ssl/statem/extensions_clnt.c

   1 /*
   2  * Copyright 2016 The OpenSSL Project Authors. All Rights Reserved.
   3  *
   4  * Licensed under the OpenSSL license (the "License").  You may not use
   5  * this file except in compliance with the License.  You can obtain a copy
   6  * in the file LICENSE in the source distribution or at
   7  * https://www.openssl.org/source/license.html
   8  */
   9
  10 #include <assert.h>
  11 #include <openssl/ocsp.h>
  12 #include "../ssl_locl.h"
  13 #include "statem_locl.h"
  14
  15 int tls_construct_ctos_renegotiate(SSL *s, WPACKET *pkt, X509 *x,
  16                                    size_t chainidx, int *al)
  17 {
  18     /* Add RI if renegotiating */
  19     if (!s->renegotiate)
  20         return 1;
  21
  22     if (!WPACKET_put_bytes_u16(pkt, TLSEXT_TYPE_renegotiate)
  23             || !WPACKET_start_sub_packet_u16(pkt)
  24             || !WPACKET_sub_memcpy_u8(pkt, s->s3->previous_client_finished,
  25                                s->s3->previous_client_finished_len)
  26             || !WPACKET_close(pkt)) {
  27         SSLerr(SSL_F_TLS_CONSTRUCT_CTOS_RENEGOTIATE, ERR_R_INTERNAL_ERROR);
  28         return 0;
  29     }
  30
  31     return 1;
  32 }
  33
  34 int tls_construct_ctos_server_name(SSL *s, WPACKET *pkt, X509 *x,
  35                                    size_t chainidx, int *al)
  36 {
  37     if (s->ext.hostname == NULL)
  38         return 1;
  39
  40     /* Add TLS extension servername to the Client Hello message */
  41     if (!WPACKET_put_bytes_u16(pkt, TLSEXT_TYPE_server_name)
  42                /* Sub-packet for server_name extension */
  43             || !WPACKET_start_sub_packet_u16(pkt)
  44                /* Sub-packet for servername list (always 1 hostname)*/
  45             || !WPACKET_start_sub_packet_u16(pkt)
  46             || !WPACKET_put_bytes_u8(pkt, TLSEXT_NAMETYPE_host_name)
  47             || !WPACKET_sub_memcpy_u16(pkt, s->ext.hostname,
  48                                        strlen(s->ext.hostname))
  49             || !WPACKET_close(pkt)
  50             || !WPACKET_close(pkt)) {
  51         SSLerr(SSL_F_TLS_CONSTRUCT_CTOS_SERVER_NAME, ERR_R_INTERNAL_ERROR);
  52         return 0;
  53     }
  54
  55     return 1;
  56 }
  57
  58 #ifndef OPENSSL_NO_SRP
  59 int tls_construct_ctos_srp(SSL *s, WPACKET *pkt, X509 *x, size_t chainidx,
  60                            int *al)
  61 {
  62     /* Add SRP username if there is one */
  63     if (s->srp_ctx.login == NULL)
  64         return 1;
  65
  66     if (!WPACKET_put_bytes_u16(pkt, TLSEXT_TYPE_srp)
  67                /* Sub-packet for SRP extension */
  68             || !WPACKET_start_sub_packet_u16(pkt)
  69             || !WPACKET_start_sub_packet_u8(pkt)
  70                /* login must not be zero...internal error if so */
  71             || !WPACKET_set_flags(pkt, WPACKET_FLAGS_NON_ZERO_LENGTH)
  72             || !WPACKET_memcpy(pkt, s->srp_ctx.login,
  73                                strlen(s->srp_ctx.login))
  74             || !WPACKET_close(pkt)
  75             || !WPACKET_close(pkt)) {
  76         SSLerr(SSL_F_TLS_CONSTRUCT_CTOS_SRP, ERR_R_INTERNAL_ERROR);
  77         return 0;
  78     }
  79
  80     return 1;
  81 }
  82 #endif
  83
  84 #ifndef OPENSSL_NO_EC
  85 static int use_ecc(SSL *s)
  86 {
  87     int i, end;
  88     unsigned long alg_k, alg_a;
  89     STACK_OF(SSL_CIPHER) *cipher_stack = NULL;
  90
  91     /* See if we support any ECC ciphersuites */
  92     if (s->version == SSL3_VERSION)
  93         return 0;
  94
  95     cipher_stack = SSL_get_ciphers(s);
  96     end = sk_SSL_CIPHER_num(cipher_stack);
  97     for (i = 0; i < end; i++) {
  98         const SSL_CIPHER *c = sk_SSL_CIPHER_value(cipher_stack, i);
  99
 100         alg_k = c->algorithm_mkey;
 101         alg_a = c->algorithm_auth;
 102         if ((alg_k & (SSL_kECDHE | SSL_kECDHEPSK))
 103                 || (alg_a & SSL_aECDSA)
 104                 || c->min_tls >= TLS1_3_VERSION)
 105             break;
 106     }
 107
 108     return i < end;
 109 }
 110
 111 int tls_construct_ctos_ec_pt_formats(SSL *s, WPACKET *pkt, X509 *x,
 112                                      size_t chainidx, int *al)
 113 {
 114     const unsigned char *pformats;
 115     size_t num_formats;
 116
 117     if (!use_ecc(s))
 118         return 1;
 119
 120     /* Add TLS extension ECPointFormats to the ClientHello message */
 121     tls1_get_formatlist(s, &pformats, &num_formats);
 122
 123     if (!WPACKET_put_bytes_u16(pkt, TLSEXT_TYPE_ec_point_formats)
 124                /* Sub-packet for formats extension */
 125             || !WPACKET_start_sub_packet_u16(pkt)
 126             || !WPACKET_sub_memcpy_u8(pkt, pformats, num_formats)
 127             || !WPACKET_close(pkt)) {
 128         SSLerr(SSL_F_TLS_CONSTRUCT_CTOS_EC_PT_FORMATS, ERR_R_INTERNAL_ERROR);
