Synchronised line endinge with release branch

1 files changed, 1747 insertions, 1747 deletions

diff --git a/openssl/ssl/t1_lib.c b/openssl/ssl/t1_lib.c
index 1ebad6166..85371c87b 100644
--- a/openssl/ssl/t1_lib.c
+++ b/openssl/ssl/t1_lib.c
@@ -1,1747 +1,1747 @@
-/* ssl/t1_lib.c */

-/* Copyright (C) 1995-1998 Eric Young (eay@cryptsoft.com)

- * All rights reserved.

- *

- * This package is an SSL implementation written

- * by Eric Young (eay@cryptsoft.com).

- * The implementation was written so as to conform with Netscapes SSL.

- * 

- * This library is free for commercial and non-commercial use as long as

- * the following conditions are aheared to.  The following conditions

- * apply to all code found in this distribution, be it the RC4, RSA,

- * lhash, DES, etc., code; not just the SSL code.  The SSL documentation

- * included with this distribution is covered by the same copyright terms

- * except that the holder is Tim Hudson (tjh@cryptsoft.com).

- * 

- * Copyright remains Eric Young's, and as such any Copyright notices in

- * the code are not to be removed.

- * If this package is used in a product, Eric Young should be given attribution

- * as the author of the parts of the library used.

- * This can be in the form of a textual message at program startup or

- * in documentation (online or textual) provided with the package.

- * 

- * Redistribution and use in source and binary forms, with or without

- * modification, are permitted provided that the following conditions

- * are met:

- * 1. Redistributions of source code must retain the copyright

- *    notice, this list of conditions and the following disclaimer.

- * 2. Redistributions in binary form must reproduce the above copyright

- *    notice, this list of conditions and the following disclaimer in the

- *    documentation and/or other materials provided with the distribution.

- * 3. All advertising materials mentioning features or use of this software

- *    must display the following acknowledgement:

- *    "This product includes cryptographic software written by

- *     Eric Young (eay@cryptsoft.com)"

- *    The word 'cryptographic' can be left out if the rouines from the library

- *    being used are not cryptographic related :-).

- * 4. If you include any Windows specific code (or a derivative thereof) from 

- *    the apps directory (application code) you must include an acknowledgement:

- *    "This product includes software written by Tim Hudson (tjh@cryptsoft.com)"

- * 

- * THIS SOFTWARE IS PROVIDED BY ERIC YOUNG ``AS IS'' AND

- * ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE

- * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE

- * ARE DISCLAIMED.  IN NO EVENT SHALL THE AUTHOR OR CONTRIBUTORS BE LIABLE

- * FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL

- * DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS

- * OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION)

- * HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT

- * LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY

- * OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF

- * SUCH DAMAGE.

- * 

- * The licence and distribution terms for any publically available version or

- * derivative of this code cannot be changed.  i.e. this code cannot simply be

- * copied and put under another distribution licence

- * [including the GNU Public Licence.]

- */

-/* ====================================================================

- * Copyright (c) 1998-2007 The OpenSSL Project.  All rights reserved.

- *

- * Redistribution and use in source and binary forms, with or without

- * modification, are permitted provided that the following conditions

- * are met:

- *

- * 1. Redistributions of source code must retain the above copyright

- *    notice, this list of conditions and the following disclaimer. 

- *

- * 2. Redistributions in binary form must reproduce the above copyright

- *    notice, this list of conditions and the following disclaimer in

- *    the documentation and/or other materials provided with the

- *    distribution.

- *

- * 3. All advertising materials mentioning features or use of this

- *    software must display the following acknowledgment:

- *    "This product includes software developed by the OpenSSL Project

- *    for use in the OpenSSL Toolkit. (http://www.openssl.org/)"

- *

- * 4. The names "OpenSSL Toolkit" and "OpenSSL Project" must not be used to

- *    endorse or promote products derived from this software without

- *    prior written permission. For written permission, please contact

- *    openssl-core@openssl.org.

- *

- * 5. Products derived from this software may not be called "OpenSSL"

- *    nor may "OpenSSL" appear in their names without prior written

- *    permission of the OpenSSL Project.

- *

- * 6. Redistributions of any form whatsoever must retain the following

- *    acknowledgment:

- *    "This product includes software developed by the OpenSSL Project

- *    for use in the OpenSSL Toolkit (http://www.openssl.org/)"

- *

- * THIS SOFTWARE IS PROVIDED BY THE OpenSSL PROJECT ``AS IS'' AND ANY

- * EXPRESSED OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE

- * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR

- * PURPOSE ARE DISCLAIMED.  IN NO EVENT SHALL THE OpenSSL PROJECT OR

- * ITS CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL,

- * SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT

- * NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES;

- * LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION)

- * HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT,

- * STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE)

- * ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED

- * OF THE POSSIBILITY OF SUCH DAMAGE.

- * ====================================================================

- *

- * This product includes cryptographic software written by Eric Young

- * (eay@cryptsoft.com).  This product includes software written by Tim

- * Hudson (tjh@cryptsoft.com).

- *

- */

-

-#include <stdio.h>

-#include <openssl/objects.h>

-#include <openssl/evp.h>

-#include <openssl/hmac.h>

-#include <openssl/ocsp.h>

-#include "ssl_locl.h"

-

-const char tls1_version_str[]="TLSv1" OPENSSL_VERSION_PTEXT;

-

-#ifndef OPENSSL_NO_TLSEXT

-static int tls_decrypt_ticket(SSL *s, const unsigned char *tick, int ticklen,

-				const unsigned char *sess_id, int sesslen,

-				SSL_SESSION **psess);

-#endif

-

-SSL3_ENC_METHOD TLSv1_enc_data={

-	tls1_enc,

-	tls1_mac,

-	tls1_setup_key_block,

-	tls1_generate_master_secret,

-	tls1_change_cipher_state,

-	tls1_final_finish_mac,

-	TLS1_FINISH_MAC_LENGTH,

-	tls1_cert_verify_mac,

-	TLS_MD_CLIENT_FINISH_CONST,TLS_MD_CLIENT_FINISH_CONST_SIZE,

-	TLS_MD_SERVER_FINISH_CONST,TLS_MD_SERVER_FINISH_CONST_SIZE,

-	tls1_alert_code,

-	};

-

-long tls1_default_timeout(void)

-	{

-	/* 2 hours, the 24 hours mentioned in the TLSv1 spec

-	 * is way too long for http, the cache would over fill */

-	return(60*60*2);

-	}

-

-int tls1_new(SSL *s)

-	{

-	if (!ssl3_new(s)) return(0);

-	s->method->ssl_clear(s);

-	return(1);

-	}

-

-void tls1_free(SSL *s)

-	{

-#ifndef OPENSSL_NO_TLSEXT

-	if (s->tlsext_session_ticket)

-		{

-		OPENSSL_free(s->tlsext_session_ticket);

-		}

-#endif /* OPENSSL_NO_TLSEXT */

-	ssl3_free(s);

-	}

-

-void tls1_clear(SSL *s)

-	{

-	ssl3_clear(s);

-	s->version=TLS1_VERSION;

-	}

-

-#ifndef OPENSSL_NO_EC

-static int nid_list[] =

-	{

-		NID_sect163k1, /* sect163k1 (1) */

-		NID_sect163r1, /* sect163r1 (2) */

-		NID_sect163r2, /* sect163r2 (3) */

-		NID_sect193r1, /* sect193r1 (4) */ 

-		NID_sect193r2, /* sect193r2 (5) */ 

-		NID_sect233k1, /* sect233k1 (6) */

-		NID_sect233r1, /* sect233r1 (7) */ 

-		NID_sect239k1, /* sect239k1 (8) */ 

-		NID_sect283k1, /* sect283k1 (9) */

-		NID_sect283r1, /* sect283r1 (10) */ 

-		NID_sect409k1, /* sect409k1 (11) */ 

-		NID_sect409r1, /* sect409r1 (12) */

-		NID_sect571k1, /* sect571k1 (13) */ 

-		NID_sect571r1, /* sect571r1 (14) */ 

-		NID_secp160k1, /* secp160k1 (15) */

-		NID_secp160r1, /* secp160r1 (16) */ 

-		NID_secp160r2, /* secp160r2 (17) */ 

-		NID_secp192k1, /* secp192k1 (18) */

-		NID_X9_62_prime192v1, /* secp192r1 (19) */ 

-		NID_secp224k1, /* secp224k1 (20) */ 

-		NID_secp224r1, /* secp224r1 (21) */

-		NID_secp256k1, /* secp256k1 (22) */ 

-		NID_X9_62_prime256v1, /* secp256r1 (23) */ 

-		NID_secp384r1, /* secp384r1 (24) */

-		NID_secp521r1  /* secp521r1 (25) */	

-	};

-	

-int tls1_ec_curve_id2nid(int curve_id)

-	{

-	/* ECC curves from draft-ietf-tls-ecc-12.txt (Oct. 17, 2005) */

-	if ((curve_id < 1) || ((unsigned int)curve_id >

-				sizeof(nid_list)/sizeof(nid_list[0])))

-		return 0;

-	return nid_list[curve_id-1];

-	}

-

-int tls1_ec_nid2curve_id(int nid)

-	{

-	/* ECC curves from draft-ietf-tls-ecc-12.txt (Oct. 17, 2005) */

-	switch (nid)

-		{

-	case NID_sect163k1: /* sect163k1 (1) */

-		return 1;

-	case NID_sect163r1: /* sect163r1 (2) */

-		return 2;

-	case NID_sect163r2: /* sect163r2 (3) */

-		return 3;

-	case NID_sect193r1: /* sect193r1 (4) */ 

-		return 4;

-	case NID_sect193r2: /* sect193r2 (5) */ 

-		return 5;

-	case NID_sect233k1: /* sect233k1 (6) */

-		return 6;

-	case NID_sect233r1: /* sect233r1 (7) */ 

-		return 7;

-	case NID_sect239k1: /* sect239k1 (8) */ 

-		return 8;

-	case NID_sect283k1: /* sect283k1 (9) */

-		return 9;

-	case NID_sect283r1: /* sect283r1 (10) */ 

-		return 10;

-	case NID_sect409k1: /* sect409k1 (11) */ 

-		return 11;

-	case NID_sect409r1: /* sect409r1 (12) */

-		return 12;

-	case NID_sect571k1: /* sect571k1 (13) */ 

-		return 13;

-	case NID_sect571r1: /* sect571r1 (14) */ 

-		return 14;

-	case NID_secp160k1: /* secp160k1 (15) */

-		return 15;

-	case NID_secp160r1: /* secp160r1 (16) */ 

-		return 16;

-	case NID_secp160r2: /* secp160r2 (17) */ 

-		return 17;

-	case NID_secp192k1: /* secp192k1 (18) */

-		return 18;

-	case NID_X9_62_prime192v1: /* secp192r1 (19) */ 

-		return 19;

-	case NID_secp224k1: /* secp224k1 (20) */ 

-		return 20;

-	case NID_secp224r1: /* secp224r1 (21) */

-		return 21;

-	case NID_secp256k1: /* secp256k1 (22) */ 

-		return 22;

-	case NID_X9_62_prime256v1: /* secp256r1 (23) */ 

-		return 23;

-	case NID_secp384r1: /* secp384r1 (24) */

-		return 24;

-	case NID_secp521r1:  /* secp521r1 (25) */	

-		return 25;

-	default:

-		return 0;

-		}

-	}

-#endif /* OPENSSL_NO_EC */

-

-#ifndef OPENSSL_NO_TLSEXT

-unsigned char *ssl_add_clienthello_tlsext(SSL *s, unsigned char *p, unsigned char *limit)

-	{

-	int extdatalen=0;

-	unsigned char *ret = p;

-

-	/* don't add extensions for SSLv3 unless doing secure renegotiation */

-	if (s->client_version == SSL3_VERSION

-					&& !s->s3->send_connection_binding)

-		return p;

-

-	ret+=2;

-

-	if (ret>=limit) return NULL; /* this really never occurs, but ... */

-

- 	if (s->tlsext_hostname != NULL)

-		{ 

-		/* Add TLS extension servername to the Client Hello message */

-		unsigned long size_str;

-		long lenmax; 

-

-		/* check for enough space.

