s->tls_session_ticket_ext_cb &&
1054 !s->tls_session_ticket_ext_cb(s, data, size, s->tls_session_ticket_ext_cb_arg))
1055 {
1056 *al = TLS1_AD_INTERNAL_ERROR;
1057 return 0;
1058 }
556 if ((SSL_get_options(s) & SSL_OP_NO_TICKET) 1059 if ((SSL_get_options(s) & SSL_OP_NO_TICKET)
557 || (size > 0)) 1060 || (size > 0))
558 { 1061 {
@@ -561,7 +1064,40 @@ int ssl_parse_serverhello_tlsext(SSL *s, unsigned char **p, unsigned char *d, in
561 } 1064 }
562 s->tlsext_ticket_expected = 1; 1065 s->tlsext_ticket_expected = 1;
563 } 1066 }
564 else if (type == TLSEXT_TYPE_status_request) 1067#ifdef TLSEXT_TYPE_opaque_prf_input
1068 else if (type == TLSEXT_TYPE_opaque_prf_input &&
1069 s->version != DTLS1_VERSION)
1070 {
1071 unsigned char *sdata = data;
1072
1073 if (size < 2)
1074 {
1075 *al = SSL_AD_DECODE_ERROR;
1076 return 0;
1077 }
1078 n2s(sdata, s->s3->server_opaque_prf_input_len);
1079 if (s->s3->server_opaque_prf_input_len != size - 2)
1080 {
1081 *al = SSL_AD_DECODE_ERROR;
1082 return 0;
1083 }
1084
1085 if (s->s3->server_opaque_prf_input != NULL) /* shouldn't really happen */
1086 OPENSSL_free(s->s3->server_opaque_prf_input);
1087 if (s->s3->server_opaque_prf_input_len == 0)
1088 s->s3->server_opaque_prf_input = OPENSSL_malloc(1); /* dummy byte just to get non-NULL */
1089 else
1090 s->s3->server_opaque_prf_input = BUF_memdup(sdata, s->s3->server_opaque_prf_input_len);
1091
1092 if (s->s3->server_opaque_prf_input == NULL)
1093 {
1094 *al = TLS1_AD_INTERNAL_ERROR;
1095 return 0;
1096 }
1097 }
1098#endif
1099 else if (type == TLSEXT_TYPE_status_request &&
1100 s->version != DTLS1_VERSION)
565 { 1101 {
566 /* MUST be empty and only sent if we've requested 1102 /* MUST be empty and only sent if we've requested
567 * a status request message. 1103 * a status request message.
@@ -574,7 +1110,12 @@ int ssl_parse_serverhello_tlsext(SSL *s, unsigned char **p, unsigned char *d, in
574 /* Set flag to expect CertificateStatus message */ 1110 /* Set flag to expect CertificateStatus message */
575 s->tlsext_status_expected = 1; 1111 s->tlsext_status_expected = 1;
576 } 1112 }
577 1113 else if (type == TLSEXT_TYPE_renegotiate)
1114 {
1115 if(!ssl_parse_serverhello_renegotiate_ext(s, data, size, al))
1116 return 0;
1117 renegotiate_seen = 1;
1118 }
578 data+=size; 1119 data+=size;
579 } 1120 }
580 1121
@@ -606,6 +1147,148 @@ int ssl_parse_serverhello_tlsext(SSL *s, unsigned char **p, unsigned char *d, in
606 } 1147 }
607 1148
608 *p = data; 1149 *p = data;
1150
1151 ri_check:
1152
1153 /* Determine if we need to see RI. Strictly speaking if we want to
1154 * avoid an attack we should *always* see RI even on initial server
1155 * hello because the client doesn't see any renegotiation during an
1156 * attack. However this would mean we could not connect to any server
1157 * which doesn't support RI so for the immediate future tolerate RI
1158 * absence on initial connect only.