 129         return 0;
 130     }
 131
 132     return 1;
 133 }
 134
 135 int tls_construct_ctos_supported_groups(SSL *s, WPACKET *pkt, X509 *x,
 136                                         size_t chainidx, int *al)
 137 {
 138     const unsigned char *pcurves = NULL, *pcurvestmp;
 139     size_t num_curves = 0, i;
 140
 141     if (!use_ecc(s))
 142         return 1;
 143
 144     /*
 145      * Add TLS extension supported_groups to the ClientHello message
 146      */
 147     /* TODO(TLS1.3): Add support for DHE groups */
 148     pcurves = s->ext.supportedgroups;
 149     if (!tls1_get_curvelist(s, 0, &pcurves, &num_curves)) {
 150         SSLerr(SSL_F_TLS_CONSTRUCT_CTOS_SUPPORTED_GROUPS,
 151                ERR_R_INTERNAL_ERROR);
 152         return 0;
 153     }
 154     pcurvestmp = pcurves;
 155
 156     if (!WPACKET_put_bytes_u16(pkt, TLSEXT_TYPE_supported_groups)
 157                /* Sub-packet for supported_groups extension */
 158             || !WPACKET_start_sub_packet_u16(pkt)
 159             || !WPACKET_start_sub_packet_u16(pkt)) {
 160         SSLerr(SSL_F_TLS_CONSTRUCT_CTOS_SUPPORTED_GROUPS,
 161                ERR_R_INTERNAL_ERROR);
 162         return 0;
 163     }
 164     /* Copy curve ID if supported */
 165     for (i = 0; i < num_curves; i++, pcurvestmp += 2) {
 166         if (tls_curve_allowed(s, pcurves, SSL_SECOP_CURVE_SUPPORTED)) {
 167             if (!WPACKET_put_bytes_u8(pkt, pcurvestmp[0])
 168                 || !WPACKET_put_bytes_u8(pkt, pcurvestmp[1])) {
 169                     SSLerr(SSL_F_TLS_CONSTRUCT_CTOS_SUPPORTED_GROUPS,
 170                            ERR_R_INTERNAL_ERROR);
 171                     return 0;
 172                 }
 173         }
 174     }
 175     if (!WPACKET_close(pkt) || !WPACKET_close(pkt)) {
 176         SSLerr(SSL_F_TLS_CONSTRUCT_CTOS_SUPPORTED_GROUPS,
 177                ERR_R_INTERNAL_ERROR);
 178         return 0;
 179     }
 180
 181     return 1;
 182 }
 183 #endif
 184
 185 int tls_construct_ctos_session_ticket(SSL *s, WPACKET *pkt, X509 *x,
 186                                       size_t chainidx, int *al)
 187 {
 188     size_t ticklen;
 189
 190     if (!tls_use_ticket(s))
 191         return 1;
 192
 193     if (!s->new_session && s->session != NULL
 194             && s->session->ext.tick != NULL) {
 195         ticklen = s->session->ext.ticklen;
 196     } else if (s->session && s->ext.session_ticket != NULL
 197                && s->ext.session_ticket->data != NULL) {
 198         ticklen = s->ext.session_ticket->length;
 199         s->session->ext.tick = OPENSSL_malloc(ticklen);
 200         if (s->session->ext.tick == NULL) {
 201             SSLerr(SSL_F_TLS_CONSTRUCT_CTOS_SESSION_TICKET,
 202                    ERR_R_INTERNAL_ERROR);
 203             return 0;
 204         }
 205         memcpy(s->session->ext.tick,
 206                s->ext.session_ticket->data, ticklen);
 207         s->session->ext.ticklen = ticklen;
 208     } else {
 209         ticklen = 0;
 210     }
 211
 212     if (ticklen == 0 && s->ext.session_ticket != NULL &&
 213             s->ext.session_ticket->data == NULL)
 214         return 1;
 215
 216     if (!WPACKET_put_bytes_u16(pkt, TLSEXT_TYPE_session_ticket)
 217             || !WPACKET_sub_memcpy_u16(pkt, s->session->ext.tick, ticklen)) {
 218         SSLerr(SSL_F_TLS_CONSTRUCT_CTOS_SESSION_TICKET, ERR_R_INTERNAL_ERROR);
 219         return 0;
 220     }
 221
 222     return 1;
 223 }
 224
 225 int tls_construct_ctos_sig_algs(SSL *s, WPACKET *pkt, X509 *x, size_t chainidx,
 226                                 int *al)
 227 {
 228     size_t salglen;
 229     const unsigned char *salg;
 230
 231     if (!SSL_CLIENT_USE_SIGALGS(s))
 232         return 1;
 233
 234     salglen = tls12_get_psigalgs(s, &salg);
 235     if (!WPACKET_put_bytes_u16(pkt, TLSEXT_TYPE_signature_algorithms)
 236                /* Sub-packet for sig-algs extension */
 237             || !WPACKET_start_sub_packet_u16(pkt)
 238                /* Sub-packet for the actual list */
 239             || !WPACKET_start_sub_packet_u16(pkt)
 240             || !tls12_copy_sigalgs(s, pkt, salg, salglen)
 241             || !WPACKET_close(pkt)
 242             || !WPACKET_close(pkt)) {
 243         SSLerr(SSL_F_TLS_CONSTRUCT_CTOS_SIG_ALGS, ERR_R_INTERNAL_ERROR);
 244         return 0;
 245     }
 246
 247     return 1;
 248 }
 249
 250 #ifndef OPENSSL_NO_OCSP
 251 int tls_construct_ctos_status_request(SSL *s, WPACKET *pkt, X509 *x,
 252                                       size_t chainidx, int *al)
 253 {
 254     int i;
 255
 256     /* This extension isn't defined for client Certificates */
 257     if (x != NULL)
 258         return 1;
 259
 260     if (s->ext.status_type != TLSEXT_STATUSTYPE_ocsp)
 261         return 1;
 262