-		   4 for the servername type and entension length

-		   2 for servernamelist length

-		   1 for the hostname type

-		   2 for hostname length

-		   + hostname length 

-		*/

-		   

-		if ((lenmax = limit - ret - 9) < 0 

-		    || (size_str = strlen(s->tlsext_hostname)) > (unsigned long)lenmax) 

-			return NULL;

-			

-		/* extension type and length */

-		s2n(TLSEXT_TYPE_server_name,ret); 

-		s2n(size_str+5,ret);

-		

-		/* length of servername list */

-		s2n(size_str+3,ret);

-	

-		/* hostname type, length and hostname */

-		*(ret++) = (unsigned char) TLSEXT_NAMETYPE_host_name;

-		s2n(size_str,ret);

-		memcpy(ret, s->tlsext_hostname, size_str);

-		ret+=size_str;

-		}

-

-        /* Add RI if renegotiating */

-        if (s->new_session)

-          {

-          int el;

-          

-          if(!ssl_add_clienthello_renegotiate_ext(s, 0, &el, 0))

-              {

-              SSLerr(SSL_F_SSL_ADD_CLIENTHELLO_TLSEXT, ERR_R_INTERNAL_ERROR);

-              return NULL;

-              }

-

-          if((limit - p - 4 - el) < 0) return NULL;

-          

-          s2n(TLSEXT_TYPE_renegotiate,ret);

-          s2n(el,ret);

-

-          if(!ssl_add_clienthello_renegotiate_ext(s, ret, &el, el))

-              {

-              SSLerr(SSL_F_SSL_ADD_CLIENTHELLO_TLSEXT, ERR_R_INTERNAL_ERROR);

-              return NULL;

-              }

-

-          ret += el;

-        }

-

-#ifndef OPENSSL_NO_EC

-	if (s->tlsext_ecpointformatlist != NULL &&

-	    s->version != DTLS1_VERSION)

-		{

-		/* Add TLS extension ECPointFormats to the ClientHello message */

-		long lenmax; 

-

-		if ((lenmax = limit - ret - 5) < 0) return NULL; 

-		if (s->tlsext_ecpointformatlist_length > (unsigned long)lenmax) return NULL;

-		if (s->tlsext_ecpointformatlist_length > 255)

-			{

-			SSLerr(SSL_F_SSL_ADD_CLIENTHELLO_TLSEXT, ERR_R_INTERNAL_ERROR);

-			return NULL;

-			}

-		

-		s2n(TLSEXT_TYPE_ec_point_formats,ret);

-		s2n(s->tlsext_ecpointformatlist_length + 1,ret);

-		*(ret++) = (unsigned char) s->tlsext_ecpointformatlist_length;

-		memcpy(ret, s->tlsext_ecpointformatlist, s->tlsext_ecpointformatlist_length);

-		ret+=s->tlsext_ecpointformatlist_length;

-		}

-	if (s->tlsext_ellipticcurvelist != NULL &&

-	    s->version != DTLS1_VERSION)

-		{

-		/* Add TLS extension EllipticCurves to the ClientHello message */

-		long lenmax; 

-

-		if ((lenmax = limit - ret - 6) < 0) return NULL; 

-		if (s->tlsext_ellipticcurvelist_length > (unsigned long)lenmax) return NULL;

-		if (s->tlsext_ellipticcurvelist_length > 65532)

-			{

-			SSLerr(SSL_F_SSL_ADD_CLIENTHELLO_TLSEXT, ERR_R_INTERNAL_ERROR);

-			return NULL;

-			}

-		

-		s2n(TLSEXT_TYPE_elliptic_curves,ret);

-		s2n(s->tlsext_ellipticcurvelist_length + 2, ret);

-

-		/* NB: draft-ietf-tls-ecc-12.txt uses a one-byte prefix for

-		 * elliptic_curve_list, but the examples use two bytes.

-		 * http://www1.ietf.org/mail-archive/web/tls/current/msg00538.html

-		 * resolves this to two bytes.

-		 */

-		s2n(s->tlsext_ellipticcurvelist_length, ret);

-		memcpy(ret, s->tlsext_ellipticcurvelist, s->tlsext_ellipticcurvelist_length);

-		ret+=s->tlsext_ellipticcurvelist_length;

-		}

-#endif /* OPENSSL_NO_EC */

-

-	if (!(SSL_get_options(s) & SSL_OP_NO_TICKET))

-		{

-		int ticklen;

-		if (!s->new_session && s->session && s->session->tlsext_tick)

-			ticklen = s->session->tlsext_ticklen;

-		else if (s->session && s->tlsext_session_ticket &&

-			 s->tlsext_session_ticket->data)

-			{

-			ticklen = s->tlsext_session_ticket->length;

-			s->session->tlsext_tick = OPENSSL_malloc(ticklen);

-			if (!s->session->tlsext_tick)

-				return NULL;

-			memcpy(s->session->tlsext_tick,

-			       s->tlsext_session_ticket->data,

-			       ticklen);

-			s->session->tlsext_ticklen = ticklen;

-			}

-		else

-			ticklen = 0;

-		if (ticklen == 0 && s->tlsext_session_ticket &&

-		    s->tlsext_session_ticket->data == NULL)

-			goto skip_ext;

-		/* Check for enough room 2 for extension type, 2 for len

- 		 * rest for ticket

-  		 */

-		if ((long)(limit - ret - 4 - ticklen) < 0) return NULL;

-		s2n(TLSEXT_TYPE_session_ticket,ret); 

-		s2n(ticklen,ret);

-		if (ticklen)

-			{

-			memcpy(ret, s->session->tlsext_tick, ticklen);

-			ret += ticklen;

-			}

-		}

-		skip_ext:

-

-#ifdef TLSEXT_TYPE_opaque_prf_input

-	if (s->s3->client_opaque_prf_input != NULL &&

-	    s->version != DTLS1_VERSION)

-		{

-		size_t col = s->s3->client_opaque_prf_input_len;

-		

-		if ((long)(limit - ret - 6 - col < 0))

-			return NULL;

-		if (col > 0xFFFD) /* can't happen */

-			return NULL;

-

-		s2n(TLSEXT_TYPE_opaque_prf_input, ret); 

-		s2n(col + 2, ret);

-		s2n(col, ret);

-		memcpy(ret, s->s3->client_opaque_prf_input, col);

-		ret += col;

-		}

-#endif

-

-	if (s->tlsext_status_type == TLSEXT_STATUSTYPE_ocsp &&

-	    s->version != DTLS1_VERSION)

-		{

-		int i;

-		long extlen, idlen, itmp;

-		OCSP_RESPID *id;

-

-		idlen = 0;

-		for (i = 0; i < sk_OCSP_RESPID_num(s->tlsext_ocsp_ids); i++)

-			{

-			id = sk_OCSP_RESPID_value(s->tlsext_ocsp_ids, i);

-			itmp = i2d_OCSP_RESPID(id, NULL);

-			if (itmp <= 0)

-				return NULL;

-			idlen += itmp + 2;

-			}

-

-		if (s->tlsext_ocsp_exts)

-			{

-			extlen = i2d_X509_EXTENSIONS(s->tlsext_ocsp_exts, NULL);

-			if (extlen < 0)

-				return NULL;

-			}

-		else

-			extlen = 0;

-			

-		if ((long)(limit - ret - 7 - extlen - idlen) < 0) return NULL;

-		s2n(TLSEXT_TYPE_status_request, ret);

-		if (extlen + idlen > 0xFFF0)

-			return NULL;

-		s2n(extlen + idlen + 5, ret);

-		*(ret++) = TLSEXT_STATUSTYPE_ocsp;

-		s2n(idlen, ret);

-		for (i = 0; i < sk_OCSP_RESPID_num(s->tlsext_ocsp_ids); i++)

-			{

-			/* save position of id len */

-			unsigned char *q = ret;

-			id = sk_OCSP_RESPID_value(s->tlsext_ocsp_ids, i);

-			/* skip over id len */

-			ret += 2;

-			itmp = i2d_OCSP_RESPID(id, &ret);

-			/* write id len */

-			s2n(itmp, q);

-			}

-		s2n(extlen, ret);

-		if (extlen > 0)

-			i2d_X509_EXTENSIONS(s->tlsext_ocsp_exts, &ret);

-		}

-

-	if ((extdatalen = ret-p-2)== 0) 

-		return p;

-

-	s2n(extdatalen,p);

-	return ret;

-	}

-

-unsigned char *ssl_add_serverhello_tlsext(SSL *s, unsigned char *p, unsigned char *limit)

-	{

-	int extdatalen=0;

-	unsigned char *ret = p;

-

-	/* don't add extensions for SSLv3, unless doing secure renegotiation */

-	if (s->version == SSL3_VERSION && !s->s3->send_connection_binding)

-		return p;

-	

-	ret+=2;

-	if (ret>=limit) return NULL; /* this really never occurs, but ... */

-

-	if (!s->hit && s->servername_done == 1 && s->session->tlsext_hostname != NULL)

-		{ 

-		if ((long)(limit - ret - 4) < 0) return NULL; 

-

-		s2n(TLSEXT_TYPE_server_name,ret);

-		s2n(0,ret);

-		}

-

-	if(s->s3->send_connection_binding)

-        {

-          int el;

-          

-          if(!ssl_add_serverhello_renegotiate_ext(s, 0, &el, 0))

-              {

-              SSLerr(SSL_F_SSL_ADD_SERVERHELLO_TLSEXT, ERR_R_INTERNAL_ERROR);

-              return NULL;

-              }

-

-          if((limit - p - 4 - el) < 0) return NULL;

-          

-          s2n(TLSEXT_TYPE_renegotiate,ret);

-          s2n(el,ret);

-

-          if(!ssl_add_serverhello_renegotiate_ext(s, ret, &el, el))

-              {

-              SSLerr(SSL_F_SSL_ADD_SERVERHELLO_TLSEXT, ERR_R_INTERNAL_ERROR);

-              return NULL;

-              }

-

-          ret += el;

-        }

-

-#ifndef OPENSSL_NO_EC

-	if (s->tlsext_ecpointformatlist != NULL &&

-	    s->version != DTLS1_VERSION)

-		{

-		/* Add TLS extension ECPointFormats to the ServerHello message */

-		long lenmax; 

-

-		if ((lenmax = limit - ret - 5) < 0) return NULL; 

-		if (s->tlsext_ecpointformatlist_length > (unsigned long)lenmax) return NULL;

-		if (s->tlsext_ecpointformatlist_length > 255)

-			{

-			SSLerr(SSL_F_SSL_ADD_SERVERHELLO_TLSEXT, ERR_R_INTERNAL_ERROR);

-			return NULL;

-			}

-		

-		s2n(TLSEXT_TYPE_ec_point_formats,ret);

-		s2n(s->tlsext_ecpointformatlist_length + 1,ret);

-		*(ret++) = (unsigned char) s->tlsext_ecpointformatlist_length;

-		memcpy(ret, s->tlsext_ecpointformatlist, s->tlsext_ecpointformatlist_length);

-		ret+=s->tlsext_ecpointformatlist_length;

-

-		}

-	/* Currently the server should not respond with a SupportedCurves extension */

-#endif /* OPENSSL_NO_EC */

-

-	if (s->tlsext_ticket_expected

-		&& !(SSL_get_options(s) & SSL_OP_NO_TICKET)) 

-		{ 

-		if ((long)(limit - ret - 4) < 0) return NULL; 

-		s2n(TLSEXT_TYPE_session_ticket,ret);

-		s2n(0,ret);

-		}

-

-	if (s->tlsext_status_expected)

-		{ 

-		if ((long)(limit - ret - 4) < 0) return NULL; 

-		s2n(TLSEXT_TYPE_status_request,ret);

-		s2n(0,ret);

-		}

-

-#ifdef TLSEXT_TYPE_opaque_prf_input

-	if (s->s3->server_opaque_prf_input != NULL &&

-	    s->version != DTLS1_VERSION)

-		{

-		size_t sol = s->s3->server_opaque_prf_input_len;

-		

-		if ((long)(limit - ret - 6 - sol) < 0)

-			return NULL;

-		if (sol > 0xFFFD) /* can't happen */

-			return NULL;

-

-		s2n(TLSEXT_TYPE_opaque_prf_input, ret); 

-		s2n(sol + 2, ret);

-		s2n(sol, ret);

-		memcpy(ret, s->s3->server_opaque_prf_input, sol);

-		ret += sol;

-		}

-#endif

-	if (((s->s3->tmp.new_cipher->id & 0xFFFF)==0x80 || (s->s3->tmp.new_cipher->id & 0xFFFF)==0x81) 

-		&& (SSL_get_options(s) & SSL_OP_CRYPTOPRO_TLSEXT_BUG))

-		{ const unsigned char cryptopro_ext[36] = {

-			0xfd, 0xe8, /*65000*/

-			0x00, 0x20, /*32 bytes length*/

-			0x30, 0x1e, 0x30, 0x08, 0x06, 0x06, 0x2a, 0x85, 

-			0x03,   0x02, 0x02, 0x09, 0x30, 0x08, 0x06, 0x06, 

-			0x2a, 0x85, 0x03, 0x02, 0x02, 0x16, 0x30, 0x08, 

-			0x06, 0x06, 0x2a, 0x85, 0x03, 0x02, 0x02, 0x17};

-			if (limit-ret<36) return NULL;

-			memcpy(ret,cryptopro_ext,36);

-			ret+=36;

-

-		}

-

-	if ((extdatalen = ret-p-2)== 0) 

-		return p;

-

-	s2n(extdatalen,p);

-	return ret;

-	}

-

-int ssl_parse_clienthello_tlsext(SSL *s, unsigned char **p, unsigned char *d, int n, int *al)

-	{

-	unsigned short type;

-	unsigned short size;

-	unsigned short len;

-	unsigned char *data = *p;

-	int renegotiate_seen = 0;

-

-	s->servername_done = 0;

-	s->tlsext_status_type = -1;

-

-	if (data >= (d+n-2))

-		goto ri_check;

-	n2s(data,len);

-

-	if (data > (d+n-len)) 

-		goto ri_check;

-

-	while (data <= (d+n-4))

-		{

-		n2s(data,type);

-		n2s(data,size);

-

-		if (data+size > (d+n))

-	   		goto ri_check;

-#if 0

-		fprintf(stderr,"Received extension type %d size %d\n",type,size);

-#endif

-		if (s->tlsext_debug_cb)

-			s->tlsext_debug_cb(s, 0, type, data, size,

-						s->tlsext_debug_arg);

-/* The servername extension is treated as follows:

-

-   - Only the hostname type is supported with a maximum length of 255.

