summaryrefslogtreecommitdiff
path: root/src/lib/libssl/t1_lib.c
diff options
context:
space:
mode:
Diffstat (limited to 'src/lib/libssl/t1_lib.c')
-rw-r--r--src/lib/libssl/t1_lib.c917
1 files changed, 40 insertions, 877 deletions
diff --git a/src/lib/libssl/t1_lib.c b/src/lib/libssl/t1_lib.c
index e8bc34c111..9ce726996d 100644
--- a/src/lib/libssl/t1_lib.c
+++ b/src/lib/libssl/t1_lib.c
@@ -55,59 +55,6 @@
55 * copied and put under another distribution licence 55 * copied and put under another distribution licence
56 * [including the GNU Public Licence.] 56 * [including the GNU Public Licence.]
57 */ 57 */
58/* ====================================================================
59 * Copyright (c) 1998-2007 The OpenSSL Project. All rights reserved.
60 *
61 * Redistribution and use in source and binary forms, with or without
62 * modification, are permitted provided that the following conditions
63 * are met:
64 *
65 * 1. Redistributions of source code must retain the above copyright
66 * notice, this list of conditions and the following disclaimer.
67 *
68 * 2. Redistributions in binary form must reproduce the above copyright
69 * notice, this list of conditions and the following disclaimer in
70 * the documentation and/or other materials provided with the
71 * distribution.
72 *
73 * 3. All advertising materials mentioning features or use of this
74 * software must display the following acknowledgment:
75 * "This product includes software developed by the OpenSSL Project
76 * for use in the OpenSSL Toolkit. (http://www.openssl.org/)"
77 *
78 * 4. The names "OpenSSL Toolkit" and "OpenSSL Project" must not be used to
79 * endorse or promote products derived from this software without
80 * prior written permission. For written permission, please contact
81 * openssl-core@openssl.org.
82 *
83 * 5. Products derived from this software may not be called "OpenSSL"
84 * nor may "OpenSSL" appear in their names without prior written
85 * permission of the OpenSSL Project.
86 *
87 * 6. Redistributions of any form whatsoever must retain the following
88 * acknowledgment:
89 * "This product includes software developed by the OpenSSL Project
90 * for use in the OpenSSL Toolkit (http://www.openssl.org/)"
91 *
92 * THIS SOFTWARE IS PROVIDED BY THE OpenSSL PROJECT ``AS IS'' AND ANY
93 * EXPRESSED OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
94 * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
95 * PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE OpenSSL PROJECT OR
96 * ITS CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL,
97 * SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT
98 * NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES;
99 * LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION)
100 * HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT,
101 * STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE)
102 * ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED
103 * OF THE POSSIBILITY OF SUCH DAMAGE.
104 * ====================================================================
105 *
106 * This product includes cryptographic software written by Eric Young
107 * (eay@cryptsoft.com). This product includes software written by Tim
108 * Hudson (tjh@cryptsoft.com).
109 *
110 */
111 58
112#include <stdio.h> 59#include <stdio.h>
113#include <openssl/objects.h> 60#include <openssl/objects.h>
@@ -145,6 +92,11 @@ long tls1_default_timeout(void)
145 return(60*60*2); 92 return(60*60*2);
146 } 93 }
147 94
95IMPLEMENT_tls1_meth_func(tlsv1_base_method,
96 ssl_undefined_function,
97 ssl_undefined_function,
98 ssl_bad_method)
99
148int tls1_new(SSL *s) 100int tls1_new(SSL *s)
149 { 101 {
150 if (!ssl3_new(s)) return(0); 102 if (!ssl3_new(s)) return(0);
@@ -154,12 +106,6 @@ int tls1_new(SSL *s)
154 106
155void tls1_free(SSL *s) 107void tls1_free(SSL *s)
156 { 108 {
157#ifndef OPENSSL_NO_TLSEXT
158 if (s->tlsext_session_ticket)
159 {
160 OPENSSL_free(s->tlsext_session_ticket);
161 }
162#endif /* OPENSSL_NO_TLSEXT */
163 ssl3_free(s); 109 ssl3_free(s);
164 } 110 }
165 111
@@ -169,105 +115,17 @@ void tls1_clear(SSL *s)
169 s->version=TLS1_VERSION; 115 s->version=TLS1_VERSION;
170 } 116 }
171 117
172#ifndef OPENSSL_NO_EC 118#if 0
173static int nid_list[] = 119long tls1_ctrl(SSL *s, int cmd, long larg, char *parg)
174 {
175 NID_sect163k1, /* sect163k1 (1) */
176 NID_sect163r1, /* sect163r1 (2) */
177 NID_sect163r2, /* sect163r2 (3) */
178 NID_sect193r1, /* sect193r1 (4) */
179 NID_sect193r2, /* sect193r2 (5) */
180 NID_sect233k1, /* sect233k1 (6) */
181 NID_sect233r1, /* sect233r1 (7) */
182 NID_sect239k1, /* sect239k1 (8) */
183 NID_sect283k1, /* sect283k1 (9) */
184 NID_sect283r1, /* sect283r1 (10) */
185 NID_sect409k1, /* sect409k1 (11) */
186 NID_sect409r1, /* sect409r1 (12) */
187 NID_sect571k1, /* sect571k1 (13) */
188 NID_sect571r1, /* sect571r1 (14) */
189 NID_secp160k1, /* secp160k1 (15) */
190 NID_secp160r1, /* secp160r1 (16) */
191 NID_secp160r2, /* secp160r2 (17) */
192 NID_secp192k1, /* secp192k1 (18) */
193 NID_X9_62_prime192v1, /* secp192r1 (19) */
194 NID_secp224k1, /* secp224k1 (20) */
195 NID_secp224r1, /* secp224r1 (21) */
196 NID_secp256k1, /* secp256k1 (22) */
197 NID_X9_62_prime256v1, /* secp256r1 (23) */
198 NID_secp384r1, /* secp384r1 (24) */
199 NID_secp521r1 /* secp521r1 (25) */
200 };
201
202int tls1_ec_curve_id2nid(int curve_id)
203 { 120 {
204 /* ECC curves from draft-ietf-tls-ecc-12.txt (Oct. 17, 2005) */ 121 return(0);
205 if ((curve_id < 1) || ((unsigned int)curve_id >
206 sizeof(nid_list)/sizeof(nid_list[0])))
