crypto/openssl/ssl/t1_lib.c

   1 /* ssl/t1_lib.c */
   2 /* Copyright (C) 1995-1998 Eric Young (eay@cryptsoft.com)
   3  * All rights reserved.
   4  *
   5  * This package is an SSL implementation written
   6  * by Eric Young (eay@cryptsoft.com).
   7  * The implementation was written so as to conform with Netscapes SSL.
   8  *
   9  * This library is free for commercial and non-commercial use as long as
  10  * the following conditions are aheared to.  The following conditions
  11  * apply to all code found in this distribution, be it the RC4, RSA,
  12  * lhash, DES, etc., code; not just the SSL code.  The SSL documentation
  13  * included with this distribution is covered by the same copyright terms
  14  * except that the holder is Tim Hudson (tjh@cryptsoft.com).
  15  *
  16  * Copyright remains Eric Young's, and as such any Copyright notices in
  17  * the code are not to be removed.
  18  * If this package is used in a product, Eric Young should be given attribution
  19  * as the author of the parts of the library used.
  20  * This can be in the form of a textual message at program startup or
  21  * in documentation (online or textual) provided with the package.
  22  *
  23  * Redistribution and use in source and binary forms, with or without
  24  * modification, are permitted provided that the following conditions
  25  * are met:
  26  * 1. Redistributions of source code must retain the copyright
  27  *    notice, this list of conditions and the following disclaimer.
  28  * 2. Redistributions in binary form must reproduce the above copyright
  29  *    notice, this list of conditions and the following disclaimer in the
  30  *    documentation and/or other materials provided with the distribution.
  31  * 3. All advertising materials mentioning features or use of this software
  32  *    must display the following acknowledgement:
  33  *    "This product includes cryptographic software written by
  34  *     Eric Young (eay@cryptsoft.com)"
  35  *    The word 'cryptographic' can be left out if the rouines from the library
  36  *    being used are not cryptographic related :-).
  37  * 4. If you include any Windows specific code (or a derivative thereof) from
  38  *    the apps directory (application code) you must include an acknowledgement:
  39  *    "This product includes software written by Tim Hudson (tjh@cryptsoft.com)"
  40  *
  41  * THIS SOFTWARE IS PROVIDED BY ERIC YOUNG ``AS IS'' AND
  42  * ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
  43  * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE
  44  * ARE DISCLAIMED.  IN NO EVENT SHALL THE AUTHOR OR CONTRIBUTORS BE LIABLE
  45  * FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL
  46  * DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS
  47  * OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION)
  48  * HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT
  49  * LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY
  50  * OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF
  51  * SUCH DAMAGE.
  52  *
  53  * The licence and distribution terms for any publically available version or
  54  * derivative of this code cannot be changed.  i.e. this code cannot simply be
  55  * copied and put under another distribution licence
  56  * [including the GNU Public Licence.]
  57  */
  58
  59 #include <stdio.h>
  60 #include <openssl/objects.h>
  61 #include <openssl/evp.h>
  62 #include <openssl/hmac.h>
  63 #include <openssl/ocsp.h>
  64 #include "ssl_locl.h"
  65
  66 const char tls1_version_str[]="TLSv1" OPENSSL_VERSION_PTEXT;
  67
  68 #ifndef OPENSSL_NO_TLSEXT
  69 static int tls_decrypt_ticket(SSL *s, const unsigned char *tick, int ticklen,
  70                                 const unsigned char *sess_id, int sesslen,
  71                                 SSL_SESSION **psess);
  72 #endif
  73
  74 SSL3_ENC_METHOD TLSv1_enc_data={
  75         tls1_enc,
  76         tls1_mac,
  77         tls1_setup_key_block,
  78         tls1_generate_master_secret,
  79         tls1_change_cipher_state,
  80         tls1_final_finish_mac,
  81         TLS1_FINISH_MAC_LENGTH,
  82         tls1_cert_verify_mac,
  83         TLS_MD_CLIENT_FINISH_CONST,TLS_MD_CLIENT_FINISH_CONST_SIZE,
  84         TLS_MD_SERVER_FINISH_CONST,TLS_MD_SERVER_FINISH_CONST_SIZE,
  85         tls1_alert_code,
  86         };
  87
  88 long tls1_default_timeout(void)
