]> git.ipfire.org Git - thirdparty/openssl.git/blame - ssl/t1_lib.c
projects / thirdparty / openssl.git / blame
? search:
summary | shortlog | log | commit | commitdiff | tree
blob | blame (incremental) | history | HEAD
free NULL cleanup 5a
[thirdparty/openssl.git] / ssl / t1_lib.c
CommitLineData
58964a49
RE		 1/* ssl/t1_lib.c */
2/* Copyright (C) 1995-1998 Eric Young (eay@cryptsoft.com)
3 * All rights reserved.
4 *
5 * This package is an SSL implementation written
6 * by Eric Young (eay@cryptsoft.com).
7 * The implementation was written so as to conform with Netscapes SSL.
0f113f3e 8 *
58964a49
RE		 9 * This library is free for commercial and non-commercial use as long as
10 * the following conditions are aheared to. The following conditions
11 * apply to all code found in this distribution, be it the RC4, RSA,
12 * lhash, DES, etc., code; not just the SSL code. The SSL documentation
13 * included with this distribution is covered by the same copyright terms
14 * except that the holder is Tim Hudson (tjh@cryptsoft.com).
0f113f3e 15 *
58964a49
RE		 16 * Copyright remains Eric Young's, and as such any Copyright notices in
17 * the code are not to be removed.
18 * If this package is used in a product, Eric Young should be given attribution
19 * as the author of the parts of the library used.
20 * This can be in the form of a textual message at program startup or
21 * in documentation (online or textual) provided with the package.
0f113f3e 22 *
58964a49
RE		 23 * Redistribution and use in source and binary forms, with or without
24 * modification, are permitted provided that the following conditions
25 * are met:
26 * 1. Redistributions of source code must retain the copyright
27 * notice, this list of conditions and the following disclaimer.
28 * 2. Redistributions in binary form must reproduce the above copyright
29 * notice, this list of conditions and the following disclaimer in the
30 * documentation and/or other materials provided with the distribution.
31 * 3. All advertising materials mentioning features or use of this software
32 * must display the following acknowledgement:
33 * "This product includes cryptographic software written by
34 * Eric Young (eay@cryptsoft.com)"
35 * The word 'cryptographic' can be left out if the rouines from the library
36 * being used are not cryptographic related :-).
0f113f3e 37 * 4. If you include any Windows specific code (or a derivative thereof) from
58964a49
RE		 38 * the apps directory (application code) you must include an acknowledgement:
39 * "This product includes software written by Tim Hudson (tjh@cryptsoft.com)"
0f113f3e 40 *
58964a49
RE		 41 * THIS SOFTWARE IS PROVIDED BY ERIC YOUNG ``AS IS'' AND
42 * ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
43 * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE
44 * ARE DISCLAIMED. IN NO EVENT SHALL THE AUTHOR OR CONTRIBUTORS BE LIABLE
45 * FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL
46 * DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS
47 * OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION)
48 * HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT
49 * LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY
50 * OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF
51 * SUCH DAMAGE.
0f113f3e 52 *
58964a49
RE		 53 * The licence and distribution terms for any publically available version or
54 * derivative of this code cannot be changed. i.e. this code cannot simply be
55 * copied and put under another distribution licence
56 * [including the GNU Public Licence.]
57 */
f1fd4544 58/* ====================================================================
52b8dad8 59 * Copyright (c) 1998-2007 The OpenSSL Project. All rights reserved.
f1fd4544
BM		 60 *
61 * Redistribution and use in source and binary forms, with or without
62 * modification, are permitted provided that the following conditions
63 * are met:
64 *
65 * 1. Redistributions of source code must retain the above copyright
0f113f3e 66 * notice, this list of conditions and the following disclaimer.
f1fd4544
BM		 67 *
68 * 2. Redistributions in binary form must reproduce the above copyright
69 * notice, this list of conditions and the following disclaimer in
70 * the documentation and/or other materials provided with the
71 * distribution.
72 *
73 * 3. All advertising materials mentioning features or use of this
74 * software must display the following acknowledgment:
75 * "This product includes software developed by the OpenSSL Project
76 * for use in the OpenSSL Toolkit. (http://www.openssl.org/)"
77 *
78 * 4. The names "OpenSSL Toolkit" and "OpenSSL Project" must not be used to
79 * endorse or promote products derived from this software without
80 * prior written permission. For written permission, please contact
81 * openssl-core@openssl.org.
82 *
83 * 5. Products derived from this software may not be called "OpenSSL"
84 * nor may "OpenSSL" appear in their names without prior written
85 * permission of the OpenSSL Project.
86 *
87 * 6. Redistributions of any form whatsoever must retain the following
88 * acknowledgment:
89 * "This product includes software developed by the OpenSSL Project
90 * for use in the OpenSSL Toolkit (http://www.openssl.org/)"
91 *
92 * THIS SOFTWARE IS PROVIDED BY THE OpenSSL PROJECT ``AS IS'' AND ANY
93 * EXPRESSED OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
94 * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
95 * PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE OpenSSL PROJECT OR
96 * ITS CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL,
97 * SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT
98 * NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES;
99 * LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION)
100 * HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT,
101 * STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE)
102 * ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED
103 * OF THE POSSIBILITY OF SUCH DAMAGE.
104 * ====================================================================
105 *
106 * This product includes cryptographic software written by Eric Young
107 * (eay@cryptsoft.com). This product includes software written by Tim
108 * Hudson (tjh@cryptsoft.com).
109 *
110 */
58964a49
RE		 111
112#include <stdio.h>
ec577822 113#include <openssl/objects.h>
6434abbf
DSH		 114#include <openssl/evp.h>
115#include <openssl/hmac.h>
67c8e7f4 116#include <openssl/ocsp.h>
4817504d 117#include <openssl/rand.h>
09599b52 118#ifndef OPENSSL_NO_DH
0f113f3e
MC		 119# include <openssl/dh.h>
120# include <openssl/bn.h>
09599b52 121#endif
58964a49
RE		 122#include "ssl_locl.h"
123
0f113f3e 124const char tls1_version_str[] = "TLSv1" OPENSSL_VERSION_PTEXT;
58964a49 125
367eb1f1 126#ifndef OPENSSL_NO_TLSEXT
6434abbf 127static int tls_decrypt_ticket(SSL *s, const unsigned char *tick, int ticklen,
0f113f3e
MC		 128 const unsigned char *sess_id, int sesslen,
129 SSL_SESSION **psess);
2daceb03 130static int ssl_check_clienthello_tlsext_early(SSL *s);
09e4e4b9 131int ssl_check_serverhello_tlsext(SSL *s);
367eb1f1 132#endif
6434abbf 133
0f113f3e
MC		 134SSL3_ENC_METHOD const TLSv1_enc_data = {
135 tls1_enc,
136 tls1_mac,
137 tls1_setup_key_block,
138 tls1_generate_master_secret,
139 tls1_change_cipher_state,
140 tls1_final_finish_mac,
141 TLS1_FINISH_MAC_LENGTH,
142 tls1_cert_verify_mac,
143 TLS_MD_CLIENT_FINISH_CONST, TLS_MD_CLIENT_FINISH_CONST_SIZE,
144 TLS_MD_SERVER_FINISH_CONST, TLS_MD_SERVER_FINISH_CONST_SIZE,
145 tls1_alert_code,
146 tls1_export_keying_material,
147 0,
148 SSL3_HM_HEADER_LENGTH,
149 ssl3_set_handshake_header,
150 ssl3_handshake_write
151};
152
153SSL3_ENC_METHOD const TLSv1_1_enc_data = {
154 tls1_enc,
155 tls1_mac,
156 tls1_setup_key_block,
157 tls1_generate_master_secret,
158 tls1_change_cipher_state,
159 tls1_final_finish_mac,
160 TLS1_FINISH_MAC_LENGTH,
161 tls1_cert_verify_mac,
162 TLS_MD_CLIENT_FINISH_CONST, TLS_MD_CLIENT_FINISH_CONST_SIZE,
163 TLS_MD_SERVER_FINISH_CONST, TLS_MD_SERVER_FINISH_CONST_SIZE,
164 tls1_alert_code,
165 tls1_export_keying_material,
166 SSL_ENC_FLAG_EXPLICIT_IV,
167 SSL3_HM_HEADER_LENGTH,
168 ssl3_set_handshake_header,
169 ssl3_handshake_write
170};
171
172SSL3_ENC_METHOD const TLSv1_2_enc_data = {
173 tls1_enc,
174 tls1_mac,
175 tls1_setup_key_block,
176 tls1_generate_master_secret,
177 tls1_change_cipher_state,
178 tls1_final_finish_mac,
179 TLS1_FINISH_MAC_LENGTH,
180 tls1_cert_verify_mac,
181 TLS_MD_CLIENT_FINISH_CONST, TLS_MD_CLIENT_FINISH_CONST_SIZE,
182 TLS_MD_SERVER_FINISH_CONST, TLS_MD_SERVER_FINISH_CONST_SIZE,
183 tls1_alert_code,
184 tls1_export_keying_material,
185 SSL_ENC_FLAG_EXPLICIT_IV | SSL_ENC_FLAG_SIGALGS | SSL_ENC_FLAG_SHA256_PRF
186 | SSL_ENC_FLAG_TLS1_2_CIPHERS,
187 SSL3_HM_HEADER_LENGTH,
188 ssl3_set_handshake_header,
189 ssl3_handshake_write
190};
58964a49 191
f3b656b2 192long tls1_default_timeout(void)
0f113f3e
MC		 193{
194 /*
195 * 2 hours, the 24 hours mentioned in the TLSv1 spec is way too long for
196 * http, the cache would over fill
197 */
198 return (60 * 60 * 2);
199}
58964a49 200
6b691a5c 201int tls1_new(SSL *s)
0f113f3e
MC		 202{
203 if (!ssl3_new(s))
204 return (0);
205 s->method->ssl_clear(s);
206 return (1);
207}
58964a49 208
6b691a5c 209void tls1_free(SSL *s)
0f113f3e 210{
12bf56c0 211#ifndef OPENSSL_NO_TLSEXT
0f113f3e
MC		 212 if (s->tlsext_session_ticket) {
213 OPENSSL_free(s->tlsext_session_ticket);
214 }
215#endif /* OPENSSL_NO_TLSEXT */
216 ssl3_free(s);
217}
58964a49 218
6b691a5c 219void tls1_clear(SSL *s)
0f113f3e
MC		 220{
221 ssl3_clear(s);
222 s->version = s->method->version;
223}
58964a49 224
525de5d3 225#ifndef OPENSSL_NO_EC
eda3766b 226
0f113f3e
MC		 227typedef struct {
228 int nid; /* Curve NID */
229 int secbits; /* Bits of security (from SP800-57) */
230 unsigned int flags; /* Flags: currently just field type */
231} tls_curve_info;
232
233# define TLS_CURVE_CHAR2 0x1
234# define TLS_CURVE_PRIME 0x0
235
236static const tls_curve_info nid_list[] = {
237 {NID_sect163k1, 80, TLS_CURVE_CHAR2}, /* sect163k1 (1) */
238 {NID_sect163r1, 80, TLS_CURVE_CHAR2}, /* sect163r1 (2) */
239 {NID_sect163r2, 80, TLS_CURVE_CHAR2}, /* sect163r2 (3) */
240 {NID_sect193r1, 80, TLS_CURVE_CHAR2}, /* sect193r1 (4) */
241 {NID_sect193r2, 80, TLS_CURVE_CHAR2}, /* sect193r2 (5) */
242 {NID_sect233k1, 112, TLS_CURVE_CHAR2}, /* sect233k1 (6) */
243 {NID_sect233r1, 112, TLS_CURVE_CHAR2}, /* sect233r1 (7) */
244 {NID_sect239k1, 112, TLS_CURVE_CHAR2}, /* sect239k1 (8) */
245 {NID_sect283k1, 128, TLS_CURVE_CHAR2}, /* sect283k1 (9) */
246 {NID_sect283r1, 128, TLS_CURVE_CHAR2}, /* sect283r1 (10) */
247 {NID_sect409k1, 192, TLS_CURVE_CHAR2}, /* sect409k1 (11) */
248 {NID_sect409r1, 192, TLS_CURVE_CHAR2}, /* sect409r1 (12) */
249 {NID_sect571k1, 256, TLS_CURVE_CHAR2}, /* sect571k1 (13) */
250 {NID_sect571r1, 256, TLS_CURVE_CHAR2}, /* sect571r1 (14) */
251 {NID_secp160k1, 80, TLS_CURVE_PRIME}, /* secp160k1 (15) */
252 {NID_secp160r1, 80, TLS_CURVE_PRIME}, /* secp160r1 (16) */
253 {NID_secp160r2, 80, TLS_CURVE_PRIME}, /* secp160r2 (17) */
254 {NID_secp192k1, 80, TLS_CURVE_PRIME}, /* secp192k1 (18) */
255 {NID_X9_62_prime192v1, 80, TLS_CURVE_PRIME}, /* secp192r1 (19) */
256 {NID_secp224k1, 112, TLS_CURVE_PRIME}, /* secp224k1 (20) */
257 {NID_secp224r1, 112, TLS_CURVE_PRIME}, /* secp224r1 (21) */
258 {NID_secp256k1, 128, TLS_CURVE_PRIME}, /* secp256k1 (22) */
259 {NID_X9_62_prime256v1, 128, TLS_CURVE_PRIME}, /* secp256r1 (23) */
260 {NID_secp384r1, 192, TLS_CURVE_PRIME}, /* secp384r1 (24) */
261 {NID_secp521r1, 256, TLS_CURVE_PRIME}, /* secp521r1 (25) */
262 {NID_brainpoolP256r1, 128, TLS_CURVE_PRIME}, /* brainpoolP256r1 (26) */
263 {NID_brainpoolP384r1, 192, TLS_CURVE_PRIME}, /* brainpoolP384r1 (27) */
264 {NID_brainpoolP512r1, 256, TLS_CURVE_PRIME}, /* brainpool512r1 (28) */
265};
266
267static const unsigned char ecformats_default[] = {
268 TLSEXT_ECPOINTFORMAT_uncompressed,
269 TLSEXT_ECPOINTFORMAT_ansiX962_compressed_prime,
270 TLSEXT_ECPOINTFORMAT_ansiX962_compressed_char2
271};
272
273static const unsigned char eccurves_default[] = {
274 0, 14, /* sect571r1 (14) */
275 0, 13, /* sect571k1 (13) */
276 0, 25, /* secp521r1 (25) */
277 0, 28, /* brainpool512r1 (28) */
278 0, 11, /* sect409k1 (11) */
279 0, 12, /* sect409r1 (12) */
280 0, 27, /* brainpoolP384r1 (27) */
281 0, 24, /* secp384r1 (24) */
282 0, 9, /* sect283k1 (9) */
283 0, 10, /* sect283r1 (10) */
284 0, 26, /* brainpoolP256r1 (26) */
285 0, 22, /* secp256k1 (22) */
286 0, 23, /* secp256r1 (23) */
287 0, 8, /* sect239k1 (8) */
288 0, 6, /* sect233k1 (6) */
289 0, 7, /* sect233r1 (7) */
290 0, 20, /* secp224k1 (20) */
291 0, 21, /* secp224r1 (21) */
292 0, 4, /* sect193r1 (4) */
293 0, 5, /* sect193r2 (5) */
294 0, 18, /* secp192k1 (18) */
295 0, 19, /* secp192r1 (19) */
296 0, 1, /* sect163k1 (1) */
297 0, 2, /* sect163r1 (2) */
298 0, 3, /* sect163r2 (3) */
299 0, 15, /* secp160k1 (15) */
300 0, 16, /* secp160r1 (16) */
301 0, 17, /* secp160r2 (17) */
302};
303
304static const unsigned char suiteb_curves[] = {
305 0, TLSEXT_curve_P_256,
306 0, TLSEXT_curve_P_384
307};
2ea80354 308
525de5d3 309int tls1_ec_curve_id2nid(int curve_id)
0f113f3e
MC		 310{
311 /* ECC curves from RFC 4492 and RFC 7027 */
312 if ((curve_id < 1) || ((unsigned int)curve_id >
313 sizeof(nid_list) / sizeof(nid_list[0])))
314 return 0;
315 return nid_list[curve_id - 1].nid;
316}
525de5d3
DSH		 317
318int tls1_ec_nid2curve_id(int nid)
0f113f3e
MC		 319{
320 /* ECC curves from RFC 4492 and RFC 7027 */
321 switch (nid) {
322 case NID_sect163k1: /* sect163k1 (1) */
323 return 1;
324 case NID_sect163r1: /* sect163r1 (2) */
325 return 2;
326 case NID_sect163r2: /* sect163r2 (3) */
327 return 3;
328 case NID_sect193r1: /* sect193r1 (4) */
329 return 4;
330 case NID_sect193r2: /* sect193r2 (5) */
331 return 5;
332 case NID_sect233k1: /* sect233k1 (6) */
333 return 6;
334 case NID_sect233r1: /* sect233r1 (7) */
335 return 7;
336 case NID_sect239k1: /* sect239k1 (8) */
337 return 8;
338 case NID_sect283k1: /* sect283k1 (9) */
339 return 9;
340 case NID_sect283r1: /* sect283r1 (10) */
341 return 10;
342 case NID_sect409k1: /* sect409k1 (11) */
343 return 11;
344 case NID_sect409r1: /* sect409r1 (12) */
345 return 12;
346 case NID_sect571k1: /* sect571k1 (13) */
347 return 13;
348 case NID_sect571r1: /* sect571r1 (14) */
349 return 14;
350 case NID_secp160k1: /* secp160k1 (15) */
351 return 15;
352 case NID_secp160r1: /* secp160r1 (16) */
353 return 16;
354 case NID_secp160r2: /* secp160r2 (17) */
355 return 17;
356 case NID_secp192k1: /* secp192k1 (18) */
357 return 18;
358 case NID_X9_62_prime192v1: /* secp192r1 (19) */
359 return 19;
360 case NID_secp224k1: /* secp224k1 (20) */
361 return 20;
362 case NID_secp224r1: /* secp224r1 (21) */
363 return 21;
364 case NID_secp256k1: /* secp256k1 (22) */
365 return 22;
366 case NID_X9_62_prime256v1: /* secp256r1 (23) */
367 return 23;
368 case NID_secp384r1: /* secp384r1 (24) */
369 return 24;
370 case NID_secp521r1: /* secp521r1 (25) */
371 return 25;
372 case NID_brainpoolP256r1: /* brainpoolP256r1 (26) */
373 return 26;
374 case NID_brainpoolP384r1: /* brainpoolP384r1 (27) */
375 return 27;
376 case NID_brainpoolP512r1: /* brainpool512r1 (28) */
377 return 28;
378 default:
379 return 0;
380 }
381}
382
740580c2
EK		 383/*
384 * Get curves list, if "sess" is set return client curves otherwise
385 * preferred list.
386 * Sets |num_curves| to the number of curves in the list, i.e.,
387 * the length of |pcurves| is 2 * num_curves.
388 * Returns 1 on success and 0 if the client curves list has invalid format.
389 * The latter indicates an internal error: we should not be accepting such
390 * lists in the first place.
391 * TODO(emilia): we should really be storing the curves list in explicitly
392 * parsed form instead. (However, this would affect binary compatibility
393 * so cannot happen in the 1.0.x series.)
fd2b65ce 394 */
740580c2 395static int tls1_get_curvelist(SSL *s, int sess,
0f113f3e
MC		 396 const unsigned char **pcurves,
397 size_t *num_curves)
398{
399 size_t pcurveslen = 0;
400 if (sess) {
401 *pcurves = s->session->tlsext_ellipticcurvelist;
402 pcurveslen = s->session->tlsext_ellipticcurvelist_length;
403 } else {
404 /* For Suite B mode only include P-256, P-384 */
405 switch (tls1_suiteb(s)) {
406 case SSL_CERT_FLAG_SUITEB_128_LOS:
407 *pcurves = suiteb_curves;
408 pcurveslen = sizeof(suiteb_curves);
409 break;
410
411 case SSL_CERT_FLAG_SUITEB_128_LOS_ONLY:
412 *pcurves = suiteb_curves;
413 pcurveslen = 2;
414 break;
415
416 case SSL_CERT_FLAG_SUITEB_192_LOS:
417 *pcurves = suiteb_curves + 2;
418 pcurveslen = 2;
419 break;
420 default:
421 *pcurves = s->tlsext_ellipticcurvelist;
422 pcurveslen = s->tlsext_ellipticcurvelist_length;
423 }
424 if (!*pcurves) {
425 *pcurves = eccurves_default;
426 pcurveslen = sizeof(eccurves_default);
427 }
428 }
429
430 /* We do not allow odd length arrays to enter the system. */
431 if (pcurveslen & 1) {
432 SSLerr(SSL_F_TLS1_GET_CURVELIST, ERR_R_INTERNAL_ERROR);
433 *num_curves = 0;
434 return 0;
435 } else {
436 *num_curves = pcurveslen / 2;
437 return 1;
438 }
439}
b362ccab
DSH		 440
441/* See if curve is allowed by security callback */
442static int tls_curve_allowed(SSL *s, const unsigned char *curve, int op)
0f113f3e
MC		 443{
444 const tls_curve_info *cinfo;
445 if (curve[0])
446 return 1;
447 if ((curve[1] < 1) || ((size_t)curve[1] >
448 sizeof(nid_list) / sizeof(nid_list[0])))
449 return 0;
450 cinfo = &nid_list[curve[1] - 1];
451# ifdef OPENSSL_NO_EC2M
452 if (cinfo->flags & TLS_CURVE_CHAR2)
453 return 0;
454# endif
455 return ssl_security(s, op, cinfo->secbits, cinfo->nid, (void *)curve);
456}
b362ccab 457
d18b716d
DSH		 458/* Check a curve is one of our preferences */
459int tls1_check_curve(SSL *s, const unsigned char *p, size_t len)
0f113f3e
MC		 460{
461 const unsigned char *curves;
462 size_t num_curves, i;
463 unsigned int suiteb_flags = tls1_suiteb(s);
464 if (len != 3 || p[0] != NAMED_CURVE_TYPE)
465 return 0;
466 /* Check curve matches Suite B preferences */
467 if (suiteb_flags) {
468 unsigned long cid = s->s3->tmp.new_cipher->id;
469 if (p[1])
470 return 0;
471 if (cid == TLS1_CK_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256) {
472 if (p[2] != TLSEXT_curve_P_256)
473 return 0;
474 } else if (cid == TLS1_CK_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384) {
475 if (p[2] != TLSEXT_curve_P_384)
476 return 0;
477 } else /* Should never happen */
478 return 0;
479 }
480 if (!tls1_get_curvelist(s, 0, &curves, &num_curves))
481 return 0;
482 for (i = 0; i < num_curves; i++, curves += 2) {
483 if (p[1] == curves[0] && p[2] == curves[1])
484 return tls_curve_allowed(s, p + 1, SSL_SECOP_CURVE_CHECK);
485 }
486 return 0;
487}
d0595f17 488
1d97c843 489/*-
376e2ca3
EK		 490 * Return |nmatch|th shared curve or NID_undef if there is no match.