207 return 0;
208 return nid_list[curve_id-1];
209 } 122 }
210 123
211int tls1_ec_nid2curve_id(int nid) 124long tls1_callback_ctrl(SSL *s, int cmd, void *(*fp)())
212 { 125 {
213 /* ECC curves from draft-ietf-tls-ecc-12.txt (Oct. 17, 2005) */ 126 return(0);
214 switch (nid)
215 {
216 case NID_sect163k1: /* sect163k1 (1) */
217 return 1;
218 case NID_sect163r1: /* sect163r1 (2) */
219 return 2;
220 case NID_sect163r2: /* sect163r2 (3) */
221 return 3;
222 case NID_sect193r1: /* sect193r1 (4) */
223 return 4;
224 case NID_sect193r2: /* sect193r2 (5) */
225 return 5;
226 case NID_sect233k1: /* sect233k1 (6) */
227 return 6;
228 case NID_sect233r1: /* sect233r1 (7) */
229 return 7;
230 case NID_sect239k1: /* sect239k1 (8) */
231 return 8;
232 case NID_sect283k1: /* sect283k1 (9) */
233 return 9;
234 case NID_sect283r1: /* sect283r1 (10) */
235 return 10;
236 case NID_sect409k1: /* sect409k1 (11) */
237 return 11;
238 case NID_sect409r1: /* sect409r1 (12) */
239 return 12;
240 case NID_sect571k1: /* sect571k1 (13) */
241 return 13;
242 case NID_sect571r1: /* sect571r1 (14) */
243 return 14;
244 case NID_secp160k1: /* secp160k1 (15) */
245 return 15;
246 case NID_secp160r1: /* secp160r1 (16) */
247 return 16;
248 case NID_secp160r2: /* secp160r2 (17) */
249 return 17;
250 case NID_secp192k1: /* secp192k1 (18) */
251 return 18;
252 case NID_X9_62_prime192v1: /* secp192r1 (19) */
253 return 19;
254 case NID_secp224k1: /* secp224k1 (20) */
255 return 20;
256 case NID_secp224r1: /* secp224r1 (21) */
257 return 21;
258 case NID_secp256k1: /* secp256k1 (22) */
259 return 22;
260 case NID_X9_62_prime256v1: /* secp256r1 (23) */
261 return 23;
262 case NID_secp384r1: /* secp384r1 (24) */
263 return 24;
264 case NID_secp521r1: /* secp521r1 (25) */
265 return 25;
266 default:
267 return 0;
268 }
269 } 127 }
270#endif /* OPENSSL_NO_EC */ 128#endif
271 129
272#ifndef OPENSSL_NO_TLSEXT 130#ifndef OPENSSL_NO_TLSEXT
273unsigned char *ssl_add_clienthello_tlsext(SSL *s, unsigned char *p, unsigned char *limit) 131unsigned char *ssl_add_clienthello_tlsext(SSL *s, unsigned char *p, unsigned char *limit)
@@ -275,11 +133,6 @@ unsigned char *ssl_add_clienthello_tlsext(SSL *s, unsigned char *p, unsigned cha
275 int extdatalen=0; 133 int extdatalen=0;
276 unsigned char *ret = p; 134 unsigned char *ret = p;
277 135
278 /* don't add extensions for SSLv3 unless doing secure renegotiation */
279 if (s->client_version == SSL3_VERSION
280 && !s->s3->send_connection_binding)
281 return p;
282
283 ret+=2; 136 ret+=2;
284 137
285 if (ret>=limit) return NULL; /* this really never occurs, but ... */ 138 if (ret>=limit) return NULL; /* this really never occurs, but ... */
@@ -299,7 +152,7 @@ unsigned char *ssl_add_clienthello_tlsext(SSL *s, unsigned char *p, unsigned cha
299 */ 152 */
300 153
301 if ((lenmax = limit - ret - 9) < 0 154 if ((lenmax = limit - ret - 9) < 0
302 || (size_str = strlen(s->tlsext_hostname)) > (unsigned long)lenmax) 155 || (size_str = strlen(s->tlsext_hostname)) > (unsigned long)lenmax)
303 return NULL; 156 return NULL;
304 157
305 /* extension type and length */ 158 /* extension type and length */
@@ -314,108 +167,21 @@ unsigned char *ssl_add_clienthello_tlsext(SSL *s, unsigned char *p, unsigned cha
314 s2n(size_str,ret); 167 s2n(size_str,ret);
315 memcpy(ret, s->tlsext_hostname, size_str); 168 memcpy(ret, s->tlsext_hostname, size_str);
316 ret+=size_str; 169 ret+=size_str;
317 }
318 170
319 /* Add RI if renegotiating */
320 if (s->new_session)
321 {
322 int el;
323
324 if(!ssl_add_clienthello_renegotiate_ext(s, 0, &el, 0))
325 {
326 SSLerr(SSL_F_SSL_ADD_CLIENTHELLO_TLSEXT, ERR_R_INTERNAL_ERROR);
327 return NULL;
328 }
329
330 if((limit - p - 4 - el) < 0) return NULL;
331
332 s2n(TLSEXT_TYPE_renegotiate,ret);
333 s2n(el,ret);
334
335 if(!ssl_add_clienthello_renegotiate_ext(s, ret, &el, el))
336 {
337 SSLerr(SSL_F_SSL_ADD_CLIENTHELLO_TLSEXT, ERR_R_INTERNAL_ERROR);
338 return NULL;
339 }
340
341 ret += el;
342 }
343
344#ifndef OPENSSL_NO_EC
345 if (s->tlsext_ecpointformatlist != NULL &&
346 s->version != DTLS1_VERSION)
347 {
348 /* Add TLS extension ECPointFormats to the ClientHello message */
349 long lenmax;
350
351 if ((lenmax = limit - ret - 5) < 0) return NULL;
352 if (s->tlsext_ecpointformatlist_length > (unsigned long)lenmax) return NULL;
353 if (s->tlsext_ecpointformatlist_length > 255)
354 {
355 SSLerr(SSL_F_SSL_ADD_CLIENTHELLO_TLSEXT, ERR_R_INTERNAL_ERROR);
356 return NULL;
357 }
358
359 s2n(TLSEXT_TYPE_ec_point_formats,ret);
360 s2n(s->tlsext_ecpointformatlist_length + 1,ret);
361 *(ret++) = (unsigned char) s->tlsext_ecpointformatlist_length;
362 memcpy(ret, s->tlsext_ecpointformatlist, s->tlsext_ecpointformatlist_length);
363 ret+=s->tlsext_ecpointformatlist_length;
364 }
365 if (s->tlsext_ellipticcurvelist != NULL &&
366 s->version != DTLS1_VERSION)
367 {
368 /* Add TLS extension EllipticCurves to the ClientHello message */
369 long lenmax;
370
371 if ((lenmax = limit - ret - 6) < 0) return NULL;
372 if (s->tlsext_ellipticcurvelist_length > (unsigned long)lenmax) return NULL;
373 if (s->tlsext_ellipticcurvelist_length > 65532)
374 {
375 SSLerr(SSL_F_SSL_ADD_CLIENTHELLO_TLSEXT, ERR_R_INTERNAL_ERROR);
376 return NULL;
377 }
378
379 s2n(TLSEXT_TYPE_elliptic_curves,ret);
380 s2n(s->tlsext_ellipticcurvelist_length + 2, ret);
381
382 /* NB: draft-ietf-tls-ecc-12.txt uses a one-byte prefix for
383 * elliptic_curve_list, but the examples use two bytes.
384 * http://www1.ietf.org/mail-archive/web/tls/current/msg00538.html
385 * resolves this to two bytes.