1159 */
1160 if (!renegotiate_seen
1161 && !(s->options & SSL_OP_LEGACY_SERVER_CONNECT)
1162 && !(s->options & SSL_OP_ALLOW_UNSAFE_LEGACY_RENEGOTIATION))
1163 {
1164 *al = SSL_AD_HANDSHAKE_FAILURE;
1165 SSLerr(SSL_F_SSL_PARSE_SERVERHELLO_TLSEXT,
1166 SSL_R_UNSAFE_LEGACY_RENEGOTIATION_DISABLED);
1167 return 0;
1168 }
1169
1170 return 1;
1171 }
1172
1173
1174int ssl_prepare_clienthello_tlsext(SSL *s)
1175 {
1176#ifndef OPENSSL_NO_EC
1177 /* If we are client and using an elliptic curve cryptography cipher suite, send the point formats
1178 * and elliptic curves we support.
1179 */
1180 int using_ecc = 0;
1181 int i;
1182 unsigned char *j;
1183 unsigned long alg_k, alg_a;
1184 STACK_OF(SSL_CIPHER) *cipher_stack = SSL_get_ciphers(s);
1185
1186 for (i = 0; i < sk_SSL_CIPHER_num(cipher_stack); i++)
1187 {
1188 SSL_CIPHER *c = sk_SSL_CIPHER_value(cipher_stack, i);
1189
1190 alg_k = c->algorithm_mkey;
1191 alg_a = c->algorithm_auth;
1192 if ((alg_k & (SSL_kEECDH|SSL_kECDHr|SSL_kECDHe) || (alg_a & SSL_aECDSA)))
1193 {
1194 using_ecc = 1;
1195 break;
1196 }
1197 }
1198 using_ecc = using_ecc && (s->version == TLS1_VERSION);
1199 if (using_ecc)
1200 {
1201 if (s->tlsext_ecpointformatlist != NULL) OPENSSL_free(s->tlsext_ecpointformatlist);
1202 if ((s->tlsext_ecpointformatlist = OPENSSL_malloc(3)) == NULL)
1203 {
1204 SSLerr(SSL_F_SSL_PREPARE_CLIENTHELLO_TLSEXT,ERR_R_MALLOC_FAILURE);
1205 return -1;
1206 }
1207 s->tlsext_ecpointformatlist_length = 3;
1208 s->tlsext_ecpointformatlist[0] = TLSEXT_ECPOINTFORMAT_uncompressed;
1209 s->tlsext_ecpointformatlist[1] = TLSEXT_ECPOINTFORMAT_ansiX962_compressed_prime;
1210 s->tlsext_ecpointformatlist[2] = TLSEXT_ECPOINTFORMAT_ansiX962_compressed_char2;
1211
1212 /* we support all named elliptic curves in draft-ietf-tls-ecc-12 */
1213 if (s->tlsext_ellipticcurvelist != NULL) OPENSSL_free(s->tlsext_ellipticcurvelist);
1214 s->tlsext_ellipticcurvelist_length = sizeof(nid_list)/sizeof(nid_list[0]) * 2;
1215 if ((s->tlsext_ellipticcurvelist = OPENSSL_malloc(s->tlsext_ellipticcurvelist_length)) == NULL)
1216 {
1217 s->tlsext_ellipticcurvelist_length = 0;
1218 SSLerr(SSL_F_SSL_PREPARE_CLIENTHELLO_TLSEXT,ERR_R_MALLOC_FAILURE);
1219 return -1;
1220 }
1221 for (i = 1, j = s->tlsext_ellipticcurvelist; (unsigned int)i <=
1222 sizeof(nid_list)/sizeof(nid_list[0]); i++)
1223 s2n(i,j);
1224 }
1225#endif /* OPENSSL_NO_EC */
1226
1227#ifdef TLSEXT_TYPE_opaque_prf_input
1228 {
1229 int r = 1;
1230
1231 if (s->ctx->tlsext_opaque_prf_input_callback != 0)
1232 {
1233 r = s->ctx->tlsext_opaque_prf_input_callback(s, NULL, 0, s->ctx->tlsext_opaque_prf_input_callback_arg);