  89         {
  90         /* 2 hours, the 24 hours mentioned in the TLSv1 spec
  91          * is way too long for http, the cache would over fill */
  92         return(60*60*2);
  93         }
  94
  95 IMPLEMENT_tls1_meth_func(tlsv1_base_method,
  96                         ssl_undefined_function,
  97                         ssl_undefined_function,
  98                         ssl_bad_method)
  99
 100 int tls1_new(SSL *s)
 101         {
 102         if (!ssl3_new(s)) return(0);
 103         s->method->ssl_clear(s);
 104         return(1);
 105         }
 106
 107 void tls1_free(SSL *s)
 108         {
 109         ssl3_free(s);
 110         }
 111
 112 void tls1_clear(SSL *s)
 113         {
 114         ssl3_clear(s);
 115         s->version=TLS1_VERSION;
 116         }
 117
 118 #if 0
 119 long tls1_ctrl(SSL *s, int cmd, long larg, char *parg)
 120         {
 121         return(0);
 122         }
 123
 124 long tls1_callback_ctrl(SSL *s, int cmd, void *(*fp)())
 125         {
 126         return(0);
 127         }
 128 #endif
 129
 130 #ifndef OPENSSL_NO_TLSEXT
 131 unsigned char *ssl_add_clienthello_tlsext(SSL *s, unsigned char *p, unsigned char *limit)
 132         {
 133         int extdatalen=0;
 134         unsigned char *ret = p;
 135
 136         ret+=2;
 137
 138         if (ret>=limit) return NULL; /* this really never occurs, but ... */
 139
 140         if (s->tlsext_hostname != NULL)
 141                 {
 142                 /* Add TLS extension servername to the Client Hello message */
 143                 unsigned long size_str;
 144                 long lenmax;
 145
 146                 /* check for enough space.
 147                    4 for the servername type and entension length
 148                    2 for servernamelist length
 149                    1 for the hostname type
 150                    2 for hostname length
 151                    + hostname length
 152                 */
 153
 154                 if ((lenmax = limit - ret - 9) < 0
 155                 || (size_str = strlen(s->tlsext_hostname)) > (unsigned long)lenmax)
 156                         return NULL;
 157
 158                 /* extension type and length */
 159                 s2n(TLSEXT_TYPE_server_name,ret);
 160                 s2n(size_str+5,ret);
 161
 162                 /* length of servername list */
 163                 s2n(size_str+3,ret);
 164
 165                 /* hostname type, length and hostname */
 166                 *(ret++) = (unsigned char) TLSEXT_NAMETYPE_host_name;
 167                 s2n(size_str,ret);
 168                 memcpy(ret, s->tlsext_hostname, size_str);
 169                 ret+=size_str;
 170
 171                 }
 172
 173         if (!(SSL_get_options(s) & SSL_OP_NO_TICKET))
 174                 {
 175                 int ticklen;
 176                 if (s->session && s->session->tlsext_tick)
 177                         ticklen = s->session->tlsext_ticklen;
 178                 else
 179                         ticklen = 0;
 180                 /* Check for enough room 2 for extension type, 2 for len
 181                  * rest for ticket
 182                  */
 183                 if (limit - ret - 4 - ticklen < 0)
 184                         return NULL;
 185                 s2n(TLSEXT_TYPE_session_ticket,ret);
 186                 s2n(ticklen,ret);
 187                 if (ticklen)
 188                         {
 189                         memcpy(ret, s->session->tlsext_tick, ticklen);
 190                         ret += ticklen;
 191                         }
 192                 }
 193
 194         if (s->tlsext_status_type == TLSEXT_STATUSTYPE_ocsp)
 195                 {
 196                 int i;
 197                 long extlen, idlen, itmp;
 198                 OCSP_RESPID *id;
 199
 200                 idlen = 0;
 201                 for (i = 0; i < sk_OCSP_RESPID_num(s->tlsext_ocsp_ids); i++)
 202                         {
 203                         id = sk_OCSP_RESPID_value(s->tlsext_ocsp_ids, i);
 204                         itmp = i2d_OCSP_RESPID(id, NULL);
 205                         if (itmp <= 0)
 206                                 return NULL;
 207                         idlen += itmp + 2;
 208                         }
 209
 210                 if (s->tlsext_ocsp_exts)
 211                         {