-   - The servername is rejected if too long or if it contains zeros,

-     in which case an fatal alert is generated.

-   - The servername field is maintained together with the session cache.

-   - When a session is resumed, the servername call back invoked in order

-     to allow the application to position itself to the right context. 

-   - The servername is acknowledged if it is new for a session or when 

-     it is identical to a previously used for the same session. 

-     Applications can control the behaviour.  They can at any time

-     set a 'desirable' servername for a new SSL object. This can be the

-     case for example with HTTPS when a Host: header field is received and

-     a renegotiation is requested. In this case, a possible servername

-     presented in the new client hello is only acknowledged if it matches

-     the value of the Host: field. 

-   - Applications must  use SSL_OP_NO_SESSION_RESUMPTION_ON_RENEGOTIATION

-     if they provide for changing an explicit servername context for the session,

-     i.e. when the session has been established with a servername extension. 

-   - On session reconnect, the servername extension may be absent. 

-

-*/      

-

-		if (type == TLSEXT_TYPE_server_name)

-			{

-			unsigned char *sdata;

-			int servname_type;

-			int dsize; 

-		

-			if (size < 2) 

-				{

-				*al = SSL_AD_DECODE_ERROR;

-				return 0;

-				}

-			n2s(data,dsize);  

-			size -= 2;

-			if (dsize > size  ) 

-				{

-				*al = SSL_AD_DECODE_ERROR;

-				return 0;

-				} 

-

-			sdata = data;

-			while (dsize > 3) 

-				{

-	 			servname_type = *(sdata++); 

-				n2s(sdata,len);

-				dsize -= 3;

-

-				if (len > dsize) 

-					{

-					*al = SSL_AD_DECODE_ERROR;

-					return 0;

-					}

-				if (s->servername_done == 0)

-				switch (servname_type)

-					{

-				case TLSEXT_NAMETYPE_host_name:

-					if (!s->hit)

-						{

-						if(s->session->tlsext_hostname)

-							{

-							*al = SSL_AD_DECODE_ERROR;

-							return 0;

-							}

-						if (len > TLSEXT_MAXLEN_host_name)

-							{

-							*al = TLS1_AD_UNRECOGNIZED_NAME;

-							return 0;

-							}

-						if ((s->session->tlsext_hostname = OPENSSL_malloc(len+1)) == NULL)

-							{

-							*al = TLS1_AD_INTERNAL_ERROR;

-							return 0;

-							}

-						memcpy(s->session->tlsext_hostname, sdata, len);

-						s->session->tlsext_hostname[len]='\0';

-						if (strlen(s->session->tlsext_hostname) != len) {

-							OPENSSL_free(s->session->tlsext_hostname);

-							s->session->tlsext_hostname = NULL;

-							*al = TLS1_AD_UNRECOGNIZED_NAME;

-							return 0;

-						}

-						s->servername_done = 1; 

-

-						}

-					else 

-						s->servername_done = s->session->tlsext_hostname

-							&& strlen(s->session->tlsext_hostname) == len 

-							&& strncmp(s->session->tlsext_hostname, (char *)sdata, len) == 0;

-					

-					break;

-

-				default:

-					break;

-					}

-				 

-				dsize -= len;

-				}

-			if (dsize != 0) 

-				{

-				*al = SSL_AD_DECODE_ERROR;

-				return 0;

-				}

-

-			}

-

-#ifndef OPENSSL_NO_EC

-		else if (type == TLSEXT_TYPE_ec_point_formats &&

-	             s->version != DTLS1_VERSION)

-			{

-			unsigned char *sdata = data;

-			int ecpointformatlist_length = *(sdata++);

-

-			if (ecpointformatlist_length != size - 1)

-				{

-				*al = TLS1_AD_DECODE_ERROR;

-				return 0;

-				}

-			if (!s->hit)

-				{

-				if(s->session->tlsext_ecpointformatlist)

-					{

-					OPENSSL_free(s->session->tlsext_ecpointformatlist);

-					s->session->tlsext_ecpointformatlist = NULL;

-					}

-				s->session->tlsext_ecpointformatlist_length = 0;

-				if ((s->session->tlsext_ecpointformatlist = OPENSSL_malloc(ecpointformatlist_length)) == NULL)

-					{

-					*al = TLS1_AD_INTERNAL_ERROR;

-					return 0;

-					}

-				s->session->tlsext_ecpointformatlist_length = ecpointformatlist_length;

-				memcpy(s->session->tlsext_ecpointformatlist, sdata, ecpointformatlist_length);

-				}

-#if 0

-			fprintf(stderr,"ssl_parse_clienthello_tlsext s->session->tlsext_ecpointformatlist (length=%i) ", s->session->tlsext_ecpointformatlist_length);

-			sdata = s->session->tlsext_ecpointformatlist;

-			for (i = 0; i < s->session->tlsext_ecpointformatlist_length; i++)

-				fprintf(stderr,"%i ",*(sdata++));

-			fprintf(stderr,"\n");

-#endif

-			}

-		else if (type == TLSEXT_TYPE_elliptic_curves &&

-	             s->version != DTLS1_VERSION)

-			{

-			unsigned char *sdata = data;

-			int ellipticcurvelist_length = (*(sdata++) << 8);

-			ellipticcurvelist_length += (*(sdata++));

-

-			if (ellipticcurvelist_length != size - 2)

-				{

-				*al = TLS1_AD_DECODE_ERROR;

-				return 0;

-				}

-			if (!s->hit)

-				{

-				if(s->session->tlsext_ellipticcurvelist)

-					{

-					*al = TLS1_AD_DECODE_ERROR;

-					return 0;

-					}

-				s->session->tlsext_ellipticcurvelist_length = 0;

-				if ((s->session->tlsext_ellipticcurvelist = OPENSSL_malloc(ellipticcurvelist_length)) == NULL)

-					{

-					*al = TLS1_AD_INTERNAL_ERROR;

-					return 0;

-					}

-				s->session->tlsext_ellipticcurvelist_length = ellipticcurvelist_length;

-				memcpy(s->session->tlsext_ellipticcurvelist, sdata, ellipticcurvelist_length);

-				}

-#if 0

-			fprintf(stderr,"ssl_parse_clienthello_tlsext s->session->tlsext_ellipticcurvelist (length=%i) ", s->session->tlsext_ellipticcurvelist_length);

-			sdata = s->session->tlsext_ellipticcurvelist;

-			for (i = 0; i < s->session->tlsext_ellipticcurvelist_length; i++)

-				fprintf(stderr,"%i ",*(sdata++));

-			fprintf(stderr,"\n");

-#endif

-			}

-#endif /* OPENSSL_NO_EC */

-#ifdef TLSEXT_TYPE_opaque_prf_input

-		else if (type == TLSEXT_TYPE_opaque_prf_input &&

-	             s->version != DTLS1_VERSION)

-			{

-			unsigned char *sdata = data;

-

-			if (size < 2)

-				{

-				*al = SSL_AD_DECODE_ERROR;

-				return 0;

-				}

-			n2s(sdata, s->s3->client_opaque_prf_input_len);

-			if (s->s3->client_opaque_prf_input_len != size - 2)

-				{

-				*al = SSL_AD_DECODE_ERROR;

-				return 0;

-				}

-

-			if (s->s3->client_opaque_prf_input != NULL) /* shouldn't really happen */

-				OPENSSL_free(s->s3->client_opaque_prf_input);

-			if (s->s3->client_opaque_prf_input_len == 0)

-				s->s3->client_opaque_prf_input = OPENSSL_malloc(1); /* dummy byte just to get non-NULL */

-			else

-				s->s3->client_opaque_prf_input = BUF_memdup(sdata, s->s3->client_opaque_prf_input_len);

-			if (s->s3->client_opaque_prf_input == NULL)

-				{

-				*al = TLS1_AD_INTERNAL_ERROR;

-				return 0;

-				}

-			}

-#endif

-		else if (type == TLSEXT_TYPE_session_ticket)

-			{

-			if (s->tls_session_ticket_ext_cb &&

-			    !s->tls_session_ticket_ext_cb(s, data, size, s->tls_session_ticket_ext_cb_arg))

-				{

-				*al = TLS1_AD_INTERNAL_ERROR;

-				return 0;

-				}

-			}

-		else if (type == TLSEXT_TYPE_renegotiate)

-			{

-			if(!ssl_parse_clienthello_renegotiate_ext(s, data, size, al))

-				return 0;

-			renegotiate_seen = 1;

-			}

-		else if (type == TLSEXT_TYPE_status_request &&

-		         s->version != DTLS1_VERSION && s->ctx->tlsext_status_cb)

-			{

-		

-			if (size < 5) 

-				{

-				*al = SSL_AD_DECODE_ERROR;

-				return 0;

-				}

-

-			s->tlsext_status_type = *data++;

-			size--;

-			if (s->tlsext_status_type == TLSEXT_STATUSTYPE_ocsp)

-				{

-				const unsigned char *sdata;

-				int dsize;

-				/* Read in responder_id_list */

-				n2s(data,dsize);

-				size -= 2;

-				if (dsize > size  ) 

-					{

-					*al = SSL_AD_DECODE_ERROR;

-					return 0;

-					}

-				while (dsize > 0)

-					{

-					OCSP_RESPID *id;

-					int idsize;

-					if (dsize < 4)

-						{

-						*al = SSL_AD_DECODE_ERROR;

-						return 0;

-						}

-					n2s(data, idsize);

-					dsize -= 2 + idsize;

-					size -= 2 + idsize;

-					if (dsize < 0)

-						{

-						*al = SSL_AD_DECODE_ERROR;

-						return 0;

-						}

-					sdata = data;

-					data += idsize;

-					id = d2i_OCSP_RESPID(NULL,

-								&sdata, idsize);

-					if (!id)

-						{

-						*al = SSL_AD_DECODE_ERROR;

-						return 0;

-						}

-					if (data != sdata)

-						{

-						OCSP_RESPID_free(id);

-						*al = SSL_AD_DECODE_ERROR;

-						return 0;

-						}

-					if (!s->tlsext_ocsp_ids

-						&& !(s->tlsext_ocsp_ids =

-						sk_OCSP_RESPID_new_null()))

-						{

-						OCSP_RESPID_free(id);

-						*al = SSL_AD_INTERNAL_ERROR;

-						return 0;

-						}

-					if (!sk_OCSP_RESPID_push(

-							s->tlsext_ocsp_ids, id))

-						{

-						OCSP_RESPID_free(id);

-						*al = SSL_AD_INTERNAL_ERROR;

-						return 0;

-						}

-					}

-

-				/* Read in request_extensions */

-				if (size < 2)

-					{

-					*al = SSL_AD_DECODE_ERROR;

-					return 0;

-					}

-				n2s(data,dsize);

-				size -= 2;

-				if (dsize != size)

-					{

-					*al = SSL_AD_DECODE_ERROR;

-					return 0;

-					}

-				sdata = data;

-				if (dsize > 0)

-					{

-					s->tlsext_ocsp_exts =

-						d2i_X509_EXTENSIONS(NULL,

-							&sdata, dsize);

-					if (!s->tlsext_ocsp_exts

-						|| (data + dsize != sdata))

-						{

-						*al = SSL_AD_DECODE_ERROR;

-						return 0;

-						}

-					}

-				}

-				/* We don't know what to do with any other type

- 			 	* so ignore it.