1234 if (!r)
1235 return -1;
1236 }
1237
1238 if (s->tlsext_opaque_prf_input != NULL)
1239 {
1240 if (s->s3->client_opaque_prf_input != NULL) /* shouldn't really happen */
1241 OPENSSL_free(s->s3->client_opaque_prf_input);
1242
1243 if (s->tlsext_opaque_prf_input_len == 0)
1244 s->s3->client_opaque_prf_input = OPENSSL_malloc(1); /* dummy byte just to get non-NULL */
1245 else
1246 s->s3->client_opaque_prf_input = BUF_memdup(s->tlsext_opaque_prf_input, s->tlsext_opaque_prf_input_len);
1247 if (s->s3->client_opaque_prf_input == NULL)
1248 {
1249 SSLerr(SSL_F_SSL_PREPARE_CLIENTHELLO_TLSEXT,ERR_R_MALLOC_FAILURE);
1250 return -1;
1251 }
1252 s->s3->client_opaque_prf_input_len = s->tlsext_opaque_prf_input_len;
1253 }
1254
1255 if (r == 2)
1256 /* at callback's request, insist on receiving an appropriate server opaque PRF input */
1257 s->s3->server_opaque_prf_input_len = s->tlsext_opaque_prf_input_len;
1258 }
1259#endif
1260
1261 return 1;
1262 }
1263
1264int ssl_prepare_serverhello_tlsext(SSL *s)
1265 {
1266#ifndef OPENSSL_NO_EC
1267 /* If we are server and using an ECC cipher suite, send the point formats we support
1268 * if the client sent us an ECPointsFormat extension. Note that the server is not
1269 * supposed to send an EllipticCurves extension.
1270 */
1271
1272 unsigned long alg_k = s->s3->tmp.new_cipher->algorithm_mkey;
1273 unsigned long alg_a = s->s3->tmp.new_cipher->algorithm_auth;
1274 int using_ecc = (alg_k & (SSL_kEECDH|SSL_kECDHr|SSL_kECDHe)) || (alg_a & SSL_aECDSA);
1275 using_ecc = using_ecc && (s->session->tlsext_ecpointformatlist != NULL);
1276
1277 if (using_ecc)
1278 {
1279 if (s->tlsext_ecpointformatlist != NULL) OPENSSL_free(s->tlsext_ecpointformatlist);
1280 if ((s->tlsext_ecpointformatlist = OPENSSL_malloc(3)) == NULL)
1281 {
1282 SSLerr(SSL_F_SSL_PREPARE_SERVERHELLO_TLSEXT,ERR_R_MALLOC_FAILURE);
1283 return -1;
1284 }
1285 s->tlsext_ecpointformatlist_length = 3;
1286 s->tlsext_ecpointformatlist[0] = TLSEXT_ECPOINTFORMAT_uncompressed;
1287 s->tlsext_ecpointformatlist[1] = TLSEXT_ECPOINTFORMAT_ansiX962_compressed_prime;
1288 s->tlsext_ecpointformatlist[2] = TLSEXT_ECPOINTFORMAT_ansiX962_compressed_char2;
1289 }
1290#endif /* OPENSSL_NO_EC */
1291
609 return 1; 1292 return 1;
610 } 1293 }
611 1294
@@ -614,6 +1297,15 @@ int ssl_check_clienthello_tlsext(SSL *s)
614 int ret=SSL_TLSEXT_ERR_NOACK; 1297 int ret=SSL_TLSEXT_ERR_NOACK;
615 int al = SSL_AD_UNRECOGNIZED_NAME; 1298 int al = SSL_AD_UNRECOGNIZED_NAME;
616 1299
1300#ifndef OPENSSL_NO_EC
1301 /* The handling of the ECPointFormats extension is done elsewhere, namely in
1302 * ssl3_choose_cipher in s3_lib.c.