491 * For nmatch == -1, return number of matches
492 * For nmatch == -2, return the NID of the curve to use for
493 * an EC tmp key, or NID_undef if there is no match.
d0595f17 494 */
a4352630 495int tls1_shared_curve(SSL *s, int nmatch)
0f113f3e
MC		 496{
497 const unsigned char *pref, *supp;
498 size_t num_pref, num_supp, i, j;
499 int k;
500 /* Can't do anything on client side */
501 if (s->server == 0)
502 return -1;
503 if (nmatch == -2) {
504 if (tls1_suiteb(s)) {
505 /*
506 * For Suite B ciphersuite determines curve: we already know
507 * these are acceptable due to previous checks.
508 */
509 unsigned long cid = s->s3->tmp.new_cipher->id;
510 if (cid == TLS1_CK_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256)
511 return NID_X9_62_prime256v1; /* P-256 */
512 if (cid == TLS1_CK_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384)
513 return NID_secp384r1; /* P-384 */
514 /* Should never happen */
515 return NID_undef;
516 }
517 /* If not Suite B just return first preference shared curve */
518 nmatch = 0;
519 }
520 /*
521 * Avoid truncation. tls1_get_curvelist takes an int
522 * but s->options is a long...
523 */
524 if (!tls1_get_curvelist
525 (s, (s->options & SSL_OP_CIPHER_SERVER_PREFERENCE) != 0, &supp,
526 &num_supp))
527 /* In practice, NID_undef == 0 but let's be precise. */
528 return nmatch == -1 ? 0 : NID_undef;
529 if (!tls1_get_curvelist
530 (s, !(s->options & SSL_OP_CIPHER_SERVER_PREFERENCE), &pref,
531 &num_pref))
532 return nmatch == -1 ? 0 : NID_undef;
533 k = 0;
534 for (i = 0; i < num_pref; i++, pref += 2) {
535 const unsigned char *tsupp = supp;
536 for (j = 0; j < num_supp; j++, tsupp += 2) {
537 if (pref[0] == tsupp[0] && pref[1] == tsupp[1]) {
538 if (!tls_curve_allowed(s, pref, SSL_SECOP_CURVE_SHARED))
539 continue;
540 if (nmatch == k) {
541 int id = (pref[0] << 8) | pref[1];
542 return tls1_ec_curve_id2nid(id);
543 }
544 k++;
545 }
546 }
547 }
548 if (nmatch == -1)
549 return k;
550 /* Out of range (nmatch > k). */
551 return NID_undef;
552}
d0595f17
DSH		 553
554int tls1_set_curves(unsigned char **pext, size_t *pextlen,
0f113f3e
MC		 555 int *curves, size_t ncurves)
556{
557 unsigned char *clist, *p;
558 size_t i;
559 /*
560 * Bitmap of curves included to detect duplicates: only works while curve
561 * ids < 32
562 */
563 unsigned long dup_list = 0;
564 clist = OPENSSL_malloc(ncurves * 2);
565 if (!clist)
566 return 0;
567 for (i = 0, p = clist; i < ncurves; i++) {
568 unsigned long idmask;
569 int id;
570 id = tls1_ec_nid2curve_id(curves[i]);
571 idmask = 1L << id;
572 if (!id || (dup_list & idmask)) {
573 OPENSSL_free(clist);
574 return 0;
575 }
576 dup_list |= idmask;
577 s2n(id, p);
578 }
579 if (*pext)
580 OPENSSL_free(*pext);
581 *pext = clist;
582 *pextlen = ncurves * 2;
583 return 1;
584}
585
586# define MAX_CURVELIST 28
587
588typedef struct {
589 size_t nidcnt;
590 int nid_arr[MAX_CURVELIST];
591} nid_cb_st;
d0595f17
DSH		 592
593static int nid_cb(const char *elem, int len, void *arg)
0f113f3e
MC		 594{
595 nid_cb_st *narg = arg;
596 size_t i;
597 int nid;
598 char etmp[20];
2747d73c
KR		 599 if (elem == NULL)
600 return 0;
0f113f3e
MC		 601 if (narg->nidcnt == MAX_CURVELIST)
602 return 0;
603 if (len > (int)(sizeof(etmp) - 1))
604 return 0;
605 memcpy(etmp, elem, len);
606 etmp[len] = 0;
607 nid = EC_curve_nist2nid(etmp);
608 if (nid == NID_undef)
609 nid = OBJ_sn2nid(etmp);
610 if (nid == NID_undef)
611 nid = OBJ_ln2nid(etmp);
612 if (nid == NID_undef)
613 return 0;
614 for (i = 0; i < narg->nidcnt; i++)
615 if (narg->nid_arr[i] == nid)
616 return 0;
617 narg->nid_arr[narg->nidcnt++] = nid;
618 return 1;
619}
620
d0595f17 621/* Set curves based on a colon separate list */
0f113f3e
MC		 622int tls1_set_curves_list(unsigned char **pext, size_t *pextlen,
623 const char *str)
624{
625 nid_cb_st ncb;
626 ncb.nidcnt = 0;
627 if (!CONF_parse_list(str, ':', 1, nid_cb, &ncb))
628 return 0;
629 if (pext == NULL)
630 return 1;
631 return tls1_set_curves(pext, pextlen, ncb.nid_arr, ncb.nidcnt);
632}
633
fd2b65ce
DSH		 634/* For an EC key set TLS id and required compression based on parameters */
635static int tls1_set_ec_id(unsigned char *curve_id, unsigned char *comp_id,
0f113f3e
MC		 636 EC_KEY *ec)
637{
638 int is_prime, id;
639 const EC_GROUP *grp;
640 const EC_METHOD *meth;
641 if (!ec)
642 return 0;
643 /* Determine if it is a prime field */
644 grp = EC_KEY_get0_group(ec);
645 if (!grp)
646 return 0;
647 meth = EC_GROUP_method_of(grp);
648 if (!meth)
649 return 0;
650 if (EC_METHOD_get_field_type(meth) == NID_X9_62_prime_field)
651 is_prime = 1;
652 else
653 is_prime = 0;
654 /* Determine curve ID */
655 id = EC_GROUP_get_curve_name(grp);
656 id = tls1_ec_nid2curve_id(id);
657 /* If we have an ID set it, otherwise set arbitrary explicit curve */
658 if (id) {
659 curve_id[0] = 0;
660 curve_id[1] = (unsigned char)id;
661 } else {
662 curve_id[0] = 0xff;
663 if (is_prime)
664 curve_id[1] = 0x01;
665 else
666 curve_id[1] = 0x02;
667 }
668 if (comp_id) {
669 if (EC_KEY_get0_public_key(ec) == NULL)
670 return 0;
671 if (EC_KEY_get_conv_form(ec) == POINT_CONVERSION_COMPRESSED) {
672 if (is_prime)
673 *comp_id = TLSEXT_ECPOINTFORMAT_ansiX962_compressed_prime;
674 else
675 *comp_id = TLSEXT_ECPOINTFORMAT_ansiX962_compressed_char2;
676 } else
677 *comp_id = TLSEXT_ECPOINTFORMAT_uncompressed;
678 }
679 return 1;
680}
681
fd2b65ce
DSH		 682/* Check an EC key is compatible with extensions */
683static int tls1_check_ec_key(SSL *s,
0f113f3e
MC		 684 unsigned char *curve_id, unsigned char *comp_id)
685{
686 const unsigned char *pformats, *pcurves;
687 size_t num_formats, num_curves, i;
688 int j;
689 /*
690 * If point formats extension present check it, otherwise everything is
691 * supported (see RFC4492).
692 */
693 if (comp_id && s->session->tlsext_ecpointformatlist) {
694 pformats = s->session->tlsext_ecpointformatlist;
695 num_formats = s->session->tlsext_ecpointformatlist_length;
696 for (i = 0; i < num_formats; i++, pformats++) {
697 if (*comp_id == *pformats)
698 break;
699 }
700 if (i == num_formats)
701 return 0;
702 }
703 if (!curve_id)
704 return 1;
705 /* Check curve is consistent with client and server preferences */
706 for (j = 0; j <= 1; j++) {
707 if (!tls1_get_curvelist(s, j, &pcurves, &num_curves))
708 return 0;
b79d2410
MC		 709 if (j == 1 && num_curves == 0) {
710 /*
711 * If we've not received any curves then skip this check.
712 * RFC 4492 does not require the supported elliptic curves extension
713 * so if it is not sent we can just choose any curve.
714 * It is invalid to send an empty list in the elliptic curves
715 * extension, so num_curves == 0 always means no extension.
716 */
717 break;
718 }
0f113f3e
MC		 719 for (i = 0; i < num_curves; i++, pcurves += 2) {
720 if (pcurves[0] == curve_id[0] && pcurves[1] == curve_id[1])
721 break;
722 }
723 if (i == num_curves)
724 return 0;
725 /* For clients can only check sent curve list */
726 if (!s->server)
727 break;
728 }
729 return 1;
730}
d61ff83b 731
5087afa1 732static void tls1_get_formatlist(SSL *s, const unsigned char **pformats,
0f113f3e
MC		 733 size_t *num_formats)
734{
735 /*
736 * If we have a custom point format list use it otherwise use default
737 */
738 if (s->tlsext_ecpointformatlist) {
739 *pformats = s->tlsext_ecpointformatlist;
740 *num_formats = s->tlsext_ecpointformatlist_length;
741 } else {
742 *pformats = ecformats_default;
743 /* For Suite B we don't support char2 fields */
744 if (tls1_suiteb(s))
745 *num_formats = sizeof(ecformats_default) - 1;
746 else
747 *num_formats = sizeof(ecformats_default);
748 }
749}
750
751/*
752 * Check cert parameters compatible with extensions: currently just checks EC
753 * certificates have compatible curves and compression.
d61ff83b 754 */
2ea80354 755static int tls1_check_cert_param(SSL *s, X509 *x, int set_ee_md)
0f113f3e
MC		 756{
757 unsigned char comp_id, curve_id[2];
758 EVP_PKEY *pkey;
759 int rv;
760 pkey = X509_get_pubkey(x);
761 if (!pkey)
762 return 0;
763 /* If not EC nothing to do */
764 if (pkey->type != EVP_PKEY_EC) {
765 EVP_PKEY_free(pkey);
766 return 1;
767 }
768 rv = tls1_set_ec_id(curve_id, &comp_id, pkey->pkey.ec);
769 EVP_PKEY_free(pkey);
770 if (!rv)
771 return 0;
772 /*
773 * Can't check curve_id for client certs as we don't have a supported
774 * curves extension.
775 */
776 rv = tls1_check_ec_key(s, s->server ? curve_id : NULL, &comp_id);
777 if (!rv)
778 return 0;
779 /*
780 * Special case for suite B. We *MUST* sign using SHA256+P-256 or
781 * SHA384+P-384, adjust digest if necessary.
782 */
783 if (set_ee_md && tls1_suiteb(s)) {
784 int check_md;
785 size_t i;
786 CERT *c = s->cert;
787 if (curve_id[0])
788 return 0;
789 /* Check to see we have necessary signing algorithm */
790 if (curve_id[1] == TLSEXT_curve_P_256)
791 check_md = NID_ecdsa_with_SHA256;
792 else if (curve_id[1] == TLSEXT_curve_P_384)
793 check_md = NID_ecdsa_with_SHA384;
794 else
795 return 0; /* Should never happen */
796 for (i = 0; i < c->shared_sigalgslen; i++)
797 if (check_md == c->shared_sigalgs[i].signandhash_nid)
798 break;
799 if (i == c->shared_sigalgslen)
800 return 0;
801 if (set_ee_md == 2) {
802 if (check_md == NID_ecdsa_with_SHA256)
803 c->pkeys[SSL_PKEY_ECC].digest = EVP_sha256();
804 else
805 c->pkeys[SSL_PKEY_ECC].digest = EVP_sha384();
806 }
807 }
808 return rv;
809}
810
10bf4fc2 811# ifndef OPENSSL_NO_EC
fd2b65ce 812/* Check EC temporary key is compatible with client extensions */
2ea80354 813int tls1_check_ec_tmp_key(SSL *s, unsigned long cid)
0f113f3e
MC		 814{
815 unsigned char curve_id[2];
816 EC_KEY *ec = s->cert->ecdh_tmp;
817# ifdef OPENSSL_SSL_DEBUG_BROKEN_PROTOCOL
818 /* Allow any curve: not just those peer supports */
819 if (s->cert->cert_flags & SSL_CERT_FLAG_BROKEN_PROTOCOL)
820 return 1;
821# endif
822 /*
823 * If Suite B, AES128 MUST use P-256 and AES256 MUST use P-384, no other
824 * curves permitted.
825 */
826 if (tls1_suiteb(s)) {
827 /* Curve to check determined by ciphersuite */
828 if (cid == TLS1_CK_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256)
829 curve_id[1] = TLSEXT_curve_P_256;
830 else if (cid == TLS1_CK_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384)
831 curve_id[1] = TLSEXT_curve_P_384;
832 else
833 return 0;
834 curve_id[0] = 0;
835 /* Check this curve is acceptable */
836 if (!tls1_check_ec_key(s, curve_id, NULL))
837 return 0;
838 /* If auto or setting curve from callback assume OK */
839 if (s->cert->ecdh_tmp_auto || s->cert->ecdh_tmp_cb)
840 return 1;
841 /* Otherwise check curve is acceptable */
842 else {
843 unsigned char curve_tmp[2];
844 if (!ec)
845 return 0;
846 if (!tls1_set_ec_id(curve_tmp, NULL, ec))
847 return 0;
848 if (!curve_tmp[0] || curve_tmp[1] == curve_id[1])
849 return 1;
850 return 0;
851 }
852
853 }
854 if (s->cert->ecdh_tmp_auto) {
855 /* Need a shared curve */
856 if (tls1_shared_curve(s, 0))
857 return 1;
858 else
859 return 0;
860 }
861 if (!ec) {
862 if (s->cert->ecdh_tmp_cb)
863 return 1;
864 else
865 return 0;
866 }
867 if (!tls1_set_ec_id(curve_id, NULL, ec))
868 return 0;
d18b716d 869/* Set this to allow use of invalid curves for testing */
0f113f3e
MC		 870# if 0
871 return 1;
872# else
873 return tls1_check_ec_key(s, curve_id, NULL);
874# endif
875}
10bf4fc2 876# endif /* OPENSSL_NO_EC */
d0595f17 877
14536c8c
DSH		 878#else
879
880static int tls1_check_cert_param(SSL *s, X509 *x, int set_ee_md)
0f113f3e
MC		 881{
882 return 1;
883}
14536c8c 884
0f113f3e 885#endif /* OPENSSL_NO_EC */
f1fd4544 886
ed3883d2 887#ifndef OPENSSL_NO_TLSEXT
fc101f88 888
0f113f3e
MC		 889/*
890 * List of supported signature algorithms and hashes. Should make this
fc101f88
DSH		 891 * customisable at some point, for now include everything we support.
892 */
893
0f113f3e
MC		 894# ifdef OPENSSL_NO_RSA
895# define tlsext_sigalg_rsa(md) /* */
896# else
897# define tlsext_sigalg_rsa(md) md, TLSEXT_signature_rsa,
898# endif
899
900# ifdef OPENSSL_NO_DSA
901# define tlsext_sigalg_dsa(md) /* */
902# else
903# define tlsext_sigalg_dsa(md) md, TLSEXT_signature_dsa,
904# endif
905
10bf4fc2
RS		 906# ifdef OPENSSL_NO_EC
907# define tlsext_sigalg_ecdsa(md) /* */
0f113f3e
MC		 908# else
909# define tlsext_sigalg_ecdsa(md) md, TLSEXT_signature_ecdsa,
910# endif
911
912# define tlsext_sigalg(md) \
913 tlsext_sigalg_rsa(md) \
914 tlsext_sigalg_dsa(md) \
915 tlsext_sigalg_ecdsa(md)
fc101f88 916
d97ed219 917static const unsigned char tls12_sigalgs[] = {
0f113f3e
MC		 918 tlsext_sigalg(TLSEXT_hash_sha512)
919 tlsext_sigalg(TLSEXT_hash_sha384)
0f113f3e
MC		 920 tlsext_sigalg(TLSEXT_hash_sha256)
921 tlsext_sigalg(TLSEXT_hash_sha224)
0f113f3e 922 tlsext_sigalg(TLSEXT_hash_sha1)
fc101f88 923};
0f113f3e 924
10bf4fc2 925# ifndef OPENSSL_NO_EC
d97ed219 926static const unsigned char suiteb_sigalgs[] = {
0f113f3e
MC		 927 tlsext_sigalg_ecdsa(TLSEXT_hash_sha256)
928 tlsext_sigalg_ecdsa(TLSEXT_hash_sha384)
2ea80354 929};
0f113f3e 930# endif
b7bfe69b 931size_t tls12_get_psigalgs(SSL *s, const unsigned char **psigs)
0f113f3e
MC		 932{
933 /*
934 * If Suite B mode use Suite B sigalgs only, ignore any other
935 * preferences.
936 */
937# ifndef OPENSSL_NO_EC
938 switch (tls1_suiteb(s)) {
939 case SSL_CERT_FLAG_SUITEB_128_LOS:
940 *psigs = suiteb_sigalgs;
941 return sizeof(suiteb_sigalgs);
942
943 case SSL_CERT_FLAG_SUITEB_128_LOS_ONLY:
944 *psigs = suiteb_sigalgs;
945 return 2;
946
947 case SSL_CERT_FLAG_SUITEB_192_LOS:
948 *psigs = suiteb_sigalgs + 2;
949 return 2;
950 }
951# endif
952 /* If server use client authentication sigalgs if not NULL */
953 if (s->server && s->cert->client_sigalgs) {
954 *psigs = s->cert->client_sigalgs;
955 return s->cert->client_sigalgslen;
956 } else if (s->cert->conf_sigalgs) {
957 *psigs = s->cert->conf_sigalgs;
958 return s->cert->conf_sigalgslen;
959 } else {
960 *psigs = tls12_sigalgs;
961 return sizeof(tls12_sigalgs);
962 }
963}
964
965/*
966 * Check signature algorithm is consistent with sent supported signature
ec4a50b3
DSH		 967 * algorithms and if so return relevant digest.
968 */
969int tls12_check_peer_sigalg(const EVP_MD **pmd, SSL *s,
0f113f3e
MC		 970 const unsigned char *sig, EVP_PKEY *pkey)
971{
972 const unsigned char *sent_sigs;
973 size_t sent_sigslen, i;
974 int sigalg = tls12_get_sigid(pkey);
975 /* Should never happen */
976 if (sigalg == -1)
977 return -1;
978 /* Check key type is consistent with signature */
979 if (sigalg != (int)sig[1]) {
980 SSLerr(SSL_F_TLS12_CHECK_PEER_SIGALG, SSL_R_WRONG_SIGNATURE_TYPE);
981 return 0;
982 }
983# ifndef OPENSSL_NO_EC
984 if (pkey->type == EVP_PKEY_EC) {
985 unsigned char curve_id[2], comp_id;
986 /* Check compression and curve matches extensions */
987 if (!tls1_set_ec_id(curve_id, &comp_id, pkey->pkey.ec))
988 return 0;
989 if (!s->server && !tls1_check_ec_key(s, curve_id, &comp_id)) {
990 SSLerr(SSL_F_TLS12_CHECK_PEER_SIGALG, SSL_R_WRONG_CURVE);
991 return 0;
992 }
993 /* If Suite B only P-384+SHA384 or P-256+SHA-256 allowed */
994 if (tls1_suiteb(s)) {
995 if (curve_id[0])
996 return 0;
997 if (curve_id[1] == TLSEXT_curve_P_256) {
998 if (sig[0] != TLSEXT_hash_sha256) {
999 SSLerr(SSL_F_TLS12_CHECK_PEER_SIGALG,
1000 SSL_R_ILLEGAL_SUITEB_DIGEST);
1001 return 0;
1002 }
1003 } else if (curve_id[1] == TLSEXT_curve_P_384) {
1004 if (sig[0] != TLSEXT_hash_sha384) {
1005 SSLerr(SSL_F_TLS12_CHECK_PEER_SIGALG,
1006 SSL_R_ILLEGAL_SUITEB_DIGEST);
1007 return 0;
1008 }
1009 } else
1010 return 0;
1011 }
1012 } else if (tls1_suiteb(s))
1013 return 0;
1014# endif
1015
1016 /* Check signature matches a type we sent */
1017 sent_sigslen = tls12_get_psigalgs(s, &sent_sigs);
1018 for (i = 0; i < sent_sigslen; i += 2, sent_sigs += 2) {
1019 if (sig[0] == sent_sigs[0] && sig[1] == sent_sigs[1])
1020 break;
1021 }
1022 /* Allow fallback to SHA1 if not strict mode */
1023 if (i == sent_sigslen
1024 && (sig[0] != TLSEXT_hash_sha1
1025 || s->cert->cert_flags & SSL_CERT_FLAGS_CHECK_TLS_STRICT)) {
1026 SSLerr(SSL_F_TLS12_CHECK_PEER_SIGALG, SSL_R_WRONG_SIGNATURE_TYPE);
1027 return 0;
1028 }
1029 *pmd = tls12_get_hash(sig[0]);
1030 if (*pmd == NULL) {
1031 SSLerr(SSL_F_TLS12_CHECK_PEER_SIGALG, SSL_R_UNKNOWN_DIGEST);
1032 return 0;
1033 }
1034 /* Make sure security callback allows algorithm */
1035 if (!ssl_security(s, SSL_SECOP_SIGALG_CHECK,
1036 EVP_MD_size(*pmd) * 4, EVP_MD_type(*pmd),
1037 (void *)sig)) {
1038 SSLerr(SSL_F_TLS12_CHECK_PEER_SIGALG, SSL_R_WRONG_SIGNATURE_TYPE);
1039 return 0;
1040 }
1041 /*
1042 * Store the digest used so applications can retrieve it if they wish.