- 			 	*/

-				else

-					s->tlsext_status_type = -1;

-			}

-

-		/* session ticket processed earlier */

-		data+=size;

-		}

-				

-	*p = data;

-

-	ri_check:

-

-	/* Need RI if renegotiating */

-

-	if (!renegotiate_seen && s->new_session &&

-		!(s->options & SSL_OP_ALLOW_UNSAFE_LEGACY_RENEGOTIATION))

-		{

-		*al = SSL_AD_HANDSHAKE_FAILURE;

-	 	SSLerr(SSL_F_SSL_PARSE_CLIENTHELLO_TLSEXT,

-				SSL_R_UNSAFE_LEGACY_RENEGOTIATION_DISABLED);

-		return 0;

-		}

-

-	return 1;

-	}

-

-int ssl_parse_serverhello_tlsext(SSL *s, unsigned char **p, unsigned char *d, int n, int *al)

-	{

-	unsigned short length;

-	unsigned short type;

-	unsigned short size;

-	unsigned char *data = *p;

-	int tlsext_servername = 0;

-	int renegotiate_seen = 0;

-

-	if (data >= (d+n-2))

-		goto ri_check;

-

-	n2s(data,length);

-	if (data+length != d+n)

-		{

-		*al = SSL_AD_DECODE_ERROR;

-		return 0;

-		}

-

-	while(data <= (d+n-4))

-		{

-		n2s(data,type);

-		n2s(data,size);

-

-		if (data+size > (d+n))

-	   		goto ri_check;

-

-		if (s->tlsext_debug_cb)

-			s->tlsext_debug_cb(s, 1, type, data, size,

-						s->tlsext_debug_arg);

-

-		if (type == TLSEXT_TYPE_server_name)

-			{

-			if (s->tlsext_hostname == NULL || size > 0)

-				{

-				*al = TLS1_AD_UNRECOGNIZED_NAME;

-				return 0;

-				}

-			tlsext_servername = 1;   

-			}

-

-#ifndef OPENSSL_NO_EC

-		else if (type == TLSEXT_TYPE_ec_point_formats &&

-	             s->version != DTLS1_VERSION)

-			{

-			unsigned char *sdata = data;

-			int ecpointformatlist_length = *(sdata++);

-

-			if (ecpointformatlist_length != size - 1)

-				{

-				*al = TLS1_AD_DECODE_ERROR;

-				return 0;

-				}

-			s->session->tlsext_ecpointformatlist_length = 0;

-			if (s->session->tlsext_ecpointformatlist != NULL) OPENSSL_free(s->session->tlsext_ecpointformatlist);

-			if ((s->session->tlsext_ecpointformatlist = OPENSSL_malloc(ecpointformatlist_length)) == NULL)

-				{

-				*al = TLS1_AD_INTERNAL_ERROR;

-				return 0;

-				}

-			s->session->tlsext_ecpointformatlist_length = ecpointformatlist_length;

-			memcpy(s->session->tlsext_ecpointformatlist, sdata, ecpointformatlist_length);

-#if 0

-			fprintf(stderr,"ssl_parse_serverhello_tlsext s->session->tlsext_ecpointformatlist ");

-			sdata = s->session->tlsext_ecpointformatlist;

-			for (i = 0; i < s->session->tlsext_ecpointformatlist_length; i++)

-				fprintf(stderr,"%i ",*(sdata++));

-			fprintf(stderr,"\n");

-#endif

-			}

-#endif /* OPENSSL_NO_EC */

-

-		else if (type == TLSEXT_TYPE_session_ticket)

-			{

-			if (s->tls_session_ticket_ext_cb &&

-			    !s->tls_session_ticket_ext_cb(s, data, size, s->tls_session_ticket_ext_cb_arg))

-				{

-				*al = TLS1_AD_INTERNAL_ERROR;

-				return 0;

-				}

-			if ((SSL_get_options(s) & SSL_OP_NO_TICKET)

-				|| (size > 0))

-				{

-				*al = TLS1_AD_UNSUPPORTED_EXTENSION;

-				return 0;

-				}

-			s->tlsext_ticket_expected = 1;

-			}

-#ifdef TLSEXT_TYPE_opaque_prf_input

-		else if (type == TLSEXT_TYPE_opaque_prf_input &&

-	             s->version != DTLS1_VERSION)

-			{

-			unsigned char *sdata = data;

-

-			if (size < 2)

-				{

-				*al = SSL_AD_DECODE_ERROR;

-				return 0;

-				}

-			n2s(sdata, s->s3->server_opaque_prf_input_len);

-			if (s->s3->server_opaque_prf_input_len != size - 2)

-				{

-				*al = SSL_AD_DECODE_ERROR;

-				return 0;

-				}

-			

-			if (s->s3->server_opaque_prf_input != NULL) /* shouldn't really happen */

-				OPENSSL_free(s->s3->server_opaque_prf_input);

-			if (s->s3->server_opaque_prf_input_len == 0)

-				s->s3->server_opaque_prf_input = OPENSSL_malloc(1); /* dummy byte just to get non-NULL */

-			else

-				s->s3->server_opaque_prf_input = BUF_memdup(sdata, s->s3->server_opaque_prf_input_len);

-

-			if (s->s3->server_opaque_prf_input == NULL)

-				{

-				*al = TLS1_AD_INTERNAL_ERROR;

-				return 0;

-				}

-			}

-#endif

-		else if (type == TLSEXT_TYPE_status_request &&

-		         s->version != DTLS1_VERSION)

-			{

-			/* MUST be empty and only sent if we've requested

-			 * a status request message.

-			 */ 

-			if ((s->tlsext_status_type == -1) || (size > 0))

-				{

-				*al = TLS1_AD_UNSUPPORTED_EXTENSION;

-				return 0;

-				}

-			/* Set flag to expect CertificateStatus message */

-			s->tlsext_status_expected = 1;

-			}

-		else if (type == TLSEXT_TYPE_renegotiate)

-			{

-			if(!ssl_parse_serverhello_renegotiate_ext(s, data, size, al))

-				return 0;

-			renegotiate_seen = 1;

-			}

-		data+=size;		

-		}

-

-	if (data != d+n)

-		{

-		*al = SSL_AD_DECODE_ERROR;

-		return 0;

-		}

-

-	if (!s->hit && tlsext_servername == 1)

-		{

- 		if (s->tlsext_hostname)

-			{

-			if (s->session->tlsext_hostname == NULL)

-				{

-				s->session->tlsext_hostname = BUF_strdup(s->tlsext_hostname);	

-				if (!s->session->tlsext_hostname)

-					{

-					*al = SSL_AD_UNRECOGNIZED_NAME;

-					return 0;

-					}

-				}

-			else 

-				{

-				*al = SSL_AD_DECODE_ERROR;

-				return 0;

-				}

-			}

-		}

-

-	*p = data;

-

-	ri_check:

-

-	/* Determine if we need to see RI. Strictly speaking if we want to

-	 * avoid an attack we should *always* see RI even on initial server

-	 * hello because the client doesn't see any renegotiation during an

-	 * attack. However this would mean we could not connect to any server

-	 * which doesn't support RI so for the immediate future tolerate RI

-	 * absence on initial connect only.

-	 */

-	if (!renegotiate_seen

-		&& !(s->options & SSL_OP_LEGACY_SERVER_CONNECT)

-		&& !(s->options & SSL_OP_ALLOW_UNSAFE_LEGACY_RENEGOTIATION))

-		{

-		*al = SSL_AD_HANDSHAKE_FAILURE;

-		SSLerr(SSL_F_SSL_PARSE_SERVERHELLO_TLSEXT,

-				SSL_R_UNSAFE_LEGACY_RENEGOTIATION_DISABLED);

-		return 0;

-		}

-

-	return 1;

-	}

-

-

-int ssl_prepare_clienthello_tlsext(SSL *s)

-	{

-#ifndef OPENSSL_NO_EC

-	/* If we are client and using an elliptic curve cryptography cipher suite, send the point formats 

-	 * and elliptic curves we support.

-	 */

-	int using_ecc = 0;

-	int i;

-	unsigned char *j;

-	unsigned long alg_k, alg_a;

-	STACK_OF(SSL_CIPHER) *cipher_stack = SSL_get_ciphers(s);

-

-	for (i = 0; i < sk_SSL_CIPHER_num(cipher_stack); i++)

-		{

-		SSL_CIPHER *c = sk_SSL_CIPHER_value(cipher_stack, i);

-

-		alg_k = c->algorithm_mkey;

-		alg_a = c->algorithm_auth;

-		if ((alg_k & (SSL_kEECDH|SSL_kECDHr|SSL_kECDHe) || (alg_a & SSL_aECDSA)))

-			{

-			using_ecc = 1;

-			break;

-			}

-		}

-	using_ecc = using_ecc && (s->version == TLS1_VERSION);

-	if (using_ecc)

-		{

-		if (s->tlsext_ecpointformatlist != NULL) OPENSSL_free(s->tlsext_ecpointformatlist);

-		if ((s->tlsext_ecpointformatlist = OPENSSL_malloc(3)) == NULL)

-			{

-			SSLerr(SSL_F_SSL_PREPARE_CLIENTHELLO_TLSEXT,ERR_R_MALLOC_FAILURE);

-			return -1;

-			}

-		s->tlsext_ecpointformatlist_length = 3;

-		s->tlsext_ecpointformatlist[0] = TLSEXT_ECPOINTFORMAT_uncompressed;

-		s->tlsext_ecpointformatlist[1] = TLSEXT_ECPOINTFORMAT_ansiX962_compressed_prime;

-		s->tlsext_ecpointformatlist[2] = TLSEXT_ECPOINTFORMAT_ansiX962_compressed_char2;

-

-		/* we support all named elliptic curves in draft-ietf-tls-ecc-12 */

-		if (s->tlsext_ellipticcurvelist != NULL) OPENSSL_free(s->tlsext_ellipticcurvelist);

-		s->tlsext_ellipticcurvelist_length = sizeof(nid_list)/sizeof(nid_list[0]) * 2;

-		if ((s->tlsext_ellipticcurvelist = OPENSSL_malloc(s->tlsext_ellipticcurvelist_length)) == NULL)

-			{

-			s->tlsext_ellipticcurvelist_length = 0;

-			SSLerr(SSL_F_SSL_PREPARE_CLIENTHELLO_TLSEXT,ERR_R_MALLOC_FAILURE);

-			return -1;

-			}

-		for (i = 1, j = s->tlsext_ellipticcurvelist; (unsigned int)i <=

-				sizeof(nid_list)/sizeof(nid_list[0]); i++)

-			s2n(i,j);

-		}

-#endif /* OPENSSL_NO_EC */

-

-#ifdef TLSEXT_TYPE_opaque_prf_input

- 	{

-		int r = 1;

-	

-		if (s->ctx->tlsext_opaque_prf_input_callback != 0)

-			{

-			r = s->ctx->tlsext_opaque_prf_input_callback(s, NULL, 0, s->ctx->tlsext_opaque_prf_input_callback_arg);

-			if (!r)

-				return -1;

-			}

-

-		if (s->tlsext_opaque_prf_input != NULL)

-			{

-			if (s->s3->client_opaque_prf_input != NULL) /* shouldn't really happen */

-				OPENSSL_free(s->s3->client_opaque_prf_input);

-

-			if (s->tlsext_opaque_prf_input_len == 0)

-				s->s3->client_opaque_prf_input = OPENSSL_malloc(1); /* dummy byte just to get non-NULL */

-			else

-				s->s3->client_opaque_prf_input = BUF_memdup(s->tlsext_opaque_prf_input, s->tlsext_opaque_prf_input_len);

-			if (s->s3->client_opaque_prf_input == NULL)

-				{

-				SSLerr(SSL_F_SSL_PREPARE_CLIENTHELLO_TLSEXT,ERR_R_MALLOC_FAILURE);

-				return -1;

-				}

-			s->s3->client_opaque_prf_input_len = s->tlsext_opaque_prf_input_len;

-			}

-

-		if (r == 2)

-			/* at callback's request, insist on receiving an appropriate server opaque PRF input */

-			s->s3->server_opaque_prf_input_len = s->tlsext_opaque_prf_input_len;

-	}

-#endif

-

-	return 1;

-	}

-

-int ssl_prepare_serverhello_tlsext(SSL *s)

-	{

-#ifndef OPENSSL_NO_EC

-	/* If we are server and using an ECC cipher suite, send the point formats we support 

-	 * if the client sent us an ECPointsFormat extension.  Note that the server is not

-	 * supposed to send an EllipticCurves extension.