 263     if (!WPACKET_put_bytes_u16(pkt, TLSEXT_TYPE_status_request)
 264                /* Sub-packet for status request extension */
 265             || !WPACKET_start_sub_packet_u16(pkt)
 266             || !WPACKET_put_bytes_u8(pkt, TLSEXT_STATUSTYPE_ocsp)
 267                /* Sub-packet for the ids */
 268             || !WPACKET_start_sub_packet_u16(pkt)) {
 269         SSLerr(SSL_F_TLS_CONSTRUCT_CTOS_STATUS_REQUEST, ERR_R_INTERNAL_ERROR);
 270         return 0;
 271     }
 272     for (i = 0; i < sk_OCSP_RESPID_num(s->ext.ocsp.ids); i++) {
 273         unsigned char *idbytes;
 274         OCSP_RESPID *id = sk_OCSP_RESPID_value(s->ext.ocsp.ids, i);
 275         int idlen = i2d_OCSP_RESPID(id, NULL);
 276
 277         if (idlen <= 0
 278                    /* Sub-packet for an individual id */
 279                 || !WPACKET_sub_allocate_bytes_u16(pkt, idlen, &idbytes)
 280                 || i2d_OCSP_RESPID(id, &idbytes) != idlen) {
 281             SSLerr(SSL_F_TLS_CONSTRUCT_CTOS_STATUS_REQUEST,
 282                    ERR_R_INTERNAL_ERROR);
 283             return 0;
 284         }
 285     }
 286     if (!WPACKET_close(pkt)
 287             || !WPACKET_start_sub_packet_u16(pkt)) {
 288         SSLerr(SSL_F_TLS_CONSTRUCT_CTOS_STATUS_REQUEST, ERR_R_INTERNAL_ERROR);
 289         return 0;
 290     }
 291     if (s->ext.ocsp.exts) {
 292         unsigned char *extbytes;
 293         int extlen = i2d_X509_EXTENSIONS(s->ext.ocsp.exts, NULL);
 294
 295         if (extlen < 0) {
 296             SSLerr(SSL_F_TLS_CONSTRUCT_CTOS_STATUS_REQUEST,
 297                    ERR_R_INTERNAL_ERROR);
 298             return 0;
 299         }
 300         if (!WPACKET_allocate_bytes(pkt, extlen, &extbytes)
 301                 || i2d_X509_EXTENSIONS(s->ext.ocsp.exts, &extbytes)
 302                    != extlen) {
 303             SSLerr(SSL_F_TLS_CONSTRUCT_CTOS_STATUS_REQUEST,
 304                    ERR_R_INTERNAL_ERROR);
 305             return 0;
 306        }
 307     }
 308     if (!WPACKET_close(pkt) || !WPACKET_close(pkt)) {
 309         SSLerr(SSL_F_TLS_CONSTRUCT_CTOS_STATUS_REQUEST, ERR_R_INTERNAL_ERROR);
 310         return 0;
 311     }
 312
 313     return 1;
 314 }
 315 #endif
 316
 317 #ifndef OPENSSL_NO_NEXTPROTONEG
 318 int tls_construct_ctos_npn(SSL *s, WPACKET *pkt, X509 *x, size_t chainidx,
 319                            int *al)
 320 {
 321     if (s->ctx->ext.npn_select_cb == NULL || s->s3->tmp.finish_md_len != 0)
 322         return 1;
 323
 324     /*
 325      * The client advertises an empty extension to indicate its support
 326      * for Next Protocol Negotiation
 327      */
 328     if (!WPACKET_put_bytes_u16(pkt, TLSEXT_TYPE_next_proto_neg)
 329             || !WPACKET_put_bytes_u16(pkt, 0)) {
 330         SSLerr(SSL_F_TLS_CONSTRUCT_CTOS_NPN, ERR_R_INTERNAL_ERROR);
 331         return 0;
 332     }
 333
 334     return 1;
 335 }
 336 #endif
 337
 338 int tls_construct_ctos_alpn(SSL *s, WPACKET *pkt, X509 *x, size_t chainidx,
 339                             int *al)
 340 {
 341     s->s3->alpn_sent = 0;
 342
 343     /*
 344      * finish_md_len is non-zero during a renegotiation, so
 345      * this avoids sending ALPN during the renegotiation
 346      */
 347     if (s->ext.alpn == NULL || s->s3->tmp.finish_md_len != 0)
 348         return 1;
 349
 350     if (!WPACKET_put_bytes_u16(pkt,
 351                 TLSEXT_TYPE_application_layer_protocol_negotiation)
 352                /* Sub-packet ALPN extension */
 353             || !WPACKET_start_sub_packet_u16(pkt)
 354             || !WPACKET_sub_memcpy_u16(pkt, s->ext.alpn, s->ext.alpn_len)
 355             || !WPACKET_close(pkt)) {
 356         SSLerr(SSL_F_TLS_CONSTRUCT_CTOS_ALPN, ERR_R_INTERNAL_ERROR);
 357         return 0;
 358     }
 359     s->s3->alpn_sent = 1;
 360
 361     return 1;
 362 }
 363
 364
 365 #ifndef OPENSSL_NO_SRTP
 366 int tls_construct_ctos_use_srtp(SSL *s, WPACKET *pkt, X509 *x, size_t chainidx,
 367                                 int *al)
 368 {
 369     STACK_OF(SRTP_PROTECTION_PROFILE) *clnt = SSL_get_srtp_profiles(s);
 370     int i, end;
 371
 372     if (clnt == NULL)
 373         return 1;
 374
 375     if (!WPACKET_put_bytes_u16(pkt, TLSEXT_TYPE_use_srtp)
 376                /* Sub-packet for SRTP extension */
 377             || !WPACKET_start_sub_packet_u16(pkt)
 378                /* Sub-packet for the protection profile list */
 379             || !WPACKET_start_sub_packet_u16(pkt)) {
 380         SSLerr(SSL_F_TLS_CONSTRUCT_CTOS_USE_SRTP, ERR_R_INTERNAL_ERROR);
 381         return 0;
 382     }
 383
 384     end = sk_SRTP_PROTECTION_PROFILE_num(clnt);
 385     for (i = 0; i < end; i++) {
 386         const SRTP_PROTECTION_PROFILE *prof =
 387             sk_SRTP_PROTECTION_PROFILE_value(clnt, i);
 388
 389         if (prof == NULL || !WPACKET_put_bytes_u16(pkt, prof->id)) {