386 */
387 s2n(s->tlsext_ellipticcurvelist_length, ret);
388 memcpy(ret, s->tlsext_ellipticcurvelist, s->tlsext_ellipticcurvelist_length);
389 ret+=s->tlsext_ellipticcurvelist_length;
390 } 171 }
391#endif /* OPENSSL_NO_EC */
392 172
393 if (!(SSL_get_options(s) & SSL_OP_NO_TICKET)) 173 if (!(SSL_get_options(s) & SSL_OP_NO_TICKET))
394 { 174 {
395 int ticklen; 175 int ticklen;
396 if (!s->new_session && s->session && s->session->tlsext_tick) 176 if (s->session && s->session->tlsext_tick)
397 ticklen = s->session->tlsext_ticklen; 177 ticklen = s->session->tlsext_ticklen;
398 else if (s->session && s->tlsext_session_ticket &&
399 s->tlsext_session_ticket->data)
400 {
401 ticklen = s->tlsext_session_ticket->length;
402 s->session->tlsext_tick = OPENSSL_malloc(ticklen);
403 if (!s->session->tlsext_tick)
404 return NULL;
405 memcpy(s->session->tlsext_tick,
406 s->tlsext_session_ticket->data,
407 ticklen);
408 s->session->tlsext_ticklen = ticklen;
409 }
410 else 178 else
411 ticklen = 0; 179 ticklen = 0;
412 if (ticklen == 0 && s->tlsext_session_ticket &&
413 s->tlsext_session_ticket->data == NULL)
414 goto skip_ext;
415 /* Check for enough room 2 for extension type, 2 for len 180 /* Check for enough room 2 for extension type, 2 for len
416 * rest for ticket 181 * rest for ticket
417 */ 182 */
418 if ((long)(limit - ret - 4 - ticklen) < 0) return NULL; 183 if (limit - ret - 4 - ticklen < 0)
184 return NULL;
419 s2n(TLSEXT_TYPE_session_ticket,ret); 185 s2n(TLSEXT_TYPE_session_ticket,ret);
420 s2n(ticklen,ret); 186 s2n(ticklen,ret);
421 if (ticklen) 187 if (ticklen)
@@ -424,29 +190,8 @@ unsigned char *ssl_add_clienthello_tlsext(SSL *s, unsigned char *p, unsigned cha
424 ret += ticklen; 190 ret += ticklen;
425 } 191 }
426 } 192 }
427 skip_ext:
428 193
429#ifdef TLSEXT_TYPE_opaque_prf_input 194 if (s->tlsext_status_type == TLSEXT_STATUSTYPE_ocsp)
430 if (s->s3->client_opaque_prf_input != NULL &&
431 s->version != DTLS1_VERSION)
432 {
433 size_t col = s->s3->client_opaque_prf_input_len;
434
435 if ((long)(limit - ret - 6 - col < 0))
436 return NULL;
437 if (col > 0xFFFD) /* can't happen */
438 return NULL;
439
440 s2n(TLSEXT_TYPE_opaque_prf_input, ret);
441 s2n(col + 2, ret);
442 s2n(col, ret);
443 memcpy(ret, s->s3->client_opaque_prf_input, col);
444 ret += col;
445 }
446#endif
447
448 if (s->tlsext_status_type == TLSEXT_STATUSTYPE_ocsp &&
449 s->version != DTLS1_VERSION)
450 { 195 {
451 int i; 196 int i;
452 long extlen, idlen, itmp; 197 long extlen, idlen, itmp;
@@ -506,74 +251,21 @@ unsigned char *ssl_add_serverhello_tlsext(SSL *s, unsigned char *p, unsigned cha
506 int extdatalen=0; 251 int extdatalen=0;
507 unsigned char *ret = p; 252 unsigned char *ret = p;
508 253
509 /* don't add extensions for SSLv3, unless doing secure renegotiation */
510 if (s->version == SSL3_VERSION && !s->s3->send_connection_binding)
511 return p;
512
513 ret+=2; 254 ret+=2;
514 if (ret>=limit) return NULL; /* this really never occurs, but ... */ 255 if (ret>=limit) return NULL; /* this really never occurs, but ... */
515 256
516 if (!s->hit && s->servername_done == 1 && s->session->tlsext_hostname != NULL) 257 if (!s->hit && s->servername_done == 1 && s->session->tlsext_hostname != NULL)
517 { 258 {
518 if ((long)(limit - ret - 4) < 0) return NULL; 259 if (limit - ret - 4 < 0) return NULL;
519 260
520 s2n(TLSEXT_TYPE_server_name,ret); 261 s2n(TLSEXT_TYPE_server_name,ret);
521 s2n(0,ret); 262 s2n(0,ret);
522 } 263 }
523 264
524 if(s->s3->send_connection_binding)
525 {
526 int el;
527
528 if(!ssl_add_serverhello_renegotiate_ext(s, 0, &el, 0))
529 {
530 SSLerr(SSL_F_SSL_ADD_SERVERHELLO_TLSEXT, ERR_R_INTERNAL_ERROR);
531 return NULL;
532 }
533
534 if((limit - p - 4 - el) < 0) return NULL;
535
536 s2n(TLSEXT_TYPE_renegotiate,ret);
537 s2n(el,ret);
538
539 if(!ssl_add_serverhello_renegotiate_ext(s, ret, &el, el))
540 {
541 SSLerr(SSL_F_SSL_ADD_SERVERHELLO_TLSEXT, ERR_R_INTERNAL_ERROR);
542 return NULL;
543 }
544
545 ret += el;
546 }
547
548#ifndef OPENSSL_NO_EC
549 if (s->tlsext_ecpointformatlist != NULL &&
550 s->version != DTLS1_VERSION)
551 {
552 /* Add TLS extension ECPointFormats to the ServerHello message */
553 long lenmax;
554
555 if ((lenmax = limit - ret - 5) < 0) return NULL;
556 if (s->tlsext_ecpointformatlist_length > (unsigned long)lenmax) return NULL;
557 if (s->tlsext_ecpointformatlist_length > 255)
558 {
559 SSLerr(SSL_F_SSL_ADD_SERVERHELLO_TLSEXT, ERR_R_INTERNAL_ERROR);
560 return NULL;
561 }
562
563 s2n(TLSEXT_TYPE_ec_point_formats,ret);
564 s2n(s->tlsext_ecpointformatlist_length + 1,ret);
565 *(ret++) = (unsigned char) s->tlsext_ecpointformatlist_length;
566 memcpy(ret, s->tlsext_ecpointformatlist, s->tlsext_ecpointformatlist_length);
567 ret+=s->tlsext_ecpointformatlist_length;
568
569 }
570 /* Currently the server should not respond with a SupportedCurves extension */
571#endif /* OPENSSL_NO_EC */
572
573 if (s->tlsext_ticket_expected 265 if (s->tlsext_ticket_expected
574 && !(SSL_get_options(s) & SSL_OP_NO_TICKET)) 266 && !(SSL_get_options(s) & SSL_OP_NO_TICKET))
575 { 267 {
576 if ((long)(limit - ret - 4) < 0) return NULL; 268 if (limit - ret - 4 < 0) return NULL;
577 s2n(TLSEXT_TYPE_session_ticket,ret); 269 s2n(TLSEXT_TYPE_session_ticket,ret);
578 s2n(0,ret); 270 s2n(0,ret);
579 } 271 }
@@ -585,39 +277,6 @@ unsigned char *ssl_add_serverhello_tlsext(SSL *s, unsigned char *p, unsigned cha
585 s2n(0,ret); 277 s2n(0,ret);
586 } 278 }
587 279
588#ifdef TLSEXT_TYPE_opaque_prf_input
589 if (s->s3->server_opaque_prf_input != NULL &&
590 s->version != DTLS1_VERSION)
591 {
592 size_t sol = s->s3->server_opaque_prf_input_len;
593
594 if ((long)(limit - ret - 6 - sol) < 0)
595 return NULL;
596 if (sol > 0xFFFD) /* can't happen */
597 return NULL;
598
599 s2n(TLSEXT_TYPE_opaque_prf_input, ret);
600 s2n(sol + 2, ret);
601 s2n(sol, ret);
602 memcpy(ret, s->s3->server_opaque_prf_input, sol);
603 ret += sol;
604 }
605#endif
606 if (((s->s3->tmp.new_cipher->id & 0xFFFF)==0x80 || (s->s3->tmp.new_cipher->id & 0xFFFF)==0x81)