-	 */

-

-	unsigned long alg_k = s->s3->tmp.new_cipher->algorithm_mkey;

-	unsigned long alg_a = s->s3->tmp.new_cipher->algorithm_auth;

-	int using_ecc = (alg_k & (SSL_kEECDH|SSL_kECDHr|SSL_kECDHe)) || (alg_a & SSL_aECDSA);

-	using_ecc = using_ecc && (s->session->tlsext_ecpointformatlist != NULL);

-	

-	if (using_ecc)

-		{

-		if (s->tlsext_ecpointformatlist != NULL) OPENSSL_free(s->tlsext_ecpointformatlist);

-		if ((s->tlsext_ecpointformatlist = OPENSSL_malloc(3)) == NULL)

-			{

-			SSLerr(SSL_F_SSL_PREPARE_SERVERHELLO_TLSEXT,ERR_R_MALLOC_FAILURE);

-			return -1;

-			}

-		s->tlsext_ecpointformatlist_length = 3;

-		s->tlsext_ecpointformatlist[0] = TLSEXT_ECPOINTFORMAT_uncompressed;

-		s->tlsext_ecpointformatlist[1] = TLSEXT_ECPOINTFORMAT_ansiX962_compressed_prime;

-		s->tlsext_ecpointformatlist[2] = TLSEXT_ECPOINTFORMAT_ansiX962_compressed_char2;

-		}

-#endif /* OPENSSL_NO_EC */

-

-	return 1;

-	}

-

-int ssl_check_clienthello_tlsext(SSL *s)

-	{

-	int ret=SSL_TLSEXT_ERR_NOACK;

-	int al = SSL_AD_UNRECOGNIZED_NAME;

-

-#ifndef OPENSSL_NO_EC

-	/* The handling of the ECPointFormats extension is done elsewhere, namely in 

-	 * ssl3_choose_cipher in s3_lib.c.

-	 */

-	/* The handling of the EllipticCurves extension is done elsewhere, namely in 

-	 * ssl3_choose_cipher in s3_lib.c.

-	 */

-#endif

-

-	if (s->ctx != NULL && s->ctx->tlsext_servername_callback != 0) 

-		ret = s->ctx->tlsext_servername_callback(s, &al, s->ctx->tlsext_servername_arg);

-	else if (s->initial_ctx != NULL && s->initial_ctx->tlsext_servername_callback != 0) 		

-		ret = s->initial_ctx->tlsext_servername_callback(s, &al, s->initial_ctx->tlsext_servername_arg);

-

-	/* If status request then ask callback what to do.

- 	 * Note: this must be called after servername callbacks in case 

- 	 * the certificate has changed.

- 	 */

-	if ((s->tlsext_status_type != -1) && s->ctx && s->ctx->tlsext_status_cb)

-		{

-		int r;

-		r = s->ctx->tlsext_status_cb(s, s->ctx->tlsext_status_arg);

-		switch (r)

-			{

-			/* We don't want to send a status request response */

-			case SSL_TLSEXT_ERR_NOACK:

-				s->tlsext_status_expected = 0;

-				break;

-			/* status request response should be sent */

-			case SSL_TLSEXT_ERR_OK:

-				if (s->tlsext_ocsp_resp)

-					s->tlsext_status_expected = 1;

-				else

-					s->tlsext_status_expected = 0;

-				break;

-			/* something bad happened */

-			case SSL_TLSEXT_ERR_ALERT_FATAL:

-				ret = SSL_TLSEXT_ERR_ALERT_FATAL;

-				al = SSL_AD_INTERNAL_ERROR;

-				goto err;

-			}

-		}

-	else

-		s->tlsext_status_expected = 0;

-

-#ifdef TLSEXT_TYPE_opaque_prf_input

- 	{

-		/* This sort of belongs into ssl_prepare_serverhello_tlsext(),

-		 * but we might be sending an alert in response to the client hello,

-		 * so this has to happen here in ssl_check_clienthello_tlsext(). */

-

-		int r = 1;

-	

-		if (s->ctx->tlsext_opaque_prf_input_callback != 0)

-			{

-			r = s->ctx->tlsext_opaque_prf_input_callback(s, NULL, 0, s->ctx->tlsext_opaque_prf_input_callback_arg);

-			if (!r)

-				{

-				ret = SSL_TLSEXT_ERR_ALERT_FATAL;

-				al = SSL_AD_INTERNAL_ERROR;

-				goto err;

-				}

-			}

-

-		if (s->s3->server_opaque_prf_input != NULL) /* shouldn't really happen */

-			OPENSSL_free(s->s3->server_opaque_prf_input);

-		s->s3->server_opaque_prf_input = NULL;

-

-		if (s->tlsext_opaque_prf_input != NULL)

-			{

-			if (s->s3->client_opaque_prf_input != NULL &&

-				s->s3->client_opaque_prf_input_len == s->tlsext_opaque_prf_input_len)

-				{

-				/* can only use this extension if we have a server opaque PRF input

-				 * of the same length as the client opaque PRF input! */

-

-				if (s->tlsext_opaque_prf_input_len == 0)

-					s->s3->server_opaque_prf_input = OPENSSL_malloc(1); /* dummy byte just to get non-NULL */

-				else

-					s->s3->server_opaque_prf_input = BUF_memdup(s->tlsext_opaque_prf_input, s->tlsext_opaque_prf_input_len);

-				if (s->s3->server_opaque_prf_input == NULL)

-					{

-					ret = SSL_TLSEXT_ERR_ALERT_FATAL;

-					al = SSL_AD_INTERNAL_ERROR;

-					goto err;

-					}

-				s->s3->server_opaque_prf_input_len = s->tlsext_opaque_prf_input_len;

-				}

-			}

-

-		if (r == 2 && s->s3->server_opaque_prf_input == NULL)

-			{

-			/* The callback wants to enforce use of the extension,

-			 * but we can't do that with the client opaque PRF input;

-			 * abort the handshake.

-			 */

-			ret = SSL_TLSEXT_ERR_ALERT_FATAL;

-			al = SSL_AD_HANDSHAKE_FAILURE;

-			}

-	}

-

-#endif

- err:

-	switch (ret)

-		{

-		case SSL_TLSEXT_ERR_ALERT_FATAL:

-			ssl3_send_alert(s,SSL3_AL_FATAL,al); 

-			return -1;

-

-		case SSL_TLSEXT_ERR_ALERT_WARNING:

-			ssl3_send_alert(s,SSL3_AL_WARNING,al);

-			return 1; 

-					

-		case SSL_TLSEXT_ERR_NOACK:

-			s->servername_done=0;

-			default:

-		return 1;

-		}

-	}

-

-int ssl_check_serverhello_tlsext(SSL *s)

-	{

-	int ret=SSL_TLSEXT_ERR_NOACK;

-	int al = SSL_AD_UNRECOGNIZED_NAME;

-

-#ifndef OPENSSL_NO_EC

-	/* If we are client and using an elliptic curve cryptography cipher

-	 * suite, then if server returns an EC point formats lists extension

-	 * it must contain uncompressed.

-	 */

-	unsigned long alg_k = s->s3->tmp.new_cipher->algorithm_mkey;

-	unsigned long alg_a = s->s3->tmp.new_cipher->algorithm_auth;

-	if ((s->tlsext_ecpointformatlist != NULL) && (s->tlsext_ecpointformatlist_length > 0) && 

-	    (s->session->tlsext_ecpointformatlist != NULL) && (s->session->tlsext_ecpointformatlist_length > 0) && 

-	    ((alg_k & (SSL_kEECDH|SSL_kECDHr|SSL_kECDHe)) || (alg_a & SSL_aECDSA)))

-		{

-		/* we are using an ECC cipher */

-		size_t i;

-		unsigned char *list;

-		int found_uncompressed = 0;

-		list = s->session->tlsext_ecpointformatlist;

-		for (i = 0; i < s->session->tlsext_ecpointformatlist_length; i++)

-			{

-			if (*(list++) == TLSEXT_ECPOINTFORMAT_uncompressed)

-				{

-				found_uncompressed = 1;

-				break;

-				}

-			}

-		if (!found_uncompressed)

-			{

-			SSLerr(SSL_F_SSL_CHECK_SERVERHELLO_TLSEXT,SSL_R_TLS_INVALID_ECPOINTFORMAT_LIST);

-			return -1;

-			}

-		}

-	ret = SSL_TLSEXT_ERR_OK;

-#endif /* OPENSSL_NO_EC */

-

-	if (s->ctx != NULL && s->ctx->tlsext_servername_callback != 0) 

-		ret = s->ctx->tlsext_servername_callback(s, &al, s->ctx->tlsext_servername_arg);

-	else if (s->initial_ctx != NULL && s->initial_ctx->tlsext_servername_callback != 0) 		

-		ret = s->initial_ctx->tlsext_servername_callback(s, &al, s->initial_ctx->tlsext_servername_arg);

-

-#ifdef TLSEXT_TYPE_opaque_prf_input

-	if (s->s3->server_opaque_prf_input_len > 0)

-		{

-		/* This case may indicate that we, as a client, want to insist on using opaque PRF inputs.

-		 * So first verify that we really have a value from the server too. */

-

-		if (s->s3->server_opaque_prf_input == NULL)

-			{

-			ret = SSL_TLSEXT_ERR_ALERT_FATAL;

-			al = SSL_AD_HANDSHAKE_FAILURE;

-			}

-		

-		/* Anytime the server *has* sent an opaque PRF input, we need to check

-		 * that we have a client opaque PRF input of the same size. */

-		if (s->s3->client_opaque_prf_input == NULL ||

-		    s->s3->client_opaque_prf_input_len != s->s3->server_opaque_prf_input_len)

-			{

-			ret = SSL_TLSEXT_ERR_ALERT_FATAL;

-			al = SSL_AD_ILLEGAL_PARAMETER;

-			}

-		}

-#endif

-

-	/* If we've requested certificate status and we wont get one

- 	 * tell the callback

- 	 */

-	if ((s->tlsext_status_type != -1) && !(s->tlsext_status_expected)

-			&& s->ctx && s->ctx->tlsext_status_cb)

-		{

-		int r;

-		/* Set resp to NULL, resplen to -1 so callback knows

- 		 * there is no response.

- 		 */

-		if (s->tlsext_ocsp_resp)

-			{

-			OPENSSL_free(s->tlsext_ocsp_resp);

-			s->tlsext_ocsp_resp = NULL;

-			}

-		s->tlsext_ocsp_resplen = -1;

-		r = s->ctx->tlsext_status_cb(s, s->ctx->tlsext_status_arg);

-		if (r == 0)

-			{

-			al = SSL_AD_BAD_CERTIFICATE_STATUS_RESPONSE;

-			ret = SSL_TLSEXT_ERR_ALERT_FATAL;

-			}

-		if (r < 0)

-			{

-			al = SSL_AD_INTERNAL_ERROR;

-			ret = SSL_TLSEXT_ERR_ALERT_FATAL;

-			}

-		}

-

-	switch (ret)

-		{

-		case SSL_TLSEXT_ERR_ALERT_FATAL:

-			ssl3_send_alert(s,SSL3_AL_FATAL,al); 

-			return -1;

-

-		case SSL_TLSEXT_ERR_ALERT_WARNING:

-			ssl3_send_alert(s,SSL3_AL_WARNING,al);

-			return 1; 

-					

-		case SSL_TLSEXT_ERR_NOACK:

-			s->servername_done=0;

-			default:

-		return 1;

-		}

-	}

-

-/* Since the server cache lookup is done early on in the processing of client

- * hello and other operations depend on the result we need to handle any TLS

- * session ticket extension at the same time.

- */

-

-int tls1_process_ticket(SSL *s, unsigned char *session_id, int len,

-				const unsigned char *limit, SSL_SESSION **ret)

-	{

-	/* Point after session ID in client hello */

-	const unsigned char *p = session_id + len;

-	unsigned short i;

-

-	/* If tickets disabled behave as if no ticket present

- 	 * to permit stateful resumption.