1043 */
1044 if (s->session && s->session->sess_cert)
1045 s->session->sess_cert->peer_key->digest = *pmd;
1046 return 1;
1047}
2ea80354 1048
0f113f3e
MC		 1049/*
1050 * Get a mask of disabled algorithms: an algorithm is disabled if it isn't
1051 * supported or doesn't appear in supported signature algorithms. Unlike
1052 * ssl_cipher_get_disabled this applies to a specific session and not global
1053 * settings.
b7bfe69b
DSH		 1054 */
1055void ssl_set_client_disabled(SSL *s)
0f113f3e
MC		 1056{
1057 CERT *c = s->cert;
1058 c->mask_a = 0;
1059 c->mask_k = 0;
1060 /* Don't allow TLS 1.2 only ciphers if we don't suppport them */
1061 if (!SSL_CLIENT_USE_TLS1_2_CIPHERS(s))
1062 c->mask_ssl = SSL_TLSV1_2;
1063 else
1064 c->mask_ssl = 0;
1065 ssl_set_sig_mask(&c->mask_a, s, SSL_SECOP_SIGALG_MASK);
1066 /*
1067 * Disable static DH if we don't include any appropriate signature
1068 * algorithms.
1069 */
1070 if (c->mask_a & SSL_aRSA)
1071 c->mask_k |= SSL_kDHr | SSL_kECDHr;
1072 if (c->mask_a & SSL_aDSS)
1073 c->mask_k |= SSL_kDHd;
1074 if (c->mask_a & SSL_aECDSA)
1075 c->mask_k |= SSL_kECDHe;
1076# ifndef OPENSSL_NO_KRB5
1077 if (!kssl_tgt_is_available(s->kssl_ctx)) {
1078 c->mask_a |= SSL_aKRB5;
1079 c->mask_k |= SSL_kKRB5;
1080 }
1081# endif
1082# ifndef OPENSSL_NO_PSK
1083 /* with PSK there must be client callback set */
1084 if (!s->psk_client_callback) {
1085 c->mask_a |= SSL_aPSK;
1086 c->mask_k |= SSL_kPSK;
1087 }
1088# endif /* OPENSSL_NO_PSK */
1089# ifndef OPENSSL_NO_SRP
1090 if (!(s->srp_ctx.srp_Mask & SSL_kSRP)) {
1091 c->mask_a |= SSL_aSRP;
1092 c->mask_k |= SSL_kSRP;
1093 }
1094# endif
1095 c->valid = 1;
1096}
fc101f88 1097
b362ccab 1098int ssl_cipher_disabled(SSL *s, const SSL_CIPHER *c, int op)
0f113f3e
MC		 1099{
1100 CERT *ct = s->cert;
1101 if (c->algorithm_ssl & ct->mask_ssl || c->algorithm_mkey & ct->mask_k
1102 || c->algorithm_auth & ct->mask_a)
1103 return 1;
1104 return !ssl_security(s, op, c->strength_bits, 0, (void *)c);
1105}
b362ccab
DSH		 1106
1107static int tls_use_ticket(SSL *s)
0f113f3e
MC		 1108{
1109 if (s->options & SSL_OP_NO_TICKET)
1110 return 0;
1111 return ssl_security(s, SSL_SECOP_TICKET, 0, 0, NULL);
1112}
ed3883d2 1113
0f113f3e
MC		 1114unsigned char *ssl_add_clienthello_tlsext(SSL *s, unsigned char *buf,
1115 unsigned char *limit, int *al)
1116{
1117 int extdatalen = 0;
1118 unsigned char *orig = buf;
1119 unsigned char *ret = buf;
1120# ifndef OPENSSL_NO_EC
1121 /* See if we support any ECC ciphersuites */
1122 int using_ecc = 0;
1123 if (s->version >= TLS1_VERSION || SSL_IS_DTLS(s)) {
1124 int i;
1125 unsigned long alg_k, alg_a;
1126 STACK_OF(SSL_CIPHER) *cipher_stack = SSL_get_ciphers(s);
1127
1128 for (i = 0; i < sk_SSL_CIPHER_num(cipher_stack); i++) {
1129 SSL_CIPHER *c = sk_SSL_CIPHER_value(cipher_stack, i);
1130
1131 alg_k = c->algorithm_mkey;
1132 alg_a = c->algorithm_auth;
1133 if ((alg_k & (SSL_kECDHE | SSL_kECDHr | SSL_kECDHe)
1134 || (alg_a & SSL_aECDSA))) {
1135 using_ecc = 1;
1136 break;
1137 }
1138 }
1139 }
1140# endif
ed3883d2 1141
0f113f3e 1142 ret += 2;
6434abbf 1143
0f113f3e
MC		 1144 if (ret >= limit)
1145 return NULL; /* this really never occurs, but ... */
5a3d8eeb 1146
0f113f3e
MC		 1147 /* Add RI if renegotiating */
1148 if (s->renegotiate) {
1149 int el;
5a3d8eeb 1150
0f113f3e
MC		 1151 if (!ssl_add_clienthello_renegotiate_ext(s, 0, &el, 0)) {
1152 SSLerr(SSL_F_SSL_ADD_CLIENTHELLO_TLSEXT, ERR_R_INTERNAL_ERROR);
1153 return NULL;
1154 }
5a3d8eeb 1155
0f113f3e
MC		 1156 if ((limit - ret - 4 - el) < 0)
1157 return NULL;
5a3d8eeb 1158
0f113f3e
MC		 1159 s2n(TLSEXT_TYPE_renegotiate, ret);
1160 s2n(el, ret);
5a3d8eeb 1161
0f113f3e
MC		 1162 if (!ssl_add_clienthello_renegotiate_ext(s, ret, &el, el)) {
1163 SSLerr(SSL_F_SSL_ADD_CLIENTHELLO_TLSEXT, ERR_R_INTERNAL_ERROR);
1164 return NULL;
5a3d8eeb 1165 }
edc032b5 1166
0f113f3e
MC		 1167 ret += el;
1168 }
1169 /* Only add RI for SSLv3 */
1170 if (s->client_version == SSL3_VERSION)
1171 goto done;
1172
1173 if (s->tlsext_hostname != NULL) {
1174 /* Add TLS extension servername to the Client Hello message */
1175 unsigned long size_str;
1176 long lenmax;
1177
50e735f9
MC		 1178 /*-
1179 * check for enough space.
1180 * 4 for the servername type and entension length
1181 * 2 for servernamelist length
1182 * 1 for the hostname type
1183 * 2 for hostname length
1184 * + hostname length
1185 */
0f113f3e
MC		 1186
1187 if ((lenmax = limit - ret - 9) < 0
1188 || (size_str =
1189 strlen(s->tlsext_hostname)) > (unsigned long)lenmax)
1190 return NULL;
1191
1192 /* extension type and length */
1193 s2n(TLSEXT_TYPE_server_name, ret);
1194 s2n(size_str + 5, ret);
1195
1196 /* length of servername list */
1197 s2n(size_str + 3, ret);
1198
1199 /* hostname type, length and hostname */
1200 *(ret++) = (unsigned char)TLSEXT_NAMETYPE_host_name;
1201 s2n(size_str, ret);
1202 memcpy(ret, s->tlsext_hostname, size_str);
1203 ret += size_str;
1204 }
1205# ifndef OPENSSL_NO_SRP
1206 /* Add SRP username if there is one */
1207 if (s->srp_ctx.login != NULL) { /* Add TLS extension SRP username to the
1208 * Client Hello message */
1209
1210 int login_len = strlen(s->srp_ctx.login);
1211 if (login_len > 255 || login_len == 0) {
1212 SSLerr(SSL_F_SSL_ADD_CLIENTHELLO_TLSEXT, ERR_R_INTERNAL_ERROR);
1213 return NULL;
1214 }
761772d7 1215
50e735f9
MC		 1216 /*-
1217 * check for enough space.
1218 * 4 for the srp type type and entension length
1219 * 1 for the srp user identity
1220 * + srp user identity length
1221 */
0f113f3e
MC		 1222 if ((limit - ret - 5 - login_len) < 0)
1223 return NULL;
1224
1225 /* fill in the extension */
1226 s2n(TLSEXT_TYPE_srp, ret);
1227 s2n(login_len + 1, ret);
1228 (*ret++) = (unsigned char)login_len;
1229 memcpy(ret, s->srp_ctx.login, login_len);
1230 ret += login_len;
1231 }
1232# endif
1233
1234# ifndef OPENSSL_NO_EC
1235 if (using_ecc) {
1236 /*
1237 * Add TLS extension ECPointFormats to the ClientHello message
1238 */
1239 long lenmax;
1240 const unsigned char *pcurves, *pformats;
1241 size_t num_curves, num_formats, curves_list_len;
1242 size_t i;
1243 unsigned char *etmp;
1244
1245 tls1_get_formatlist(s, &pformats, &num_formats);
1246
1247 if ((lenmax = limit - ret - 5) < 0)
1248 return NULL;
1249 if (num_formats > (size_t)lenmax)
1250 return NULL;
1251 if (num_formats > 255) {
1252 SSLerr(SSL_F_SSL_ADD_CLIENTHELLO_TLSEXT, ERR_R_INTERNAL_ERROR);
1253 return NULL;
1254 }
4817504d 1255
0f113f3e
MC		 1256 s2n(TLSEXT_TYPE_ec_point_formats, ret);
1257 /* The point format list has 1-byte length. */
1258 s2n(num_formats + 1, ret);
1259 *(ret++) = (unsigned char)num_formats;
1260 memcpy(ret, pformats, num_formats);
1261 ret += num_formats;
1262
1263 /*
1264 * Add TLS extension EllipticCurves to the ClientHello message
1265 */
1266 pcurves = s->tlsext_ellipticcurvelist;
1267 if (!tls1_get_curvelist(s, 0, &pcurves, &num_curves))
1268 return NULL;
1269
1270 if ((lenmax = limit - ret - 6) < 0)
1271 return NULL;
1272 if (num_curves > (size_t)lenmax / 2)
1273 return NULL;
1274 if (num_curves > 65532 / 2) {
1275 SSLerr(SSL_F_SSL_ADD_CLIENTHELLO_TLSEXT, ERR_R_INTERNAL_ERROR);
1276 return NULL;
1277 }
ee2ffc27 1278
0f113f3e
MC		 1279 s2n(TLSEXT_TYPE_elliptic_curves, ret);
1280 etmp = ret + 4;
1281 /* Copy curve ID if supported */
1282 for (i = 0; i < num_curves; i++, pcurves += 2) {
1283 if (tls_curve_allowed(s, pcurves, SSL_SECOP_CURVE_SUPPORTED)) {
1284 *etmp++ = pcurves[0];
1285 *etmp++ = pcurves[1];
1286 }
1287 }
01f2f18f 1288
0f113f3e
MC		 1289 curves_list_len = etmp - ret - 4;
1290
1291 s2n(curves_list_len + 2, ret);
1292 s2n(curves_list_len, ret);
1293 ret += curves_list_len;
1294 }
1295# endif /* OPENSSL_NO_EC */
1296
1297 if (tls_use_ticket(s)) {
1298 int ticklen;
1299 if (!s->new_session && s->session && s->session->tlsext_tick)
1300 ticklen = s->session->tlsext_ticklen;
1301 else if (s->session && s->tlsext_session_ticket &&
1302 s->tlsext_session_ticket->data) {
1303 ticklen = s->tlsext_session_ticket->length;
1304 s->session->tlsext_tick = OPENSSL_malloc(ticklen);
1305 if (!s->session->tlsext_tick)
1306 return NULL;
1307 memcpy(s->session->tlsext_tick,
1308 s->tlsext_session_ticket->data, ticklen);
1309 s->session->tlsext_ticklen = ticklen;
1310 } else
1311 ticklen = 0;
1312 if (ticklen == 0 && s->tlsext_session_ticket &&
1313 s->tlsext_session_ticket->data == NULL)
1314 goto skip_ext;
1315 /*
1316 * Check for enough room 2 for extension type, 2 for len rest for
1317 * ticket
1318 */
1319 if ((long)(limit - ret - 4 - ticklen) < 0)
1320 return NULL;
1321 s2n(TLSEXT_TYPE_session_ticket, ret);
1322 s2n(ticklen, ret);
1323 if (ticklen) {
1324 memcpy(ret, s->session->tlsext_tick, ticklen);
1325 ret += ticklen;
1326 }
1327 }
1328 skip_ext:
1329
1330 if (SSL_USE_SIGALGS(s)) {
1331 size_t salglen;
1332 const unsigned char *salg;
1333 unsigned char *etmp;
1334 salglen = tls12_get_psigalgs(s, &salg);
1335 if ((size_t)(limit - ret) < salglen + 6)
1336 return NULL;
1337 s2n(TLSEXT_TYPE_signature_algorithms, ret);
1338 etmp = ret;
1339 /* Skip over lengths for now */
1340 ret += 4;
1341 salglen = tls12_copy_sigalgs(s, ret, salg, salglen);
1342 /* Fill in lengths */
1343 s2n(salglen + 2, etmp);
1344 s2n(salglen, etmp);
1345 ret += salglen;
1346 }
0f113f3e
MC		 1347
1348 if (s->tlsext_status_type == TLSEXT_STATUSTYPE_ocsp) {
1349 int i;
1350 long extlen, idlen, itmp;
1351 OCSP_RESPID *id;
1352
1353 idlen = 0;
1354 for (i = 0; i < sk_OCSP_RESPID_num(s->tlsext_ocsp_ids); i++) {
1355 id = sk_OCSP_RESPID_value(s->tlsext_ocsp_ids, i);
1356 itmp = i2d_OCSP_RESPID(id, NULL);
1357 if (itmp <= 0)
1358 return NULL;
1359 idlen += itmp + 2;
860c3dd1
DSH		 1360 }
1361
0f113f3e
MC		 1362 if (s->tlsext_ocsp_exts) {
1363 extlen = i2d_X509_EXTENSIONS(s->tlsext_ocsp_exts, NULL);
1364 if (extlen < 0)
1365 return NULL;
1366 } else
1367 extlen = 0;
1368
1369 if ((long)(limit - ret - 7 - extlen - idlen) < 0)
1370 return NULL;
1371 s2n(TLSEXT_TYPE_status_request, ret);
1372 if (extlen + idlen > 0xFFF0)
1373 return NULL;
1374 s2n(extlen + idlen + 5, ret);
1375 *(ret++) = TLSEXT_STATUSTYPE_ocsp;
1376 s2n(idlen, ret);
1377 for (i = 0; i < sk_OCSP_RESPID_num(s->tlsext_ocsp_ids); i++) {
1378 /* save position of id len */
1379 unsigned char *q = ret;
1380 id = sk_OCSP_RESPID_value(s->tlsext_ocsp_ids, i);
1381 /* skip over id len */
1382 ret += 2;
1383 itmp = i2d_OCSP_RESPID(id, &ret);
1384 /* write id len */
1385 s2n(itmp, q);
1386 }
1387 s2n(extlen, ret);
1388 if (extlen > 0)
1389 i2d_X509_EXTENSIONS(s->tlsext_ocsp_exts, &ret);
1390 }
1391# ifndef OPENSSL_NO_HEARTBEATS
1392 /* Add Heartbeat extension */
1393 if ((limit - ret - 4 - 1) < 0)
1394 return NULL;
1395 s2n(TLSEXT_TYPE_heartbeat, ret);
1396 s2n(1, ret);
50e735f9
MC		 1397 /*-
1398 * Set mode:
1399 * 1: peer may send requests
1400 * 2: peer not allowed to send requests
1401 */
0f113f3e
MC		 1402 if (s->tlsext_heartbeat & SSL_TLSEXT_HB_DONT_RECV_REQUESTS)
1403 *(ret++) = SSL_TLSEXT_HB_DONT_SEND_REQUESTS;
1404 else
1405 *(ret++) = SSL_TLSEXT_HB_ENABLED;
1406# endif
1407
1408# ifndef OPENSSL_NO_NEXTPROTONEG
1409 if (s->ctx->next_proto_select_cb && !s->s3->tmp.finish_md_len) {
1410 /*
1411 * The client advertises an emtpy extension to indicate its support
1412 * for Next Protocol Negotiation
1413 */
1414 if (limit - ret - 4 < 0)
1415 return NULL;
1416 s2n(TLSEXT_TYPE_next_proto_neg, ret);
1417 s2n(0, ret);
1418 }
1419# endif
1420
1421 if (s->alpn_client_proto_list && !s->s3->tmp.finish_md_len) {
1422 if ((size_t)(limit - ret) < 6 + s->alpn_client_proto_list_len)
1423 return NULL;
1424 s2n(TLSEXT_TYPE_application_layer_protocol_negotiation, ret);
1425 s2n(2 + s->alpn_client_proto_list_len, ret);
1426 s2n(s->alpn_client_proto_list_len, ret);
1427 memcpy(ret, s->alpn_client_proto_list, s->alpn_client_proto_list_len);
1428 ret += s->alpn_client_proto_list_len;
1429 }
1430# ifndef OPENSSL_NO_SRTP
1431 if (SSL_IS_DTLS(s) && SSL_get_srtp_profiles(s)) {
1432 int el;
1433
69f68237
MC		 1434 /* Returns 0 on success!! */
1435 if (ssl_add_clienthello_use_srtp_ext(s, 0, &el, 0)) {
1436 SSLerr(SSL_F_SSL_ADD_CLIENTHELLO_TLSEXT, ERR_R_INTERNAL_ERROR);
1437 return NULL;
1438 }
0f113f3e
MC		 1439
1440 if ((limit - ret - 4 - el) < 0)
1441 return NULL;
1442
1443 s2n(TLSEXT_TYPE_use_srtp, ret);
1444 s2n(el, ret);
1445
1446 if (ssl_add_clienthello_use_srtp_ext(s, ret, &el, el)) {
1447 SSLerr(SSL_F_SSL_ADD_CLIENTHELLO_TLSEXT, ERR_R_INTERNAL_ERROR);
1448 return NULL;
1449 }
1450 ret += el;
1451 }
1452# endif
1453 custom_ext_init(&s->cert->cli_ext);
1454 /* Add custom TLS Extensions to ClientHello */
1455 if (!custom_ext_add(s, 0, &ret, limit, al))
1456 return NULL;
1457# ifdef TLSEXT_TYPE_encrypt_then_mac
1458 s2n(TLSEXT_TYPE_encrypt_then_mac, ret);
1459 s2n(0, ret);
1460# endif
ddc06b35
DSH		 1461 s2n(TLSEXT_TYPE_extended_master_secret, ret);
1462 s2n(0, ret);
0f113f3e
MC		 1463
1464 /*
1465 * Add padding to workaround bugs in F5 terminators. See
1466 * https://tools.ietf.org/html/draft-agl-tls-padding-03 NB: because this
1467 * code works out the length of all existing extensions it MUST always
1468 * appear last.
1469 */
1470 if (s->options & SSL_OP_TLSEXT_PADDING) {
1471 int hlen = ret - (unsigned char *)s->init_buf->data;
1472 /*
1473 * The code in s23_clnt.c to build ClientHello messages includes the
1474 * 5-byte record header in the buffer, while the code in s3_clnt.c
1475 * does not.