607 && (SSL_get_options(s) & SSL_OP_CRYPTOPRO_TLSEXT_BUG))
608 { const unsigned char cryptopro_ext[36] = {
609 0xfd, 0xe8, /*65000*/
610 0x00, 0x20, /*32 bytes length*/
611 0x30, 0x1e, 0x30, 0x08, 0x06, 0x06, 0x2a, 0x85,
612 0x03, 0x02, 0x02, 0x09, 0x30, 0x08, 0x06, 0x06,
613 0x2a, 0x85, 0x03, 0x02, 0x02, 0x16, 0x30, 0x08,
614 0x06, 0x06, 0x2a, 0x85, 0x03, 0x02, 0x02, 0x17};
615 if (limit-ret<36) return NULL;
616 memcpy(ret,cryptopro_ext,36);
617 ret+=36;
618
619 }
620
621 if ((extdatalen = ret-p-2)== 0) 280 if ((extdatalen = ret-p-2)== 0)
622 return p; 281 return p;
623 282
@@ -631,17 +290,15 @@ int ssl_parse_clienthello_tlsext(SSL *s, unsigned char **p, unsigned char *d, in
631 unsigned short size; 290 unsigned short size;
632 unsigned short len; 291 unsigned short len;
633 unsigned char *data = *p; 292 unsigned char *data = *p;
634 int renegotiate_seen = 0;
635
636 s->servername_done = 0; 293 s->servername_done = 0;
637 s->tlsext_status_type = -1; 294 s->tlsext_status_type = -1;
638 295
639 if (data >= (d+n-2)) 296 if (data >= (d+n-2))
640 goto ri_check; 297 return 1;
641 n2s(data,len); 298 n2s(data,len);
642 299
643 if (data > (d+n-len)) 300 if (data > (d+n-len))
644 goto ri_check; 301 return 1;
645 302
646 while (data <= (d+n-4)) 303 while (data <= (d+n-4))
647 { 304 {
@@ -649,10 +306,8 @@ int ssl_parse_clienthello_tlsext(SSL *s, unsigned char **p, unsigned char *d, in
649 n2s(data,size); 306 n2s(data,size);
650 307
651 if (data+size > (d+n)) 308 if (data+size > (d+n))
652 goto ri_check; 309 return 1;
653#if 0 310
654 fprintf(stderr,"Received extension type %d size %d\n",type,size);
655#endif
656 if (s->tlsext_debug_cb) 311 if (s->tlsext_debug_cb)
657 s->tlsext_debug_cb(s, 0, type, data, size, 312 s->tlsext_debug_cb(s, 0, type, data, size,
658 s->tlsext_debug_arg); 313 s->tlsext_debug_arg);
@@ -752,114 +407,8 @@ int ssl_parse_clienthello_tlsext(SSL *s, unsigned char **p, unsigned char *d, in
752 } 407 }
753 408
754 } 409 }
755 410 else if (type == TLSEXT_TYPE_status_request
756#ifndef OPENSSL_NO_EC 411 && s->ctx->tlsext_status_cb)
757 else if (type == TLSEXT_TYPE_ec_point_formats &&
758 s->version != DTLS1_VERSION)
759 {
760 unsigned char *sdata = data;
761 int ecpointformatlist_length = *(sdata++);
762
763 if (ecpointformatlist_length != size - 1)
764 {
765 *al = TLS1_AD_DECODE_ERROR;
766 return 0;
767 }
768 s->session->tlsext_ecpointformatlist_length = 0;
769 if (s->session->tlsext_ecpointformatlist != NULL) OPENSSL_free(s->session->tlsext_ecpointformatlist);
770 if ((s->session->tlsext_ecpointformatlist = OPENSSL_malloc(ecpointformatlist_length)) == NULL)
771 {
772 *al = TLS1_AD_INTERNAL_ERROR;
773 return 0;
774 }
775 s->session->tlsext_ecpointformatlist_length = ecpointformatlist_length;
776 memcpy(s->session->tlsext_ecpointformatlist, sdata, ecpointformatlist_length);
777#if 0
778 fprintf(stderr,"ssl_parse_clienthello_tlsext s->session->tlsext_ecpointformatlist (length=%i) ", s->session->tlsext_ecpointformatlist_length);
779 sdata = s->session->tlsext_ecpointformatlist;
780 for (i = 0; i < s->session->tlsext_ecpointformatlist_length; i++)
781 fprintf(stderr,"%i ",*(sdata++));
782 fprintf(stderr,"\n");
783#endif
784 }
785 else if (type == TLSEXT_TYPE_elliptic_curves &&
786 s->version != DTLS1_VERSION)
787 {
788 unsigned char *sdata = data;
789 int ellipticcurvelist_length = (*(sdata++) << 8);
790 ellipticcurvelist_length += (*(sdata++));
791
792 if (ellipticcurvelist_length != size - 2)
793 {
794 *al = TLS1_AD_DECODE_ERROR;
795 return 0;
796 }
797 s->session->tlsext_ellipticcurvelist_length = 0;
798 if (s->session->tlsext_ellipticcurvelist != NULL) OPENSSL_free(s->session->tlsext_ellipticcurvelist);
799 if ((s->session->tlsext_ellipticcurvelist = OPENSSL_malloc(ellipticcurvelist_length)) == NULL)
800 {
801 *al = TLS1_AD_INTERNAL_ERROR;
802 return 0;
803 }
804 s->session->tlsext_ellipticcurvelist_length = ellipticcurvelist_length;
805 memcpy(s->session->tlsext_ellipticcurvelist, sdata, ellipticcurvelist_length);
806#if 0
807 fprintf(stderr,"ssl_parse_clienthello_tlsext s->session->tlsext_ellipticcurvelist (length=%i) ", s->session->tlsext_ellipticcurvelist_length);
808 sdata = s->session->tlsext_ellipticcurvelist;
809 for (i = 0; i < s->session->tlsext_ellipticcurvelist_length; i++)
810 fprintf(stderr,"%i ",*(sdata++));
811 fprintf(stderr,"\n");
812#endif
813 }
814#endif /* OPENSSL_NO_EC */
815#ifdef TLSEXT_TYPE_opaque_prf_input
816 else if (type == TLSEXT_TYPE_opaque_prf_input &&
817 s->version != DTLS1_VERSION)
818 {
819 unsigned char *sdata = data;
820
821 if (size < 2)
822 {
823 *al = SSL_AD_DECODE_ERROR;
824 return 0;
825 }
826 n2s(sdata, s->s3->client_opaque_prf_input_len);
827 if (s->s3->client_opaque_prf_input_len != size - 2)
828 {
829 *al = SSL_AD_DECODE_ERROR;
830 return 0;
831 }
832
833 if (s->s3->client_opaque_prf_input != NULL) /* shouldn't really happen */
834 OPENSSL_free(s->s3->client_opaque_prf_input);
835 if (s->s3->client_opaque_prf_input_len == 0)
836 s->s3->client_opaque_prf_input = OPENSSL_malloc(1); /* dummy byte just to get non-NULL */
837 else
838 s->s3->client_opaque_prf_input = BUF_memdup(sdata, s->s3->client_opaque_prf_input_len);
839 if (s->s3->client_opaque_prf_input == NULL)
840 {
841 *al = TLS1_AD_INTERNAL_ERROR;
842 return 0;
843 }
844 }
845#endif
846 else if (type == TLSEXT_TYPE_session_ticket)
847 {
848 if (s->tls_session_ticket_ext_cb &&
849 !s->tls_session_ticket_ext_cb(s, data, size, s->tls_session_ticket_ext_cb_arg))
850 {
851 *al = TLS1_AD_INTERNAL_ERROR;
852 return 0;
853 }
854 }
855 else if (type == TLSEXT_TYPE_renegotiate)
856 {
857 if(!ssl_parse_clienthello_renegotiate_ext(s, data, size, al))
858 return 0;
859 renegotiate_seen = 1;
860 }
861 else if (type == TLSEXT_TYPE_status_request &&
862 s->version != DTLS1_VERSION && s->ctx->tlsext_status_cb)
863 { 412 {
864 413
865 if (size < 5) 414 if (size < 5)
@@ -958,26 +507,12 @@ int ssl_parse_clienthello_tlsext(SSL *s, unsigned char **p, unsigned char *d, in