- 	 */

-	if (SSL_get_options(s) & SSL_OP_NO_TICKET)

-		return 1;

-

-	if ((s->version <= SSL3_VERSION) || !limit)

-		return 1;

-	if (p >= limit)

-		return -1;

-	/* Skip past DTLS cookie */

-	if (s->version == DTLS1_VERSION || s->version == DTLS1_BAD_VER)

-		{

-		i = *(p++);

-		p+= i;

-		if (p >= limit)

-			return -1;

-		}

-	/* Skip past cipher list */

-	n2s(p, i);

-	p+= i;

-	if (p >= limit)

-		return -1;

-	/* Skip past compression algorithm list */

-	i = *(p++);

-	p += i;

-	if (p > limit)

-		return -1;

-	/* Now at start of extensions */

-	if ((p + 2) >= limit)

-		return 1;

-	n2s(p, i);

-	while ((p + 4) <= limit)

-		{

-		unsigned short type, size;

-		n2s(p, type);

-		n2s(p, size);

-		if (p + size > limit)

-			return 1;

-		if (type == TLSEXT_TYPE_session_ticket)

-			{

-			/* If tickets disabled indicate cache miss which will

- 			 * trigger a full handshake

- 			 */

-			if (SSL_get_options(s) & SSL_OP_NO_TICKET)

-				return 1;

-			/* If zero length note client will accept a ticket

- 			 * and indicate cache miss to trigger full handshake

- 			 */

-			if (size == 0)

-				{

-				s->tlsext_ticket_expected = 1;

-				return 0;	/* Cache miss */

-				}

-			if (s->tls_session_secret_cb)

-				{

-				/* Indicate cache miss here and instead of

-				 * generating the session from ticket now,

-				 * trigger abbreviated handshake based on

-				 * external mechanism to calculate the master

-				 * secret later. */

-				return 0;

-				}

-			return tls_decrypt_ticket(s, p, size, session_id, len,

-									ret);

-			}

-		p += size;

-		}

-	return 1;

-	}

-

-static int tls_decrypt_ticket(SSL *s, const unsigned char *etick, int eticklen,

-				const unsigned char *sess_id, int sesslen,

-				SSL_SESSION **psess)

-	{

-	SSL_SESSION *sess;

-	unsigned char *sdec;

-	const unsigned char *p;

-	int slen, mlen, renew_ticket = 0;

-	unsigned char tick_hmac[EVP_MAX_MD_SIZE];

-	HMAC_CTX hctx;

-	EVP_CIPHER_CTX ctx;

-	SSL_CTX *tctx = s->initial_ctx;

-	/* Need at least keyname + iv + some encrypted data */

-	if (eticklen < 48)

-		goto tickerr;

-	/* Initialize session ticket encryption and HMAC contexts */

-	HMAC_CTX_init(&hctx);

-	EVP_CIPHER_CTX_init(&ctx);

-	if (tctx->tlsext_ticket_key_cb)

-		{

-		unsigned char *nctick = (unsigned char *)etick;

-		int rv = tctx->tlsext_ticket_key_cb(s, nctick, nctick + 16,

-							&ctx, &hctx, 0);

-		if (rv < 0)

-			return -1;

-		if (rv == 0)

-			goto tickerr;

-		if (rv == 2)

-			renew_ticket = 1;

-		}

-	else

-		{

-		/* Check key name matches */

-		if (memcmp(etick, tctx->tlsext_tick_key_name, 16))

-			goto tickerr;

-		HMAC_Init_ex(&hctx, tctx->tlsext_tick_hmac_key, 16,

-					tlsext_tick_md(), NULL);

-		EVP_DecryptInit_ex(&ctx, EVP_aes_128_cbc(), NULL,

-				tctx->tlsext_tick_aes_key, etick + 16);

-		}

-	/* Attempt to process session ticket, first conduct sanity and

- 	 * integrity checks on ticket.

- 	 */

-	mlen = HMAC_size(&hctx);

-	if (mlen < 0)

-		{

-		EVP_CIPHER_CTX_cleanup(&ctx);

-		return -1;

-		}

-	eticklen -= mlen;

-	/* Check HMAC of encrypted ticket */

-	HMAC_Update(&hctx, etick, eticklen);

-	HMAC_Final(&hctx, tick_hmac, NULL);

-	HMAC_CTX_cleanup(&hctx);

-	if (memcmp(tick_hmac, etick + eticklen, mlen))

-		goto tickerr;

-	/* Attempt to decrypt session data */

-	/* Move p after IV to start of encrypted ticket, update length */

-	p = etick + 16 + EVP_CIPHER_CTX_iv_length(&ctx);

-	eticklen -= 16 + EVP_CIPHER_CTX_iv_length(&ctx);

-	sdec = OPENSSL_malloc(eticklen);

-	if (!sdec)

-		{

-		EVP_CIPHER_CTX_cleanup(&ctx);

-		return -1;

-		}

-	EVP_DecryptUpdate(&ctx, sdec, &slen, p, eticklen);

-	if (EVP_DecryptFinal(&ctx, sdec + slen, &mlen) <= 0)

-		goto tickerr;

-	slen += mlen;

-	EVP_CIPHER_CTX_cleanup(&ctx);

-	p = sdec;

-		

-	sess = d2i_SSL_SESSION(NULL, &p, slen);

-	OPENSSL_free(sdec);

-	if (sess)

-		{

-		/* The session ID if non-empty is used by some clients to

- 		 * detect that the ticket has been accepted. So we copy it to

- 		 * the session structure. If it is empty set length to zero

- 		 * as required by standard.

- 		 */

-		if (sesslen)

-			memcpy(sess->session_id, sess_id, sesslen);

-		sess->session_id_length = sesslen;

-		*psess = sess;

-		s->tlsext_ticket_expected = renew_ticket;

-		return 1;

-		}

-	/* If session decrypt failure indicate a cache miss and set state to

- 	 * send a new ticket

- 	 */

-	tickerr:	

-	s->tlsext_ticket_expected = 1;

-	return 0;