 212                         extlen = i2d_X509_EXTENSIONS(s->tlsext_ocsp_exts, NULL);
 213                         if (extlen < 0)
 214                                 return NULL;
 215                         }
 216                 else
 217                         extlen = 0;
 218
 219                 if ((long)(limit - ret - 7 - extlen - idlen) < 0) return NULL;
 220                 s2n(TLSEXT_TYPE_status_request, ret);
 221                 if (extlen + idlen > 0xFFF0)
 222                         return NULL;
 223                 s2n(extlen + idlen + 5, ret);
 224                 *(ret++) = TLSEXT_STATUSTYPE_ocsp;
 225                 s2n(idlen, ret);
 226                 for (i = 0; i < sk_OCSP_RESPID_num(s->tlsext_ocsp_ids); i++)
 227                         {
 228                         /* save position of id len */
 229                         unsigned char *q = ret;
 230                         id = sk_OCSP_RESPID_value(s->tlsext_ocsp_ids, i);
 231                         /* skip over id len */
 232                         ret += 2;
 233                         itmp = i2d_OCSP_RESPID(id, &ret);
 234                         /* write id len */
 235                         s2n(itmp, q);
 236                         }
 237                 s2n(extlen, ret);
 238                 if (extlen > 0)
 239                         i2d_X509_EXTENSIONS(s->tlsext_ocsp_exts, &ret);
 240                 }
 241
 242         if ((extdatalen = ret-p-2)== 0)
 243                 return p;
 244
 245         s2n(extdatalen,p);
 246         return ret;
 247         }
 248
 249 unsigned char *ssl_add_serverhello_tlsext(SSL *s, unsigned char *p, unsigned char *limit)
 250         {
 251         int extdatalen=0;
 252         unsigned char *ret = p;
 253
 254         ret+=2;
 255         if (ret>=limit) return NULL; /* this really never occurs, but ... */
 256
 257         if (!s->hit && s->servername_done == 1 && s->session->tlsext_hostname != NULL)
 258                 {
 259                 if (limit - ret - 4 < 0) return NULL;
 260
 261                 s2n(TLSEXT_TYPE_server_name,ret);
 262                 s2n(0,ret);
 263                 }
 264
 265         if (s->tlsext_ticket_expected
 266                 && !(SSL_get_options(s) & SSL_OP_NO_TICKET))
 267                 {
 268                 if (limit - ret - 4 < 0) return NULL;
 269                 s2n(TLSEXT_TYPE_session_ticket,ret);
 270                 s2n(0,ret);
 271                 }
 272
 273         if (s->tlsext_status_expected)
 274                 {
 275                 if ((long)(limit - ret - 4) < 0) return NULL;
 276                 s2n(TLSEXT_TYPE_status_request,ret);
 277                 s2n(0,ret);
 278                 }
 279
 280         if ((extdatalen = ret-p-2)== 0)
 281                 return p;
 282
 283         s2n(extdatalen,p);
 284         return ret;
 285         }
 286
 287 int ssl_parse_clienthello_tlsext(SSL *s, unsigned char **p, unsigned char *d, int n, int *al)
 288         {
 289         unsigned short type;
 290         unsigned short size;
 291         unsigned short len;
 292         unsigned char *data = *p;
 293         s->servername_done = 0;
 294         s->tlsext_status_type = -1;
 295
 296         if (data >= (d+n-2))
 297                 return 1;
 298         n2s(data,len);
 299
 300         if (data > (d+n-len))
 301                 return 1;
 302
 303         while (data <= (d+n-4))
 304                 {
 305                 n2s(data,type);
 306                 n2s(data,size);
 307
 308                 if (data+size > (d+n))
 309                         return 1;
 310
 311                 if (s->tlsext_debug_cb)
 312                         s->tlsext_debug_cb(s, 0, type, data, size,
 313                                                 s->tlsext_debug_arg);
 314 /* The servername extension is treated as follows:
 315
 316    - Only the hostname type is supported with a maximum length of 255.
 317    - The servername is rejected if too long or if it contains zeros,
 318      in which case an fatal alert is generated.
 319    - The servername field is maintained together with the session cache.
 320    - When a session is resumed, the servername call back invoked in order
 321      to allow the application to position itself to the right context.
 322    - The servername is acknowledged if it is new for a session or when
 323      it is identical to a previously used for the same session.