1476 */
1477 if (s->state == SSL23_ST_CW_CLNT_HELLO_A)
1478 hlen -= 5;
1479 if (hlen > 0xff && hlen < 0x200) {
1480 hlen = 0x200 - hlen;
1481 if (hlen >= 4)
1482 hlen -= 4;
1483 else
1484 hlen = 0;
1485
1486 s2n(TLSEXT_TYPE_padding, ret);
1487 s2n(hlen, ret);
1488 memset(ret, 0, hlen);
1489 ret += hlen;
1490 }
1491 }
5a3d8eeb 1492
0f113f3e 1493 done:
5a3d8eeb 1494
0f113f3e
MC		 1495 if ((extdatalen = ret - orig - 2) == 0)
1496 return orig;
5a3d8eeb 1497
0f113f3e
MC		 1498 s2n(extdatalen, orig);
1499 return ret;
1500}
333f926d 1501
0f113f3e
MC		 1502unsigned char *ssl_add_serverhello_tlsext(SSL *s, unsigned char *buf,
1503 unsigned char *limit, int *al)
1504{
1505 int extdatalen = 0;
1506 unsigned char *orig = buf;
1507 unsigned char *ret = buf;
1508# ifndef OPENSSL_NO_NEXTPROTONEG
1509 int next_proto_neg_seen;
1510# endif
1511# ifndef OPENSSL_NO_EC
1512 unsigned long alg_k = s->s3->tmp.new_cipher->algorithm_mkey;
1513 unsigned long alg_a = s->s3->tmp.new_cipher->algorithm_auth;
1514 int using_ecc = (alg_k & (SSL_kECDHE | SSL_kECDHr | SSL_kECDHe))
1515 || (alg_a & SSL_aECDSA);
1516 using_ecc = using_ecc && (s->session->tlsext_ecpointformatlist != NULL);
1517# endif
1518
1519 ret += 2;
1520 if (ret >= limit)
1521 return NULL; /* this really never occurs, but ... */
1522
1523 if (s->s3->send_connection_binding) {
1524 int el;
1525
1526 if (!ssl_add_serverhello_renegotiate_ext(s, 0, &el, 0)) {
1527 SSLerr(SSL_F_SSL_ADD_SERVERHELLO_TLSEXT, ERR_R_INTERNAL_ERROR);
1528 return NULL;
1529 }
333f926d 1530
0f113f3e
MC		 1531 if ((limit - ret - 4 - el) < 0)
1532 return NULL;
333f926d 1533
0f113f3e
MC		 1534 s2n(TLSEXT_TYPE_renegotiate, ret);
1535 s2n(el, ret);
333f926d 1536
0f113f3e
MC		 1537 if (!ssl_add_serverhello_renegotiate_ext(s, ret, &el, el)) {
1538 SSLerr(SSL_F_SSL_ADD_SERVERHELLO_TLSEXT, ERR_R_INTERNAL_ERROR);
1539 return NULL;
1540 }
333f926d 1541
0f113f3e
MC		 1542 ret += el;
1543 }
1544
1545 /* Only add RI for SSLv3 */
1546 if (s->version == SSL3_VERSION)
1547 goto done;
1548
1549 if (!s->hit && s->servername_done == 1
1550 && s->session->tlsext_hostname != NULL) {
1551 if ((long)(limit - ret - 4) < 0)
1552 return NULL;
1553
1554 s2n(TLSEXT_TYPE_server_name, ret);
1555 s2n(0, ret);
1556 }
1557# ifndef OPENSSL_NO_EC
1558 if (using_ecc) {
1559 const unsigned char *plist;
1560 size_t plistlen;
1561 /*
1562 * Add TLS extension ECPointFormats to the ServerHello message
1563 */
1564 long lenmax;
1565
1566 tls1_get_formatlist(s, &plist, &plistlen);
1567
1568 if ((lenmax = limit - ret - 5) < 0)
1569 return NULL;
1570 if (plistlen > (size_t)lenmax)
1571 return NULL;
1572 if (plistlen > 255) {
1573 SSLerr(SSL_F_SSL_ADD_SERVERHELLO_TLSEXT, ERR_R_INTERNAL_ERROR);
1574 return NULL;
1575 }
4817504d 1576
0f113f3e
MC		 1577 s2n(TLSEXT_TYPE_ec_point_formats, ret);
1578 s2n(plistlen + 1, ret);
1579 *(ret++) = (unsigned char)plistlen;
1580 memcpy(ret, plist, plistlen);
1581 ret += plistlen;
1582
1583 }
1584 /*
1585 * Currently the server should not respond with a SupportedCurves
1586 * extension
1587 */
1588# endif /* OPENSSL_NO_EC */
1589
1590 if (s->tlsext_ticket_expected && tls_use_ticket(s)) {
1591 if ((long)(limit - ret - 4) < 0)
1592 return NULL;
1593 s2n(TLSEXT_TYPE_session_ticket, ret);
1594 s2n(0, ret);
1595 }
1596
1597 if (s->tlsext_status_expected) {
1598 if ((long)(limit - ret - 4) < 0)
1599 return NULL;
1600 s2n(TLSEXT_TYPE_status_request, ret);
1601 s2n(0, ret);
1602 }
0f113f3e
MC		 1603
1604# ifndef OPENSSL_NO_SRTP
1605 if (SSL_IS_DTLS(s) && s->srtp_profile) {
1606 int el;
1607
69f68237 1608 /* Returns 0 on success!! */
61986d32 1609 if (ssl_add_serverhello_use_srtp_ext(s, 0, &el, 0)) {
69f68237
MC		 1610 SSLerr(SSL_F_SSL_ADD_SERVERHELLO_TLSEXT, ERR_R_INTERNAL_ERROR);
1611 return NULL;
1612 }
0f113f3e
MC		 1613 if ((limit - ret - 4 - el) < 0)
1614 return NULL;
1615
1616 s2n(TLSEXT_TYPE_use_srtp, ret);
1617 s2n(el, ret);
1618
1619 if (ssl_add_serverhello_use_srtp_ext(s, ret, &el, el)) {
1620 SSLerr(SSL_F_SSL_ADD_SERVERHELLO_TLSEXT, ERR_R_INTERNAL_ERROR);
1621 return NULL;
1622 }
1623 ret += el;
1624 }
1625# endif
1626
1627 if (((s->s3->tmp.new_cipher->id & 0xFFFF) == 0x80
1628 || (s->s3->tmp.new_cipher->id & 0xFFFF) == 0x81)
1629 && (SSL_get_options(s) & SSL_OP_CRYPTOPRO_TLSEXT_BUG)) {
1630 const unsigned char cryptopro_ext[36] = {
1631 0xfd, 0xe8, /* 65000 */
1632 0x00, 0x20, /* 32 bytes length */
1633 0x30, 0x1e, 0x30, 0x08, 0x06, 0x06, 0x2a, 0x85,
1634 0x03, 0x02, 0x02, 0x09, 0x30, 0x08, 0x06, 0x06,
1635 0x2a, 0x85, 0x03, 0x02, 0x02, 0x16, 0x30, 0x08,
1636 0x06, 0x06, 0x2a, 0x85, 0x03, 0x02, 0x02, 0x17
1637 };
1638 if (limit - ret < 36)
1639 return NULL;
1640 memcpy(ret, cryptopro_ext, 36);
1641 ret += 36;
1642
1643 }
1644# ifndef OPENSSL_NO_HEARTBEATS
1645 /* Add Heartbeat extension if we've received one */
1646 if (s->tlsext_heartbeat & SSL_TLSEXT_HB_ENABLED) {
1647 if ((limit - ret - 4 - 1) < 0)
1648 return NULL;
1649 s2n(TLSEXT_TYPE_heartbeat, ret);
1650 s2n(1, ret);
50e735f9
MC		 1651 /*-
1652 * Set mode:
1653 * 1: peer may send requests
1654 * 2: peer not allowed to send requests
1655 */
0f113f3e
MC		 1656 if (s->tlsext_heartbeat & SSL_TLSEXT_HB_DONT_RECV_REQUESTS)
1657 *(ret++) = SSL_TLSEXT_HB_DONT_SEND_REQUESTS;
1658 else
1659 *(ret++) = SSL_TLSEXT_HB_ENABLED;
1660
1661 }
1662# endif
1663
1664# ifndef OPENSSL_NO_NEXTPROTONEG
1665 next_proto_neg_seen = s->s3->next_proto_neg_seen;
1666 s->s3->next_proto_neg_seen = 0;
1667 if (next_proto_neg_seen && s->ctx->next_protos_advertised_cb) {
1668 const unsigned char *npa;
1669 unsigned int npalen;
1670 int r;
1671
1672 r = s->ctx->next_protos_advertised_cb(s, &npa, &npalen,
1673 s->
1674 ctx->next_protos_advertised_cb_arg);
1675 if (r == SSL_TLSEXT_ERR_OK) {
1676 if ((long)(limit - ret - 4 - npalen) < 0)
1677 return NULL;
1678 s2n(TLSEXT_TYPE_next_proto_neg, ret);
1679 s2n(npalen, ret);
1680 memcpy(ret, npa, npalen);
1681 ret += npalen;
1682 s->s3->next_proto_neg_seen = 1;
1683 }
1684 }
1685# endif
1686 if (!custom_ext_add(s, 1, &ret, limit, al))
1687 return NULL;
1688# ifdef TLSEXT_TYPE_encrypt_then_mac
1689 if (s->s3->flags & TLS1_FLAGS_ENCRYPT_THEN_MAC) {
1690 /*
1691 * Don't use encrypt_then_mac if AEAD or RC4 might want to disable
1692 * for other cases too.
1693 */
1694 if (s->s3->tmp.new_cipher->algorithm_mac == SSL_AEAD
1695 || s->s3->tmp.new_cipher->algorithm_enc == SSL_RC4)
1696 s->s3->flags &= ~TLS1_FLAGS_ENCRYPT_THEN_MAC;
1697 else {
1698 s2n(TLSEXT_TYPE_encrypt_then_mac, ret);
1699 s2n(0, ret);
1700 }
1701 }
1702# endif
ddc06b35
DSH		 1703 if (!s->hit && s->session->flags & SSL_SESS_FLAG_EXTMS) {
1704 s2n(TLSEXT_TYPE_extended_master_secret, ret);
1705 s2n(0, ret);
1706 }
0f113f3e
MC		 1707
1708 if (s->s3->alpn_selected) {
1709 const unsigned char *selected = s->s3->alpn_selected;
1710 unsigned len = s->s3->alpn_selected_len;
1711
1712 if ((long)(limit - ret - 4 - 2 - 1 - len) < 0)
1713 return NULL;
1714 s2n(TLSEXT_TYPE_application_layer_protocol_negotiation, ret);
1715 s2n(3 + len, ret);
1716 s2n(1 + len, ret);
1717 *ret++ = len;
1718 memcpy(ret, selected, len);
1719 ret += len;
1720 }
1721
1722 done:
1723
1724 if ((extdatalen = ret - orig - 2) == 0)
1725 return orig;
1726
1727 s2n(extdatalen, orig);
1728 return ret;
1729}
a398f821 1730
0f113f3e
MC		 1731/*
1732 * tls1_alpn_handle_client_hello is called to process the ALPN extension in a
1733 * ClientHello. data: the contents of the extension, not including the type
1734 * and length. data_len: the number of bytes in |data| al: a pointer to the
1735 * alert value to send in the event of a non-zero return. returns: 0 on
1736 * success.
1737 */
6f017a8f 1738static int tls1_alpn_handle_client_hello(SSL *s, const unsigned char *data,
0f113f3e
MC		 1739 unsigned data_len, int *al)
1740{
1741 unsigned i;
1742 unsigned proto_len;
1743 const unsigned char *selected;
1744 unsigned char selected_len;
1745 int r;
1746
1747 if (s->ctx->alpn_select_cb == NULL)
1748 return 0;
1749
1750 if (data_len < 2)
1751 goto parse_error;
1752
1753 /*
1754 * data should contain a uint16 length followed by a series of 8-bit,
1755 * length-prefixed strings.
1756 */
1757 i = ((unsigned)data[0]) << 8 | ((unsigned)data[1]);
1758 data_len -= 2;
1759 data += 2;
1760 if (data_len != i)
1761 goto parse_error;
1762
1763 if (data_len < 2)
1764 goto parse_error;
1765
1766 for (i = 0; i < data_len;) {
1767 proto_len = data[i];
1768 i++;
1769
1770 if (proto_len == 0)
1771 goto parse_error;
1772
1773 if (i + proto_len < i || i + proto_len > data_len)
1774 goto parse_error;
1775
1776 i += proto_len;
1777 }
1778
1779 r = s->ctx->alpn_select_cb(s, &selected, &selected_len, data, data_len,
1780 s->ctx->alpn_select_cb_arg);
1781 if (r == SSL_TLSEXT_ERR_OK) {
1782 if (s->s3->alpn_selected)
1783 OPENSSL_free(s->s3->alpn_selected);
1784 s->s3->alpn_selected = OPENSSL_malloc(selected_len);
1785 if (!s->s3->alpn_selected) {
1786 *al = SSL_AD_INTERNAL_ERROR;
1787 return -1;
1788 }
1789 memcpy(s->s3->alpn_selected, selected, selected_len);
1790 s->s3->alpn_selected_len = selected_len;
1791 }
1792 return 0;
1793
1794 parse_error:
1795 *al = SSL_AD_DECODE_ERROR;
1796 return -1;
1797}
6f017a8f 1798
0f113f3e 1799# ifndef OPENSSL_NO_EC
1d97c843
TH		 1800/*-
1801 * ssl_check_for_safari attempts to fingerprint Safari using OS X
dece3209
RS		 1802 * SecureTransport using the TLS extension block in |d|, of length |n|.
1803 * Safari, since 10.6, sends exactly these extensions, in this order:
1804 * SNI,
1805 * elliptic_curves
1806 * ec_point_formats
1807 *
1808 * We wish to fingerprint Safari because they broke ECDHE-ECDSA support in 10.8,
1809 * but they advertise support. So enabling ECDHE-ECDSA ciphers breaks them.
1810 * Sadly we cannot differentiate 10.6, 10.7 and 10.8.4 (which work), from
1811 * 10.8..10.8.3 (which don't work).
1812 */
0f113f3e
MC		 1813static void ssl_check_for_safari(SSL *s, const unsigned char *data,
1814 const unsigned char *d, int n)
1815{
1816 unsigned short type, size;
1817 static const unsigned char kSafariExtensionsBlock[] = {
1818 0x00, 0x0a, /* elliptic_curves extension */
1819 0x00, 0x08, /* 8 bytes */
1820 0x00, 0x06, /* 6 bytes of curve ids */
1821 0x00, 0x17, /* P-256 */
1822 0x00, 0x18, /* P-384 */
1823 0x00, 0x19, /* P-521 */
1824
1825 0x00, 0x0b, /* ec_point_formats */
1826 0x00, 0x02, /* 2 bytes */
1827 0x01, /* 1 point format */
1828 0x00, /* uncompressed */
1829 };
1830
1831 /* The following is only present in TLS 1.2 */
1832 static const unsigned char kSafariTLS12ExtensionsBlock[] = {
1833 0x00, 0x0d, /* signature_algorithms */
1834 0x00, 0x0c, /* 12 bytes */
1835 0x00, 0x0a, /* 10 bytes */
1836 0x05, 0x01, /* SHA-384/RSA */
1837 0x04, 0x01, /* SHA-256/RSA */
1838 0x02, 0x01, /* SHA-1/RSA */
1839 0x04, 0x03, /* SHA-256/ECDSA */
1840 0x02, 0x03, /* SHA-1/ECDSA */
1841 };
1842
1843 if (data >= (d + n - 2))
1844 return;
1845 data += 2;
1846
1847 if (data > (d + n - 4))
1848 return;
1849 n2s(data, type);
1850 n2s(data, size);
1851
1852 if (type != TLSEXT_TYPE_server_name)
1853 return;
1854
1855 if (data + size > d + n)
1856 return;
1857 data += size;
1858
1859 if (TLS1_get_client_version(s) >= TLS1_2_VERSION) {
1860 const size_t len1 = sizeof(kSafariExtensionsBlock);
1861 const size_t len2 = sizeof(kSafariTLS12ExtensionsBlock);
1862
1863 if (data + len1 + len2 != d + n)
1864 return;
1865 if (memcmp(data, kSafariExtensionsBlock, len1) != 0)
1866 return;
1867 if (memcmp(data + len1, kSafariTLS12ExtensionsBlock, len2) != 0)
1868 return;
1869 } else {
1870 const size_t len = sizeof(kSafariExtensionsBlock);
1871
1872 if (data + len != d + n)
1873 return;
1874 if (memcmp(data, kSafariExtensionsBlock, len) != 0)
1875 return;
1876 }
1877
1878 s->s3->is_probably_safari = 1;
dece3209 1879}
0f113f3e
MC		 1880# endif /* !OPENSSL_NO_EC */
1881
1882static int ssl_scan_clienthello_tlsext(SSL *s, unsigned char **p,
1883 unsigned char *d, int n, int *al)
1884{
1885 unsigned short type;
1886 unsigned short size;
1887 unsigned short len;
1888 unsigned char *data = *p;
1889 int renegotiate_seen = 0;
1890
1891 s->servername_done = 0;
1892 s->tlsext_status_type = -1;
1893# ifndef OPENSSL_NO_NEXTPROTONEG
1894 s->s3->next_proto_neg_seen = 0;
1895# endif
1896
1897 if (s->s3->alpn_selected) {
1898 OPENSSL_free(s->s3->alpn_selected);
1899 s->s3->alpn_selected = NULL;
1900 }
1901# ifndef OPENSSL_NO_HEARTBEATS
1902 s->tlsext_heartbeat &= ~(SSL_TLSEXT_HB_ENABLED |
1903 SSL_TLSEXT_HB_DONT_SEND_REQUESTS);
1904# endif
1905
1906# ifndef OPENSSL_NO_EC
1907 if (s->options & SSL_OP_SAFARI_ECDHE_ECDSA_BUG)
1908 ssl_check_for_safari(s, data, d, n);
1909# endif /* !OPENSSL_NO_EC */
1910
1911 /* Clear any signature algorithms extension received */
1912 if (s->cert->peer_sigalgs) {
1913 OPENSSL_free(s->cert->peer_sigalgs);
1914 s->cert->peer_sigalgs = NULL;
1915 }
1916# ifdef TLSEXT_TYPE_encrypt_then_mac
1917 s->s3->flags &= ~TLS1_FLAGS_ENCRYPT_THEN_MAC;
1918# endif
1919
1920# ifndef OPENSSL_NO_SRP
1921 if (s->srp_ctx.login != NULL) {
1922 OPENSSL_free(s->srp_ctx.login);
1923 s->srp_ctx.login = NULL;
1924 }
1925# endif
1926
1927 s->srtp_profile = NULL;
1928
1929 if (data >= (d + n - 2))
1930 goto ri_check;
1931 n2s(data, len);
1932
1933 if (data > (d + n - len))
1934 goto ri_check;
1935
1936 while (data <= (d + n - 4)) {
1937 n2s(data, type);
1938 n2s(data, size);
1939
1940 if (data + size > (d + n))
1941 goto ri_check;
0f113f3e
MC		 1942 if (s->tlsext_debug_cb)
1943 s->tlsext_debug_cb(s, 0, type, data, size, s->tlsext_debug_arg);
1944 if (type == TLSEXT_TYPE_renegotiate) {
1945 if (!ssl_parse_clienthello_renegotiate_ext(s, data, size, al))
1946 return 0;
1947 renegotiate_seen = 1;
1948 } else if (s->version == SSL3_VERSION) {
1949 }
1d97c843
TH		 1950/*-
1951 * The servername extension is treated as follows:
1952 *
1953 * - Only the hostname type is supported with a maximum length of 255.
1954 * - The servername is rejected if too long or if it contains zeros,
1955 * in which case an fatal alert is generated.
1956 * - The servername field is maintained together with the session cache.
1957 * - When a session is resumed, the servername call back invoked in order
0f113f3e
MC		 1958 * to allow the application to position itself to the right context.
1959 * - The servername is acknowledged if it is new for a session or when
1960 * it is identical to a previously used for the same session.
1d97c843
TH		 1961 * Applications can control the behaviour. They can at any time
1962 * set a 'desirable' servername for a new SSL object. This can be the
1963 * case for example with HTTPS when a Host: header field is received and
1964 * a renegotiation is requested. In this case, a possible servername
1965 * presented in the new client hello is only acknowledged if it matches
0f113f3e 1966 * the value of the Host: field.
1d97c843 1967 * - Applications must use SSL_OP_NO_SESSION_RESUMPTION_ON_RENEGOTIATION
0f113f3e
MC		 1968 * if they provide for changing an explicit servername context for the
1969 * session, i.e. when the session has been established with a servername
1970 * extension.
1971 * - On session reconnect, the servername extension may be absent.
1d97c843 1972 *
0f113f3e 1973 */
ed3883d2 1974
0f113f3e
MC		 1975 else if (type == TLSEXT_TYPE_server_name) {
1976 unsigned char *sdata;
1977 int servname_type;
1978 int dsize;
1979
1980 if (size < 2) {
1981 *al = SSL_AD_DECODE_ERROR;
1982 return 0;
1983 }
1984 n2s(data, dsize);
1985 size -= 2;
1986 if (dsize > size) {
1987 *al = SSL_AD_DECODE_ERROR;
1988 return 0;
1989 }
1990
1991 sdata = data;
1992 while (dsize > 3) {
1993 servname_type = *(sdata++);
1994 n2s(sdata, len);
1995 dsize -= 3;
1996
1997 if (len > dsize) {
1998 *al = SSL_AD_DECODE_ERROR;
1999 return 0;
2000 }
2001 if (s->servername_done == 0)
2002 switch (servname_type) {
2003 case TLSEXT_NAMETYPE_host_name:
2004 if (!s->hit) {
2005 if (s->session->tlsext_hostname) {
2006 *al = SSL_AD_DECODE_ERROR;
2007 return 0;
2008 }
2009 if (len > TLSEXT_MAXLEN_host_name) {
2010 *al = TLS1_AD_UNRECOGNIZED_NAME;
2011 return 0;
2012 }
2013 if ((s->session->tlsext_hostname =
2014 OPENSSL_malloc(len + 1)) == NULL) {
2015 *al = TLS1_AD_INTERNAL_ERROR;
2016 return 0;
2017 }
2018 memcpy(s->session->tlsext_hostname, sdata, len);
2019 s->session->tlsext_hostname[len] = '\0';
2020 if (strlen(s->session->tlsext_hostname) != len) {
2021 OPENSSL_free(s->session->tlsext_hostname);
2022 s->session->tlsext_hostname = NULL;
2023 *al = TLS1_AD_UNRECOGNIZED_NAME;
2024 return 0;
2025 }
2026 s->servername_done = 1;
761772d7 2027
0f113f3e
MC		 2028 } else
2029 s->servername_done = s->session->tlsext_hostname
2030 && strlen(s->session->tlsext_hostname) == len
2031 && strncmp(s->session->tlsext_hostname,
2032 (char *)sdata, len) == 0;
b2284ed3 2033
0f113f3e 2034 break;
ee2ffc27 2035
0f113f3e
MC		 2036 default:
2037 break;
2038 }
6f31dd72 2039
0f113f3e
MC		 2040 dsize -= len;
2041 }
2042 if (dsize != 0) {
2043 *al = SSL_AD_DECODE_ERROR;
2044 return 0;
2045 }
6f017a8f 2046
0f113f3e
MC		 2047 }
2048# ifndef OPENSSL_NO_SRP
2049 else if (type == TLSEXT_TYPE_srp) {
2050 if (size <= 0 || ((len = data[0])) != (size - 1)) {
2051 *al = SSL_AD_DECODE_ERROR;
2052 return 0;
2053 }
2054 if (s->srp_ctx.login != NULL) {
2055 *al = SSL_AD_DECODE_ERROR;
2056 return 0;
2057 }
2058 if ((s->srp_ctx.login = OPENSSL_malloc(len + 1)) == NULL)
2059 return -1;
2060 memcpy(s->srp_ctx.login, &data[1], len);
2061 s->srp_ctx.login[len] = '\0';
2062
2063 if (strlen(s->srp_ctx.login) != len) {
2064 *al = SSL_AD_DECODE_ERROR;
2065 return 0;
2066 }
2067 }
2068# endif
2069
2070# ifndef OPENSSL_NO_EC
2071 else if (type == TLSEXT_TYPE_ec_point_formats) {
2072 unsigned char *sdata = data;
2073 int ecpointformatlist_length = *(sdata++);
2074
2075 if (ecpointformatlist_length != size - 1 ||
2076 ecpointformatlist_length < 1) {
2077 *al = TLS1_AD_DECODE_ERROR;
2078 return 0;
2079 }
2080 if (!s->hit) {
2081 if (s->session->tlsext_ecpointformatlist) {
2082 OPENSSL_free(s->session->tlsext_ecpointformatlist);
2083 s->session->tlsext_ecpointformatlist = NULL;
2084 }
2085 s->session->tlsext_ecpointformatlist_length = 0;
2086 if ((s->session->tlsext_ecpointformatlist =
2087 OPENSSL_malloc(ecpointformatlist_length)) == NULL) {
2088 *al = TLS1_AD_INTERNAL_ERROR;
2089 return 0;
2090 }
2091 s->session->tlsext_ecpointformatlist_length =
2092 ecpointformatlist_length;
2093 memcpy(s->session->tlsext_ecpointformatlist, sdata,
2094 ecpointformatlist_length);
2095 }
0f113f3e
MC		 2096 } else if (type == TLSEXT_TYPE_elliptic_curves) {
2097 unsigned char *sdata = data;
2098 int ellipticcurvelist_length = (*(sdata++) << 8);
2099 ellipticcurvelist_length += (*(sdata++));
2100
2101 if (ellipticcurvelist_length != size - 2 ||
2102 ellipticcurvelist_length < 1 ||
2103 /* Each NamedCurve is 2 bytes. */
2104 ellipticcurvelist_length & 1) {
2105 *al = TLS1_AD_DECODE_ERROR;
2106 return 0;
2107 }
2108 if (!s->hit) {
2109 if (s->session->tlsext_ellipticcurvelist) {
2110 *al = TLS1_AD_DECODE_ERROR;
2111 return 0;
2112 }
2113 s->session->tlsext_ellipticcurvelist_length = 0;
2114 if ((s->session->tlsext_ellipticcurvelist =
2115 OPENSSL_malloc(ellipticcurvelist_length)) == NULL) {
2116 *al = TLS1_AD_INTERNAL_ERROR;
2117 return 0;
2118 }
2119 s->session->tlsext_ellipticcurvelist_length =
2120 ellipticcurvelist_length;
2121 memcpy(s->session->tlsext_ellipticcurvelist, sdata,
2122 ellipticcurvelist_length);
2123 }
0f113f3e
MC		 2124 }
2125# endif /* OPENSSL_NO_EC */
0f113f3e
MC		 2126 else if (type == TLSEXT_TYPE_session_ticket) {
2127 if (s->tls_session_ticket_ext_cb &&
2128 !s->tls_session_ticket_ext_cb(s, data, size,
2129 s->tls_session_ticket_ext_cb_arg))
2130 {
2131 *al = TLS1_AD_INTERNAL_ERROR;
2132 return 0;
2133 }
2134 } else if (type == TLSEXT_TYPE_signature_algorithms) {
2135 int dsize;
2136 if (s->cert->peer_sigalgs || size < 2) {
2137 *al = SSL_AD_DECODE_ERROR;
2138 return 0;
2139 }
2140 n2s(data, dsize);
2141 size -= 2;
2142 if (dsize != size || dsize & 1 || !dsize) {
2143 *al = SSL_AD_DECODE_ERROR;
2144 return 0;
2145 }
2146 if (!tls1_save_sigalgs(s, data, dsize)) {
2147 *al = SSL_AD_DECODE_ERROR;
2148 return 0;
2149 }
2150 } else if (type == TLSEXT_TYPE_status_request) {
2151
2152 if (size < 5) {
2153 *al = SSL_AD_DECODE_ERROR;
2154 return 0;
2155 }
2156
2157 s->tlsext_status_type = *data++;
2158 size--;
2159 if (s->tlsext_status_type == TLSEXT_STATUSTYPE_ocsp) {
2160 const unsigned char *sdata;
2161 int dsize;
2162 /* Read in responder_id_list */
2163 n2s(data, dsize);
2164 size -= 2;
2165 if (dsize > size) {
2166 *al = SSL_AD_DECODE_ERROR;
2167 return 0;
2168 }
2169 while (dsize > 0) {
2170 OCSP_RESPID *id;
2171 int idsize;
2172 if (dsize < 4) {
2173 *al = SSL_AD_DECODE_ERROR;
2174 return 0;
2175 }
2176 n2s(data, idsize);
2177 dsize -= 2 + idsize;
2178 size -= 2 + idsize;
2179 if (dsize < 0) {
2180 *al = SSL_AD_DECODE_ERROR;
2181 return 0;
2182 }
2183 sdata = data;
2184 data += idsize;
2185 id = d2i_OCSP_RESPID(NULL, &sdata, idsize);
2186 if (!id) {
2187 *al = SSL_AD_DECODE_ERROR;
2188 return 0;
2189 }
2190 if (data != sdata) {
2191 OCSP_RESPID_free(id);
2192 *al = SSL_AD_DECODE_ERROR;
2193 return 0;
2194 }
2195 if (!s->tlsext_ocsp_ids
2196 && !(s->tlsext_ocsp_ids =
2197 sk_OCSP_RESPID_new_null())) {
2198 OCSP_RESPID_free(id);
2199 *al = SSL_AD_INTERNAL_ERROR;
2200 return 0;
2201 }
2202 if (!sk_OCSP_RESPID_push(s->tlsext_ocsp_ids, id)) {
2203 OCSP_RESPID_free(id);
2204 *al = SSL_AD_INTERNAL_ERROR;
2205 return 0;
2206 }
2207 }
4817504d 2208
0f113f3e
MC		 2209 /* Read in request_extensions */
2210 if (size < 2) {
2211 *al = SSL_AD_DECODE_ERROR;
2212 return 0;
2213 }
2214 n2s(data, dsize);
2215 size -= 2;
2216 if (dsize != size) {
2217 *al = SSL_AD_DECODE_ERROR;
2218 return 0;
2219 }
2220 sdata = data;
2221 if (dsize > 0) {
222561fe
RS		 2222 sk_X509_EXTENSION_pop_free(s->tlsext_ocsp_exts,
2223 X509_EXTENSION_free);
0f113f3e
MC		 2224 s->tlsext_ocsp_exts =
2225 d2i_X509_EXTENSIONS(NULL, &sdata, dsize);
2226 if (!s->tlsext_ocsp_exts || (data + dsize != sdata)) {
2227 *al = SSL_AD_DECODE_ERROR;
2228 return 0;
2229 }
2230 }
2231 }
2232 /*
2233 * We don't know what to do with any other type * so ignore it.