1303 */
1304 /* The handling of the EllipticCurves extension is done elsewhere, namely in
1305 * ssl3_choose_cipher in s3_lib.c.
1306 */
1307#endif
1308
617 if (s->ctx != NULL && s->ctx->tlsext_servername_callback != 0) 1309 if (s->ctx != NULL && s->ctx->tlsext_servername_callback != 0)
618 ret = s->ctx->tlsext_servername_callback(s, &al, s->ctx->tlsext_servername_arg); 1310 ret = s->ctx->tlsext_servername_callback(s, &al, s->ctx->tlsext_servername_arg);
619 else if (s->initial_ctx != NULL && s->initial_ctx->tlsext_servername_callback != 0) 1311 else if (s->initial_ctx != NULL && s->initial_ctx->tlsext_servername_callback != 0)
@@ -623,7 +1315,7 @@ int ssl_check_clienthello_tlsext(SSL *s)
623 * Note: this must be called after servername callbacks in case 1315 * Note: this must be called after servername callbacks in case
624 * the certificate has changed. 1316 * the certificate has changed.
625 */ 1317 */
626 if ((s->tlsext_status_type != -1) && s->ctx->tlsext_status_cb) 1318 if ((s->tlsext_status_type != -1) && s->ctx && s->ctx->tlsext_status_cb)
627 { 1319 {
628 int r; 1320 int r;
629 r = s->ctx->tlsext_status_cb(s, s->ctx->tlsext_status_arg); 1321 r = s->ctx->tlsext_status_cb(s, s->ctx->tlsext_status_arg);
@@ -649,7 +1341,65 @@ int ssl_check_clienthello_tlsext(SSL *s)
649 } 1341 }
650 else 1342 else
651 s->tlsext_status_expected = 0; 1343 s->tlsext_status_expected = 0;
652 err: 1344
1345#ifdef TLSEXT_TYPE_opaque_prf_input
1346 {
1347 /* This sort of belongs into ssl_prepare_serverhello_tlsext(),
1348 * but we might be sending an alert in response to the client hello,
1349 * so this has to happen here in ssl_check_clienthello_tlsext(). */
1350
1351 int r = 1;
1352
1353 if (s->ctx->tlsext_opaque_prf_input_callback != 0)
1354 {
1355 r = s->ctx->tlsext_opaque_prf_input_callback(s, NULL, 0, s->ctx->tlsext_opaque_prf_input_callback_arg);
1356 if (!r)
1357 {
1358 ret = SSL_TLSEXT_ERR_ALERT_FATAL;
1359 al = SSL_AD_INTERNAL_ERROR;
1360 goto err;
1361 }
1362 }
1363
1364 if (s->s3->server_opaque_prf_input != NULL) /* shouldn't really happen */
1365 OPENSSL_free(s->s3->server_opaque_prf_input);
1366 s->s3->server_opaque_prf_input = NULL;
1367
1368 if (s->tlsext_opaque_prf_input != NULL)
1369 {
1370 if (s->s3->client_opaque_prf_input != NULL &&
1371 s->s3->client_opaque_prf_input_len == s->tlsext_opaque_prf_input_len)
1372 {
1373 /* can only use this extension if we have a server opaque PRF input
1374 * of the same length as the client opaque PRF input! */
1375
1376 if (s->tlsext_opaque_prf_input_len == 0)
1377 s->s3->server_opaque_prf_input = OPENSSL_malloc(1); /* dummy byte just to get non-NULL */
1378 else
1379 s->s3->server_opaque_prf_input = BUF_memdup(s->tlsext_opaque_prf_input, s->tlsext_opaque_prf_input_len);
1380 if (s->s3->server_opaque_prf_input == NULL)
1381 {
1382 ret = SSL_TLSEXT_ERR_ALERT_FATAL;
1383 al = SSL_AD_INTERNAL_ERROR;
1384 goto err;
1385 }
1386 s->s3->server_opaque_prf_input_len = s->tlsext_opaque_prf_input_len;
1387 }
1388 }
1389
1390 if (r == 2 && s->s3->server_opaque_prf_input == NULL)
1391 {
1392 /* The callback wants to enforce use of the extension,
1393 * but we can't do that with the client opaque PRF input;
1394 * abort the handshake.