 324      Applications can control the behaviour.  They can at any time
 325      set a 'desirable' servername for a new SSL object. This can be the
 326      case for example with HTTPS when a Host: header field is received and
 327      a renegotiation is requested. In this case, a possible servername
 328      presented in the new client hello is only acknowledged if it matches
 329      the value of the Host: field.
 330    - Applications must  use SSL_OP_NO_SESSION_RESUMPTION_ON_RENEGOTIATION
 331      if they provide for changing an explicit servername context for the session,
 332      i.e. when the session has been established with a servername extension.
 333    - On session reconnect, the servername extension may be absent.
 334
 335 */
 336
 337                 if (type == TLSEXT_TYPE_server_name)
 338                         {
 339                         unsigned char *sdata;
 340                         int servname_type;
 341                         int dsize;
 342
 343                         if (size < 2)
 344                                 {
 345                                 *al = SSL_AD_DECODE_ERROR;
 346                                 return 0;
 347                                 }
 348                         n2s(data,dsize);
 349                         size -= 2;
 350                         if (dsize > size  )
 351                                 {
 352                                 *al = SSL_AD_DECODE_ERROR;
 353                                 return 0;
 354                                 }
 355
 356                         sdata = data;
 357                         while (dsize > 3)
 358                                 {
 359                                 servname_type = *(sdata++);
 360                                 n2s(sdata,len);
 361                                 dsize -= 3;
 362
 363                                 if (len > dsize)
 364                                         {
 365                                         *al = SSL_AD_DECODE_ERROR;
 366                                         return 0;
 367                                         }
 368                                 if (s->servername_done == 0)
 369                                 switch (servname_type)
 370                                         {
 371                                 case TLSEXT_NAMETYPE_host_name:
 372                                         if (!s->hit)
 373                                                 {
 374                                                 if(s->session->tlsext_hostname)
 375                                                         {
 376                                                         *al = SSL_AD_DECODE_ERROR;
 377                                                         return 0;
 378                                                         }
 379                                                 if (len > TLSEXT_MAXLEN_host_name)
 380                                                         {
 381                                                         *al = TLS1_AD_UNRECOGNIZED_NAME;
 382                                                         return 0;
 383                                                         }
 384                                                 if ((s->session->tlsext_hostname = OPENSSL_malloc(len+1)) == NULL)
 385                                                         {
 386                                                         *al = TLS1_AD_INTERNAL_ERROR;
 387                                                         return 0;
 388                                                         }
 389                                                 memcpy(s->session->tlsext_hostname, sdata, len);
 390                                                 s->session->tlsext_hostname[len]='\0';
 391                                                 if (strlen(s->session->tlsext_hostname) != len) {
 392                                                         OPENSSL_free(s->session->tlsext_hostname);
 393                                                         s->session->tlsext_hostname = NULL;
 394                                                         *al = TLS1_AD_UNRECOGNIZED_NAME;
 395                                                         return 0;
 396                                                 }
 397                                                 s->servername_done = 1;
 398
 399                                                 }
 400                                         else
 401                                                 s->servername_done = s->session->tlsext_hostname
 402                                                         && strlen(s->session->tlsext_hostname) == len
 403                                                         && strncmp(s->session->tlsext_hostname, (char *)sdata, len) == 0;
 404
 405                                         break;
 406
 407                                 default:
 408                                         break;
 409                                         }
 410
 411                                 dsize -= len;
 412                                 }
 413                         if (dsize != 0)
 414                                 {
 415                                 *al = SSL_AD_DECODE_ERROR;
 416                                 return 0;
 417                                 }
 418
 419                         }
 420                 else if (type == TLSEXT_TYPE_status_request
 421                                                 && s->ctx->tlsext_status_cb)
 422                         {
 423
 424                         if (size < 5)
 425                                 {
 426                                 *al = SSL_AD_DECODE_ERROR;
 427                                 return 0;
 428                                 }
 429
 430                         s->tlsext_status_type = *data++;
 431                         size--;
 432                         if (s->tlsext_status_type == TLSEXT_STATUSTYPE_ocsp)
 433                                 {
 434                                 const unsigned char *sdata;
 435                                 int dsize;
 436                                 /* Read in responder_id_list */
 437                                 n2s(data,dsize);
 438                                 size -= 2;
 439                                 if (dsize > size  )
 440                                         {
 441                                         *al = SSL_AD_DECODE_ERROR;
 442                                         return 0;
 443                                         }
 444                                 while (dsize > 0)
 445                                         {