 390             SSLerr(SSL_F_TLS_CONSTRUCT_CTOS_USE_SRTP, ERR_R_INTERNAL_ERROR);
 391             return 0;
 392         }
 393     }
 394     if (!WPACKET_close(pkt)
 395                /* Add an empty use_mki value */
 396             || !WPACKET_put_bytes_u8(pkt, 0)
 397             || !WPACKET_close(pkt)) {
 398         SSLerr(SSL_F_TLS_CONSTRUCT_CTOS_USE_SRTP, ERR_R_INTERNAL_ERROR);
 399         return 0;
 400     }
 401
 402     return 1;
 403 }
 404 #endif
 405
 406 int tls_construct_ctos_etm(SSL *s, WPACKET *pkt, X509 *x, size_t chainidx,
 407                            int *al)
 408 {
 409     if (s->options & SSL_OP_NO_ENCRYPT_THEN_MAC)
 410         return 1;
 411
 412     if (!WPACKET_put_bytes_u16(pkt, TLSEXT_TYPE_encrypt_then_mac)
 413             || !WPACKET_put_bytes_u16(pkt, 0)) {
 414         SSLerr(SSL_F_TLS_CONSTRUCT_CTOS_ETM, ERR_R_INTERNAL_ERROR);
 415         return 0;
 416     }
 417
 418     return 1;
 419 }
 420
 421 #ifndef OPENSSL_NO_CT
 422 int tls_construct_ctos_sct(SSL *s, WPACKET *pkt, X509 *x, size_t chainidx,
 423                            int *al)
 424 {
 425     if (s->ct_validation_callback == NULL)
 426         return 1;
 427
 428     /* Not defined for client Certificates */
 429     if (x != NULL)
 430         return 1;
 431
 432     if (!WPACKET_put_bytes_u16(pkt, TLSEXT_TYPE_signed_certificate_timestamp)
 433             || !WPACKET_put_bytes_u16(pkt, 0)) {
 434         SSLerr(SSL_F_TLS_CONSTRUCT_CTOS_SCT, ERR_R_INTERNAL_ERROR);
 435         return 0;
 436     }
 437
 438     return 1;
 439 }
 440 #endif
 441
 442 int tls_construct_ctos_ems(SSL *s, WPACKET *pkt, X509 *x, size_t chainidx,
 443                            int *al)
 444 {
 445     if (!WPACKET_put_bytes_u16(pkt, TLSEXT_TYPE_extended_master_secret)
 446             || !WPACKET_put_bytes_u16(pkt, 0)) {
 447         SSLerr(SSL_F_TLS_CONSTRUCT_CTOS_EMS, ERR_R_INTERNAL_ERROR);
 448         return 0;
 449     }
 450
 451     return 1;
 452 }
 453
 454 int tls_construct_ctos_supported_versions(SSL *s, WPACKET *pkt, X509 *x,
 455                                           size_t chainidx, int *al)
 456 {
 457     int currv, min_version, max_version, reason;
 458
 459     if (!WPACKET_put_bytes_u16(pkt, TLSEXT_TYPE_supported_versions)
 460             || !WPACKET_start_sub_packet_u16(pkt)
 461             || !WPACKET_start_sub_packet_u8(pkt)) {
 462         SSLerr(SSL_F_TLS_CONSTRUCT_CTOS_SUPPORTED_VERSIONS,
 463                ERR_R_INTERNAL_ERROR);
 464         return 0;
 465     }
 466
 467     reason = ssl_get_client_min_max_version(s, &min_version, &max_version);
 468     if (reason != 0) {
 469         SSLerr(SSL_F_TLS_CONSTRUCT_CTOS_SUPPORTED_VERSIONS, reason);
 470         return 0;
 471     }
 472
 473     /*
 474      * TODO(TLS1.3): There is some discussion on the TLS list as to wheter
 475      * we should include versions <TLS1.2. For the moment we do. To be
 476      * reviewed later.
 477      */
 478     for (currv = max_version; currv >= min_version; currv--) {
 479         /* TODO(TLS1.3): Remove this first if clause prior to release!! */
 480         if (currv == TLS1_3_VERSION) {
 481             if (!WPACKET_put_bytes_u16(pkt, TLS1_3_VERSION_DRAFT)) {
 482                 SSLerr(SSL_F_TLS_CONSTRUCT_CTOS_SUPPORTED_VERSIONS,
 483                        ERR_R_INTERNAL_ERROR);
 484                 return 0;
 485             }
 486         } else if (!WPACKET_put_bytes_u16(pkt, currv)) {
 487             SSLerr(SSL_F_TLS_CONSTRUCT_CTOS_SUPPORTED_VERSIONS,
 488                    ERR_R_INTERNAL_ERROR);
 489             return 0;
 490         }
 491     }
 492     if (!WPACKET_close(pkt) || !WPACKET_close(pkt)) {
 493         SSLerr(SSL_F_TLS_CONSTRUCT_CTOS_SUPPORTED_VERSIONS,
 494                ERR_R_INTERNAL_ERROR);
 495         return 0;
 496     }
 497
 498     return 1;
 499 }
 500
 501 int tls_construct_ctos_key_share(SSL *s, WPACKET *pkt, X509 *x, size_t chainidx,
 502                                  int *al)
 503 {
 504 #ifndef OPENSSL_NO_TLS1_3
 505     size_t i, sharessent = 0, num_curves = 0;
 506     const unsigned char *pcurves = NULL;
 507
 508     /* key_share extension */
 509     if (!WPACKET_put_bytes_u16(pkt, TLSEXT_TYPE_key_share)
 510                /* Extension data sub-packet */
 511             || !WPACKET_start_sub_packet_u16(pkt)
 512                /* KeyShare list sub-packet */
 513             || !WPACKET_start_sub_packet_u16(pkt)) {
 514         SSLerr(SSL_F_TLS_CONSTRUCT_CTOS_KEY_SHARE, ERR_R_INTERNAL_ERROR);
 515         return 0;
 516     }
 517
 518     pcurves = s->ext.supportedgroups;
 519     if (!tls1_get_curvelist(s, 0, &pcurves, &num_curves)) {
 520         SSLerr(SSL_F_TLS_CONSTRUCT_CTOS_KEY_SHARE, ERR_R_INTERNAL_ERROR);
 521         return 0;
 522     }
 523
 524     /*
 525      * TODO(TLS1.3): Make the number of key_shares sent configurable. For