1395 */
1396 ret = SSL_TLSEXT_ERR_ALERT_FATAL;
1397 al = SSL_AD_HANDSHAKE_FAILURE;
1398 }
1399 }
1400
1401#endif
1402 err:
653 switch (ret) 1403 switch (ret)
654 { 1404 {
655 case SSL_TLSEXT_ERR_ALERT_FATAL: 1405 case SSL_TLSEXT_ERR_ALERT_FATAL:
@@ -672,16 +1422,75 @@ int ssl_check_serverhello_tlsext(SSL *s)
672 int ret=SSL_TLSEXT_ERR_NOACK; 1422 int ret=SSL_TLSEXT_ERR_NOACK;
673 int al = SSL_AD_UNRECOGNIZED_NAME; 1423 int al = SSL_AD_UNRECOGNIZED_NAME;
674 1424
1425#ifndef OPENSSL_NO_EC
1426 /* If we are client and using an elliptic curve cryptography cipher suite, then server
1427 * must return a an EC point formats lists containing uncompressed.
1428 */
1429 unsigned long alg_k = s->s3->tmp.new_cipher->algorithm_mkey;
1430 unsigned long alg_a = s->s3->tmp.new_cipher->algorithm_auth;
1431 if ((s->tlsext_ecpointformatlist != NULL) && (s->tlsext_ecpointformatlist_length > 0) &&
1432 ((alg_k & (SSL_kEECDH|SSL_kECDHr|SSL_kECDHe)) || (alg_a & SSL_aECDSA)))
1433 {
1434 /* we are using an ECC cipher */
1435 size_t i;
1436 unsigned char *list;
1437 int found_uncompressed = 0;
1438 if ((s->session->tlsext_ecpointformatlist == NULL) || (s->session->tlsext_ecpointformatlist_length == 0))
1439 {
1440 SSLerr(SSL_F_SSL_CHECK_SERVERHELLO_TLSEXT,SSL_R_TLS_INVALID_ECPOINTFORMAT_LIST);
1441 return -1;
1442 }
1443 list = s->session->tlsext_ecpointformatlist;
1444 for (i = 0; i < s->session->tlsext_ecpointformatlist_length; i++)
1445 {
1446 if (*(list++) == TLSEXT_ECPOINTFORMAT_uncompressed)
1447 {
1448 found_uncompressed = 1;
1449 break;
1450 }
1451 }
1452 if (!found_uncompressed)
1453 {
1454 SSLerr(SSL_F_SSL_CHECK_SERVERHELLO_TLSEXT,SSL_R_TLS_INVALID_ECPOINTFORMAT_LIST);
1455 return -1;
1456 }
1457 }
1458 ret = SSL_TLSEXT_ERR_OK;
1459#endif /* OPENSSL_NO_EC */
1460
675 if (s->ctx != NULL && s->ctx->tlsext_servername_callback != 0) 1461 if (s->ctx != NULL && s->ctx->tlsext_servername_callback != 0)
676 ret = s->ctx->tlsext_servername_callback(s, &al, s->ctx->tlsext_servername_arg); 1462 ret = s->ctx->tlsext_servername_callback(s, &al, s->ctx->tlsext_servername_arg);
677 else if (s->initial_ctx != NULL && s->initial_ctx->tlsext_servername_callback != 0) 1463 else if (s->initial_ctx != NULL && s->initial_ctx->tlsext_servername_callback != 0)
678 ret = s->initial_ctx->tlsext_servername_callback(s, &al, s->initial_ctx->tlsext_servername_arg); 1464 ret = s->initial_ctx->tlsext_servername_callback(s, &al, s->initial_ctx->tlsext_servername_arg);
679 1465
1466#ifdef TLSEXT_TYPE_opaque_prf_input
1467 if (s->s3->server_opaque_prf_input_len > 0)
1468 {
1469 /* This case may indicate that we, as a client, want to insist on using opaque PRF inputs.