2234 */
2235 else
2236 s->tlsext_status_type = -1;
2237 }
2238# ifndef OPENSSL_NO_HEARTBEATS
2239 else if (type == TLSEXT_TYPE_heartbeat) {
2240 switch (data[0]) {
2241 case 0x01: /* Client allows us to send HB requests */
2242 s->tlsext_heartbeat |= SSL_TLSEXT_HB_ENABLED;
2243 break;
2244 case 0x02: /* Client doesn't accept HB requests */
2245 s->tlsext_heartbeat |= SSL_TLSEXT_HB_ENABLED;
2246 s->tlsext_heartbeat |= SSL_TLSEXT_HB_DONT_SEND_REQUESTS;
2247 break;
2248 default:
2249 *al = SSL_AD_ILLEGAL_PARAMETER;
2250 return 0;
2251 }
2252 }
2253# endif
2254# ifndef OPENSSL_NO_NEXTPROTONEG
2255 else if (type == TLSEXT_TYPE_next_proto_neg &&
2256 s->s3->tmp.finish_md_len == 0 &&
2257 s->s3->alpn_selected == NULL) {
50e735f9
MC		 2258 /*-
2259 * We shouldn't accept this extension on a
2260 * renegotiation.
2261 *
2262 * s->new_session will be set on renegotiation, but we
2263 * probably shouldn't rely that it couldn't be set on
2264 * the initial renegotation too in certain cases (when
2265 * there's some other reason to disallow resuming an
2266 * earlier session -- the current code won't be doing
2267 * anything like that, but this might change).
2268 *
2269 * A valid sign that there's been a previous handshake
2270 * in this connection is if s->s3->tmp.finish_md_len >
2271 * 0. (We are talking about a check that will happen
2272 * in the Hello protocol round, well before a new
2273 * Finished message could have been computed.)
2274 */
0f113f3e
MC		 2275 s->s3->next_proto_neg_seen = 1;
2276 }
2277# endif
2278
2279 else if (type == TLSEXT_TYPE_application_layer_protocol_negotiation &&
2280 s->ctx->alpn_select_cb && s->s3->tmp.finish_md_len == 0) {
2281 if (tls1_alpn_handle_client_hello(s, data, size, al) != 0)
2282 return 0;
2283# ifndef OPENSSL_NO_NEXTPROTONEG
2284 /* ALPN takes precedence over NPN. */
2285 s->s3->next_proto_neg_seen = 0;
2286# endif
2287 }
5e3ff62c 2288
0f113f3e
MC		 2289 /* session ticket processed earlier */
2290# ifndef OPENSSL_NO_SRTP
2291 else if (SSL_IS_DTLS(s) && SSL_get_srtp_profiles(s)
2292 && type == TLSEXT_TYPE_use_srtp) {
2293 if (ssl_parse_clienthello_use_srtp_ext(s, data, size, al))
2294 return 0;
2295 }
2296# endif
2297# ifdef TLSEXT_TYPE_encrypt_then_mac
2298 else if (type == TLSEXT_TYPE_encrypt_then_mac)
2299 s->s3->flags |= TLS1_FLAGS_ENCRYPT_THEN_MAC;
2300# endif
ddc06b35
DSH		 2301 else if (type == TLSEXT_TYPE_extended_master_secret) {
2302 if (!s->hit)
2303 s->session->flags |= SSL_SESS_FLAG_EXTMS;
2304 }
0f113f3e
MC		 2305 /*
2306 * If this ClientHello extension was unhandled and this is a
2307 * nonresumed connection, check whether the extension is a custom
2308 * TLS Extension (has a custom_srv_ext_record), and if so call the
2309 * callback and record the extension number so that an appropriate
2310 * ServerHello may be later returned.
2311 */
2312 else if (!s->hit) {
2313 if (custom_ext_parse(s, 1, type, data, size, al) <= 0)
2314 return 0;
2315 }
ed3883d2 2316
0f113f3e
MC		 2317 data += size;
2318 }
6f017a8f 2319
0f113f3e
MC		 2320 *p = data;
2321
2322 ri_check:
ed3883d2 2323
0f113f3e
MC		 2324 /* Need RI if renegotiating */
2325
2326 if (!renegotiate_seen && s->renegotiate &&
2327 !(s->options & SSL_OP_ALLOW_UNSAFE_LEGACY_RENEGOTIATION)) {
2328 *al = SSL_AD_HANDSHAKE_FAILURE;
2329 SSLerr(SSL_F_SSL_SCAN_CLIENTHELLO_TLSEXT,
2330 SSL_R_UNSAFE_LEGACY_RENEGOTIATION_DISABLED);
2331 return 0;
2332 }
2333
2334 return 1;
2335}
2336
2337int ssl_parse_clienthello_tlsext(SSL *s, unsigned char **p, unsigned char *d,
2338 int n)
2339{
2340 int al = -1;
2341 custom_ext_init(&s->cert->srv_ext);
2342 if (ssl_scan_clienthello_tlsext(s, p, d, n, &al) <= 0) {
2343 ssl3_send_alert(s, SSL3_AL_FATAL, al);
2344 return 0;
2345 }
2346
2347 if (ssl_check_clienthello_tlsext_early(s) <= 0) {
2348 SSLerr(SSL_F_SSL_PARSE_CLIENTHELLO_TLSEXT, SSL_R_CLIENTHELLO_TLSEXT);
2349 return 0;
2350 }
2351 return 1;
2352}
2353
2354# ifndef OPENSSL_NO_NEXTPROTONEG
2355/*
2356 * ssl_next_proto_validate validates a Next Protocol Negotiation block. No
2357 * elements of zero length are allowed and the set of elements must exactly
2358 * fill the length of the block.
2359 */
2360static char ssl_next_proto_validate(unsigned char *d, unsigned len)
2361{
2362 unsigned int off = 0;
2363
2364 while (off < len) {
2365 if (d[off] == 0)
2366 return 0;
2367 off += d[off];
2368 off++;
2369 }
2370
2371 return off == len;
2372}
2373# endif
2374
2375static int ssl_scan_serverhello_tlsext(SSL *s, unsigned char **p,
2376 unsigned char *d, int n, int *al)
2377{
2378 unsigned short length;
2379 unsigned short type;
2380 unsigned short size;
2381 unsigned char *data = *p;
2382 int tlsext_servername = 0;
2383 int renegotiate_seen = 0;
2384
2385# ifndef OPENSSL_NO_NEXTPROTONEG
2386 s->s3->next_proto_neg_seen = 0;
2387# endif
2388 s->tlsext_ticket_expected = 0;
2389
2390 if (s->s3->alpn_selected) {
2391 OPENSSL_free(s->s3->alpn_selected);
2392 s->s3->alpn_selected = NULL;
2393 }
2394# ifndef OPENSSL_NO_HEARTBEATS
2395 s->tlsext_heartbeat &= ~(SSL_TLSEXT_HB_ENABLED |
2396 SSL_TLSEXT_HB_DONT_SEND_REQUESTS);
2397# endif
2398
2399# ifdef TLSEXT_TYPE_encrypt_then_mac
2400 s->s3->flags &= ~TLS1_FLAGS_ENCRYPT_THEN_MAC;
2401# endif
2402
2403 if (data >= (d + n - 2))
2404 goto ri_check;
2405
2406 n2s(data, length);
2407 if (data + length != d + n) {
2408 *al = SSL_AD_DECODE_ERROR;
2409 return 0;
2410 }
2411
2412 while (data <= (d + n - 4)) {
2413 n2s(data, type);
2414 n2s(data, size);
2415
2416 if (data + size > (d + n))
2417 goto ri_check;
2418
2419 if (s->tlsext_debug_cb)
2420 s->tlsext_debug_cb(s, 1, type, data, size, s->tlsext_debug_arg);
2421
2422 if (type == TLSEXT_TYPE_renegotiate) {
2423 if (!ssl_parse_serverhello_renegotiate_ext(s, data, size, al))
2424 return 0;
2425 renegotiate_seen = 1;
2426 } else if (s->version == SSL3_VERSION) {
2427 } else if (type == TLSEXT_TYPE_server_name) {
2428 if (s->tlsext_hostname == NULL || size > 0) {
2429 *al = TLS1_AD_UNRECOGNIZED_NAME;
2430 return 0;
2431 }
2432 tlsext_servername = 1;
2433 }
2434# ifndef OPENSSL_NO_EC
2435 else if (type == TLSEXT_TYPE_ec_point_formats) {
2436 unsigned char *sdata = data;
2437 int ecpointformatlist_length = *(sdata++);
2438
2439 if (ecpointformatlist_length != size - 1) {
2440 *al = TLS1_AD_DECODE_ERROR;
2441 return 0;
2442 }
2443 if (!s->hit) {
2444 s->session->tlsext_ecpointformatlist_length = 0;
2445 if (s->session->tlsext_ecpointformatlist != NULL)
2446 OPENSSL_free(s->session->tlsext_ecpointformatlist);
2447 if ((s->session->tlsext_ecpointformatlist =
2448 OPENSSL_malloc(ecpointformatlist_length)) == NULL) {
2449 *al = TLS1_AD_INTERNAL_ERROR;
2450 return 0;
2451 }
2452 s->session->tlsext_ecpointformatlist_length =
2453 ecpointformatlist_length;
2454 memcpy(s->session->tlsext_ecpointformatlist, sdata,
2455 ecpointformatlist_length);
2456 }
0f113f3e
MC		 2457 }
2458# endif /* OPENSSL_NO_EC */
2459
2460 else if (type == TLSEXT_TYPE_session_ticket) {
2461 if (s->tls_session_ticket_ext_cb &&
2462 !s->tls_session_ticket_ext_cb(s, data, size,
2463 s->tls_session_ticket_ext_cb_arg))
2464 {
2465 *al = TLS1_AD_INTERNAL_ERROR;
2466 return 0;
2467 }
2468 if (!tls_use_ticket(s) || (size > 0)) {
2469 *al = TLS1_AD_UNSUPPORTED_EXTENSION;
2470 return 0;
2471 }
2472 s->tlsext_ticket_expected = 1;
2473 }
0f113f3e
MC		 2474 else if (type == TLSEXT_TYPE_status_request) {
2475 /*
2476 * MUST be empty and only sent if we've requested a status
2477 * request message.
2478 */
2479 if ((s->tlsext_status_type == -1) || (size > 0)) {
2480 *al = TLS1_AD_UNSUPPORTED_EXTENSION;
2481 return 0;
2482 }
2483 /* Set flag to expect CertificateStatus message */
2484 s->tlsext_status_expected = 1;
2485 }
2486# ifndef OPENSSL_NO_NEXTPROTONEG
2487 else if (type == TLSEXT_TYPE_next_proto_neg &&
2488 s->s3->tmp.finish_md_len == 0) {
2489 unsigned char *selected;
2490 unsigned char selected_len;
2491
2492 /* We must have requested it. */
2493 if (s->ctx->next_proto_select_cb == NULL) {
2494 *al = TLS1_AD_UNSUPPORTED_EXTENSION;
2495 return 0;
2496 }
2497 /* The data must be valid */
2498 if (!ssl_next_proto_validate(data, size)) {
2499 *al = TLS1_AD_DECODE_ERROR;
2500 return 0;
2501 }
2502 if (s->
2503 ctx->next_proto_select_cb(s, &selected, &selected_len, data,
2504 size,
2505 s->ctx->next_proto_select_cb_arg) !=
2506 SSL_TLSEXT_ERR_OK) {
2507 *al = TLS1_AD_INTERNAL_ERROR;
2508 return 0;
2509 }
2510 s->next_proto_negotiated = OPENSSL_malloc(selected_len);
2511 if (!s->next_proto_negotiated) {
2512 *al = TLS1_AD_INTERNAL_ERROR;
2513 return 0;
2514 }
2515 memcpy(s->next_proto_negotiated, selected, selected_len);
2516 s->next_proto_negotiated_len = selected_len;
2517 s->s3->next_proto_neg_seen = 1;
2518 }
2519# endif
2520
2521 else if (type == TLSEXT_TYPE_application_layer_protocol_negotiation) {
2522 unsigned len;
2523
2524 /* We must have requested it. */
2525 if (s->alpn_client_proto_list == NULL) {
2526 *al = TLS1_AD_UNSUPPORTED_EXTENSION;
2527 return 0;
2528 }
2529 if (size < 4) {
2530 *al = TLS1_AD_DECODE_ERROR;
2531 return 0;
2532 }
50e735f9
MC		 2533 /*-
2534 * The extension data consists of:
2535 * uint16 list_length
2536 * uint8 proto_length;
2537 * uint8 proto[proto_length];
2538 */
0f113f3e
MC		 2539 len = data[0];
2540 len <<= 8;
2541 len |= data[1];
2542 if (len != (unsigned)size - 2) {
2543 *al = TLS1_AD_DECODE_ERROR;
2544 return 0;
2545 }
2546 len = data[2];
2547 if (len != (unsigned)size - 3) {
2548 *al = TLS1_AD_DECODE_ERROR;
2549 return 0;
2550 }
2551 if (s->s3->alpn_selected)
2552 OPENSSL_free(s->s3->alpn_selected);
2553 s->s3->alpn_selected = OPENSSL_malloc(len);
2554 if (!s->s3->alpn_selected) {
2555 *al = TLS1_AD_INTERNAL_ERROR;
2556 return 0;
2557 }
2558 memcpy(s->s3->alpn_selected, data + 3, len);
2559 s->s3->alpn_selected_len = len;
2560 }
2561# ifndef OPENSSL_NO_HEARTBEATS
2562 else if (type == TLSEXT_TYPE_heartbeat) {
2563 switch (data[0]) {
2564 case 0x01: /* Server allows us to send HB requests */
2565 s->tlsext_heartbeat |= SSL_TLSEXT_HB_ENABLED;
2566 break;
2567 case 0x02: /* Server doesn't accept HB requests */
2568 s->tlsext_heartbeat |= SSL_TLSEXT_HB_ENABLED;
2569 s->tlsext_heartbeat |= SSL_TLSEXT_HB_DONT_SEND_REQUESTS;
2570 break;
2571 default:
2572 *al = SSL_AD_ILLEGAL_PARAMETER;
2573 return 0;
2574 }
2575 }
2576# endif
2577# ifndef OPENSSL_NO_SRTP
2578 else if (SSL_IS_DTLS(s) && type == TLSEXT_TYPE_use_srtp) {
2579 if (ssl_parse_serverhello_use_srtp_ext(s, data, size, al))
2580 return 0;
2581 }
2582# endif
2583# ifdef TLSEXT_TYPE_encrypt_then_mac
2584 else if (type == TLSEXT_TYPE_encrypt_then_mac) {
2585 /* Ignore if inappropriate ciphersuite */
2586 if (s->s3->tmp.new_cipher->algorithm_mac != SSL_AEAD
2587 && s->s3->tmp.new_cipher->algorithm_enc != SSL_RC4)
2588 s->s3->flags |= TLS1_FLAGS_ENCRYPT_THEN_MAC;
2589 }
2590# endif
ddc06b35
DSH		 2591 else if (type == TLSEXT_TYPE_extended_master_secret) {
2592 if (!s->hit)
2593 s->session->flags |= SSL_SESS_FLAG_EXTMS;
2594 }
0f113f3e
MC		 2595 /*
2596 * If this extension type was not otherwise handled, but matches a
2597 * custom_cli_ext_record, then send it to the c callback
2598 */
2599 else if (custom_ext_parse(s, 0, type, data, size, al) <= 0)
2600 return 0;
2601
2602 data += size;
2603 }
2604
2605 if (data != d + n) {
2606 *al = SSL_AD_DECODE_ERROR;
2607 return 0;
2608 }
2609
2610 if (!s->hit && tlsext_servername == 1) {
2611 if (s->tlsext_hostname) {
2612 if (s->session->tlsext_hostname == NULL) {
2613 s->session->tlsext_hostname = BUF_strdup(s->tlsext_hostname);
2614 if (!s->session->tlsext_hostname) {
2615 *al = SSL_AD_UNRECOGNIZED_NAME;
2616 return 0;
2617 }
2618 } else {
2619 *al = SSL_AD_DECODE_ERROR;
2620 return 0;
2621 }
2622 }
2623 }
2624
2625 *p = data;
2626
2627 ri_check:
2628
2629 /*
2630 * Determine if we need to see RI. Strictly speaking if we want to avoid
2631 * an attack we should *always* see RI even on initial server hello
2632 * because the client doesn't see any renegotiation during an attack.
2633 * However this would mean we could not connect to any server which
2634 * doesn't support RI so for the immediate future tolerate RI absence on
2635 * initial connect only.
2636 */
2637 if (!renegotiate_seen && !(s->options & SSL_OP_LEGACY_SERVER_CONNECT)
2638 && !(s->options & SSL_OP_ALLOW_UNSAFE_LEGACY_RENEGOTIATION)) {
2639 *al = SSL_AD_HANDSHAKE_FAILURE;
2640 SSLerr(SSL_F_SSL_SCAN_SERVERHELLO_TLSEXT,
2641 SSL_R_UNSAFE_LEGACY_RENEGOTIATION_DISABLED);
2642 return 0;
2643 }
2644
2645 return 1;
2646}
b2172f4f 2647
36ca4ba6 2648int ssl_prepare_clienthello_tlsext(SSL *s)
0f113f3e
MC		 2649{
2650
0f113f3e
MC		 2651 return 1;
2652}
36ca4ba6
BM		 2653
2654int ssl_prepare_serverhello_tlsext(SSL *s)
0f113f3e
MC		 2655{
2656 return 1;
2657}
36ca4ba6 2658
2daceb03 2659static int ssl_check_clienthello_tlsext_early(SSL *s)
0f113f3e
MC		 2660{
2661 int ret = SSL_TLSEXT_ERR_NOACK;
2662 int al = SSL_AD_UNRECOGNIZED_NAME;
2663
2664# ifndef OPENSSL_NO_EC
2665 /*
2666 * The handling of the ECPointFormats extension is done elsewhere, namely
2667 * in ssl3_choose_cipher in s3_lib.c.
2668 */
2669 /*
2670 * The handling of the EllipticCurves extension is done elsewhere, namely
2671 * in ssl3_choose_cipher in s3_lib.c.