 526      * now, just send one
 527      */
 528     for (i = 0; i < num_curves && sharessent < 1; i++, pcurves += 2) {
 529         unsigned char *encodedPoint = NULL;
 530         unsigned int curve_id = 0;
 531         EVP_PKEY *key_share_key = NULL;
 532         size_t encodedlen;
 533
 534         if (!tls_curve_allowed(s, pcurves, SSL_SECOP_CURVE_SUPPORTED))
 535             continue;
 536
 537         if (s->s3->tmp.pkey != NULL) {
 538             /* Shouldn't happen! */
 539             SSLerr(SSL_F_TLS_CONSTRUCT_CTOS_KEY_SHARE, ERR_R_INTERNAL_ERROR);
 540             return 0;
 541         }
 542
 543         /* Generate a key for this key_share */
 544         curve_id = (pcurves[0] << 8) | pcurves[1];
 545         key_share_key = ssl_generate_pkey_curve(curve_id);
 546         if (key_share_key == NULL) {
 547             SSLerr(SSL_F_TLS_CONSTRUCT_CTOS_KEY_SHARE, ERR_R_EVP_LIB);
 548             return 0;
 549         }
 550
 551         /* Encode the public key. */
 552         encodedlen = EVP_PKEY_get1_tls_encodedpoint(key_share_key,
 553                                                     &encodedPoint);
 554         if (encodedlen == 0) {
 555             SSLerr(SSL_F_TLS_CONSTRUCT_CTOS_KEY_SHARE, ERR_R_EC_LIB);
 556             EVP_PKEY_free(key_share_key);
 557             return 0;
 558         }
 559
 560         /* Create KeyShareEntry */
 561         if (!WPACKET_put_bytes_u16(pkt, curve_id)
 562                 || !WPACKET_sub_memcpy_u16(pkt, encodedPoint, encodedlen)) {
 563             SSLerr(SSL_F_TLS_CONSTRUCT_CTOS_KEY_SHARE, ERR_R_INTERNAL_ERROR);
 564             EVP_PKEY_free(key_share_key);
 565             OPENSSL_free(encodedPoint);
 566             return 0;
 567         }
 568
 569         /*
 570          * TODO(TLS1.3): When changing to send more than one key_share we're
 571          * going to need to be able to save more than one EVP_PKEY. For now
 572          * we reuse the existing tmp.pkey
 573          */
 574         s->s3->group_id = curve_id;
 575         s->s3->tmp.pkey = key_share_key;
 576         sharessent++;
 577         OPENSSL_free(encodedPoint);
 578     }
 579
 580     if (!WPACKET_close(pkt) || !WPACKET_close(pkt)) {
 581         SSLerr(SSL_F_TLS_CONSTRUCT_CTOS_KEY_SHARE, ERR_R_INTERNAL_ERROR);
 582         return 0;
 583     }
 584 #endif
 585
 586     return 1;
 587 }
 588
 589 #define F5_WORKAROUND_MIN_MSG_LEN   0xff
 590 #define F5_WORKAROUND_MAX_MSG_LEN   0x200
 591
 592 int tls_construct_ctos_padding(SSL *s, WPACKET *pkt, X509 *x, size_t chainidx,
 593                                int *al)
 594 {
 595     unsigned char *padbytes;
 596     size_t hlen;
 597
 598     if ((s->options & SSL_OP_TLSEXT_PADDING) == 0)
 599         return 1;
 600
 601     /*
 602      * Add padding to workaround bugs in F5 terminators. See
 603      * https://tools.ietf.org/html/draft-agl-tls-padding-03 NB: because this
 604      * code calculates the length of all existing extensions it MUST always
 605      * appear last.
 606      */
 607     if (!WPACKET_get_total_written(pkt, &hlen)) {
 608         SSLerr(SSL_F_TLS_CONSTRUCT_CTOS_PADDING, ERR_R_INTERNAL_ERROR);
 609         return 0;
 610     }
 611
 612     if (hlen > F5_WORKAROUND_MIN_MSG_LEN && hlen < F5_WORKAROUND_MAX_MSG_LEN) {
 613         /* Calculate the amond of padding we need to add */
 614         hlen = F5_WORKAROUND_MAX_MSG_LEN - hlen;
 615
 616         /*
 617          * Take off the size of extension header itself (2 bytes for type and
 618          * 2 bytes for length bytes)
 619          */
 620         if (hlen >= 4)
 621             hlen -= 4;
 622         else
 623             hlen = 0;
 624
 625         if (!WPACKET_put_bytes_u16(pkt, TLSEXT_TYPE_padding)
 626                 || !WPACKET_sub_allocate_bytes_u16(pkt, hlen, &padbytes)) {
 627             SSLerr(SSL_F_TLS_CONSTRUCT_CTOS_PADDING, ERR_R_INTERNAL_ERROR);
 628             return 0;
 629         }
 630         memset(padbytes, 0, hlen);
 631     }
 632
 633     return 1;
 634 }
 635
 636 /*
 637  * Parse the server's renegotiation binding and abort if it's not right
 638  */
 639 int tls_parse_stoc_renegotiate(SSL *s, PACKET *pkt, X509 *x, size_t chainidx,
 640                                int *al)
 641 {
 642     size_t expected_len = s->s3->previous_client_finished_len
 643         + s->s3->previous_server_finished_len;
 644     size_t ilen;
 645     const unsigned char *data;
 646
 647     /* Check for logic errors */
 648     assert(expected_len == 0 || s->s3->previous_client_finished_len != 0);
 649     assert(expected_len == 0 || s->s3->previous_server_finished_len != 0);
 650
 651     /* Parse the length byte */
 652     if (!PACKET_get_1_len(pkt, &ilen)) {
 653         SSLerr(SSL_F_TLS_PARSE_STOC_RENEGOTIATE,
 654                SSL_R_RENEGOTIATION_ENCODING_ERR);