 446                                         OCSP_RESPID *id;
 447                                         int idsize;
 448                                         if (dsize < 4)
 449                                                 {
 450                                                 *al = SSL_AD_DECODE_ERROR;
 451                                                 return 0;
 452                                                 }
 453                                         n2s(data, idsize);
 454                                         dsize -= 2 + idsize;
 455                                         if (dsize < 0)
 456                                                 {
 457                                                 *al = SSL_AD_DECODE_ERROR;
 458                                                 return 0;
 459                                                 }
 460                                         sdata = data;
 461                                         data += idsize;
 462                                         id = d2i_OCSP_RESPID(NULL,
 463                                                                 &sdata, idsize);
 464                                         if (!id)
 465                                                 {
 466                                                 *al = SSL_AD_DECODE_ERROR;
 467                                                 return 0;
 468                                                 }
 469                                         if (data != sdata)
 470                                                 {
 471                                                 OCSP_RESPID_free(id);
 472                                                 *al = SSL_AD_DECODE_ERROR;
 473                                                 return 0;
 474                                                 }
 475                                         if (!s->tlsext_ocsp_ids
 476                                                 && !(s->tlsext_ocsp_ids =
 477                                                 sk_OCSP_RESPID_new_null()))
 478                                                 {
 479                                                 OCSP_RESPID_free(id);
 480                                                 *al = SSL_AD_INTERNAL_ERROR;
 481                                                 return 0;
 482                                                 }
 483                                         if (!sk_OCSP_RESPID_push(
 484                                                         s->tlsext_ocsp_ids, id))
 485                                                 {
 486                                                 OCSP_RESPID_free(id);
 487                                                 *al = SSL_AD_INTERNAL_ERROR;
 488                                                 return 0;
 489                                                 }
 490                                         }
 491
 492                                 /* Read in request_extensions */
 493                                 n2s(data,dsize);
 494                                 size -= 2;
 495                                 if (dsize > size)
 496                                         {
 497                                         *al = SSL_AD_DECODE_ERROR;
 498                                         return 0;
 499                                         }
 500                                 sdata = data;
 501                                 if (dsize > 0)
 502                                         {
 503                                         s->tlsext_ocsp_exts =
 504                                                 d2i_X509_EXTENSIONS(NULL,
 505                                                         &sdata, dsize);
 506                                         if (!s->tlsext_ocsp_exts
 507                                                 || (data + dsize != sdata))
 508                                                 {
 509                                                 *al = SSL_AD_DECODE_ERROR;
 510                                                 return 0;
 511                                                 }
 512                                         }
 513                                 }
 514                                 /* We don't know what to do with any other type
 515                                 * so ignore it.
 516                                 */
 517                                 else
 518                                         s->tlsext_status_type = -1;
 519                         }
 520                 /* session ticket processed earlier */
 521
 522                 data+=size;
 523                 }
 524
 525         *p = data;
 526         return 1;
 527         }
 528
 529 int ssl_parse_serverhello_tlsext(SSL *s, unsigned char **p, unsigned char *d, int n, int *al)
 530         {
 531         unsigned short type;
 532         unsigned short size;
 533         unsigned short len;
 534         unsigned char *data = *p;
 535
 536         int tlsext_servername = 0;
 537
 538         if (data >= (d+n-2))
 539                 return 1;
 540
 541         n2s(data,len);
 542
 543         while(data <= (d+n-4))
 544                 {
 545                 n2s(data,type);
 546                 n2s(data,size);
 547
 548                 if (data+size > (d+n))
 549                         return 1;
 550
 551                 if (s->tlsext_debug_cb)
 552                         s->tlsext_debug_cb(s, 1, type, data, size,
 553                                                 s->tlsext_debug_arg);
 554
 555                 if (type == TLSEXT_TYPE_server_name)
 556                         {
 557                         if (s->tlsext_hostname == NULL || size > 0)
 558                                 {
 559                                 *al = TLS1_AD_UNRECOGNIZED_NAME;
 560                                 return 0;
 561                                 }
 562                         tlsext_servername = 1;
 563                         }
 564                 else if (type == TLSEXT_TYPE_session_ticket)
 565                         {
 566                         if ((SSL_get_options(s) & SSL_OP_NO_TICKET)
 567                                 || (size > 0))
 568                                 {
 569                                 *al = TLS1_AD_UNSUPPORTED_EXTENSION;
 570                                 return 0;
 571                                 }
 572                         s->tlsext_ticket_expected = 1;
 573                         }
 574                 else if (type == TLSEXT_TYPE_status_request)
 575                         {
 576                         /* MUST be empty and only sent if we've requested
 577                          * a status request message.