-	}

-

-#endif

+/* ssl/t1_lib.c */
+/* Copyright (C) 1995-1998 Eric Young (eay@cryptsoft.com)
+ * All rights reserved.
+ *
+ * This package is an SSL implementation written
+ * by Eric Young (eay@cryptsoft.com).
+ * The implementation was written so as to conform with Netscapes SSL.
+ * 
+ * This library is free for commercial and non-commercial use as long as
+ * the following conditions are aheared to.  The following conditions
+ * apply to all code found in this distribution, be it the RC4, RSA,
+ * lhash, DES, etc., code; not just the SSL code.  The SSL documentation
+ * included with this distribution is covered by the same copyright terms
+ * except that the holder is Tim Hudson (tjh@cryptsoft.com).
+ * 
+ * Copyright remains Eric Young's, and as such any Copyright notices in
+ * the code are not to be removed.
+ * If this package is used in a product, Eric Young should be given attribution
+ * as the author of the parts of the library used.
+ * This can be in the form of a textual message at program startup or
+ * in documentation (online or textual) provided with the package.
+ * 
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 1. Redistributions of source code must retain the copyright
+ *    notice, this list of conditions and the following disclaimer.
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in the
+ *    documentation and/or other materials provided with the distribution.
+ * 3. All advertising materials mentioning features or use of this software
+ *    must display the following acknowledgement:
+ *    "This product includes cryptographic software written by
+ *     Eric Young (eay@cryptsoft.com)"
+ *    The word 'cryptographic' can be left out if the rouines from the library
+ *    being used are not cryptographic related :-).
+ * 4. If you include any Windows specific code (or a derivative thereof) from 
+ *    the apps directory (application code) you must include an acknowledgement:
+ *    "This product includes software written by Tim Hudson (tjh@cryptsoft.com)"
+ * 
+ * THIS SOFTWARE IS PROVIDED BY ERIC YOUNG ``AS IS'' AND
+ * ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
+ * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE
+ * ARE DISCLAIMED.  IN NO EVENT SHALL THE AUTHOR OR CONTRIBUTORS BE LIABLE
+ * FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL
+ * DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS
+ * OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION)
+ * HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT
+ * LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY
+ * OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF
+ * SUCH DAMAGE.
+ * 
+ * The licence and distribution terms for any publically available version or
+ * derivative of this code cannot be changed.  i.e. this code cannot simply be
+ * copied and put under another distribution licence
+ * [including the GNU Public Licence.]
+ */
+/* ====================================================================
+ * Copyright (c) 1998-2007 The OpenSSL Project.  All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ *
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer. 
+ *
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in
+ *    the documentation and/or other materials provided with the
+ *    distribution.
+ *
+ * 3. All advertising materials mentioning features or use of this
+ *    software must display the following acknowledgment:
+ *    "This product includes software developed by the OpenSSL Project
+ *    for use in the OpenSSL Toolkit. (http://www.openssl.org/)"
+ *
+ * 4. The names "OpenSSL Toolkit" and "OpenSSL Project" must not be used to
+ *    endorse or promote products derived from this software without
+ *    prior written permission. For written permission, please contact
+ *    openssl-core@openssl.org.
+ *
+ * 5. Products derived from this software may not be called "OpenSSL"
+ *    nor may "OpenSSL" appear in their names without prior written
+ *    permission of the OpenSSL Project.
+ *
+ * 6. Redistributions of any form whatsoever must retain the following
+ *    acknowledgment:
+ *    "This product includes software developed by the OpenSSL Project
+ *    for use in the OpenSSL Toolkit (http://www.openssl.org/)"
+ *
+ * THIS SOFTWARE IS PROVIDED BY THE OpenSSL PROJECT ``AS IS'' AND ANY
+ * EXPRESSED OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
+ * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
+ * PURPOSE ARE DISCLAIMED.  IN NO EVENT SHALL THE OpenSSL PROJECT OR
+ * ITS CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL,
+ * SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT
+ * NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES;
+ * LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION)
+ * HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT,
+ * STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE)
+ * ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED
+ * OF THE POSSIBILITY OF SUCH DAMAGE.
+ * ====================================================================
+ *
+ * This product includes cryptographic software written by Eric Young
+ * (eay@cryptsoft.com).  This product includes software written by Tim
+ * Hudson (tjh@cryptsoft.com).
+ *
+ */
+
+#include <stdio.h>
+#include <openssl/objects.h>
+#include <openssl/evp.h>
+#include <openssl/hmac.h>
+#include <openssl/ocsp.h>
+#include "ssl_locl.h"
+
+const char tls1_version_str[]="TLSv1" OPENSSL_VERSION_PTEXT;
+
+#ifndef OPENSSL_NO_TLSEXT
+static int tls_decrypt_ticket(SSL *s, const unsigned char *tick, int ticklen,
+				const unsigned char *sess_id, int sesslen,
+				SSL_SESSION **psess);
+#endif
+
+SSL3_ENC_METHOD TLSv1_enc_data={
+	tls1_enc,
+	tls1_mac,
+	tls1_setup_key_block,
+	tls1_generate_master_secret,
+	tls1_change_cipher_state,
+	tls1_final_finish_mac,
+	TLS1_FINISH_MAC_LENGTH,
+	tls1_cert_verify_mac,
+	TLS_MD_CLIENT_FINISH_CONST,TLS_MD_CLIENT_FINISH_CONST_SIZE,
+	TLS_MD_SERVER_FINISH_CONST,TLS_MD_SERVER_FINISH_CONST_SIZE,
+	tls1_alert_code,
+	};
+
+long tls1_default_timeout(void)
+	{
+	/* 2 hours, the 24 hours mentioned in the TLSv1 spec
+	 * is way too long for http, the cache would over fill */
+	return(60*60*2);
+	}
+
+int tls1_new(SSL *s)
+	{
+	if (!ssl3_new(s)) return(0);
+	s->method->ssl_clear(s);
+	return(1);
+	}
+
+void tls1_free(SSL *s)
+	{
+#ifndef OPENSSL_NO_TLSEXT
+	if (s->tlsext_session_ticket)
+		{
+		OPENSSL_free(s->tlsext_session_ticket);
+		}
+#endif /* OPENSSL_NO_TLSEXT */
+	ssl3_free(s);
+	}
+
+void tls1_clear(SSL *s)
+	{
+	ssl3_clear(s);
+	s->version=TLS1_VERSION;
+	}
+
+#ifndef OPENSSL_NO_EC
+static int nid_list[] =
+	{
+		NID_sect163k1, /* sect163k1 (1) */
+		NID_sect163r1, /* sect163r1 (2) */
+		NID_sect163r2, /* sect163r2 (3) */
+		NID_sect193r1, /* sect193r1 (4) */ 
+		NID_sect193r2, /* sect193r2 (5) */ 
+		NID_sect233k1, /* sect233k1 (6) */
+		NID_sect233r1, /* sect233r1 (7) */ 
+		NID_sect239k1, /* sect239k1 (8) */ 
+		NID_sect283k1, /* sect283k1 (9) */
+		NID_sect283r1, /* sect283r1 (10) */ 
+		NID_sect409k1, /* sect409k1 (11) */ 
+		NID_sect409r1, /* sect409r1 (12) */
+		NID_sect571k1, /* sect571k1 (13) */ 
+		NID_sect571r1, /* sect571r1 (14) */ 
+		NID_secp160k1, /* secp160k1 (15) */
+		NID_secp160r1, /* secp160r1 (16) */ 
+		NID_secp160r2, /* secp160r2 (17) */ 
+		NID_secp192k1, /* secp192k1 (18) */
+		NID_X9_62_prime192v1, /* secp192r1 (19) */ 
+		NID_secp224k1, /* secp224k1 (20) */ 
+		NID_secp224r1, /* secp224r1 (21) */
+		NID_secp256k1, /* secp256k1 (22) */ 
+		NID_X9_62_prime256v1, /* secp256r1 (23) */ 
+		NID_secp384r1, /* secp384r1 (24) */
+		NID_secp521r1  /* secp521r1 (25) */	
+	};
+	
+int tls1_ec_curve_id2nid(int curve_id)
+	{
+	/* ECC curves from draft-ietf-tls-ecc-12.txt (Oct. 17, 2005) */
+	if ((curve_id < 1) || ((unsigned int)curve_id >
+				sizeof(nid_list)/sizeof(nid_list[0])))
+		return 0;
+	return nid_list[curve_id-1];
+	}
+
+int tls1_ec_nid2curve_id(int nid)
+	{
+	/* ECC curves from draft-ietf-tls-ecc-12.txt (Oct. 17, 2005) */
+	switch (nid)
+		{
+	case NID_sect163k1: /* sect163k1 (1) */
+		return 1;
+	case NID_sect163r1: /* sect163r1 (2) */
+		return 2;
+	case NID_sect163r2: /* sect163r2 (3) */
+		return 3;
+	case NID_sect193r1: /* sect193r1 (4) */ 
+		return 4;
+	case NID_sect193r2: /* sect193r2 (5) */ 
+		return 5;
+	case NID_sect233k1: /* sect233k1 (6) */
+		return 6;
+	case NID_sect233r1: /* sect233r1 (7) */ 
+		return 7;
+	case NID_sect239k1: /* sect239k1 (8) */ 
+		return 8;
+	case NID_sect283k1: /* sect283k1 (9) */
+		return 9;
+	case NID_sect283r1: /* sect283r1 (10) */ 
+		return 10;
+	case NID_sect409k1: /* sect409k1 (11) */ 
+		return 11;
+	case NID_sect409r1: /* sect409r1 (12) */
+		return 12;
+	case NID_sect571k1: /* sect571k1 (13) */ 
+		return 13;
+	case NID_sect571r1: /* sect571r1 (14) */ 
+		return 14;
+	case NID_secp160k1: /* secp160k1 (15) */
+		return 15;
+	case NID_secp160r1: /* secp160r1 (16) */ 
+		return 16;
+	case NID_secp160r2: /* secp160r2 (17) */ 
+		return 17;
+	case NID_secp192k1: /* secp192k1 (18) */
+		return 18;
+	case NID_X9_62_prime192v1: /* secp192r1 (19) */ 
+		return 19;
+	case NID_secp224k1: /* secp224k1 (20) */ 
+		return 20;
+	case NID_secp224r1: /* secp224r1 (21) */
+		return 21;
+	case NID_secp256k1: /* secp256k1 (22) */ 
+		return 22;
+	case NID_X9_62_prime256v1: /* secp256r1 (23) */ 
+		return 23;
+	case NID_secp384r1: /* secp384r1 (24) */
+		return 24;
+	case NID_secp521r1:  /* secp521r1 (25) */	
+		return 25;
+	default:
+		return 0;
+		}
+	}
+#endif /* OPENSSL_NO_EC */
+
+#ifndef OPENSSL_NO_TLSEXT
+unsigned char *ssl_add_clienthello_tlsext(SSL *s, unsigned char *p, unsigned char *limit)
+	{
+	int extdatalen=0;
+	unsigned char *ret = p;
+
+	/* don't add extensions for SSLv3 unless doing secure renegotiation */
+	if (s->client_version == SSL3_VERSION
+					&& !s->s3->send_connection_binding)
+		return p;
+
+	ret+=2;
+
+	if (ret>=limit) return NULL; /* this really never occurs, but ... */
+
+ 	if (s->tlsext_hostname != NULL)
+		{ 
+		/* Add TLS extension servername to the Client Hello message */
+		unsigned long size_str;
+		long lenmax; 
+
+		/* check for enough space.
+		   4 for the servername type and entension length
+		   2 for servernamelist length
+		   1 for the hostname type
+		   2 for hostname length
+		   + hostname length 
+		*/
+		   
+		if ((lenmax = limit - ret - 9) < 0 
+		    || (size_str = strlen(s->tlsext_hostname)) > (unsigned long)lenmax) 
+			return NULL;
+			
+		/* extension type and length */
+		s2n(TLSEXT_TYPE_server_name,ret); 
+		s2n(size_str+5,ret);
+		
+		/* length of servername list */
+		s2n(size_str+3,ret);
+	
+		/* hostname type, length and hostname */
+		*(ret++) = (unsigned char) TLSEXT_NAMETYPE_host_name;
+		s2n(size_str,ret);
+		memcpy(ret, s->tlsext_hostname, size_str);
+		ret+=size_str;
+		}
+
+        /* Add RI if renegotiating */
+        if (s->new_session)
+          {
+          int el;
+          
+          if(!ssl_add_clienthello_renegotiate_ext(s, 0, &el, 0))
+              {
+              SSLerr(SSL_F_SSL_ADD_CLIENTHELLO_TLSEXT, ERR_R_INTERNAL_ERROR);
+              return NULL;
+              }
+
+          if((limit - p - 4 - el) < 0) return NULL;
+          
+          s2n(TLSEXT_TYPE_renegotiate,ret);
+          s2n(el,ret);
+
+          if(!ssl_add_clienthello_renegotiate_ext(s, ret, &el, el))
+              {
+              SSLerr(SSL_F_SSL_ADD_CLIENTHELLO_TLSEXT, ERR_R_INTERNAL_ERROR);
+              return NULL;
+              }
+
+          ret += el;
+        }
+
+#ifndef OPENSSL_NO_EC
+	if (s->tlsext_ecpointformatlist != NULL &&
+	    s->version != DTLS1_VERSION)
+		{
+		/* Add TLS extension ECPointFormats to the ClientHello message */
+		long lenmax; 
+
+		if ((lenmax = limit - ret - 5) < 0) return NULL; 
+		if (s->tlsext_ecpointformatlist_length > (unsigned long)lenmax) return NULL;
+		if (s->tlsext_ecpointformatlist_length > 255)
+			{
+			SSLerr(SSL_F_SSL_ADD_CLIENTHELLO_TLSEXT, ERR_R_INTERNAL_ERROR);
+			return NULL;
+			}
+		
+		s2n(TLSEXT_TYPE_ec_point_formats,ret);
+		s2n(s->tlsext_ecpointformatlist_length + 1,ret);
+		*(ret++) = (unsigned char) s->tlsext_ecpointformatlist_length;
+		memcpy(ret, s->tlsext_ecpointformatlist, s->tlsext_ecpointformatlist_length);
+		ret+=s->tlsext_ecpointformatlist_length;
+		}
+	if (s->tlsext_ellipticcurvelist != NULL &&
+	    s->version != DTLS1_VERSION)
+		{
+		/* Add TLS extension EllipticCurves to the ClientHello message */
+		long lenmax; 
+
+		if ((lenmax = limit - ret - 6) < 0) return NULL; 
+		if (s->tlsext_ellipticcurvelist_length > (unsigned long)lenmax) return NULL;
+		if (s->tlsext_ellipticcurvelist_length > 65532)
+			{
+			SSLerr(SSL_F_SSL_ADD_CLIENTHELLO_TLSEXT, ERR_R_INTERNAL_ERROR);
+			return NULL;
+			}
+		
+		s2n(TLSEXT_TYPE_elliptic_curves,ret);
+		s2n(s->tlsext_ellipticcurvelist_length + 2, ret);
+