 655         *al = SSL_AD_ILLEGAL_PARAMETER;
 656         return 0;
 657     }
 658
 659     /* Consistency check */
 660     if (PACKET_remaining(pkt) != ilen) {
 661         SSLerr(SSL_F_TLS_PARSE_STOC_RENEGOTIATE,
 662                SSL_R_RENEGOTIATION_ENCODING_ERR);
 663         *al = SSL_AD_ILLEGAL_PARAMETER;
 664         return 0;
 665     }
 666
 667     /* Check that the extension matches */
 668     if (ilen != expected_len) {
 669         SSLerr(SSL_F_TLS_PARSE_STOC_RENEGOTIATE,
 670                SSL_R_RENEGOTIATION_MISMATCH);
 671         *al = SSL_AD_HANDSHAKE_FAILURE;
 672         return 0;
 673     }
 674
 675     if (!PACKET_get_bytes(pkt, &data, s->s3->previous_client_finished_len)
 676         || memcmp(data, s->s3->previous_client_finished,
 677                   s->s3->previous_client_finished_len) != 0) {
 678         SSLerr(SSL_F_TLS_PARSE_STOC_RENEGOTIATE,
 679                SSL_R_RENEGOTIATION_MISMATCH);
 680         *al = SSL_AD_HANDSHAKE_FAILURE;
 681         return 0;
 682     }
 683
 684     if (!PACKET_get_bytes(pkt, &data, s->s3->previous_server_finished_len)
 685         || memcmp(data, s->s3->previous_server_finished,
 686                   s->s3->previous_server_finished_len) != 0) {
 687         SSLerr(SSL_F_TLS_PARSE_STOC_RENEGOTIATE,
 688                SSL_R_RENEGOTIATION_MISMATCH);
 689         *al = SSL_AD_ILLEGAL_PARAMETER;
 690         return 0;
 691     }
 692     s->s3->send_connection_binding = 1;
 693
 694     return 1;
 695 }
 696
 697 int tls_parse_stoc_server_name(SSL *s, PACKET *pkt, X509 *x, size_t chainidx,
 698                                int *al)
 699 {
 700     if (s->ext.hostname == NULL || PACKET_remaining(pkt) > 0) {
 701         *al = SSL_AD_UNRECOGNIZED_NAME;
 702         return 0;
 703     }
 704
 705     if (!s->hit) {
 706         if (s->session->ext.hostname != NULL) {
 707             *al = SSL_AD_INTERNAL_ERROR;
 708             return 0;
 709         }
 710         s->session->ext.hostname = OPENSSL_strdup(s->ext.hostname);
 711         if (s->session->ext.hostname == NULL) {
 712             *al = SSL_AD_INTERNAL_ERROR;
 713             return 0;
 714         }
 715     }
 716
 717     return 1;
 718 }
 719
 720 #ifndef OPENSSL_NO_EC
 721 int tls_parse_stoc_ec_pt_formats(SSL *s, PACKET *pkt, X509 *x, size_t chainidx,
 722                                  int *al)
 723 {
 724     unsigned int ecpointformats_len;
 725     PACKET ecptformatlist;
 726
 727     if (!PACKET_as_length_prefixed_1(pkt, &ecptformatlist)) {
 728         *al = SSL_AD_DECODE_ERROR;
 729         return 0;
 730     }
 731     if (!s->hit) {
 732         ecpointformats_len = PACKET_remaining(&ecptformatlist);
 733         s->session->ext.ecpointformats_len = 0;
 734
 735         OPENSSL_free(s->session->ext.ecpointformats);
 736         s->session->ext.ecpointformats = OPENSSL_malloc(ecpointformats_len);
 737         if (s->session->ext.ecpointformats == NULL) {
 738             *al = SSL_AD_INTERNAL_ERROR;
 739             return 0;
 740         }
 741
 742         s->session->ext.ecpointformats_len = ecpointformats_len;
 743
 744         if (!PACKET_copy_bytes(&ecptformatlist,
 745                                s->session->ext.ecpointformats,
 746                                ecpointformats_len)) {
 747             *al = SSL_AD_INTERNAL_ERROR;
 748             return 0;
 749         }
 750     }
 751
 752     return 1;
 753 }
 754 #endif
 755
 756 int tls_parse_stoc_session_ticket(SSL *s, PACKET *pkt, X509 *x, size_t chainidx,
 757                                   int *al)
 758 {
 759     if (s->ext.session_ticket_cb != NULL &&
 760         !s->ext.session_ticket_cb(s, PACKET_data(pkt),
 761                               PACKET_remaining(pkt),
 762                               s->ext.session_ticket_cb_arg)) {
 763         *al = SSL_AD_INTERNAL_ERROR;
 764         return 0;
 765     }
 766
 767     if (!tls_use_ticket(s) || PACKET_remaining(pkt) > 0) {
 768         *al = SSL_AD_UNSUPPORTED_EXTENSION;
 769         return 0;
 770     }
 771
 772     s->ext.ticket_expected = 1;
 773
 774     return 1;
 775 }
 776
 777 #ifndef OPENSSL_NO_OCSP
 778 int tls_parse_stoc_status_request(SSL *s, PACKET *pkt, X509 *x, size_t chainidx,
 779                                   int *al)
 780 {
 781     /*
 782      * MUST only be sent if we've requested a status
 783      * request message. In TLS <= 1.2 it must also be empty.
 784      */
 785     if (s->ext.status_type == TLSEXT_STATUSTYPE_nothing
 786             || (!SSL_IS_TLS13(s) && PACKET_remaining(pkt) > 0)) {
 787         *al = SSL_AD_UNSUPPORTED_EXTENSION;
 788         return 0;
 789     }
 790
 791     if (SSL_IS_TLS13(s)) {
 792         /* We only know how to handle this if it's for the first Certificate in
 793          * the chain. We ignore any other repsonses.