958 else 507 else
959 s->tlsext_status_type = -1; 508 s->tlsext_status_type = -1;
960 } 509 }
961
962 /* session ticket processed earlier */ 510 /* session ticket processed earlier */
963 data+=size;
964 }
965
966 *p = data;
967
968 ri_check:
969
970 /* Need RI if renegotiating */
971 511
972 if (!renegotiate_seen && s->new_session && 512 data+=size;
973 !(s->options & SSL_OP_ALLOW_UNSAFE_LEGACY_RENEGOTIATION))
974 {
975 *al = SSL_AD_HANDSHAKE_FAILURE;
976 SSLerr(SSL_F_SSL_PARSE_CLIENTHELLO_TLSEXT,
977 SSL_R_UNSAFE_LEGACY_RENEGOTIATION_DISABLED);
978 return 0;
979 } 513 }
980 514
515 *p = data;
981 return 1; 516 return 1;
982 } 517 }
983 518
@@ -987,11 +522,11 @@ int ssl_parse_serverhello_tlsext(SSL *s, unsigned char **p, unsigned char *d, in
987 unsigned short size; 522 unsigned short size;
988 unsigned short len; 523 unsigned short len;
989 unsigned char *data = *p; 524 unsigned char *data = *p;
525
990 int tlsext_servername = 0; 526 int tlsext_servername = 0;
991 int renegotiate_seen = 0;
992 527
993 if (data >= (d+n-2)) 528 if (data >= (d+n-2))
994 goto ri_check; 529 return 1;
995 530
996 n2s(data,len); 531 n2s(data,len);
997 532
@@ -1001,7 +536,7 @@ int ssl_parse_serverhello_tlsext(SSL *s, unsigned char **p, unsigned char *d, in
1001 n2s(data,size); 536 n2s(data,size);
1002 537
1003 if (data+size > (d+n)) 538 if (data+size > (d+n))
1004 goto ri_check; 539 return 1;
1005 540
1006 if (s->tlsext_debug_cb) 541 if (s->tlsext_debug_cb)
1007 s->tlsext_debug_cb(s, 1, type, data, size, 542 s->tlsext_debug_cb(s, 1, type, data, size,
@@ -1016,46 +551,8 @@ int ssl_parse_serverhello_tlsext(SSL *s, unsigned char **p, unsigned char *d, in
1016 } 551 }
1017 tlsext_servername = 1; 552 tlsext_servername = 1;
1018 } 553 }
1019
1020#ifndef OPENSSL_NO_EC
1021 else if (type == TLSEXT_TYPE_ec_point_formats &&
1022 s->version != DTLS1_VERSION)
1023 {
1024 unsigned char *sdata = data;
1025 int ecpointformatlist_length = *(sdata++);
1026
1027 if (ecpointformatlist_length != size - 1)
1028 {
1029 *al = TLS1_AD_DECODE_ERROR;
1030 return 0;
1031 }
1032 s->session->tlsext_ecpointformatlist_length = 0;
1033 if (s->session->tlsext_ecpointformatlist != NULL) OPENSSL_free(s->session->tlsext_ecpointformatlist);
1034 if ((s->session->tlsext_ecpointformatlist = OPENSSL_malloc(ecpointformatlist_length)) == NULL)
1035 {
1036 *al = TLS1_AD_INTERNAL_ERROR;
1037 return 0;
1038 }
1039 s->session->tlsext_ecpointformatlist_length = ecpointformatlist_length;
1040 memcpy(s->session->tlsext_ecpointformatlist, sdata, ecpointformatlist_length);
1041#if 0
1042 fprintf(stderr,"ssl_parse_serverhello_tlsext s->session->tlsext_ecpointformatlist ");
1043 sdata = s->session->tlsext_ecpointformatlist;
1044 for (i = 0; i < s->session->tlsext_ecpointformatlist_length; i++)
1045 fprintf(stderr,"%i ",*(sdata++));
1046 fprintf(stderr,"\n");
1047#endif
1048 }
1049#endif /* OPENSSL_NO_EC */
1050
1051 else if (type == TLSEXT_TYPE_session_ticket) 554 else if (type == TLSEXT_TYPE_session_ticket)
1052 { 555 {
1053 if (s->tls_session_ticket_ext_cb &&
1054 !s->tls_session_ticket_ext_cb(s, data, size, s->tls_session_ticket_ext_cb_arg))
1055 {
1056 *al = TLS1_AD_INTERNAL_ERROR;
1057 return 0;
1058 }
1059 if ((SSL_get_options(s) & SSL_OP_NO_TICKET) 556 if ((SSL_get_options(s) & SSL_OP_NO_TICKET)
1060 || (size > 0)) 557 || (size > 0))
1061 { 558 {
@@ -1064,40 +561,7 @@ int ssl_parse_serverhello_tlsext(SSL *s, unsigned char **p, unsigned char *d, in
1064 } 561 }
1065 s->tlsext_ticket_expected = 1; 562 s->tlsext_ticket_expected = 1;
1066 } 563 }
1067#ifdef TLSEXT_TYPE_opaque_prf_input 564 else if (type == TLSEXT_TYPE_status_request)
1068 else if (type == TLSEXT_TYPE_opaque_prf_input &&
1069 s->version != DTLS1_VERSION)
1070 {
1071 unsigned char *sdata = data;
1072
1073 if (size < 2)
1074 {
1075 *al = SSL_AD_DECODE_ERROR;
1076 return 0;
1077 }
1078 n2s(sdata, s->s3->server_opaque_prf_input_len);
1079 if (s->s3->server_opaque_prf_input_len != size - 2)
1080 {
1081 *al = SSL_AD_DECODE_ERROR;
1082 return 0;
1083 }
1084
1085 if (s->s3->server_opaque_prf_input != NULL) /* shouldn't really happen */
1086 OPENSSL_free(s->s3->server_opaque_prf_input);
1087 if (s->s3->server_opaque_prf_input_len == 0)
1088 s->s3->server_opaque_prf_input = OPENSSL_malloc(1); /* dummy byte just to get non-NULL */
1089 else
1090 s->s3->server_opaque_prf_input = BUF_memdup(sdata, s->s3->server_opaque_prf_input_len);
1091
1092 if (s->s3->server_opaque_prf_input == NULL)
1093 {
1094 *al = TLS1_AD_INTERNAL_ERROR;
1095 return 0;
1096 }
1097 }
1098#endif
1099 else if (type == TLSEXT_TYPE_status_request &&
1100 s->version != DTLS1_VERSION)
1101 { 565 {
1102 /* MUST be empty and only sent if we've requested 566 /* MUST be empty and only sent if we've requested
1103 * a status request message. 567 * a status request message.
@@ -1110,12 +574,7 @@ int ssl_parse_serverhello_tlsext(SSL *s, unsigned char **p, unsigned char *d, in
1110 /* Set flag to expect CertificateStatus message */ 574 /* Set flag to expect CertificateStatus message */
1111 s->tlsext_status_expected = 1; 575 s->tlsext_status_expected = 1;
1112 } 576 }
1113 else if (type == TLSEXT_TYPE_renegotiate) 577
1114 {
1115 if(!ssl_parse_serverhello_renegotiate_ext(s, data, size, al))
1116 return 0;
1117 renegotiate_seen = 1;
1118 }
1119 data+=size; 578 data+=size;
1120 } 579 }
1121 580
@@ -1147,148 +606,6 @@ int ssl_parse_serverhello_tlsext(SSL *s, unsigned char **p, unsigned char *d, in
1147 } 606 }
1148 607
1149 *p = data; 608 *p = data;
1150
1151 ri_check:
1152
1153 /* Determine if we need to see RI. Strictly speaking if we want to
1154 * avoid an attack we should *always* see RI even on initial server
1155 * hello because the client doesn't see any renegotiation during an
1156 * attack. However this would mean we could not connect to any server
1157 * which doesn't support RI so for the immediate future tolerate RI
1158 * absence on initial connect only.