 578                          */
 579                         if ((s->tlsext_status_type == -1) || (size > 0))
 580                                 {
 581                                 *al = TLS1_AD_UNSUPPORTED_EXTENSION;
 582                                 return 0;
 583                                 }
 584                         /* Set flag to expect CertificateStatus message */
 585                         s->tlsext_status_expected = 1;
 586                         }
 587
 588                 data+=size;
 589                 }
 590
 591         if (data != d+n)
 592                 {
 593                 *al = SSL_AD_DECODE_ERROR;
 594                 return 0;
 595                 }
 596
 597         if (!s->hit && tlsext_servername == 1)
 598                 {
 599                 if (s->tlsext_hostname)
 600                         {
 601                         if (s->session->tlsext_hostname == NULL)
 602                                 {
 603                                 s->session->tlsext_hostname = BUF_strdup(s->tlsext_hostname);
 604                                 if (!s->session->tlsext_hostname)
 605                                         {
 606                                         *al = SSL_AD_UNRECOGNIZED_NAME;
 607                                         return 0;
 608                                         }
 609                                 }
 610                         else
 611                                 {
 612                                 *al = SSL_AD_DECODE_ERROR;
 613                                 return 0;
 614                                 }
 615                         }
 616                 }
 617
 618         *p = data;
 619         return 1;
 620         }
 621
 622 int ssl_check_clienthello_tlsext(SSL *s)
 623         {
 624         int ret=SSL_TLSEXT_ERR_NOACK;
 625         int al = SSL_AD_UNRECOGNIZED_NAME;
 626
 627         if (s->ctx != NULL && s->ctx->tlsext_servername_callback != 0)
 628                 ret = s->ctx->tlsext_servername_callback(s, &al, s->ctx->tlsext_servername_arg);
 629         else if (s->initial_ctx != NULL && s->initial_ctx->tlsext_servername_callback != 0)
 630                 ret = s->initial_ctx->tlsext_servername_callback(s, &al, s->initial_ctx->tlsext_servername_arg);
 631
 632         /* If status request then ask callback what to do.
 633          * Note: this must be called after servername callbacks in case
 634          * the certificate has changed.
 635          */
 636         if ((s->tlsext_status_type != -1) && s->ctx->tlsext_status_cb)
 637                 {
 638                 int r;
 639                 r = s->ctx->tlsext_status_cb(s, s->ctx->tlsext_status_arg);
 640                 switch (r)
 641                         {
 642                         /* We don't want to send a status request response */
 643                         case SSL_TLSEXT_ERR_NOACK:
 644                                 s->tlsext_status_expected = 0;
 645                                 break;
 646                         /* status request response should be sent */
 647                         case SSL_TLSEXT_ERR_OK:
 648                                 if (s->tlsext_ocsp_resp)
 649                                         s->tlsext_status_expected = 1;
 650                                 else
 651                                         s->tlsext_status_expected = 0;
 652                                 break;
 653                         /* something bad happened */
 654                         case SSL_TLSEXT_ERR_ALERT_FATAL:
 655                                 ret = SSL_TLSEXT_ERR_ALERT_FATAL;
 656                                 al = SSL_AD_INTERNAL_ERROR;
 657                                 goto err;
 658                         }
 659                 }
 660         else
 661                 s->tlsext_status_expected = 0;
 662         err:
 663         switch (ret)
 664                 {
 665                 case SSL_TLSEXT_ERR_ALERT_FATAL:
 666                         ssl3_send_alert(s,SSL3_AL_FATAL,al);
 667                         return -1;
 668
 669                 case SSL_TLSEXT_ERR_ALERT_WARNING:
 670                         ssl3_send_alert(s,SSL3_AL_WARNING,al);
 671                         return 1;
 672
 673                 case SSL_TLSEXT_ERR_NOACK:
 674                         s->servername_done=0;
 675                         default:
 676                 return 1;
 677                 }
 678         }
 679
 680 int ssl_check_serverhello_tlsext(SSL *s)
 681         {
 682         int ret=SSL_TLSEXT_ERR_NOACK;
 683         int al = SSL_AD_UNRECOGNIZED_NAME;
 684
 685         if (s->ctx != NULL && s->ctx->tlsext_servername_callback != 0)
 686                 ret = s->ctx->tlsext_servername_callback(s, &al, s->ctx->tlsext_servername_arg);
 687         else if (s->initial_ctx != NULL && s->initial_ctx->tlsext_servername_callback != 0)
 688                 ret = s->initial_ctx->tlsext_servername_callback(s, &al, s->initial_ctx->tlsext_servername_arg);
 689
 690         /* If we've requested certificate status and we wont get one
 691          * tell the callback
 692          */
 693         if ((s->tlsext_status_type != -1) && !(s->tlsext_status_expected)
 694                         && s->ctx->tlsext_status_cb)
 695                 {
 696                 int r;
 697                 /* Set resp to NULL, resplen to -1 so callback knows
 698                  * there is no response.