2672 */
2673# endif
2674
2675 if (s->ctx != NULL && s->ctx->tlsext_servername_callback != 0)
2676 ret =
2677 s->ctx->tlsext_servername_callback(s, &al,
2678 s->ctx->tlsext_servername_arg);
2679 else if (s->initial_ctx != NULL
2680 && s->initial_ctx->tlsext_servername_callback != 0)
2681 ret =
2682 s->initial_ctx->tlsext_servername_callback(s, &al,
2683 s->
2684 initial_ctx->tlsext_servername_arg);
2685
0f113f3e
MC		 2686 switch (ret) {
2687 case SSL_TLSEXT_ERR_ALERT_FATAL:
2688 ssl3_send_alert(s, SSL3_AL_FATAL, al);
2689 return -1;
2690
2691 case SSL_TLSEXT_ERR_ALERT_WARNING:
2692 ssl3_send_alert(s, SSL3_AL_WARNING, al);
2693 return 1;
2694
2695 case SSL_TLSEXT_ERR_NOACK:
2696 s->servername_done = 0;
2697 default:
2698 return 1;
2699 }
2700}
f1fd4544 2701
e469af8d 2702int tls1_set_server_sigalgs(SSL *s)
0f113f3e
MC		 2703{
2704 int al;
2705 size_t i;
2706 /* Clear any shared sigtnature algorithms */
2707 if (s->cert->shared_sigalgs) {
2708 OPENSSL_free(s->cert->shared_sigalgs);
2709 s->cert->shared_sigalgs = NULL;
34e3edbf 2710 s->cert->shared_sigalgslen = 0;
0f113f3e
MC		 2711 }
2712 /* Clear certificate digests and validity flags */
2713 for (i = 0; i < SSL_PKEY_NUM; i++) {
2714 s->cert->pkeys[i].digest = NULL;
2715 s->cert->pkeys[i].valid_flags = 0;
2716 }
2717
2718 /* If sigalgs received process it. */
2719 if (s->cert->peer_sigalgs) {
2720 if (!tls1_process_sigalgs(s)) {
2721 SSLerr(SSL_F_TLS1_SET_SERVER_SIGALGS, ERR_R_MALLOC_FAILURE);
2722 al = SSL_AD_INTERNAL_ERROR;
2723 goto err;
2724 }
2725 /* Fatal error is no shared signature algorithms */
2726 if (!s->cert->shared_sigalgs) {
2727 SSLerr(SSL_F_TLS1_SET_SERVER_SIGALGS,
2728 SSL_R_NO_SHARED_SIGATURE_ALGORITHMS);
2729 al = SSL_AD_ILLEGAL_PARAMETER;
2730 goto err;
2731 }
2732 } else
2733 ssl_cert_set_default_md(s->cert);
2734 return 1;
2735 err:
2736 ssl3_send_alert(s, SSL3_AL_FATAL, al);
2737 return 0;
2738}
e469af8d 2739
2daceb03 2740int ssl_check_clienthello_tlsext_late(SSL *s)
0f113f3e
MC		 2741{
2742 int ret = SSL_TLSEXT_ERR_OK;
2743 int al;
2744
2745 /*
2746 * If status request then ask callback what to do. Note: this must be
2747 * called after servername callbacks in case the certificate has changed,
2748 * and must be called after the cipher has been chosen because this may
2749 * influence which certificate is sent
2750 */
2751 if ((s->tlsext_status_type != -1) && s->ctx && s->ctx->tlsext_status_cb) {
2752 int r;
2753 CERT_PKEY *certpkey;
2754 certpkey = ssl_get_server_send_pkey(s);
2755 /* If no certificate can't return certificate status */
2756 if (certpkey == NULL) {
2757 s->tlsext_status_expected = 0;
2758 return 1;
2759 }
2760 /*
2761 * Set current certificate to one we will use so SSL_get_certificate
2762 * et al can pick it up.
2763 */
2764 s->cert->key = certpkey;
2765 r = s->ctx->tlsext_status_cb(s, s->ctx->tlsext_status_arg);
2766 switch (r) {
2767 /* We don't want to send a status request response */
2768 case SSL_TLSEXT_ERR_NOACK:
2769 s->tlsext_status_expected = 0;
2770 break;
2771 /* status request response should be sent */
2772 case SSL_TLSEXT_ERR_OK:
2773 if (s->tlsext_ocsp_resp)
2774 s->tlsext_status_expected = 1;
2775 else
2776 s->tlsext_status_expected = 0;
2777 break;
2778 /* something bad happened */
2779 case SSL_TLSEXT_ERR_ALERT_FATAL:
2780 ret = SSL_TLSEXT_ERR_ALERT_FATAL;
2781 al = SSL_AD_INTERNAL_ERROR;
2782 goto err;
2783 }
2784 } else
2785 s->tlsext_status_expected = 0;
2daceb03
BL		 2786
2787 err:
0f113f3e
MC		 2788 switch (ret) {
2789 case SSL_TLSEXT_ERR_ALERT_FATAL:
2790 ssl3_send_alert(s, SSL3_AL_FATAL, al);
2791 return -1;
2792
2793 case SSL_TLSEXT_ERR_ALERT_WARNING:
2794 ssl3_send_alert(s, SSL3_AL_WARNING, al);
2795 return 1;
2796
2797 default:
2798 return 1;
2799 }
2800}
2daceb03 2801
36ca4ba6 2802int ssl_check_serverhello_tlsext(SSL *s)
0f113f3e
MC		 2803{
2804 int ret = SSL_TLSEXT_ERR_NOACK;
2805 int al = SSL_AD_UNRECOGNIZED_NAME;
2806
2807# ifndef OPENSSL_NO_EC
2808 /*
2809 * If we are client and using an elliptic curve cryptography cipher
2810 * suite, then if server returns an EC point formats lists extension it
2811 * must contain uncompressed.
2812 */
2813 unsigned long alg_k = s->s3->tmp.new_cipher->algorithm_mkey;
2814 unsigned long alg_a = s->s3->tmp.new_cipher->algorithm_auth;
2815 if ((s->tlsext_ecpointformatlist != NULL)
2816 && (s->tlsext_ecpointformatlist_length > 0)
2817 && (s->session->tlsext_ecpointformatlist != NULL)
2818 && (s->session->tlsext_ecpointformatlist_length > 0)
2819 && ((alg_k & (SSL_kECDHE | SSL_kECDHr | SSL_kECDHe))
2820 || (alg_a & SSL_aECDSA))) {
2821 /* we are using an ECC cipher */
2822 size_t i;
2823 unsigned char *list;
2824 int found_uncompressed = 0;
2825 list = s->session->tlsext_ecpointformatlist;
2826 for (i = 0; i < s->session->tlsext_ecpointformatlist_length; i++) {
2827 if (*(list++) == TLSEXT_ECPOINTFORMAT_uncompressed) {
2828 found_uncompressed = 1;
2829 break;
2830 }
2831 }
2832 if (!found_uncompressed) {
2833 SSLerr(SSL_F_SSL_CHECK_SERVERHELLO_TLSEXT,
2834 SSL_R_TLS_INVALID_ECPOINTFORMAT_LIST);
2835 return -1;
2836 }
2837 }
2838 ret = SSL_TLSEXT_ERR_OK;
2839# endif /* OPENSSL_NO_EC */
2840
2841 if (s->ctx != NULL && s->ctx->tlsext_servername_callback != 0)
2842 ret =
2843 s->ctx->tlsext_servername_callback(s, &al,
2844 s->ctx->tlsext_servername_arg);
2845 else if (s->initial_ctx != NULL
2846 && s->initial_ctx->tlsext_servername_callback != 0)
2847 ret =
2848 s->initial_ctx->tlsext_servername_callback(s, &al,
2849 s->
2850 initial_ctx->tlsext_servername_arg);
2851
0f113f3e
MC		 2852 /*
2853 * If we've requested certificate status and we wont get one tell the
2854 * callback
2855 */
2856 if ((s->tlsext_status_type != -1) && !(s->tlsext_status_expected)
2857 && s->ctx && s->ctx->tlsext_status_cb) {
2858 int r;
2859 /*
2860 * Set resp to NULL, resplen to -1 so callback knows there is no
2861 * response.
2862 */
2863 if (s->tlsext_ocsp_resp) {
2864 OPENSSL_free(s->tlsext_ocsp_resp);
2865 s->tlsext_ocsp_resp = NULL;
2866 }
2867 s->tlsext_ocsp_resplen = -1;
2868 r = s->ctx->tlsext_status_cb(s, s->ctx->tlsext_status_arg);
2869 if (r == 0) {
2870 al = SSL_AD_BAD_CERTIFICATE_STATUS_RESPONSE;
2871 ret = SSL_TLSEXT_ERR_ALERT_FATAL;
2872 }
2873 if (r < 0) {
2874 al = SSL_AD_INTERNAL_ERROR;
2875 ret = SSL_TLSEXT_ERR_ALERT_FATAL;
2876 }
2877 }
2878
2879 switch (ret) {
2880 case SSL_TLSEXT_ERR_ALERT_FATAL:
2881 ssl3_send_alert(s, SSL3_AL_FATAL, al);
2882 return -1;
2883
2884 case SSL_TLSEXT_ERR_ALERT_WARNING:
2885 ssl3_send_alert(s, SSL3_AL_WARNING, al);
2886 return 1;
2887
2888 case SSL_TLSEXT_ERR_NOACK:
2889 s->servername_done = 0;
2890 default:
2891 return 1;
2892 }
2893}
761772d7 2894
0f113f3e
MC		 2895int ssl_parse_serverhello_tlsext(SSL *s, unsigned char **p, unsigned char *d,
2896 int n)
2897{
2898 int al = -1;
2899 if (s->version < SSL3_VERSION)
2900 return 1;
2901 if (ssl_scan_serverhello_tlsext(s, p, d, n, &al) <= 0) {
2902 ssl3_send_alert(s, SSL3_AL_FATAL, al);
2903 return 0;
2904 }
2905
2906 if (ssl_check_serverhello_tlsext(s) <= 0) {
2907 SSLerr(SSL_F_SSL_PARSE_SERVERHELLO_TLSEXT, SSL_R_SERVERHELLO_TLSEXT);
2908 return 0;
2909 }
2910 return 1;
09e4e4b9
DSH		 2911}
2912
1d97c843
TH		 2913/*-
2914 * Since the server cache lookup is done early on in the processing of the
c519e89f
BM		 2915 * ClientHello, and other operations depend on the result, we need to handle
2916 * any TLS session ticket extension at the same time.
2917 *
2918 * session_id: points at the session ID in the ClientHello. This code will
2919 * read past the end of this in order to parse out the session ticket
2920 * extension, if any.
2921 * len: the length of the session ID.
2922 * limit: a pointer to the first byte after the ClientHello.
2923 * ret: (output) on return, if a ticket was decrypted, then this is set to
2924 * point to the resulting session.
2925 *
2926 * If s->tls_session_secret_cb is set then we are expecting a pre-shared key
2927 * ciphersuite, in which case we have no use for session tickets and one will
2928 * never be decrypted, nor will s->tlsext_ticket_expected be set to 1.
2929 *
2930 * Returns:
2931 * -1: fatal error, either from parsing or decrypting the ticket.
2932 * 0: no ticket was found (or was ignored, based on settings).
2933 * 1: a zero length extension was found, indicating that the client supports
2934 * session tickets but doesn't currently have one to offer.
2935 * 2: either s->tls_session_secret_cb was set, or a ticket was offered but
2936 * couldn't be decrypted because of a non-fatal error.
2937 * 3: a ticket was successfully decrypted and *ret was set.
2938 *
2939 * Side effects:
2940 * Sets s->tlsext_ticket_expected to 1 if the server will have to issue
2941 * a new session ticket to the client because the client indicated support
2942 * (and s->tls_session_secret_cb is NULL) but the client either doesn't have
2943 * a session ticket or we couldn't use the one it gave us, or if
2944 * s->ctx->tlsext_ticket_key_cb asked to renew the client's ticket.
2945 * Otherwise, s->tlsext_ticket_expected is set to 0.
6434abbf 2946 */
6434abbf 2947int tls1_process_ticket(SSL *s, unsigned char *session_id, int len,
0f113f3e
MC		 2948 const unsigned char *limit, SSL_SESSION **ret)
2949{
2950 /* Point after session ID in client hello */
2951 const unsigned char *p = session_id + len;
2952 unsigned short i;
2953
2954 *ret = NULL;
2955 s->tlsext_ticket_expected = 0;
2956
2957 /*
2958 * If tickets disabled behave as if no ticket present to permit stateful
2959 * resumption.
2960 */
2961 if (!tls_use_ticket(s))
2962 return 0;
2963 if ((s->version <= SSL3_VERSION) || !limit)
2964 return 0;
2965 if (p >= limit)
2966 return -1;
2967 /* Skip past DTLS cookie */
2968 if (SSL_IS_DTLS(s)) {
2969 i = *(p++);
2970 p += i;
2971 if (p >= limit)
2972 return -1;
2973 }
2974 /* Skip past cipher list */
2975 n2s(p, i);
2976 p += i;
2977 if (p >= limit)
2978 return -1;
2979 /* Skip past compression algorithm list */
2980 i = *(p++);
2981 p += i;
2982 if (p > limit)
2983 return -1;
2984 /* Now at start of extensions */
2985 if ((p + 2) >= limit)
2986 return 0;
2987 n2s(p, i);
2988 while ((p + 4) <= limit) {
2989 unsigned short type, size;
2990 n2s(p, type);
2991 n2s(p, size);
2992 if (p + size > limit)
2993 return 0;
2994 if (type == TLSEXT_TYPE_session_ticket) {
2995 int r;
2996 if (size == 0) {
2997 /*
2998 * The client will accept a ticket but doesn't currently have
2999 * one.
3000 */
3001 s->tlsext_ticket_expected = 1;
3002 return 1;
3003 }
3004 if (s->tls_session_secret_cb) {
3005 /*
3006 * Indicate that the ticket couldn't be decrypted rather than
3007 * generating the session from ticket now, trigger
3008 * abbreviated handshake based on external mechanism to
3009 * calculate the master secret later.
3010 */
3011 return 2;
3012 }
3013 r = tls_decrypt_ticket(s, p, size, session_id, len, ret);
3014 switch (r) {
3015 case 2: /* ticket couldn't be decrypted */
3016 s->tlsext_ticket_expected = 1;
3017 return 2;
3018 case 3: /* ticket was decrypted */
3019 return r;
3020 case 4: /* ticket decrypted but need to renew */
3021 s->tlsext_ticket_expected = 1;
3022 return 3;
3023 default: /* fatal error */
3024 return -1;
3025 }
3026 }
3027 p += size;
3028 }
3029 return 0;
3030}
6434abbf 3031
1d97c843
TH		 3032/*-
3033 * tls_decrypt_ticket attempts to decrypt a session ticket.
c519e89f
BM		 3034 *
3035 * etick: points to the body of the session ticket extension.
3036 * eticklen: the length of the session tickets extenion.
3037 * sess_id: points at the session ID.
3038 * sesslen: the length of the session ID.
3039 * psess: (output) on return, if a ticket was decrypted, then this is set to
3040 * point to the resulting session.
3041 *
3042 * Returns:
3043 * -1: fatal error, either from parsing or decrypting the ticket.
3044 * 2: the ticket couldn't be decrypted.
3045 * 3: a ticket was successfully decrypted and *psess was set.
3046 * 4: same as 3, but the ticket needs to be renewed.
3047 */
0f113f3e
MC		 3048static int tls_decrypt_ticket(SSL *s, const unsigned char *etick,
3049 int eticklen, const unsigned char *sess_id,
3050 int sesslen, SSL_SESSION **psess)
3051{
3052 SSL_SESSION *sess;
3053 unsigned char *sdec;
3054 const unsigned char *p;
3055 int slen, mlen, renew_ticket = 0;
3056 unsigned char tick_hmac[EVP_MAX_MD_SIZE];
3057 HMAC_CTX hctx;
3058 EVP_CIPHER_CTX ctx;
3059 SSL_CTX *tctx = s->initial_ctx;
3060 /* Need at least keyname + iv + some encrypted data */
3061 if (eticklen < 48)
3062 return 2;
3063 /* Initialize session ticket encryption and HMAC contexts */
3064 HMAC_CTX_init(&hctx);
3065 EVP_CIPHER_CTX_init(&ctx);
3066 if (tctx->tlsext_ticket_key_cb) {
3067 unsigned char *nctick = (unsigned char *)etick;
3068 int rv = tctx->tlsext_ticket_key_cb(s, nctick, nctick + 16,
3069 &ctx, &hctx, 0);
3070 if (rv < 0)
3071 return -1;
3072 if (rv == 0)
3073 return 2;
3074 if (rv == 2)
3075 renew_ticket = 1;
3076 } else {
3077 /* Check key name matches */
3078 if (memcmp(etick, tctx->tlsext_tick_key_name, 16))
3079 return 2;
3080 HMAC_Init_ex(&hctx, tctx->tlsext_tick_hmac_key, 16,
474e469b 3081 EVP_sha256(), NULL);
0f113f3e
MC		 3082 EVP_DecryptInit_ex(&ctx, EVP_aes_128_cbc(), NULL,
3083 tctx->tlsext_tick_aes_key, etick + 16);
3084 }
3085 /*
3086 * Attempt to process session ticket, first conduct sanity and integrity
3087 * checks on ticket.
3088 */
3089 mlen = HMAC_size(&hctx);
3090 if (mlen < 0) {
3091 EVP_CIPHER_CTX_cleanup(&ctx);
3092 return -1;
3093 }
3094 eticklen -= mlen;
3095 /* Check HMAC of encrypted ticket */
3096 HMAC_Update(&hctx, etick, eticklen);
3097 HMAC_Final(&hctx, tick_hmac, NULL);
3098 HMAC_CTX_cleanup(&hctx);
3099 if (CRYPTO_memcmp(tick_hmac, etick + eticklen, mlen)) {
3100 EVP_CIPHER_CTX_cleanup(&ctx);
3101 return 2;
3102 }
3103 /* Attempt to decrypt session data */
3104 /* Move p after IV to start of encrypted ticket, update length */
3105 p = etick + 16 + EVP_CIPHER_CTX_iv_length(&ctx);
3106 eticklen -= 16 + EVP_CIPHER_CTX_iv_length(&ctx);
3107 sdec = OPENSSL_malloc(eticklen);
3108 if (!sdec) {
3109 EVP_CIPHER_CTX_cleanup(&ctx);
3110 return -1;
3111 }
3112 EVP_DecryptUpdate(&ctx, sdec, &slen, p, eticklen);
3113 if (EVP_DecryptFinal(&ctx, sdec + slen, &mlen) <= 0) {
3114 EVP_CIPHER_CTX_cleanup(&ctx);
3115 OPENSSL_free(sdec);
3116 return 2;
3117 }
3118 slen += mlen;
3119 EVP_CIPHER_CTX_cleanup(&ctx);
3120 p = sdec;
3121
3122 sess = d2i_SSL_SESSION(NULL, &p, slen);
3123 OPENSSL_free(sdec);
3124 if (sess) {
3125 /*
3126 * The session ID, if non-empty, is used by some clients to detect
3127 * that the ticket has been accepted. So we copy it to the session
3128 * structure. If it is empty set length to zero as required by
3129 * standard.
3130 */
3131 if (sesslen)
3132 memcpy(sess->session_id, sess_id, sesslen);
3133 sess->session_id_length = sesslen;
3134 *psess = sess;
3135 if (renew_ticket)
3136 return 4;
3137 else
3138 return 3;
3139 }
3140 ERR_clear_error();
3141 /*
3142 * For session parse failure, indicate that we need to send a new ticket.