1470 * So first verify that we really have a value from the server too. */
1471
1472 if (s->s3->server_opaque_prf_input == NULL)
1473 {
1474 ret = SSL_TLSEXT_ERR_ALERT_FATAL;
1475 al = SSL_AD_HANDSHAKE_FAILURE;
1476 }
1477
1478 /* Anytime the server *has* sent an opaque PRF input, we need to check
1479 * that we have a client opaque PRF input of the same size. */
1480 if (s->s3->client_opaque_prf_input == NULL ||
1481 s->s3->client_opaque_prf_input_len != s->s3->server_opaque_prf_input_len)
1482 {
1483 ret = SSL_TLSEXT_ERR_ALERT_FATAL;
1484 al = SSL_AD_ILLEGAL_PARAMETER;
1485 }
1486 }
1487#endif
1488
680 /* If we've requested certificate status and we wont get one 1489 /* If we've requested certificate status and we wont get one
681 * tell the callback 1490 * tell the callback
682 */ 1491 */
683 if ((s->tlsext_status_type != -1) && !(s->tlsext_status_expected) 1492 if ((s->tlsext_status_type != -1) && !(s->tlsext_status_expected)
684 && s->ctx->tlsext_status_cb) 1493 && s->ctx && s->ctx->tlsext_status_cb)
685 { 1494 {
686 int r; 1495 int r;
687 /* Set resp to NULL, resplen to -1 so callback knows 1496 /* Set resp to NULL, resplen to -1 so callback knows
@@ -745,6 +1554,14 @@ int tls1_process_ticket(SSL *s, unsigned char *session_id, int len,
745 return 1; 1554 return 1;
746 if (p >= limit) 1555 if (p >= limit)
747 return -1; 1556 return -1;
1557 /* Skip past DTLS cookie */
1558 if (s->version == DTLS1_VERSION || s->version == DTLS1_BAD_VER)
1559 {
1560 i = *(p++);
1561 p+= i;
1562 if (p >= limit)
1563 return -1;
1564 }
748 /* Skip past cipher list */ 1565 /* Skip past cipher list */
749 n2s(p, i); 1566 n2s(p, i);
750 p+= i; 1567 p+= i;
@@ -768,6 +1585,11 @@ int tls1_process_ticket(SSL *s, unsigned char *session_id, int len,
768 return 1; 1585 return 1;
769 if (type == TLSEXT_TYPE_session_ticket) 1586 if (type == TLSEXT_TYPE_session_ticket)
770 { 1587 {
1588 /* If tickets disabled indicate cache miss which will
1589 * trigger a full handshake
1590 */
1591 if (SSL_get_options(s) & SSL_OP_NO_TICKET)
1592 return 1;
771 /* If zero length note client will accept a ticket 1593 /* If zero length note client will accept a ticket
772 * and indicate cache miss to trigger full handshake 1594 * and indicate cache miss to trigger full handshake
773 */ 1595 */
@@ -776,6 +1598,15 @@ int tls1_process_ticket(SSL *s, unsigned char *session_id, int len,
776 s->tlsext_ticket_expected = 1; 1598 s->tlsext_ticket_expected = 1;
777 return 0; /* Cache miss */ 1599 return 0; /* Cache miss */
778 } 1600 }
1601 if (s->tls_session_secret_cb)
1602 {
1603 /* Indicate cache miss here and instead of
1604 * generating the session from ticket now,
1605 * trigger abbreviated handshake based on
1606 * external mechanism to calculate the master
1607 * secret later. */