 699                  */
 700                 if (s->tlsext_ocsp_resp)
 701                         {
 702                         OPENSSL_free(s->tlsext_ocsp_resp);
 703                         s->tlsext_ocsp_resp = NULL;
 704                         }
 705                 s->tlsext_ocsp_resplen = -1;
 706                 r = s->ctx->tlsext_status_cb(s, s->ctx->tlsext_status_arg);
 707                 if (r == 0)
 708                         {
 709                         al = SSL_AD_BAD_CERTIFICATE_STATUS_RESPONSE;
 710                         ret = SSL_TLSEXT_ERR_ALERT_FATAL;
 711                         }
 712                 if (r < 0)
 713                         {
 714                         al = SSL_AD_INTERNAL_ERROR;
 715                         ret = SSL_TLSEXT_ERR_ALERT_FATAL;
 716                         }
 717                 }
 718
 719         switch (ret)
 720                 {
 721                 case SSL_TLSEXT_ERR_ALERT_FATAL:
 722                         ssl3_send_alert(s,SSL3_AL_FATAL,al);
 723                         return -1;
 724
 725                 case SSL_TLSEXT_ERR_ALERT_WARNING:
 726                         ssl3_send_alert(s,SSL3_AL_WARNING,al);
 727                         return 1;
 728
 729                 case SSL_TLSEXT_ERR_NOACK:
 730                         s->servername_done=0;
 731                         default:
 732                 return 1;
 733                 }
 734         }
 735
 736 /* Since the server cache lookup is done early on in the processing of client
 737  * hello and other operations depend on the result we need to handle any TLS
 738  * session ticket extension at the same time.
 739  */
 740
 741 int tls1_process_ticket(SSL *s, unsigned char *session_id, int len,
 742                                 const unsigned char *limit, SSL_SESSION **ret)
 743         {
 744         /* Point after session ID in client hello */
 745         const unsigned char *p = session_id + len;
 746         unsigned short i;
 747
 748         /* If tickets disabled behave as if no ticket present
 749          * to permit stateful resumption.
 750          */
 751         if (SSL_get_options(s) & SSL_OP_NO_TICKET)
 752                 return 1;
 753
 754         if ((s->version <= SSL3_VERSION) || !limit)
 755                 return 1;
 756         if (p >= limit)
 757                 return -1;
 758         /* Skip past cipher list */
 759         n2s(p, i);
 760         p+= i;
 761         if (p >= limit)
 762                 return -1;
 763         /* Skip past compression algorithm list */
 764         i = *(p++);
 765         p += i;
 766         if (p > limit)
 767                 return -1;
 768         /* Now at start of extensions */
 769         if ((p + 2) >= limit)
 770                 return 1;
 771         n2s(p, i);
 772         while ((p + 4) <= limit)
 773                 {
 774                 unsigned short type, size;
 775                 n2s(p, type);
 776                 n2s(p, size);
 777                 if (p + size > limit)
 778                         return 1;
 779                 if (type == TLSEXT_TYPE_session_ticket)
 780                         {
 781                         /* If zero length note client will accept a ticket
 782                          * and indicate cache miss to trigger full handshake
 783                          */
 784                         if (size == 0)
 785                                 {
 786                                 s->tlsext_ticket_expected = 1;
 787                                 return 0;       /* Cache miss */
 788                                 }
 789                         return tls_decrypt_ticket(s, p, size, session_id, len,
 790                                                                         ret);
 791                         }
 792                 p += size;
 793                 }
 794         return 1;
 795         }
 796
 797 static int tls_decrypt_ticket(SSL *s, const unsigned char *etick, int eticklen,