3143 */
3144 return 2;
3145}
6434abbf 3146
6b7be581
DSH		 3147/* Tables to translate from NIDs to TLS v1.2 ids */
3148
0f113f3e
MC		 3149typedef struct {
3150 int nid;
3151 int id;
3152} tls12_lookup;
6b7be581 3153
d97ed219 3154static const tls12_lookup tls12_md[] = {
0f113f3e
MC		 3155 {NID_md5, TLSEXT_hash_md5},
3156 {NID_sha1, TLSEXT_hash_sha1},
3157 {NID_sha224, TLSEXT_hash_sha224},
3158 {NID_sha256, TLSEXT_hash_sha256},
3159 {NID_sha384, TLSEXT_hash_sha384},
3160 {NID_sha512, TLSEXT_hash_sha512}
6b7be581
DSH		 3161};
3162
d97ed219 3163static const tls12_lookup tls12_sig[] = {
0f113f3e
MC		 3164 {EVP_PKEY_RSA, TLSEXT_signature_rsa},
3165 {EVP_PKEY_DSA, TLSEXT_signature_dsa},
3166 {EVP_PKEY_EC, TLSEXT_signature_ecdsa}
6b7be581
DSH		 3167};
3168
d97ed219 3169static int tls12_find_id(int nid, const tls12_lookup *table, size_t tlen)
0f113f3e
MC		 3170{
3171 size_t i;
3172 for (i = 0; i < tlen; i++) {
3173 if (table[i].nid == nid)
3174 return table[i].id;
3175 }
3176 return -1;
3177}
e7f8ff43 3178
d97ed219 3179static int tls12_find_nid(int id, const tls12_lookup *table, size_t tlen)
0f113f3e
MC		 3180{
3181 size_t i;
3182 for (i = 0; i < tlen; i++) {
3183 if ((table[i].id) == id)
3184 return table[i].nid;
3185 }
3186 return NID_undef;
3187}
3188
3189int tls12_get_sigandhash(unsigned char *p, const EVP_PKEY *pk,
3190 const EVP_MD *md)
3191{
3192 int sig_id, md_id;
3193 if (!md)
3194 return 0;
3195 md_id = tls12_find_id(EVP_MD_type(md), tls12_md,
3196 sizeof(tls12_md) / sizeof(tls12_lookup));
3197 if (md_id == -1)
3198 return 0;
3199 sig_id = tls12_get_sigid(pk);
3200 if (sig_id == -1)
3201 return 0;
3202 p[0] = (unsigned char)md_id;
3203 p[1] = (unsigned char)sig_id;
3204 return 1;
3205}
6b7be581 3206
a2f9200f 3207int tls12_get_sigid(const EVP_PKEY *pk)
0f113f3e
MC		 3208{
3209 return tls12_find_id(pk->type, tls12_sig,
3210 sizeof(tls12_sig) / sizeof(tls12_lookup));
3211}
3212
3213typedef struct {
3214 int nid;
3215 int secbits;
3216 const EVP_MD *(*mfunc) (void);
3217} tls12_hash_info;
b362ccab
DSH		 3218
3219static const tls12_hash_info tls12_md_info[] = {
0f113f3e
MC		 3220# ifdef OPENSSL_NO_MD5
3221 {NID_md5, 64, 0},
3222# else
3223 {NID_md5, 64, EVP_md5},
3224# endif
0f113f3e 3225 {NID_sha1, 80, EVP_sha1},
0f113f3e
MC		 3226 {NID_sha224, 112, EVP_sha224},
3227 {NID_sha256, 128, EVP_sha256},
0f113f3e
MC		 3228 {NID_sha384, 192, EVP_sha384},
3229 {NID_sha512, 256, EVP_sha512}
b362ccab 3230};
a2f9200f 3231
b362ccab 3232static const tls12_hash_info *tls12_get_hash_info(unsigned char hash_alg)
0f113f3e
MC		 3233{
3234 if (hash_alg == 0)
3235 return NULL;
3236 if (hash_alg > sizeof(tls12_md_info) / sizeof(tls12_md_info[0]))
3237 return NULL;
3238 return tls12_md_info + hash_alg - 1;
3239}
a2f9200f 3240
b362ccab 3241const EVP_MD *tls12_get_hash(unsigned char hash_alg)
0f113f3e
MC		 3242{
3243 const tls12_hash_info *inf;
3244 if (hash_alg == TLSEXT_hash_md5 && FIPS_mode())
3245 return NULL;
3246 inf = tls12_get_hash_info(hash_alg);
3247 if (!inf || !inf->mfunc)
3248 return NULL;
3249 return inf->mfunc();
3250}
a2f9200f 3251
4453cd8c 3252static int tls12_get_pkey_idx(unsigned char sig_alg)
0f113f3e
MC		 3253{
3254 switch (sig_alg) {
3255# ifndef OPENSSL_NO_RSA
3256 case TLSEXT_signature_rsa:
3257 return SSL_PKEY_RSA_SIGN;
3258# endif
3259# ifndef OPENSSL_NO_DSA
3260 case TLSEXT_signature_dsa:
3261 return SSL_PKEY_DSA_SIGN;
3262# endif
10bf4fc2 3263# ifndef OPENSSL_NO_EC
0f113f3e
MC		 3264 case TLSEXT_signature_ecdsa:
3265 return SSL_PKEY_ECC;
3266# endif
3267 }
3268 return -1;
3269}
4453cd8c
DSH		 3270
3271/* Convert TLS 1.2 signature algorithm extension values into NIDs */
3272static void tls1_lookup_sigalg(int *phash_nid, int *psign_nid,
0f113f3e
MC		 3273 int *psignhash_nid, const unsigned char *data)
3274{
3275 int sign_nid = 0, hash_nid = 0;
3276 if (!phash_nid && !psign_nid && !psignhash_nid)
3277 return;
3278 if (phash_nid || psignhash_nid) {
3279 hash_nid = tls12_find_nid(data[0], tls12_md,
3280 sizeof(tls12_md) / sizeof(tls12_lookup));
3281 if (phash_nid)
3282 *phash_nid = hash_nid;
3283 }
3284 if (psign_nid || psignhash_nid) {
3285 sign_nid = tls12_find_nid(data[1], tls12_sig,
3286 sizeof(tls12_sig) / sizeof(tls12_lookup));
3287 if (psign_nid)
3288 *psign_nid = sign_nid;
3289 }
3290 if (psignhash_nid) {
3291 if (sign_nid && hash_nid)
3292 OBJ_find_sigid_by_algs(psignhash_nid, hash_nid, sign_nid);
3293 else
3294 *psignhash_nid = NID_undef;
3295 }
3296}
3297
b362ccab
DSH		 3298/* Check to see if a signature algorithm is allowed */
3299static int tls12_sigalg_allowed(SSL *s, int op, const unsigned char *ptmp)
0f113f3e
MC		 3300{
3301 /* See if we have an entry in the hash table and it is enabled */
3302 const tls12_hash_info *hinf = tls12_get_hash_info(ptmp[0]);
3303 if (!hinf || !hinf->mfunc)
3304 return 0;
3305 /* See if public key algorithm allowed */
3306 if (tls12_get_pkey_idx(ptmp[1]) == -1)
3307 return 0;
3308 /* Finally see if security callback allows it */
3309 return ssl_security(s, op, hinf->secbits, hinf->nid, (void *)ptmp);
3310}
3311
3312/*
3313 * Get a mask of disabled public key algorithms based on supported signature
3314 * algorithms. For example if no signature algorithm supports RSA then RSA is
3315 * disabled.
b362ccab
DSH		 3316 */
3317
3318void ssl_set_sig_mask(unsigned long *pmask_a, SSL *s, int op)
0f113f3e
MC		 3319{
3320 const unsigned char *sigalgs;
3321 size_t i, sigalgslen;
3322 int have_rsa = 0, have_dsa = 0, have_ecdsa = 0;
3323 /*
3324 * Now go through all signature algorithms seeing if we support any for
3325 * RSA, DSA, ECDSA. Do this for all versions not just TLS 1.2. To keep
3326 * down calls to security callback only check if we have to.
3327 */
3328 sigalgslen = tls12_get_psigalgs(s, &sigalgs);
3329 for (i = 0; i < sigalgslen; i += 2, sigalgs += 2) {
3330 switch (sigalgs[1]) {
3331# ifndef OPENSSL_NO_RSA
3332 case TLSEXT_signature_rsa:
3333 if (!have_rsa && tls12_sigalg_allowed(s, op, sigalgs))
3334 have_rsa = 1;
3335 break;
3336# endif
3337# ifndef OPENSSL_NO_DSA
3338 case TLSEXT_signature_dsa:
3339 if (!have_dsa && tls12_sigalg_allowed(s, op, sigalgs))
3340 have_dsa = 1;
3341 break;
3342# endif
10bf4fc2 3343# ifndef OPENSSL_NO_EC
0f113f3e
MC		 3344 case TLSEXT_signature_ecdsa:
3345 if (!have_ecdsa && tls12_sigalg_allowed(s, op, sigalgs))
3346 have_ecdsa = 1;
3347 break;
3348# endif
3349 }
3350 }
3351 if (!have_rsa)
3352 *pmask_a |= SSL_aRSA;
3353 if (!have_dsa)
3354 *pmask_a |= SSL_aDSS;
3355 if (!have_ecdsa)
3356 *pmask_a |= SSL_aECDSA;
3357}
b362ccab
DSH		 3358
3359size_t tls12_copy_sigalgs(SSL *s, unsigned char *out,
0f113f3e
MC		 3360 const unsigned char *psig, size_t psiglen)
3361{
3362 unsigned char *tmpout = out;
3363 size_t i;
3364 for (i = 0; i < psiglen; i += 2, psig += 2) {
3365 if (tls12_sigalg_allowed(s, SSL_SECOP_SIGALG_SUPPORTED, psig)) {
3366 *tmpout++ = psig[0];
3367 *tmpout++ = psig[1];
3368 }
3369 }
3370 return tmpout - out;
3371}
b362ccab 3372
4453cd8c 3373/* Given preference and allowed sigalgs set shared sigalgs */
b362ccab 3374static int tls12_shared_sigalgs(SSL *s, TLS_SIGALGS *shsig,
0f113f3e
MC		 3375 const unsigned char *pref, size_t preflen,
3376 const unsigned char *allow, size_t allowlen)
3377{
3378 const unsigned char *ptmp, *atmp;
3379 size_t i, j, nmatch = 0;
3380 for (i = 0, ptmp = pref; i < preflen; i += 2, ptmp += 2) {
3381 /* Skip disabled hashes or signature algorithms */
3382 if (!tls12_sigalg_allowed(s, SSL_SECOP_SIGALG_SHARED, ptmp))
3383 continue;
3384 for (j = 0, atmp = allow; j < allowlen; j += 2, atmp += 2) {
3385 if (ptmp[0] == atmp[0] && ptmp[1] == atmp[1]) {
3386 nmatch++;
3387 if (shsig) {
3388 shsig->rhash = ptmp[0];
3389 shsig->rsign = ptmp[1];
3390 tls1_lookup_sigalg(&shsig->hash_nid,
3391 &shsig->sign_nid,
3392 &shsig->signandhash_nid, ptmp);
3393 shsig++;
3394 }
3395 break;
3396 }
3397 }
3398 }
3399 return nmatch;
3400}
4453cd8c
DSH		 3401
3402/* Set shared signature algorithms for SSL structures */
3403static int tls1_set_shared_sigalgs(SSL *s)
0f113f3e
MC		 3404{
3405 const unsigned char *pref, *allow, *conf;
3406 size_t preflen, allowlen, conflen;
3407 size_t nmatch;
3408 TLS_SIGALGS *salgs = NULL;
3409 CERT *c = s->cert;
3410 unsigned int is_suiteb = tls1_suiteb(s);
3411 if (c->shared_sigalgs) {
3412 OPENSSL_free(c->shared_sigalgs);
3413 c->shared_sigalgs = NULL;
34e3edbf 3414 c->shared_sigalgslen = 0;
0f113f3e
MC		 3415 }
3416 /* If client use client signature algorithms if not NULL */
3417 if (!s->server && c->client_sigalgs && !is_suiteb) {
3418 conf = c->client_sigalgs;
3419 conflen = c->client_sigalgslen;
3420 } else if (c->conf_sigalgs && !is_suiteb) {
3421 conf = c->conf_sigalgs;
3422 conflen = c->conf_sigalgslen;
3423 } else
3424 conflen = tls12_get_psigalgs(s, &conf);
3425 if (s->options & SSL_OP_CIPHER_SERVER_PREFERENCE || is_suiteb) {
3426 pref = conf;
3427 preflen = conflen;
3428 allow = c->peer_sigalgs;
3429 allowlen = c->peer_sigalgslen;
3430 } else {
3431 allow = conf;
3432 allowlen = conflen;
3433 pref = c->peer_sigalgs;
3434 preflen = c->peer_sigalgslen;
3435 }
3436 nmatch = tls12_shared_sigalgs(s, NULL, pref, preflen, allow, allowlen);
34e3edbf
DSH		 3437 if (nmatch) {
3438 salgs = OPENSSL_malloc(nmatch * sizeof(TLS_SIGALGS));
3439 if (!salgs)
3440 return 0;
3441 nmatch = tls12_shared_sigalgs(s, salgs, pref, preflen, allow, allowlen);
3442 } else {
3443 salgs = NULL;
3444 }
0f113f3e
MC		 3445 c->shared_sigalgs = salgs;
3446 c->shared_sigalgslen = nmatch;
3447 return 1;
3448}
4453cd8c 3449
6b7be581
DSH		 3450/* Set preferred digest for each key type */
3451
c800c27a 3452int tls1_save_sigalgs(SSL *s, const unsigned char *data, int dsize)
0f113f3e
MC		 3453{
3454 CERT *c = s->cert;
3455 /* Extension ignored for inappropriate versions */
3456 if (!SSL_USE_SIGALGS(s))
3457 return 1;
3458 /* Should never happen */
3459 if (!c)
3460 return 0;
3461
3462 if (c->peer_sigalgs)
3463 OPENSSL_free(c->peer_sigalgs);
3464 c->peer_sigalgs = OPENSSL_malloc(dsize);
3465 if (!c->peer_sigalgs)
3466 return 0;
3467 c->peer_sigalgslen = dsize;
3468 memcpy(c->peer_sigalgs, data, dsize);
3469 return 1;
3470}
6b7be581 3471
c800c27a 3472int tls1_process_sigalgs(SSL *s)
0f113f3e
MC		 3473{
3474 int idx;
3475 size_t i;
3476 const EVP_MD *md;
3477 CERT *c = s->cert;
3478 TLS_SIGALGS *sigptr;
3479 if (!tls1_set_shared_sigalgs(s))
3480 return 0;
3481
3482# ifdef OPENSSL_SSL_DEBUG_BROKEN_PROTOCOL
3483 if (s->cert->cert_flags & SSL_CERT_FLAG_BROKEN_PROTOCOL) {
3484 /*
3485 * Use first set signature preference to force message digest,
3486 * ignoring any peer preferences.
3487 */
3488 const unsigned char *sigs = NULL;
3489 if (s->server)
3490 sigs = c->conf_sigalgs;
3491 else
3492 sigs = c->client_sigalgs;
3493 if (sigs) {
3494 idx = tls12_get_pkey_idx(sigs[1]);
3495 md = tls12_get_hash(sigs[0]);
3496 c->pkeys[idx].digest = md;
3497 c->pkeys[idx].valid_flags = CERT_PKEY_EXPLICIT_SIGN;
3498 if (idx == SSL_PKEY_RSA_SIGN) {
3499 c->pkeys[SSL_PKEY_RSA_ENC].valid_flags =
3500 CERT_PKEY_EXPLICIT_SIGN;
3501 c->pkeys[SSL_PKEY_RSA_ENC].digest = md;
3502 }
3503 }
3504 }
3505# endif
3506
3507 for (i = 0, sigptr = c->shared_sigalgs;
3508 i < c->shared_sigalgslen; i++, sigptr++) {
3509 idx = tls12_get_pkey_idx(sigptr->rsign);
3510 if (idx > 0 && c->pkeys[idx].digest == NULL) {
3511 md = tls12_get_hash(sigptr->rhash);
3512 c->pkeys[idx].digest = md;
3513 c->pkeys[idx].valid_flags = CERT_PKEY_EXPLICIT_SIGN;
3514 if (idx == SSL_PKEY_RSA_SIGN) {
3515 c->pkeys[SSL_PKEY_RSA_ENC].valid_flags =
3516 CERT_PKEY_EXPLICIT_SIGN;
3517 c->pkeys[SSL_PKEY_RSA_ENC].digest = md;
3518 }
3519 }
6b7be581 3520
0f113f3e
MC		 3521 }
3522 /*
3523 * In strict mode leave unset digests as NULL to indicate we can't use
3524 * the certificate for signing.
3525 */
3526 if (!(s->cert->cert_flags & SSL_CERT_FLAGS_CHECK_TLS_STRICT)) {
3527 /*
3528 * Set any remaining keys to default values. NOTE: if alg is not
3529 * supported it stays as NULL.
3530 */
3531# ifndef OPENSSL_NO_DSA
3532 if (!c->pkeys[SSL_PKEY_DSA_SIGN].digest)
3533 c->pkeys[SSL_PKEY_DSA_SIGN].digest = EVP_sha1();
3534# endif
3535# ifndef OPENSSL_NO_RSA
3536 if (!c->pkeys[SSL_PKEY_RSA_SIGN].digest) {
3537 c->pkeys[SSL_PKEY_RSA_SIGN].digest = EVP_sha1();
3538 c->pkeys[SSL_PKEY_RSA_ENC].digest = EVP_sha1();
3539 }
3540# endif
10bf4fc2 3541# ifndef OPENSSL_NO_EC
0f113f3e
MC		 3542 if (!c->pkeys[SSL_PKEY_ECC].digest)
3543 c->pkeys[SSL_PKEY_ECC].digest = EVP_sha1();
3544# endif
3545 }
3546 return 1;
3547}
4817504d 3548
e7f8ff43 3549int SSL_get_sigalgs(SSL *s, int idx,
0f113f3e
MC		 3550 int *psign, int *phash, int *psignhash,
3551 unsigned char *rsig, unsigned char *rhash)
3552{
3553 const unsigned char *psig = s->cert->peer_sigalgs;
3554 if (psig == NULL)
3555 return 0;
3556 if (idx >= 0) {
3557 idx <<= 1;
3558 if (idx >= (int)s->cert->peer_sigalgslen)
3559 return 0;
3560 psig += idx;
3561 if (rhash)
3562 *rhash = psig[0];
3563 if (rsig)
3564 *rsig = psig[1];
3565 tls1_lookup_sigalg(phash, psign, psignhash, psig);
3566 }
3567 return s->cert->peer_sigalgslen / 2;
3568}
4453cd8c
DSH		 3569
3570int SSL_get_shared_sigalgs(SSL *s, int idx,
0f113f3e
MC		 3571 int *psign, int *phash, int *psignhash,
3572 unsigned char *rsig, unsigned char *rhash)
3573{
3574 TLS_SIGALGS *shsigalgs = s->cert->shared_sigalgs;
3575 if (!shsigalgs || idx >= (int)s->cert->shared_sigalgslen)
3576 return 0;
3577 shsigalgs += idx;
3578 if (phash)
3579 *phash = shsigalgs->hash_nid;
3580 if (psign)
3581 *psign = shsigalgs->sign_nid;
3582 if (psignhash)
3583 *psignhash = shsigalgs->signandhash_nid;
3584 if (rsig)
3585 *rsig = shsigalgs->rsign;
3586 if (rhash)
3587 *rhash = shsigalgs->rhash;
3588 return s->cert->shared_sigalgslen;
3589}
3590
3591# ifndef OPENSSL_NO_HEARTBEATS
2c60ed04 3592int tls1_process_heartbeat(SSL *s, unsigned char *p, unsigned int length)
0f113f3e 3593{
2c60ed04 3594 unsigned char *pl;
0f113f3e
MC		 3595 unsigned short hbtype;
3596 unsigned int payload;
3597 unsigned int padding = 16; /* Use minimum padding */
3598
3599 if (s->msg_callback)
3600 s->msg_callback(0, s->version, TLS1_RT_HEARTBEAT,
258f8721 3601 p, length,
0f113f3e
MC		 3602 s, s->msg_callback_arg);
3603
3604 /* Read type and payload length first */
258f8721 3605 if (1 + 2 + 16 > length)
0f113f3e
MC		 3606 return 0; /* silently discard */
3607 hbtype = *p++;
3608 n2s(p, payload);
258f8721 3609 if (1 + 2 + payload + 16 > length)
0f113f3e
MC		 3610 return 0; /* silently discard per RFC 6520 sec. 4 */
3611 pl = p;
3612
3613 if (hbtype == TLS1_HB_REQUEST) {
3614 unsigned char *buffer, *bp;
3615 int r;
3616
3617 /*
3618 * Allocate memory for the response, size is 1 bytes message type,
3619 * plus 2 bytes payload length, plus payload, plus padding
3620 */
3621 buffer = OPENSSL_malloc(1 + 2 + payload + padding);
3622 if (buffer == NULL) {
3623 SSLerr(SSL_F_TLS1_PROCESS_HEARTBEAT, ERR_R_MALLOC_FAILURE);
3624 return -1;
3625 }
3626 bp = buffer;
3627
3628 /* Enter response type, length and copy payload */
3629 *bp++ = TLS1_HB_RESPONSE;
3630 s2n(payload, bp);
3631 memcpy(bp, pl, payload);
3632 bp += payload;
3633 /* Random padding */
266483d2
MC		 3634 if (RAND_bytes(bp, padding) <= 0) {
3635 OPENSSL_free(buffer);
3636 return -1;
3637 }
0f113f3e
MC		 3638
3639 r = ssl3_write_bytes(s, TLS1_RT_HEARTBEAT, buffer,
3640 3 + payload + padding);
3641
3642 if (r >= 0 && s->msg_callback)
3643 s->msg_callback(1, s->version, TLS1_RT_HEARTBEAT,
3644 buffer, 3 + payload + padding,
3645 s, s->msg_callback_arg);
3646
3647 OPENSSL_free(buffer);
3648
3649 if (r < 0)
3650 return r;
3651 } else if (hbtype == TLS1_HB_RESPONSE) {
3652 unsigned int seq;
3653
3654 /*
3655 * We only send sequence numbers (2 bytes unsigned int), and 16
3656 * random bytes, so we just try to read the sequence number
3657 */
3658 n2s(pl, seq);
3659
3660 if (payload == 18 && seq == s->tlsext_hb_seq) {
3661 s->tlsext_hb_seq++;
3662 s->tlsext_hb_pending = 0;
3663 }
3664 }
3665
3666 return 0;
3667}
0f229cce 3668
0f113f3e
MC		 3669int tls1_heartbeat(SSL *s)
3670{
3671 unsigned char *buf, *p;
266483d2 3672 int ret = -1;
0f113f3e
MC		 3673 unsigned int payload = 18; /* Sequence number + random bytes */
3674 unsigned int padding = 16; /* Use minimum padding */
3675
3676 /* Only send if peer supports and accepts HB requests... */
3677 if (!(s->tlsext_heartbeat & SSL_TLSEXT_HB_ENABLED) ||
3678 s->tlsext_heartbeat & SSL_TLSEXT_HB_DONT_SEND_REQUESTS) {
3679 SSLerr(SSL_F_TLS1_HEARTBEAT, SSL_R_TLS_HEARTBEAT_PEER_DOESNT_ACCEPT);
3680 return -1;
3681 }
3682
3683 /* ...and there is none in flight yet... */
3684 if (s->tlsext_hb_pending) {
3685 SSLerr(SSL_F_TLS1_HEARTBEAT, SSL_R_TLS_HEARTBEAT_PENDING);
3686 return -1;
3687 }
3688
3689 /* ...and no handshake in progress. */
3690 if (SSL_in_init(s) || s->in_handshake) {
3691 SSLerr(SSL_F_TLS1_HEARTBEAT, SSL_R_UNEXPECTED_MESSAGE);
3692 return -1;
3693 }
3694
3695 /*
3696 * Check if padding is too long, payload and padding must not exceed 2^14
3697 * - 3 = 16381 bytes in total.
3698 */
3699 OPENSSL_assert(payload + padding <= 16381);
3700
50e735f9
MC		 3701 /*-
3702 * Create HeartBeat message, we just use a sequence number
3703 * as payload to distuingish different messages and add
3704 * some random stuff.