1159 */
1160 if (!renegotiate_seen
1161 && !(s->options & SSL_OP_LEGACY_SERVER_CONNECT)
1162 && !(s->options & SSL_OP_ALLOW_UNSAFE_LEGACY_RENEGOTIATION))
1163 {
1164 *al = SSL_AD_HANDSHAKE_FAILURE;
1165 SSLerr(SSL_F_SSL_PARSE_SERVERHELLO_TLSEXT,
1166 SSL_R_UNSAFE_LEGACY_RENEGOTIATION_DISABLED);
1167 return 0;
1168 }
1169
1170 return 1;
1171 }
1172
1173
1174int ssl_prepare_clienthello_tlsext(SSL *s)
1175 {
1176#ifndef OPENSSL_NO_EC
1177 /* If we are client and using an elliptic curve cryptography cipher suite, send the point formats
1178 * and elliptic curves we support.
1179 */
1180 int using_ecc = 0;
1181 int i;
1182 unsigned char *j;
1183 unsigned long alg_k, alg_a;
1184 STACK_OF(SSL_CIPHER) *cipher_stack = SSL_get_ciphers(s);
1185
1186 for (i = 0; i < sk_SSL_CIPHER_num(cipher_stack); i++)
1187 {
1188 SSL_CIPHER *c = sk_SSL_CIPHER_value(cipher_stack, i);
1189
1190 alg_k = c->algorithm_mkey;
1191 alg_a = c->algorithm_auth;
1192 if ((alg_k & (SSL_kEECDH|SSL_kECDHr|SSL_kECDHe) || (alg_a & SSL_aECDSA)))
1193 {
1194 using_ecc = 1;
1195 break;
1196 }
1197 }
1198 using_ecc = using_ecc && (s->version == TLS1_VERSION);
1199 if (using_ecc)
1200 {
1201 if (s->tlsext_ecpointformatlist != NULL) OPENSSL_free(s->tlsext_ecpointformatlist);
1202 if ((s->tlsext_ecpointformatlist = OPENSSL_malloc(3)) == NULL)
1203 {
1204 SSLerr(SSL_F_SSL_PREPARE_CLIENTHELLO_TLSEXT,ERR_R_MALLOC_FAILURE);
1205 return -1;
1206 }
1207 s->tlsext_ecpointformatlist_length = 3;
1208 s->tlsext_ecpointformatlist[0] = TLSEXT_ECPOINTFORMAT_uncompressed;
1209 s->tlsext_ecpointformatlist[1] = TLSEXT_ECPOINTFORMAT_ansiX962_compressed_prime;
1210 s->tlsext_ecpointformatlist[2] = TLSEXT_ECPOINTFORMAT_ansiX962_compressed_char2;
1211
1212 /* we support all named elliptic curves in draft-ietf-tls-ecc-12 */
1213 if (s->tlsext_ellipticcurvelist != NULL) OPENSSL_free(s->tlsext_ellipticcurvelist);
1214 s->tlsext_ellipticcurvelist_length = sizeof(nid_list)/sizeof(nid_list[0]) * 2;
1215 if ((s->tlsext_ellipticcurvelist = OPENSSL_malloc(s->tlsext_ellipticcurvelist_length)) == NULL)
1216 {
1217 s->tlsext_ellipticcurvelist_length = 0;
1218 SSLerr(SSL_F_SSL_PREPARE_CLIENTHELLO_TLSEXT,ERR_R_MALLOC_FAILURE);
1219 return -1;
1220 }
1221 for (i = 1, j = s->tlsext_ellipticcurvelist; (unsigned int)i <=
1222 sizeof(nid_list)/sizeof(nid_list[0]); i++)
1223 s2n(i,j);
1224 }
1225#endif /* OPENSSL_NO_EC */
1226
1227#ifdef TLSEXT_TYPE_opaque_prf_input
1228 {
1229 int r = 1;
1230
1231 if (s->ctx->tlsext_opaque_prf_input_callback != 0)
1232 {
1233 r = s->ctx->tlsext_opaque_prf_input_callback(s, NULL, 0, s->ctx->tlsext_opaque_prf_input_callback_arg);
1234 if (!r)
1235 return -1;
1236 }
1237
1238 if (s->tlsext_opaque_prf_input != NULL)
1239 {
1240 if (s->s3->client_opaque_prf_input != NULL) /* shouldn't really happen */
1241 OPENSSL_free(s->s3->client_opaque_prf_input);
1242
1243 if (s->tlsext_opaque_prf_input_len == 0)
1244 s->s3->client_opaque_prf_input = OPENSSL_malloc(1); /* dummy byte just to get non-NULL */
1245 else
1246 s->s3->client_opaque_prf_input = BUF_memdup(s->tlsext_opaque_prf_input, s->tlsext_opaque_prf_input_len);
1247 if (s->s3->client_opaque_prf_input == NULL)
1248 {
1249 SSLerr(SSL_F_SSL_PREPARE_CLIENTHELLO_TLSEXT,ERR_R_MALLOC_FAILURE);
1250 return -1;
1251 }
1252 s->s3->client_opaque_prf_input_len = s->tlsext_opaque_prf_input_len;
1253 }
1254
1255 if (r == 2)
1256 /* at callback's request, insist on receiving an appropriate server opaque PRF input */
1257 s->s3->server_opaque_prf_input_len = s->tlsext_opaque_prf_input_len;
1258 }
1259#endif
1260
1261 return 1;
1262 }
1263
1264int ssl_prepare_serverhello_tlsext(SSL *s)
1265 {
1266#ifndef OPENSSL_NO_EC
1267 /* If we are server and using an ECC cipher suite, send the point formats we support
1268 * if the client sent us an ECPointsFormat extension. Note that the server is not
1269 * supposed to send an EllipticCurves extension.
1270 */
1271
1272 unsigned long alg_k = s->s3->tmp.new_cipher->algorithm_mkey;
1273 unsigned long alg_a = s->s3->tmp.new_cipher->algorithm_auth;
1274 int using_ecc = (alg_k & (SSL_kEECDH|SSL_kECDHr|SSL_kECDHe)) || (alg_a & SSL_aECDSA);
1275 using_ecc = using_ecc && (s->session->tlsext_ecpointformatlist != NULL);
1276
1277 if (using_ecc)
1278 {
1279 if (s->tlsext_ecpointformatlist != NULL) OPENSSL_free(s->tlsext_ecpointformatlist);
1280 if ((s->tlsext_ecpointformatlist = OPENSSL_malloc(3)) == NULL)
1281 {
1282 SSLerr(SSL_F_SSL_PREPARE_SERVERHELLO_TLSEXT,ERR_R_MALLOC_FAILURE);
1283 return -1;
1284 }
1285 s->tlsext_ecpointformatlist_length = 3;
1286 s->tlsext_ecpointformatlist[0] = TLSEXT_ECPOINTFORMAT_uncompressed;
1287 s->tlsext_ecpointformatlist[1] = TLSEXT_ECPOINTFORMAT_ansiX962_compressed_prime;
1288 s->tlsext_ecpointformatlist[2] = TLSEXT_ECPOINTFORMAT_ansiX962_compressed_char2;
1289 }
1290#endif /* OPENSSL_NO_EC */
1291
1292 return 1; 609 return 1;
1293 } 610 }
1294 611
@@ -1297,15 +614,6 @@ int ssl_check_clienthello_tlsext(SSL *s)
1297 int ret=SSL_TLSEXT_ERR_NOACK; 614 int ret=SSL_TLSEXT_ERR_NOACK;
1298 int al = SSL_AD_UNRECOGNIZED_NAME; 615 int al = SSL_AD_UNRECOGNIZED_NAME;
1299 616
1300#ifndef OPENSSL_NO_EC
1301 /* The handling of the ECPointFormats extension is done elsewhere, namely in
1302 * ssl3_choose_cipher in s3_lib.c.