 798                                 const unsigned char *sess_id, int sesslen,
 799                                 SSL_SESSION **psess)
 800         {
 801         SSL_SESSION *sess;
 802         unsigned char *sdec;
 803         const unsigned char *p;
 804         int slen, mlen, renew_ticket = 0;
 805         unsigned char tick_hmac[EVP_MAX_MD_SIZE];
 806         HMAC_CTX hctx;
 807         EVP_CIPHER_CTX ctx;
 808         /* Need at least keyname + iv + some encrypted data */
 809         if (eticklen < 48)
 810                 goto tickerr;
 811         /* Initialize session ticket encryption and HMAC contexts */
 812         HMAC_CTX_init(&hctx);
 813         EVP_CIPHER_CTX_init(&ctx);
 814         if (s->ctx->tlsext_ticket_key_cb)
 815                 {
 816                 unsigned char *nctick = (unsigned char *)etick;
 817                 int rv = s->ctx->tlsext_ticket_key_cb(s, nctick, nctick + 16,
 818                                                         &ctx, &hctx, 0);
 819                 if (rv < 0)
 820                         return -1;
 821                 if (rv == 0)
 822                         goto tickerr;
 823                 if (rv == 2)
 824                         renew_ticket = 1;
 825                 }
 826         else
 827                 {
 828                 /* Check key name matches */
 829                 if (memcmp(etick, s->ctx->tlsext_tick_key_name, 16))
 830                         goto tickerr;
 831                 HMAC_Init_ex(&hctx, s->ctx->tlsext_tick_hmac_key, 16,
 832                                         tlsext_tick_md(), NULL);
 833                 EVP_DecryptInit_ex(&ctx, EVP_aes_128_cbc(), NULL,
 834                                 s->ctx->tlsext_tick_aes_key, etick + 16);
 835                 }
 836         /* Attempt to process session ticket, first conduct sanity and
 837          * integrity checks on ticket.
 838          */
 839         mlen = HMAC_size(&hctx);
 840         eticklen -= mlen;
 841         /* Check HMAC of encrypted ticket */
 842         HMAC_Update(&hctx, etick, eticklen);
 843         HMAC_Final(&hctx, tick_hmac, NULL);
 844         HMAC_CTX_cleanup(&hctx);
 845         if (memcmp(tick_hmac, etick + eticklen, mlen))
 846                 goto tickerr;
 847         /* Attempt to decrypt session data */
 848         /* Move p after IV to start of encrypted ticket, update length */
 849         p = etick + 16 + EVP_CIPHER_CTX_iv_length(&ctx);
 850         eticklen -= 16 + EVP_CIPHER_CTX_iv_length(&ctx);
 851         sdec = OPENSSL_malloc(eticklen);
 852         if (!sdec)
 853                 {
 854                 EVP_CIPHER_CTX_cleanup(&ctx);
 855                 return -1;
 856                 }
 857         EVP_DecryptUpdate(&ctx, sdec, &slen, p, eticklen);
 858         if (EVP_DecryptFinal(&ctx, sdec + slen, &mlen) <= 0)
 859                 goto tickerr;
 860         slen += mlen;
 861         EVP_CIPHER_CTX_cleanup(&ctx);
 862         p = sdec;
 863
 864         sess = d2i_SSL_SESSION(NULL, &p, slen);
 865         OPENSSL_free(sdec);
 866         if (sess)
 867                 {
 868                 /* The session ID if non-empty is used by some clients to
 869                  * detect that the ticket has been accepted. So we copy it to
 870                  * the session structure. If it is empty set length to zero
 871                  * as required by standard.
 872                  */
 873                 if (sesslen)
 874                         memcpy(sess->session_id, sess_id, sesslen);
 875                 sess->session_id_length = sesslen;
 876                 *psess = sess;
 877                 s->tlsext_ticket_expected = renew_ticket;
 878                 return 1;
 879                 }
 880         /* If session decrypt failure indicate a cache miss and set state to
 881          * send a new ticket
 882          */
 883         tickerr:
 884         s->tlsext_ticket_expected = 1;
 885         return 0;
 886         }
 887
 888 #endif