 794          */
 795         if (chainidx != 0)
 796             return 1;
 797         return tls_process_cert_status_body(s, pkt, al);
 798     }
 799
 800     /* Set flag to expect CertificateStatus message */
 801     s->ext.status_expected = 1;
 802
 803     return 1;
 804 }
 805 #endif
 806
 807
 808 #ifndef OPENSSL_NO_CT
 809 int tls_parse_stoc_sct(SSL *s, PACKET *pkt, X509 *x, size_t chainidx, int *al)
 810 {
 811     /*
 812      * Only take it if we asked for it - i.e if there is no CT validation
 813      * callback set, then a custom extension MAY be processing it, so we
 814      * need to let control continue to flow to that.
 815      */
 816     if (s->ct_validation_callback != NULL) {
 817         size_t size = PACKET_remaining(pkt);
 818
 819         /* Simply copy it off for later processing */
 820         OPENSSL_free(s->ext.scts);
 821         s->ext.scts = NULL;
 822
 823         s->ext.scts_len = size;
 824         if (size > 0) {
 825             s->ext.scts = OPENSSL_malloc(size);
 826             if (s->ext.scts == NULL
 827                     || !PACKET_copy_bytes(pkt, s->ext.scts, size)) {
 828                 *al = SSL_AD_INTERNAL_ERROR;
 829                 return 0;
 830             }
 831         }
 832     } else {
 833         if (custom_ext_parse(s, 0, TLSEXT_TYPE_signed_certificate_timestamp,
 834                              PACKET_data(pkt), PACKET_remaining(pkt), al) <= 0)
 835             return 0;
 836     }
 837
 838     return 1;
 839 }
 840 #endif
 841
 842
 843 #ifndef OPENSSL_NO_NEXTPROTONEG
 844 /*
 845  * ssl_next_proto_validate validates a Next Protocol Negotiation block. No
 846  * elements of zero length are allowed and the set of elements must exactly
 847  * fill the length of the block. Returns 1 on success or 0 on failure.
 848  */
 849 static int ssl_next_proto_validate(PACKET *pkt)
 850 {
 851     PACKET tmp_protocol;
 852
 853     while (PACKET_remaining(pkt)) {
 854         if (!PACKET_get_length_prefixed_1(pkt, &tmp_protocol)
 855             || PACKET_remaining(&tmp_protocol) == 0)
 856             return 0;
 857     }
 858
 859     return 1;
 860 }
 861
 862 int tls_parse_stoc_npn(SSL *s, PACKET *pkt, X509 *x, size_t chainidx, int *al)
 863 {
 864     unsigned char *selected;
 865     unsigned char selected_len;
 866     PACKET tmppkt;
 867
 868     /* Check if we are in a renegotiation. If so ignore this extension */
 869     if (s->s3->tmp.finish_md_len != 0)
 870         return 1;
 871
 872     /* We must have requested it. */
 873     if (s->ctx->ext.npn_select_cb == NULL) {
 874         *al = SSL_AD_UNSUPPORTED_EXTENSION;
 875         return 0;
 876     }
 877
 878     /* The data must be valid */
 879     tmppkt = *pkt;
 880     if (!ssl_next_proto_validate(&tmppkt)) {
 881         *al = SSL_AD_DECODE_ERROR;
 882         return 0;
 883     }
 884     if (s->ctx->ext.npn_select_cb(s, &selected, &selected_len,
 885                                   PACKET_data(pkt),
 886                                   PACKET_remaining(pkt),
 887                                   s->ctx->ext.npn_select_cb_arg) !=
 888              SSL_TLSEXT_ERR_OK) {
 889         *al = SSL_AD_INTERNAL_ERROR;
 890         return 0;
 891     }
 892
 893     /*
 894      * Could be non-NULL if server has sent multiple NPN extensions in
 895      * a single Serverhello
 896      */
 897     OPENSSL_free(s->ext.npn);
 898     s->ext.npn = OPENSSL_malloc(selected_len);
 899     if (s->ext.npn == NULL) {
 900         *al = SSL_AD_INTERNAL_ERROR;
 901         return 0;
 902     }
 903
 904     memcpy(s->ext.npn, selected, selected_len);
 905     s->ext.npn_len = selected_len;
 906     s->s3->npn_seen = 1;
 907
 908     return 1;
 909 }
 910 #endif
 911
 912 int tls_parse_stoc_alpn(SSL *s, PACKET *pkt, X509 *x, size_t chainidx, int *al)
 913 {
 914     size_t len;
 915
 916     /* We must have requested it. */
 917     if (!s->s3->alpn_sent) {
 918         *al = SSL_AD_UNSUPPORTED_EXTENSION;
 919         return 0;
 920     }
 921     /*-
 922      * The extension data consists of:
 923      *   uint16 list_length
 924      *   uint8 proto_length;
 925      *   uint8 proto[proto_length];
 926      */
 927     if (!PACKET_get_net_2_len(pkt, &len)
 928         || PACKET_remaining(pkt) != len || !PACKET_get_1_len(pkt, &len)
 929         || PACKET_remaining(pkt) != len) {
 930         *al = SSL_AD_DECODE_ERROR;
 931         return 0;
 932     }
 933     OPENSSL_free(s->s3->alpn_selected);
 934     s->s3->alpn_selected = OPENSSL_malloc(len);
 935     if (s->s3->alpn_selected == NULL) {
 936         *al = SSL_AD_INTERNAL_ERROR;
 937         return 0;
 938     }
 939     if (!PACKET_copy_bytes(pkt, s->s3->alpn_selected, len)) {
 940         *al = SSL_AD_DECODE_ERROR;
 941         return 0;