1303 */
1304 /* The handling of the EllipticCurves extension is done elsewhere, namely in
1305 * ssl3_choose_cipher in s3_lib.c.
1306 */
1307#endif
1308
1309 if (s->ctx != NULL && s->ctx->tlsext_servername_callback != 0) 617 if (s->ctx != NULL && s->ctx->tlsext_servername_callback != 0)
1310 ret = s->ctx->tlsext_servername_callback(s, &al, s->ctx->tlsext_servername_arg); 618 ret = s->ctx->tlsext_servername_callback(s, &al, s->ctx->tlsext_servername_arg);
1311 else if (s->initial_ctx != NULL && s->initial_ctx->tlsext_servername_callback != 0) 619 else if (s->initial_ctx != NULL && s->initial_ctx->tlsext_servername_callback != 0)
@@ -1315,7 +623,7 @@ int ssl_check_clienthello_tlsext(SSL *s)
1315 * Note: this must be called after servername callbacks in case 623 * Note: this must be called after servername callbacks in case
1316 * the certificate has changed. 624 * the certificate has changed.
1317 */ 625 */
1318 if ((s->tlsext_status_type != -1) && s->ctx && s->ctx->tlsext_status_cb) 626 if ((s->tlsext_status_type != -1) && s->ctx->tlsext_status_cb)
1319 { 627 {
1320 int r; 628 int r;
1321 r = s->ctx->tlsext_status_cb(s, s->ctx->tlsext_status_arg); 629 r = s->ctx->tlsext_status_cb(s, s->ctx->tlsext_status_arg);
@@ -1341,65 +649,7 @@ int ssl_check_clienthello_tlsext(SSL *s)
1341 } 649 }
1342 else 650 else
1343 s->tlsext_status_expected = 0; 651 s->tlsext_status_expected = 0;
1344 652 err:
1345#ifdef TLSEXT_TYPE_opaque_prf_input
1346 {
1347 /* This sort of belongs into ssl_prepare_serverhello_tlsext(),
1348 * but we might be sending an alert in response to the client hello,
1349 * so this has to happen here in ssl_check_clienthello_tlsext(). */
1350
1351 int r = 1;
1352
1353 if (s->ctx->tlsext_opaque_prf_input_callback != 0)
1354 {
1355 r = s->ctx->tlsext_opaque_prf_input_callback(s, NULL, 0, s->ctx->tlsext_opaque_prf_input_callback_arg);
1356 if (!r)
1357 {
1358 ret = SSL_TLSEXT_ERR_ALERT_FATAL;
1359 al = SSL_AD_INTERNAL_ERROR;
1360 goto err;
1361 }
1362 }
1363
1364 if (s->s3->server_opaque_prf_input != NULL) /* shouldn't really happen */
1365 OPENSSL_free(s->s3->server_opaque_prf_input);
1366 s->s3->server_opaque_prf_input = NULL;
1367
1368 if (s->tlsext_opaque_prf_input != NULL)
1369 {
1370 if (s->s3->client_opaque_prf_input != NULL &&
1371 s->s3->client_opaque_prf_input_len == s->tlsext_opaque_prf_input_len)
1372 {
1373 /* can only use this extension if we have a server opaque PRF input
1374 * of the same length as the client opaque PRF input! */
1375
1376 if (s->tlsext_opaque_prf_input_len == 0)
1377 s->s3->server_opaque_prf_input = OPENSSL_malloc(1); /* dummy byte just to get non-NULL */
1378 else
1379 s->s3->server_opaque_prf_input = BUF_memdup(s->tlsext_opaque_prf_input, s->tlsext_opaque_prf_input_len);
1380 if (s->s3->server_opaque_prf_input == NULL)
1381 {
1382 ret = SSL_TLSEXT_ERR_ALERT_FATAL;
1383 al = SSL_AD_INTERNAL_ERROR;
1384 goto err;
1385 }
1386 s->s3->server_opaque_prf_input_len = s->tlsext_opaque_prf_input_len;
1387 }
1388 }
1389
1390 if (r == 2 && s->s3->server_opaque_prf_input == NULL)
1391 {
1392 /* The callback wants to enforce use of the extension,
1393 * but we can't do that with the client opaque PRF input;
1394 * abort the handshake.
1395 */
1396 ret = SSL_TLSEXT_ERR_ALERT_FATAL;
1397 al = SSL_AD_HANDSHAKE_FAILURE;
1398 }
1399 }
1400
1401#endif
1402 err:
1403 switch (ret) 653 switch (ret)
1404 { 654 {
1405 case SSL_TLSEXT_ERR_ALERT_FATAL: 655 case SSL_TLSEXT_ERR_ALERT_FATAL:
@@ -1422,75 +672,16 @@ int ssl_check_serverhello_tlsext(SSL *s)
1422 int ret=SSL_TLSEXT_ERR_NOACK; 672 int ret=SSL_TLSEXT_ERR_NOACK;
1423 int al = SSL_AD_UNRECOGNIZED_NAME; 673 int al = SSL_AD_UNRECOGNIZED_NAME;
1424 674
1425#ifndef OPENSSL_NO_EC
1426 /* If we are client and using an elliptic curve cryptography cipher suite, then server
1427 * must return a an EC point formats lists containing uncompressed.
1428 */
1429 unsigned long alg_k = s->s3->tmp.new_cipher->algorithm_mkey;
1430 unsigned long alg_a = s->s3->tmp.new_cipher->algorithm_auth;
1431 if ((s->tlsext_ecpointformatlist != NULL) && (s->tlsext_ecpointformatlist_length > 0) &&
1432 ((alg_k & (SSL_kEECDH|SSL_kECDHr|SSL_kECDHe)) || (alg_a & SSL_aECDSA)))
1433 {
1434 /* we are using an ECC cipher */
1435 size_t i;
1436 unsigned char *list;
1437 int found_uncompressed = 0;
1438 if ((s->session->tlsext_ecpointformatlist == NULL) || (s->session->tlsext_ecpointformatlist_length == 0))
1439 {
1440 SSLerr(SSL_F_SSL_CHECK_SERVERHELLO_TLSEXT,SSL_R_TLS_INVALID_ECPOINTFORMAT_LIST);
1441 return -1;
1442 }
1443 list = s->session->tlsext_ecpointformatlist;
1444 for (i = 0; i < s->session->tlsext_ecpointformatlist_length; i++)
1445 {
1446 if (*(list++) == TLSEXT_ECPOINTFORMAT_uncompressed)
1447 {
1448 found_uncompressed = 1;
1449 break;
1450 }
1451 }
1452 if (!found_uncompressed)
1453 {
1454 SSLerr(SSL_F_SSL_CHECK_SERVERHELLO_TLSEXT,SSL_R_TLS_INVALID_ECPOINTFORMAT_LIST);
1455 return -1;
1456 }
1457 }
1458 ret = SSL_TLSEXT_ERR_OK;
1459#endif /* OPENSSL_NO_EC */
1460
1461 if (s->ctx != NULL && s->ctx->tlsext_servername_callback != 0) 675 if (s->ctx != NULL && s->ctx->tlsext_servername_callback != 0)
1462 ret = s->ctx->tlsext_servername_callback(s, &al, s->ctx->tlsext_servername_arg); 676 ret = s->ctx->tlsext_servername_callback(s, &al, s->ctx->tlsext_servername_arg);
1463 else if (s->initial_ctx != NULL && s->initial_ctx->tlsext_servername_callback != 0) 677 else if (s->initial_ctx != NULL && s->initial_ctx->tlsext_servername_callback != 0)
1464 ret = s->initial_ctx->tlsext_servername_callback(s, &al, s->initial_ctx->tlsext_servername_arg); 678 ret = s->initial_ctx->tlsext_servername_callback(s, &al, s->initial_ctx->tlsext_servername_arg);
1465 679
1466#ifdef TLSEXT_TYPE_opaque_prf_input
1467 if (s->s3->server_opaque_prf_input_len > 0)
1468 {
1469 /* This case may indicate that we, as a client, want to insist on using opaque PRF inputs.