1608 return 0;
1609 }
779 return tls_decrypt_ticket(s, p, size, session_id, len, 1610 return tls_decrypt_ticket(s, p, size, session_id, len,
780 ret); 1611 ret);
781 } 1612 }
@@ -795,16 +1626,17 @@ static int tls_decrypt_ticket(SSL *s, const unsigned char *etick, int eticklen,
795 unsigned char tick_hmac[EVP_MAX_MD_SIZE]; 1626 unsigned char tick_hmac[EVP_MAX_MD_SIZE];
796 HMAC_CTX hctx; 1627 HMAC_CTX hctx;
797 EVP_CIPHER_CTX ctx; 1628 EVP_CIPHER_CTX ctx;
1629 SSL_CTX *tctx = s->initial_ctx;
798 /* Need at least keyname + iv + some encrypted data */ 1630 /* Need at least keyname + iv + some encrypted data */
799 if (eticklen < 48) 1631 if (eticklen < 48)
800 goto tickerr; 1632 goto tickerr;
801 /* Initialize session ticket encryption and HMAC contexts */ 1633 /* Initialize session ticket encryption and HMAC contexts */
802 HMAC_CTX_init(&hctx); 1634 HMAC_CTX_init(&hctx);
803 EVP_CIPHER_CTX_init(&ctx); 1635 EVP_CIPHER_CTX_init(&ctx);
804 if (s->ctx->tlsext_ticket_key_cb) 1636 if (tctx->tlsext_ticket_key_cb)
805 { 1637 {
806 unsigned char *nctick = (unsigned char *)etick; 1638 unsigned char *nctick = (unsigned char *)etick;
807 int rv = s->ctx->tlsext_ticket_key_cb(s, nctick, nctick + 16, 1639 int rv = tctx->tlsext_ticket_key_cb(s, nctick, nctick + 16,
808 &ctx, &hctx, 0); 1640 &ctx, &hctx, 0);
809 if (rv < 0) 1641 if (rv < 0)
810 return -1; 1642 return -1;
@@ -816,17 +1648,22 @@ static int tls_decrypt_ticket(SSL *s, const unsigned char *etick, int eticklen,
816 else 1648 else
817 { 1649 {
818 /* Check key name matches */ 1650 /* Check key name matches */
819 if (memcmp(etick, s->ctx->tlsext_tick_key_name, 16)) 1651 if (memcmp(etick, tctx->tlsext_tick_key_name, 16))
820 goto tickerr; 1652 goto tickerr;
821 HMAC_Init_ex(&hctx, s->ctx->tlsext_tick_hmac_key, 16, 1653 HMAC_Init_ex(&hctx, tctx->tlsext_tick_hmac_key, 16,
822 tlsext_tick_md(), NULL); 1654 tlsext_tick_md(), NULL);
823 EVP_DecryptInit_ex(&ctx, EVP_aes_128_cbc(), NULL, 1655 EVP_DecryptInit_ex(&ctx, EVP_aes_128_cbc(), NULL,
824 s->ctx->tlsext_tick_aes_key, etick + 16); 1656 tctx->tlsext_tick_aes_key, etick + 16);
825 } 1657 }
826 /* Attempt to process session ticket, first conduct sanity and 1658 /* Attempt to process session ticket, first conduct sanity and
827 * integrity checks on ticket. 1659 * integrity checks on ticket.
828 */ 1660 */
829 mlen = HMAC_size(&hctx); 1661 mlen = HMAC_size(&hctx);
1662 if (mlen < 0)
1663 {
1664 EVP_CIPHER_CTX_cleanup(&ctx);
1665 return -1;
1666 }
830 eticklen -= mlen; 1667 eticklen -= mlen;
831 /* Check HMAC of encrypted ticket */ 1668 /* Check HMAC of encrypted ticket */
832 HMAC_Update(&hctx, etick, eticklen); 1669 HMAC_Update(&hctx, etick, eticklen);
generated by cgit v1.2.3-55-g6feb (git 2.39.1) at 2025-11-03 01:49:20 +0000