 942     }
 943     s->s3->alpn_selected_len = len;
 944
 945     return 1;
 946 }
 947
 948 #ifndef OPENSSL_NO_SRTP
 949 int tls_parse_stoc_use_srtp(SSL *s, PACKET *pkt, X509 *x, size_t chainidx,
 950                             int *al)
 951 {
 952     unsigned int id, ct, mki;
 953     int i;
 954     STACK_OF(SRTP_PROTECTION_PROFILE) *clnt;
 955     SRTP_PROTECTION_PROFILE *prof;
 956
 957     if (!PACKET_get_net_2(pkt, &ct) || ct != 2
 958             || !PACKET_get_net_2(pkt, &id)
 959             || !PACKET_get_1(pkt, &mki)
 960             || PACKET_remaining(pkt) != 0) {
 961         SSLerr(SSL_F_TLS_PARSE_STOC_USE_SRTP,
 962                SSL_R_BAD_SRTP_PROTECTION_PROFILE_LIST);
 963         *al = SSL_AD_DECODE_ERROR;
 964         return 0;
 965     }
 966
 967     if (mki != 0) {
 968         /* Must be no MKI, since we never offer one */
 969         SSLerr(SSL_F_TLS_PARSE_STOC_USE_SRTP, SSL_R_BAD_SRTP_MKI_VALUE);
 970         *al = SSL_AD_ILLEGAL_PARAMETER;
 971         return 0;
 972     }
 973
 974     /* Throw an error if the server gave us an unsolicited extension */
 975     clnt = SSL_get_srtp_profiles(s);
 976     if (clnt == NULL) {
 977         SSLerr(SSL_F_TLS_PARSE_STOC_USE_SRTP, SSL_R_NO_SRTP_PROFILES);
 978         *al = SSL_AD_DECODE_ERROR;
 979         return 0;
 980     }
 981
 982     /*
 983      * Check to see if the server gave us something we support (and
 984      * presumably offered)
 985      */
 986     for (i = 0; i < sk_SRTP_PROTECTION_PROFILE_num(clnt); i++) {
 987         prof = sk_SRTP_PROTECTION_PROFILE_value(clnt, i);
 988
 989         if (prof->id == id) {
 990             s->srtp_profile = prof;
 991             *al = 0;
 992             return 1;
 993         }
 994     }
 995
 996     SSLerr(SSL_F_TLS_PARSE_STOC_USE_SRTP,
 997            SSL_R_BAD_SRTP_PROTECTION_PROFILE_LIST);
 998     *al = SSL_AD_DECODE_ERROR;
 999     return 0;
1000 }
1001 #endif
1002
1003 int tls_parse_stoc_etm(SSL *s, PACKET *pkt, X509 *x, size_t chainidx, int *al)
1004 {
1005     /* Ignore if inappropriate ciphersuite */
1006     if (!(s->options & SSL_OP_NO_ENCRYPT_THEN_MAC)
1007             && s->s3->tmp.new_cipher->algorithm_mac != SSL_AEAD
1008             && s->s3->tmp.new_cipher->algorithm_enc != SSL_RC4)
1009         s->s3->flags |= TLS1_FLAGS_ENCRYPT_THEN_MAC;
1010
1011     return 1;
1012 }
1013
1014 int tls_parse_stoc_ems(SSL *s, PACKET *pkt, X509 *x, size_t chainidx, int *al)
1015 {
1016     s->s3->flags |= TLS1_FLAGS_RECEIVED_EXTMS;
1017     if (!s->hit)
1018         s->session->flags |= SSL_SESS_FLAG_EXTMS;
1019
1020     return 1;
1021 }
1022
1023 int tls_parse_stoc_key_share(SSL *s, PACKET *pkt, X509 *x, size_t chainidx,
1024                              int *al)
1025 {
1026 #ifndef OPENSSL_NO_TLS1_3
1027     unsigned int group_id;
1028     PACKET encoded_pt;
1029     EVP_PKEY *ckey = s->s3->tmp.pkey, *skey = NULL;
1030
1031     /* Sanity check */
1032     if (ckey == NULL) {
1033         *al = SSL_AD_INTERNAL_ERROR;
1034         SSLerr(SSL_F_TLS_PARSE_STOC_KEY_SHARE, ERR_R_INTERNAL_ERROR);
1035         return 0;
1036     }
1037
1038     if (!PACKET_get_net_2(pkt, &group_id)) {
1039         *al = SSL_AD_HANDSHAKE_FAILURE;
1040         SSLerr(SSL_F_TLS_PARSE_STOC_KEY_SHARE, SSL_R_LENGTH_MISMATCH);
1041         return 0;
1042     }
1043
1044     if (group_id != s->s3->group_id) {
1045         /*
1046          * This isn't for the group that we sent in the original
1047          * key_share!
1048          */
1049         *al = SSL_AD_HANDSHAKE_FAILURE;
1050         SSLerr(SSL_F_TLS_PARSE_STOC_KEY_SHARE, SSL_R_BAD_KEY_SHARE);
1051         return 0;
1052     }
1053
1054     if (!PACKET_as_length_prefixed_2(pkt, &encoded_pt)
1055             || PACKET_remaining(&encoded_pt) == 0) {
1056         *al = SSL_AD_DECODE_ERROR;
1057         SSLerr(SSL_F_TLS_PARSE_STOC_KEY_SHARE, SSL_R_LENGTH_MISMATCH);
1058         return 0;
1059     }
1060
1061     skey = ssl_generate_pkey(ckey);
1062     if (skey == NULL) {
1063         *al = SSL_AD_INTERNAL_ERROR;
1064         SSLerr(SSL_F_TLS_PARSE_STOC_KEY_SHARE, ERR_R_MALLOC_FAILURE);
1065         return 0;
1066     }
1067     if (!EVP_PKEY_set1_tls_encodedpoint(skey, PACKET_data(&encoded_pt),
1068                                         PACKET_remaining(&encoded_pt))) {
1069         *al = SSL_AD_DECODE_ERROR;
1070         SSLerr(SSL_F_TLS_PARSE_STOC_KEY_SHARE, SSL_R_BAD_ECPOINT);
1071         EVP_PKEY_free(skey);
1072         return 0;
1073     }
1074
1075     if (ssl_derive(s, ckey, skey, 1) == 0) {
1076         *al = SSL_AD_INTERNAL_ERROR;
1077         SSLerr(SSL_F_TLS_PARSE_STOC_KEY_SHARE, ERR_R_INTERNAL_ERROR);
1078         EVP_PKEY_free(skey);
1079         return 0;
1080     }
1081     EVP_PKEY_free(skey);
1082 #endif
1083
1084     return 1;
1085 }