1470 * So first verify that we really have a value from the server too. */
1471
1472 if (s->s3->server_opaque_prf_input == NULL)
1473 {
1474 ret = SSL_TLSEXT_ERR_ALERT_FATAL;
1475 al = SSL_AD_HANDSHAKE_FAILURE;
1476 }
1477
1478 /* Anytime the server *has* sent an opaque PRF input, we need to check
1479 * that we have a client opaque PRF input of the same size. */
1480 if (s->s3->client_opaque_prf_input == NULL ||
1481 s->s3->client_opaque_prf_input_len != s->s3->server_opaque_prf_input_len)
1482 {
1483 ret = SSL_TLSEXT_ERR_ALERT_FATAL;
1484 al = SSL_AD_ILLEGAL_PARAMETER;
1485 }
1486 }
1487#endif
1488
1489 /* If we've requested certificate status and we wont get one 680 /* If we've requested certificate status and we wont get one
1490 * tell the callback 681 * tell the callback
1491 */ 682 */
1492 if ((s->tlsext_status_type != -1) && !(s->tlsext_status_expected) 683 if ((s->tlsext_status_type != -1) && !(s->tlsext_status_expected)
1493 && s->ctx && s->ctx->tlsext_status_cb) 684 && s->ctx->tlsext_status_cb)
1494 { 685 {
1495 int r; 686 int r;
1496 /* Set resp to NULL, resplen to -1 so callback knows 687 /* Set resp to NULL, resplen to -1 so callback knows
@@ -1554,14 +745,6 @@ int tls1_process_ticket(SSL *s, unsigned char *session_id, int len,
1554 return 1; 745 return 1;
1555 if (p >= limit) 746 if (p >= limit)
1556 return -1; 747 return -1;
1557 /* Skip past DTLS cookie */
1558 if (s->version == DTLS1_VERSION || s->version == DTLS1_BAD_VER)
1559 {
1560 i = *(p++);
1561 p+= i;
1562 if (p >= limit)
1563 return -1;
1564 }
1565 /* Skip past cipher list */ 748 /* Skip past cipher list */
1566 n2s(p, i); 749 n2s(p, i);
1567 p+= i; 750 p+= i;
@@ -1585,11 +768,6 @@ int tls1_process_ticket(SSL *s, unsigned char *session_id, int len,
1585 return 1; 768 return 1;
1586 if (type == TLSEXT_TYPE_session_ticket) 769 if (type == TLSEXT_TYPE_session_ticket)
1587 { 770 {
1588 /* If tickets disabled indicate cache miss which will
1589 * trigger a full handshake
1590 */
1591 if (SSL_get_options(s) & SSL_OP_NO_TICKET)
1592 return 1;
1593 /* If zero length note client will accept a ticket 771 /* If zero length note client will accept a ticket
1594 * and indicate cache miss to trigger full handshake 772 * and indicate cache miss to trigger full handshake
1595 */ 773 */
@@ -1598,15 +776,6 @@ int tls1_process_ticket(SSL *s, unsigned char *session_id, int len,
1598 s->tlsext_ticket_expected = 1; 776 s->tlsext_ticket_expected = 1;
1599 return 0; /* Cache miss */ 777 return 0; /* Cache miss */
1600 } 778 }
1601 if (s->tls_session_secret_cb)
1602 {
1603 /* Indicate cache miss here and instead of
1604 * generating the session from ticket now,
1605 * trigger abbreviated handshake based on
1606 * external mechanism to calculate the master
1607 * secret later. */
1608 return 0;
1609 }
1610 return tls_decrypt_ticket(s, p, size, session_id, len, 779 return tls_decrypt_ticket(s, p, size, session_id, len,
1611 ret); 780 ret);
1612 } 781 }
@@ -1626,17 +795,16 @@ static int tls_decrypt_ticket(SSL *s, const unsigned char *etick, int eticklen,
1626 unsigned char tick_hmac[EVP_MAX_MD_SIZE]; 795 unsigned char tick_hmac[EVP_MAX_MD_SIZE];
1627 HMAC_CTX hctx; 796 HMAC_CTX hctx;
1628 EVP_CIPHER_CTX ctx; 797 EVP_CIPHER_CTX ctx;
1629 SSL_CTX *tctx = s->initial_ctx;
1630 /* Need at least keyname + iv + some encrypted data */ 798 /* Need at least keyname + iv + some encrypted data */
1631 if (eticklen < 48) 799 if (eticklen < 48)
1632 goto tickerr; 800 goto tickerr;
1633 /* Initialize session ticket encryption and HMAC contexts */ 801 /* Initialize session ticket encryption and HMAC contexts */
1634 HMAC_CTX_init(&hctx); 802 HMAC_CTX_init(&hctx);
1635 EVP_CIPHER_CTX_init(&ctx); 803 EVP_CIPHER_CTX_init(&ctx);
1636 if (tctx->tlsext_ticket_key_cb) 804 if (s->ctx->tlsext_ticket_key_cb)
1637 { 805 {
1638 unsigned char *nctick = (unsigned char *)etick; 806 unsigned char *nctick = (unsigned char *)etick;
1639 int rv = tctx->tlsext_ticket_key_cb(s, nctick, nctick + 16, 807 int rv = s->ctx->tlsext_ticket_key_cb(s, nctick, nctick + 16,
1640 &ctx, &hctx, 0); 808 &ctx, &hctx, 0);
1641 if (rv < 0) 809 if (rv < 0)
1642 return -1; 810 return -1;
@@ -1648,22 +816,17 @@ static int tls_decrypt_ticket(SSL *s, const unsigned char *etick, int eticklen,
1648 else 816 else
1649 { 817 {
1650 /* Check key name matches */ 818 /* Check key name matches */
1651 if (memcmp(etick, tctx->tlsext_tick_key_name, 16)) 819 if (memcmp(etick, s->ctx->tlsext_tick_key_name, 16))
1652 goto tickerr; 820 goto tickerr;
1653 HMAC_Init_ex(&hctx, tctx->tlsext_tick_hmac_key, 16, 821 HMAC_Init_ex(&hctx, s->ctx->tlsext_tick_hmac_key, 16,
1654 tlsext_tick_md(), NULL); 822 tlsext_tick_md(), NULL);
1655 EVP_DecryptInit_ex(&ctx, EVP_aes_128_cbc(), NULL, 823 EVP_DecryptInit_ex(&ctx, EVP_aes_128_cbc(), NULL,
1656 tctx->tlsext_tick_aes_key, etick + 16); 824 s->ctx->tlsext_tick_aes_key, etick + 16);
1657 } 825 }
1658 /* Attempt to process session ticket, first conduct sanity and 826 /* Attempt to process session ticket, first conduct sanity and
1659 * integrity checks on ticket. 827 * integrity checks on ticket.
1660 */ 828 */
1661 mlen = HMAC_size(&hctx); 829 mlen = HMAC_size(&hctx);
1662 if (mlen < 0)
1663 {
1664 EVP_CIPHER_CTX_cleanup(&ctx);
1665 return -1;
1666 }
1667 eticklen -= mlen; 830 eticklen -= mlen;
1668 /* Check HMAC of encrypted ticket */ 831 /* Check HMAC of encrypted ticket */
1669 HMAC_Update(&hctx, etick, eticklen); 832 HMAC_Update(&hctx, etick, eticklen);
generated by cgit v1.2.3-55-g6feb (git 2.39.1) at 2025-12-09 04:29:13 +0000