3705 * - Message Type, 1 byte
3706 * - Payload Length, 2 bytes (unsigned int)
3707 * - Payload, the sequence number (2 bytes uint)
3708 * - Payload, random bytes (16 bytes uint)
3709 * - Padding
3710 */
0f113f3e
MC		 3711 buf = OPENSSL_malloc(1 + 2 + payload + padding);
3712 if (buf == NULL) {
3713 SSLerr(SSL_F_TLS1_HEARTBEAT, ERR_R_MALLOC_FAILURE);
3714 return -1;
3715 }
3716 p = buf;
3717 /* Message Type */
3718 *p++ = TLS1_HB_REQUEST;
3719 /* Payload length (18 bytes here) */
3720 s2n(payload, p);
3721 /* Sequence number */
3722 s2n(s->tlsext_hb_seq, p);
3723 /* 16 random bytes */
266483d2
MC		 3724 if (RAND_bytes(p, 16) <= 0) {
3725 SSLerr(SSL_F_TLS1_HEARTBEAT, ERR_R_INTERNAL_ERROR);
3726 goto err;
3727 }
0f113f3e
MC		 3728 p += 16;
3729 /* Random padding */
266483d2
MC		 3730 if (RAND_bytes(p, padding) <= 0) {
3731 SSLerr(SSL_F_TLS1_HEARTBEAT, ERR_R_INTERNAL_ERROR);
3732 goto err;
3733 }
0f113f3e
MC		 3734
3735 ret = ssl3_write_bytes(s, TLS1_RT_HEARTBEAT, buf, 3 + payload + padding);
3736 if (ret >= 0) {
3737 if (s->msg_callback)
3738 s->msg_callback(1, s->version, TLS1_RT_HEARTBEAT,
3739 buf, 3 + payload + padding,
3740 s, s->msg_callback_arg);
3741
3742 s->tlsext_hb_pending = 1;
3743 }
3744
266483d2 3745 err:
0f113f3e 3746 OPENSSL_free(buf);
0f113f3e
MC		 3747 return ret;
3748}
3749# endif
3750
3751# define MAX_SIGALGLEN (TLSEXT_hash_num * TLSEXT_signature_num * 2)
0f229cce 3752
0f113f3e
MC		 3753typedef struct {
3754 size_t sigalgcnt;
3755 int sigalgs[MAX_SIGALGLEN];
3756} sig_cb_st;
0f229cce
DSH		 3757
3758static int sig_cb(const char *elem, int len, void *arg)
0f113f3e
MC		 3759{
3760 sig_cb_st *sarg = arg;
3761 size_t i;
3762 char etmp[20], *p;
3763 int sig_alg, hash_alg;
2747d73c
KR		 3764 if (elem == NULL)
3765 return 0;
0f113f3e
MC		 3766 if (sarg->sigalgcnt == MAX_SIGALGLEN)
3767 return 0;
3768 if (len > (int)(sizeof(etmp) - 1))
3769 return 0;
3770 memcpy(etmp, elem, len);
3771 etmp[len] = 0;
3772 p = strchr(etmp, '+');
3773 if (!p)
3774 return 0;
3775 *p = 0;
3776 p++;
3777 if (!*p)
3778 return 0;
3779
3780 if (!strcmp(etmp, "RSA"))
3781 sig_alg = EVP_PKEY_RSA;
3782 else if (!strcmp(etmp, "DSA"))
3783 sig_alg = EVP_PKEY_DSA;
3784 else if (!strcmp(etmp, "ECDSA"))
3785 sig_alg = EVP_PKEY_EC;
3786 else
3787 return 0;
3788
3789 hash_alg = OBJ_sn2nid(p);
3790 if (hash_alg == NID_undef)
3791 hash_alg = OBJ_ln2nid(p);
3792 if (hash_alg == NID_undef)
3793 return 0;
3794
3795 for (i = 0; i < sarg->sigalgcnt; i += 2) {
3796 if (sarg->sigalgs[i] == sig_alg && sarg->sigalgs[i + 1] == hash_alg)
3797 return 0;
3798 }
3799 sarg->sigalgs[sarg->sigalgcnt++] = hash_alg;
3800 sarg->sigalgs[sarg->sigalgcnt++] = sig_alg;
3801 return 1;
3802}
3803
3804/*
3805 * Set suppored signature algorithms based on a colon separated list of the
3806 * form sig+hash e.g. RSA+SHA512:DSA+SHA512
3807 */
3dbc46df 3808int tls1_set_sigalgs_list(CERT *c, const char *str, int client)
0f113f3e
MC		 3809{
3810 sig_cb_st sig;
3811 sig.sigalgcnt = 0;
3812 if (!CONF_parse_list(str, ':', 1, sig_cb, &sig))
3813 return 0;
3814 if (c == NULL)
3815 return 1;
3816 return tls1_set_sigalgs(c, sig.sigalgs, sig.sigalgcnt, client);
3817}
3818
3819int tls1_set_sigalgs(CERT *c, const int *psig_nids, size_t salglen,
3820 int client)
3821{
3822 unsigned char *sigalgs, *sptr;
3823 int rhash, rsign;
3824 size_t i;
3825 if (salglen & 1)
3826 return 0;
3827 sigalgs = OPENSSL_malloc(salglen);
3828 if (sigalgs == NULL)
3829 return 0;
3830 for (i = 0, sptr = sigalgs; i < salglen; i += 2) {
3831 rhash = tls12_find_id(*psig_nids++, tls12_md,
3832 sizeof(tls12_md) / sizeof(tls12_lookup));
3833 rsign = tls12_find_id(*psig_nids++, tls12_sig,
3834 sizeof(tls12_sig) / sizeof(tls12_lookup));
3835
3836 if (rhash == -1 || rsign == -1)
3837 goto err;
3838 *sptr++ = rhash;
3839 *sptr++ = rsign;
3840 }
3841
3842 if (client) {
3843 if (c->client_sigalgs)
3844 OPENSSL_free(c->client_sigalgs);
3845 c->client_sigalgs = sigalgs;
3846 c->client_sigalgslen = salglen;
3847 } else {
3848 if (c->conf_sigalgs)
3849 OPENSSL_free(c->conf_sigalgs);
3850 c->conf_sigalgs = sigalgs;
3851 c->conf_sigalgslen = salglen;
3852 }
3853
3854 return 1;
3855
3856 err:
3857 OPENSSL_free(sigalgs);
3858 return 0;
3859}
4453cd8c 3860
d61ff83b 3861static int tls1_check_sig_alg(CERT *c, X509 *x, int default_nid)
0f113f3e
MC		 3862{
3863 int sig_nid;
3864 size_t i;
3865 if (default_nid == -1)
3866 return 1;
3867 sig_nid = X509_get_signature_nid(x);
3868 if (default_nid)
3869 return sig_nid == default_nid ? 1 : 0;
3870 for (i = 0; i < c->shared_sigalgslen; i++)
3871 if (sig_nid == c->shared_sigalgs[i].signandhash_nid)
3872 return 1;
3873 return 0;
3874}
3875
6dbb6219
DSH		 3876/* Check to see if a certificate issuer name matches list of CA names */
3877static int ssl_check_ca_name(STACK_OF(X509_NAME) *names, X509 *x)
0f113f3e
MC		 3878{
3879 X509_NAME *nm;
3880 int i;
3881 nm = X509_get_issuer_name(x);
3882 for (i = 0; i < sk_X509_NAME_num(names); i++) {
3883 if (!X509_NAME_cmp(nm, sk_X509_NAME_value(names, i)))
3884 return 1;
3885 }
3886 return 0;
3887}
3888
3889/*
3890 * Check certificate chain is consistent with TLS extensions and is usable by
3891 * server. This servers two purposes: it allows users to check chains before
3892 * passing them to the server and it allows the server to check chains before
3893 * attempting to use them.
d61ff83b 3894 */
6dbb6219
DSH		 3895
3896/* Flags which need to be set for a certificate when stict mode not set */
3897
0f113f3e
MC		 3898# define CERT_PKEY_VALID_FLAGS \
3899 (CERT_PKEY_EE_SIGNATURE|CERT_PKEY_EE_PARAM)
6dbb6219 3900/* Strict mode flags */
0f113f3e
MC		 3901# define CERT_PKEY_STRICT_FLAGS \
3902 (CERT_PKEY_VALID_FLAGS|CERT_PKEY_CA_SIGNATURE|CERT_PKEY_CA_PARAM \
3903 | CERT_PKEY_ISSUER_NAME|CERT_PKEY_CERT_TYPE)
6dbb6219 3904
d61ff83b 3905int tls1_check_chain(SSL *s, X509 *x, EVP_PKEY *pk, STACK_OF(X509) *chain,
0f113f3e
MC		 3906 int idx)
3907{
3908 int i;
3909 int rv = 0;
3910 int check_flags = 0, strict_mode;
3911 CERT_PKEY *cpk = NULL;
3912 CERT *c = s->cert;
3913 unsigned int suiteb_flags = tls1_suiteb(s);
3914 /* idx == -1 means checking server chains */
3915 if (idx != -1) {
3916 /* idx == -2 means checking client certificate chains */
3917 if (idx == -2) {
3918 cpk = c->key;
3919 idx = cpk - c->pkeys;
3920 } else
3921 cpk = c->pkeys + idx;
3922 x = cpk->x509;
3923 pk = cpk->privatekey;
3924 chain = cpk->chain;
3925 strict_mode = c->cert_flags & SSL_CERT_FLAGS_CHECK_TLS_STRICT;
3926 /* If no cert or key, forget it */
3927 if (!x || !pk)
3928 goto end;
3929# ifdef OPENSSL_SSL_DEBUG_BROKEN_PROTOCOL
3930 /* Allow any certificate to pass test */
3931 if (s->cert->cert_flags & SSL_CERT_FLAG_BROKEN_PROTOCOL) {
3932 rv = CERT_PKEY_STRICT_FLAGS | CERT_PKEY_EXPLICIT_SIGN |
3933 CERT_PKEY_VALID | CERT_PKEY_SIGN;
3934 cpk->valid_flags = rv;
3935 return rv;
3936 }
3937# endif
3938 } else {
3939 if (!x || !pk)
d813f9eb 3940 return 0;
0f113f3e
MC		 3941 idx = ssl_cert_type(x, pk);
3942 if (idx == -1)
d813f9eb 3943 return 0;
0f113f3e
MC		 3944 cpk = c->pkeys + idx;
3945 if (c->cert_flags & SSL_CERT_FLAGS_CHECK_TLS_STRICT)
3946 check_flags = CERT_PKEY_STRICT_FLAGS;
3947 else
3948 check_flags = CERT_PKEY_VALID_FLAGS;
3949 strict_mode = 1;
3950 }
3951
3952 if (suiteb_flags) {
3953 int ok;
3954 if (check_flags)
3955 check_flags |= CERT_PKEY_SUITEB;
3956 ok = X509_chain_check_suiteb(NULL, x, chain, suiteb_flags);
3957 if (ok == X509_V_OK)
3958 rv |= CERT_PKEY_SUITEB;
3959 else if (!check_flags)
3960 goto end;
3961 }
3962
3963 /*
3964 * Check all signature algorithms are consistent with signature
3965 * algorithms extension if TLS 1.2 or later and strict mode.
3966 */
3967 if (TLS1_get_version(s) >= TLS1_2_VERSION && strict_mode) {
3968 int default_nid;
3969 unsigned char rsign = 0;
3970 if (c->peer_sigalgs)
3971 default_nid = 0;
3972 /* If no sigalgs extension use defaults from RFC5246 */
3973 else {
3974 switch (idx) {
3975 case SSL_PKEY_RSA_ENC:
3976 case SSL_PKEY_RSA_SIGN:
3977 case SSL_PKEY_DH_RSA:
3978 rsign = TLSEXT_signature_rsa;
3979 default_nid = NID_sha1WithRSAEncryption;
3980 break;
3981
3982 case SSL_PKEY_DSA_SIGN:
3983 case SSL_PKEY_DH_DSA:
3984 rsign = TLSEXT_signature_dsa;
3985 default_nid = NID_dsaWithSHA1;
3986 break;
3987
3988 case SSL_PKEY_ECC:
3989 rsign = TLSEXT_signature_ecdsa;
3990 default_nid = NID_ecdsa_with_SHA1;
3991 break;
3992
3993 default:
3994 default_nid = -1;
3995 break;
3996 }
3997 }
3998 /*
3999 * If peer sent no signature algorithms extension and we have set
4000 * preferred signature algorithms check we support sha1.
4001 */
4002 if (default_nid > 0 && c->conf_sigalgs) {
4003 size_t j;
4004 const unsigned char *p = c->conf_sigalgs;
4005 for (j = 0; j < c->conf_sigalgslen; j += 2, p += 2) {
4006 if (p[0] == TLSEXT_hash_sha1 && p[1] == rsign)
4007 break;
4008 }
4009 if (j == c->conf_sigalgslen) {
4010 if (check_flags)
4011 goto skip_sigs;
4012 else
4013 goto end;
4014 }
4015 }
4016 /* Check signature algorithm of each cert in chain */
4017 if (!tls1_check_sig_alg(c, x, default_nid)) {
4018 if (!check_flags)
4019 goto end;
4020 } else
4021 rv |= CERT_PKEY_EE_SIGNATURE;
4022 rv |= CERT_PKEY_CA_SIGNATURE;
4023 for (i = 0; i < sk_X509_num(chain); i++) {
4024 if (!tls1_check_sig_alg(c, sk_X509_value(chain, i), default_nid)) {
4025 if (check_flags) {
4026 rv &= ~CERT_PKEY_CA_SIGNATURE;
4027 break;
4028 } else
4029 goto end;
4030 }
4031 }
4032 }
4033 /* Else not TLS 1.2, so mark EE and CA signing algorithms OK */
4034 else if (check_flags)
4035 rv |= CERT_PKEY_EE_SIGNATURE | CERT_PKEY_CA_SIGNATURE;
4036 skip_sigs:
4037 /* Check cert parameters are consistent */
4038 if (tls1_check_cert_param(s, x, check_flags ? 1 : 2))
4039 rv |= CERT_PKEY_EE_PARAM;
4040 else if (!check_flags)
4041 goto end;
4042 if (!s->server)
4043 rv |= CERT_PKEY_CA_PARAM;
4044 /* In strict mode check rest of chain too */
4045 else if (strict_mode) {
4046 rv |= CERT_PKEY_CA_PARAM;
4047 for (i = 0; i < sk_X509_num(chain); i++) {
4048 X509 *ca = sk_X509_value(chain, i);
4049 if (!tls1_check_cert_param(s, ca, 0)) {
4050 if (check_flags) {
4051 rv &= ~CERT_PKEY_CA_PARAM;
4052 break;
4053 } else
4054 goto end;
4055 }
4056 }
4057 }
4058 if (!s->server && strict_mode) {
4059 STACK_OF(X509_NAME) *ca_dn;
4060 int check_type = 0;
4061 switch (pk->type) {
4062 case EVP_PKEY_RSA:
4063 check_type = TLS_CT_RSA_SIGN;
4064 break;
4065 case EVP_PKEY_DSA:
4066 check_type = TLS_CT_DSS_SIGN;
4067 break;
4068 case EVP_PKEY_EC:
4069 check_type = TLS_CT_ECDSA_SIGN;
4070 break;
4071 case EVP_PKEY_DH:
4072 case EVP_PKEY_DHX:
4073 {
4074 int cert_type = X509_certificate_type(x, pk);
4075 if (cert_type & EVP_PKS_RSA)
4076 check_type = TLS_CT_RSA_FIXED_DH;
4077 if (cert_type & EVP_PKS_DSA)
4078 check_type = TLS_CT_DSS_FIXED_DH;
4079 }
4080 }
4081 if (check_type) {
4082 const unsigned char *ctypes;
4083 int ctypelen;
4084 if (c->ctypes) {
4085 ctypes = c->ctypes;
4086 ctypelen = (int)c->ctype_num;
4087 } else {
4088 ctypes = (unsigned char *)s->s3->tmp.ctype;
4089 ctypelen = s->s3->tmp.ctype_num;
4090 }
4091 for (i = 0; i < ctypelen; i++) {
4092 if (ctypes[i] == check_type) {
4093 rv |= CERT_PKEY_CERT_TYPE;
4094 break;
4095 }
4096 }
4097 if (!(rv & CERT_PKEY_CERT_TYPE) && !check_flags)
4098 goto end;
4099 } else
4100 rv |= CERT_PKEY_CERT_TYPE;
4101
4102 ca_dn = s->s3->tmp.ca_names;
4103
4104 if (!sk_X509_NAME_num(ca_dn))
4105 rv |= CERT_PKEY_ISSUER_NAME;
4106
4107 if (!(rv & CERT_PKEY_ISSUER_NAME)) {
4108 if (ssl_check_ca_name(ca_dn, x))
4109 rv |= CERT_PKEY_ISSUER_NAME;
4110 }
4111 if (!(rv & CERT_PKEY_ISSUER_NAME)) {
4112 for (i = 0; i < sk_X509_num(chain); i++) {
4113 X509 *xtmp = sk_X509_value(chain, i);
4114 if (ssl_check_ca_name(ca_dn, xtmp)) {
4115 rv |= CERT_PKEY_ISSUER_NAME;
4116 break;
4117 }
4118 }
4119 }
4120 if (!check_flags && !(rv & CERT_PKEY_ISSUER_NAME))
4121 goto end;
4122 } else
4123 rv |= CERT_PKEY_ISSUER_NAME | CERT_PKEY_CERT_TYPE;
4124
4125 if (!check_flags || (rv & check_flags) == check_flags)
4126 rv |= CERT_PKEY_VALID;
4127
4128 end:
4129
4130 if (TLS1_get_version(s) >= TLS1_2_VERSION) {
4131 if (cpk->valid_flags & CERT_PKEY_EXPLICIT_SIGN)
4132 rv |= CERT_PKEY_EXPLICIT_SIGN | CERT_PKEY_SIGN;
4133 else if (cpk->digest)
4134 rv |= CERT_PKEY_SIGN;
4135 } else
4136 rv |= CERT_PKEY_SIGN | CERT_PKEY_EXPLICIT_SIGN;
4137
4138 /*
4139 * When checking a CERT_PKEY structure all flags are irrelevant if the
4140 * chain is invalid.
4141 */
4142 if (!check_flags) {
4143 if (rv & CERT_PKEY_VALID)
4144 cpk->valid_flags = rv;
4145 else {
4146 /* Preserve explicit sign flag, clear rest */
4147 cpk->valid_flags &= CERT_PKEY_EXPLICIT_SIGN;
4148 return 0;
4149 }
4150 }
4151 return rv;
4152}
d61ff83b
DSH		 4153
4154/* Set validity of certificates in an SSL structure */
4155void tls1_set_cert_validity(SSL *s)
0f113f3e 4156{
17dd65e6
MC		 4157 tls1_check_chain(s, NULL, NULL, NULL, SSL_PKEY_RSA_ENC);
4158 tls1_check_chain(s, NULL, NULL, NULL, SSL_PKEY_RSA_SIGN);
4159 tls1_check_chain(s, NULL, NULL, NULL, SSL_PKEY_DSA_SIGN);
4160 tls1_check_chain(s, NULL, NULL, NULL, SSL_PKEY_DH_RSA);
4161 tls1_check_chain(s, NULL, NULL, NULL, SSL_PKEY_DH_DSA);
4162 tls1_check_chain(s, NULL, NULL, NULL, SSL_PKEY_ECC);
0f113f3e
MC		 4163}
4164
18d71588
DSH		 4165/* User level utiity function to check a chain is suitable */
4166int SSL_check_chain(SSL *s, X509 *x, EVP_PKEY *pk, STACK_OF(X509) *chain)
0f113f3e
MC		 4167{
4168 return tls1_check_chain(s, x, pk, chain, -1);
4169}
d61ff83b 4170
4453cd8c 4171#endif
09599b52
DSH		 4172
4173#ifndef OPENSSL_NO_DH
4174DH *ssl_get_auto_dh(SSL *s)
0f113f3e
MC		 4175{
4176 int dh_secbits = 80;
4177 if (s->cert->dh_tmp_auto == 2)
4178 return DH_get_1024_160();
4179 if (s->s3->tmp.new_cipher->algorithm_auth & SSL_aNULL) {
4180 if (s->s3->tmp.new_cipher->strength_bits == 256)
4181 dh_secbits = 128;
4182 else
4183 dh_secbits = 80;
4184 } else {
4185 CERT_PKEY *cpk = ssl_get_server_send_pkey(s);
4186 dh_secbits = EVP_PKEY_security_bits(cpk->privatekey);
4187 }
4188
4189 if (dh_secbits >= 128) {
4190 DH *dhp = DH_new();
4191 if (!dhp)
4192 return NULL;
4193 dhp->g = BN_new();
4194 if (dhp->g)
4195 BN_set_word(dhp->g, 2);
4196 if (dh_secbits >= 192)
4197 dhp->p = get_rfc3526_prime_8192(NULL);
4198 else
4199 dhp->p = get_rfc3526_prime_3072(NULL);
4200 if (!dhp->p || !dhp->g) {
4201 DH_free(dhp);
4202 return NULL;
4203 }
4204 return dhp;
4205 }
4206 if (dh_secbits >= 112)
4207 return DH_get_2048_224();
4208 return DH_get_1024_160();
4209}
09599b52 4210#endif
b362ccab
DSH		 4211
4212static int ssl_security_cert_key(SSL *s, SSL_CTX *ctx, X509 *x, int op)
0f113f3e
MC		 4213{
4214 int secbits;
4215 EVP_PKEY *pkey = X509_get_pubkey(x);
4216 if (pkey) {
4217 secbits = EVP_PKEY_security_bits(pkey);
4218 EVP_PKEY_free(pkey);
4219 } else
4220 secbits = -1;
4221 if (s)
4222 return ssl_security(s, op, secbits, 0, x);
4223 else
4224 return ssl_ctx_security(ctx, op, secbits, 0, x);
4225}
b362ccab
DSH		 4226
4227static int ssl_security_cert_sig(SSL *s, SSL_CTX *ctx, X509 *x, int op)
0f113f3e
MC		 4228{
4229 /* Lookup signature algorithm digest */
4230 int secbits = -1, md_nid = NID_undef, sig_nid;
4231 sig_nid = X509_get_signature_nid(x);
4232 if (sig_nid && OBJ_find_sigid_algs(sig_nid, &md_nid, NULL)) {
4233 const EVP_MD *md;
4234 if (md_nid && (md = EVP_get_digestbynid(md_nid)))
4235 secbits = EVP_MD_size(md) * 4;
4236 }
4237 if (s)
4238 return ssl_security(s, op, secbits, md_nid, x);
4239 else
4240 return ssl_ctx_security(ctx, op, secbits, md_nid, x);
4241}
b362ccab
DSH		 4242
4243int ssl_security_cert(SSL *s, SSL_CTX *ctx, X509 *x, int vfy, int is_ee)
0f113f3e
MC		 4244{
4245 if (vfy)
4246 vfy = SSL_SECOP_PEER;
4247 if (is_ee) {
4248 if (!ssl_security_cert_key(s, ctx, x, SSL_SECOP_EE_KEY | vfy))
4249 return SSL_R_EE_KEY_TOO_SMALL;
4250 } else {
4251 if (!ssl_security_cert_key(s, ctx, x, SSL_SECOP_CA_KEY | vfy))
4252 return SSL_R_CA_KEY_TOO_SMALL;
4253 }
4254 if (!ssl_security_cert_sig(s, ctx, x, SSL_SECOP_CA_MD | vfy))
4255 return SSL_R_CA_MD_TOO_WEAK;
4256 return 1;
4257}
4258
4259/*
4260 * Check security of a chain, if sk includes the end entity certificate then
4261 * x is NULL. If vfy is 1 then we are verifying a peer chain and not sending
4262 * one to the peer. Return values: 1 if ok otherwise error code to use
b362ccab
DSH		 4263 */
4264
4265int ssl_security_cert_chain(SSL *s, STACK_OF(X509) *sk, X509 *x, int vfy)
0f113f3e
MC		 4266{
4267 int rv, start_idx, i;
4268 if (x == NULL) {
4269 x = sk_X509_value(sk, 0);
4270 start_idx = 1;
4271 } else
4272 start_idx = 0;
4273
4274 rv = ssl_security_cert(s, NULL, x, vfy, 1);
4275 if (rv != 1)
4276 return rv;
4277
4278 for (i = start_idx; i < sk_X509_num(sk); i++) {
4279 x = sk_X509_value(sk, i);
4280 rv = ssl_security_cert(s, NULL, x, vfy, 0);
4281 if (rv != 1)
4282 return rv;
4283 }
4284 return 1;
4285}
A mirror of the official openssl repository