+		/* NB: draft-ietf-tls-ecc-12.txt uses a one-byte prefix for
+		 * elliptic_curve_list, but the examples use two bytes.
+		 * http://www1.ietf.org/mail-archive/web/tls/current/msg00538.html
+		 * resolves this to two bytes.
+		 */
+		s2n(s->tlsext_ellipticcurvelist_length, ret);
+		memcpy(ret, s->tlsext_ellipticcurvelist, s->tlsext_ellipticcurvelist_length);
+		ret+=s->tlsext_ellipticcurvelist_length;
+		}
+#endif /* OPENSSL_NO_EC */
+
+	if (!(SSL_get_options(s) & SSL_OP_NO_TICKET))
+		{
+		int ticklen;
+		if (!s->new_session && s->session && s->session->tlsext_tick)
+			ticklen = s->session->tlsext_ticklen;
+		else if (s->session && s->tlsext_session_ticket &&
+			 s->tlsext_session_ticket->data)
+			{
+			ticklen = s->tlsext_session_ticket->length;
+			s->session->tlsext_tick = OPENSSL_malloc(ticklen);
+			if (!s->session->tlsext_tick)
+				return NULL;
+			memcpy(s->session->tlsext_tick,
+			       s->tlsext_session_ticket->data,
+			       ticklen);
+			s->session->tlsext_ticklen = ticklen;
+			}
+		else
+			ticklen = 0;
+		if (ticklen == 0 && s->tlsext_session_ticket &&
+		    s->tlsext_session_ticket->data == NULL)
+			goto skip_ext;
+		/* Check for enough room 2 for extension type, 2 for len
+ 		 * rest for ticket
+  		 */
+		if ((long)(limit - ret - 4 - ticklen) < 0) return NULL;
+		s2n(TLSEXT_TYPE_session_ticket,ret); 
+		s2n(ticklen,ret);
+		if (ticklen)
+			{
+			memcpy(ret, s->session->tlsext_tick, ticklen);
+			ret += ticklen;
+			}
+		}
+		skip_ext:
+
+#ifdef TLSEXT_TYPE_opaque_prf_input
+	if (s->s3->client_opaque_prf_input != NULL &&
+	    s->version != DTLS1_VERSION)
+		{
+		size_t col = s->s3->client_opaque_prf_input_len;
+		
+		if ((long)(limit - ret - 6 - col < 0))
+			return NULL;
+		if (col > 0xFFFD) /* can't happen */
+			return NULL;
+
+		s2n(TLSEXT_TYPE_opaque_prf_input, ret); 
+		s2n(col + 2, ret);
+		s2n(col, ret);
+		memcpy(ret, s->s3->client_opaque_prf_input, col);
+		ret += col;
+		}
+#endif
+
+	if (s->tlsext_status_type == TLSEXT_STATUSTYPE_ocsp &&
+	    s->version != DTLS1_VERSION)
+		{
+		int i;
+		long extlen, idlen, itmp;
+		OCSP_RESPID *id;
+
+		idlen = 0;
+		for (i = 0; i < sk_OCSP_RESPID_num(s->tlsext_ocsp_ids); i++)
+			{
+			id = sk_OCSP_RESPID_value(s->tlsext_ocsp_ids, i);
+			itmp = i2d_OCSP_RESPID(id, NULL);
+			if (itmp <= 0)
+				return NULL;
+			idlen += itmp + 2;
+			}
+
+		if (s->tlsext_ocsp_exts)
+			{
+			extlen = i2d_X509_EXTENSIONS(s->tlsext_ocsp_exts, NULL);
+			if (extlen < 0)
+				return NULL;
+			}
+		else
+			extlen = 0;
+			
+		if ((long)(limit - ret - 7 - extlen - idlen) < 0) return NULL;
+		s2n(TLSEXT_TYPE_status_request, ret);
+		if (extlen + idlen > 0xFFF0)
+			return NULL;
+		s2n(extlen + idlen + 5, ret);
+		*(ret++) = TLSEXT_STATUSTYPE_ocsp;
+		s2n(idlen, ret);
+		for (i = 0; i < sk_OCSP_RESPID_num(s->tlsext_ocsp_ids); i++)
+			{
+			/* save position of id len */
+			unsigned char *q = ret;
+			id = sk_OCSP_RESPID_value(s->tlsext_ocsp_ids, i);
+			/* skip over id len */
+			ret += 2;
+			itmp = i2d_OCSP_RESPID(id, &ret);
+			/* write id len */
+			s2n(itmp, q);
+			}
+		s2n(extlen, ret);
+		if (extlen > 0)
+			i2d_X509_EXTENSIONS(s->tlsext_ocsp_exts, &ret);
+		}
+
+	if ((extdatalen = ret-p-2)== 0) 
+		return p;
+
+	s2n(extdatalen,p);
+	return ret;
+	}
+
+unsigned char *ssl_add_serverhello_tlsext(SSL *s, unsigned char *p, unsigned char *limit)
+	{
+	int extdatalen=0;
+	unsigned char *ret = p;
+
+	/* don't add extensions for SSLv3, unless doing secure renegotiation */
+	if (s->version == SSL3_VERSION && !s->s3->send_connection_binding)
+		return p;
+	
+	ret+=2;
+	if (ret>=limit) return NULL; /* this really never occurs, but ... */
+
+	if (!s->hit && s->servername_done == 1 && s->session->tlsext_hostname != NULL)
+		{ 
+		if ((long)(limit - ret - 4) < 0) return NULL; 
+
+		s2n(TLSEXT_TYPE_server_name,ret);
+		s2n(0,ret);
+		}
+
+	if(s->s3->send_connection_binding)
+        {
+          int el;
+          
+          if(!ssl_add_serverhello_renegotiate_ext(s, 0, &el, 0))
+              {
+              SSLerr(SSL_F_SSL_ADD_SERVERHELLO_TLSEXT, ERR_R_INTERNAL_ERROR);
+              return NULL;
+              }
+
+          if((limit - p - 4 - el) < 0) return NULL;
+          
+          s2n(TLSEXT_TYPE_renegotiate,ret);
+          s2n(el,ret);
+
+          if(!ssl_add_serverhello_renegotiate_ext(s, ret, &el, el))
+              {
+              SSLerr(SSL_F_SSL_ADD_SERVERHELLO_TLSEXT, ERR_R_INTERNAL_ERROR);
+              return NULL;
+              }
+
+          ret += el;
+        }
+
+#ifndef OPENSSL_NO_EC
+	if (s->tlsext_ecpointformatlist != NULL &&
+	    s->version != DTLS1_VERSION)
+		{
+		/* Add TLS extension ECPointFormats to the ServerHello message */
+		long lenmax; 
+
+		if ((lenmax = limit - ret - 5) < 0) return NULL; 
+		if (s->tlsext_ecpointformatlist_length > (unsigned long)lenmax) return NULL;
+		if (s->tlsext_ecpointformatlist_length > 255)
+			{
+			SSLerr(SSL_F_SSL_ADD_SERVERHELLO_TLSEXT, ERR_R_INTERNAL_ERROR);
+			return NULL;
+			}
+		
+		s2n(TLSEXT_TYPE_ec_point_formats,ret);
+		s2n(s->tlsext_ecpointformatlist_length + 1,ret);
+		*(ret++) = (unsigned char) s->tlsext_ecpointformatlist_length;
+		memcpy(ret, s->tlsext_ecpointformatlist, s->tlsext_ecpointformatlist_length);
+		ret+=s->tlsext_ecpointformatlist_length;
+
+		}
+	/* Currently the server should not respond with a SupportedCurves extension */
+#endif /* OPENSSL_NO_EC */
+
+	if (s->tlsext_ticket_expected
+		&& !(SSL_get_options(s) & SSL_OP_NO_TICKET)) 
+		{ 
+		if ((long)(limit - ret - 4) < 0) return NULL; 
+		s2n(TLSEXT_TYPE_session_ticket,ret);
+		s2n(0,ret);
+		}
+
+	if (s->tlsext_status_expected)
+		{ 
+		if ((long)(limit - ret - 4) < 0) return NULL; 
+		s2n(TLSEXT_TYPE_status_request,ret);
+		s2n(0,ret);
+		}
+
+#ifdef TLSEXT_TYPE_opaque_prf_input
+	if (s->s3->server_opaque_prf_input != NULL &&
+	    s->version != DTLS1_VERSION)
+		{
+		size_t sol = s->s3->server_opaque_prf_input_len;
+		
+		if ((long)(limit - ret - 6 - sol) < 0)
+			return NULL;
+		if (sol > 0xFFFD) /* can't happen */
+			return NULL;
+
+		s2n(TLSEXT_TYPE_opaque_prf_input, ret); 
+		s2n(sol + 2, ret);
+		s2n(sol, ret);
+		memcpy(ret, s->s3->server_opaque_prf_input, sol);
+		ret += sol;
+		}
+#endif
+	if (((s->s3->tmp.new_cipher->id & 0xFFFF)==0x80 || (s->s3->tmp.new_cipher->id & 0xFFFF)==0x81) 
+		&& (SSL_get_options(s) & SSL_OP_CRYPTOPRO_TLSEXT_BUG))
+		{ const unsigned char cryptopro_ext[36] = {
+			0xfd, 0xe8, /*65000*/
+			0x00, 0x20, /*32 bytes length*/
+			0x30, 0x1e, 0x30, 0x08, 0x06, 0x06, 0x2a, 0x85, 
+			0x03,   0x02, 0x02, 0x09, 0x30, 0x08, 0x06, 0x06, 
+			0x2a, 0x85, 0x03, 0x02, 0x02, 0x16, 0x30, 0x08, 
+			0x06, 0x06, 0x2a, 0x85, 0x03, 0x02, 0x02, 0x17};
+			if (limit-ret<36) return NULL;
+			memcpy(ret,cryptopro_ext,36);
+			ret+=36;
+
+		}
+
+	if ((extdatalen = ret-p-2)== 0) 
+		return p;
+
+	s2n(extdatalen,p);
+	return ret;
+	}
+
+int ssl_parse_clienthello_tlsext(SSL *s, unsigned char **p, unsigned char *d, int n, int *al)
+	{
+	unsigned short type;
+	unsigned short size;
+	unsigned short len;
+	unsigned char *data = *p;
+	int renegotiate_seen = 0;
+
+	s->servername_done = 0;
+	s->tlsext_status_type = -1;
+
+	if (data >= (d+n-2))
+		goto ri_check;
+	n2s(data,len);
+
+	if (data > (d+n-len)) 
+		goto ri_check;
+
+	while (data <= (d+n-4))
+		{
+		n2s(data,type);
+		n2s(data,size);
+
+		if (data+size > (d+n))
+	   		goto ri_check;
+#if 0
+		fprintf(stderr,"Received extension type %d size %d\n",type,size);
+#endif
+		if (s->tlsext_debug_cb)
+			s->tlsext_debug_cb(s, 0, type, data, size,
+						s->tlsext_debug_arg);
+/* The servername extension is treated as follows:
+
+   - Only the hostname type is supported with a maximum length of 255.
+   - The servername is rejected if too long or if it contains zeros,
+     in which case an fatal alert is generated.
+   - The servername field is maintained together with the session cache.
+   - When a session is resumed, the servername call back invoked in order
+     to allow the application to position itself to the right context. 
+   - The servername is acknowledged if it is new for a session or when 
+     it is identical to a previously used for the same session. 
+     Applications can control the behaviour.  They can at any time
+     set a 'desirable' servername for a new SSL object. This can be the
+     case for example with HTTPS when a Host: header field is received and
+     a renegotiation is requested. In this case, a possible servername
+     presented in the new client hello is only acknowledged if it matches
+     the value of the Host: field. 
+   - Applications must  use SSL_OP_NO_SESSION_RESUMPTION_ON_RENEGOTIATION
+     if they provide for changing an explicit servername context for the session,
+     i.e. when the session has been established with a servername extension. 
+   - On session reconnect, the servername extension may be absent. 
+
+*/      
+
+		if (type == TLSEXT_TYPE_server_name)
+			{
+			unsigned char *sdata;
+			int servname_type;
+			int dsize; 
+		
+			if (size < 2) 
+				{
+				*al = SSL_AD_DECODE_ERROR;
+				return 0;
+				}
+			n2s(data,dsize);  
+			size -= 2;
+			if (dsize > size  ) 
+				{
+				*al = SSL_AD_DECODE_ERROR;
+				return 0;
+				} 
+
+			sdata = data;
+			while (dsize > 3) 
+				{
+	 			servname_type = *(sdata++); 
+				n2s(sdata,len);
+				dsize -= 3;
+
+				if (len > dsize) 
+					{
+					*al = SSL_AD_DECODE_ERROR;
+					return 0;
+					}
+				if (s->servername_done == 0)
+				switch (servname_type)
+					{
+				case TLSEXT_NAMETYPE_host_name:
+					if (!s->hit)
+						{
+						if(s->session->tlsext_hostname)
+							{
+							*al = SSL_AD_DECODE_ERROR;
+							return 0;
+							}
+						if (len > TLSEXT_MAXLEN_host_name)
+							{
+							*al = TLS1_AD_UNRECOGNIZED_NAME;
+							return 0;
+							}
+						if ((s->session->tlsext_hostname = OPENSSL_malloc(len+1)) == NULL)
+							{
+							*al = TLS1_AD_INTERNAL_ERROR;
+							return 0;
+							}
+						memcpy(s->session->tlsext_hostname, sdata, len);
+						s->session->tlsext_hostname[len]='\0';
+						if (strlen(s->session->tlsext_hostname) != len) {
+							OPENSSL_free(s->session->tlsext_hostname);
+							s->session->tlsext_hostname = NULL;
+							*al = TLS1_AD_UNRECOGNIZED_NAME;
+							return 0;
+						}
+						s->servername_done = 1; 
+
+						}
+					else 
+						s->servername_done = s->session->tlsext_hostname
+							&& strlen(s->session->tlsext_hostname) == len 
+							&& strncmp(s->session->tlsext_hostname, (char *)sdata, len) == 0;
+					
+					break;
+
+				default:
+					break;
+					}
+				 
+				dsize -= len;
+				}
+			if (dsize != 0) 
+				{
+				*al = SSL_AD_DECODE_ERROR;
+				return 0;
+				}
+
+			}
+
+#ifndef OPENSSL_NO_EC
+		else if (type == TLSEXT_TYPE_ec_point_formats &&
+	             s->version != DTLS1_VERSION)
+			{
+			unsigned char *sdata = data;
+			int ecpointformatlist_length = *(sdata++);
+
+			if (ecpointformatlist_length != size - 1)
+				{
+				*al = TLS1_AD_DECODE_ERROR;
+				return 0;
+				}
+			if (!s->hit)
+				{
+				if(s->session->tlsext_ecpointformatlist)
+					{
+					OPENSSL_free(s->session->tlsext_ecpointformatlist);
+					s->session->tlsext_ecpointformatlist = NULL;
+					}
+				s->session->tlsext_ecpointformatlist_length = 0;
+				if ((s->session->tlsext_ecpointformatlist = OPENSSL_malloc(ecpointformatlist_length)) == NULL)
+					{
+					*al = TLS1_AD_INTERNAL_ERROR;
+					return 0;
+					}
+				s->session->tlsext_ecpointformatlist_length = ecpointformatlist_length;
+				memcpy(s->session->tlsext_ecpointformatlist, sdata, ecpointformatlist_length);
+				}
+#if 0
+			fprintf(stderr,"ssl_parse_clienthello_tlsext s->session->tlsext_ecpointformatlist (length=%i) ", s->session->tlsext_ecpointformatlist_length);
+			sdata = s->session->tlsext_ecpointformatlist;
+			for (i = 0; i < s->session->tlsext_ecpointformatlist_length; i++)
+				fprintf(stderr,"%i ",*(sdata++));
+			fprintf(stderr,"\n");
+#endif
+			}
+		else if (type == TLSEXT_TYPE_elliptic_curves &&
+	             s->version != DTLS1_VERSION)
+			{
+			unsigned char *sdata = data;
+			int ellipticcurvelist_length = (*(sdata++) << 8);
+			ellipticcurvelist_length += (*(sdata++));
+
+			if (ellipticcurvelist_length != size - 2)
+				{
+				*al = TLS1_AD_DECODE_ERROR;
+				return 0;
+				}
+			if (!s->hit)
+				{
+				if(s->session->tlsext_ellipticcurvelist)
+					{
+					*al = TLS1_AD_DECODE_ERROR;
+					return 0;
+					}
+				s->session->tlsext_ellipticcurvelist_length = 0;
+				if ((s->session->tlsext_ellipticcurvelist = OPENSSL_malloc(ellipticcurvelist_length)) == NULL)
+					{
+					*al = TLS1_AD_INTERNAL_ERROR;
+					return 0;
+					}
+				s->session->tlsext_ellipticcurvelist_length = ellipticcurvelist_length;
+				memcpy(s->session->tlsext_ellipticcurvelist, sdata, ellipticcurvelist_length);
+				}
+#if 0
+			fprintf(stderr,"ssl_parse_clienthello_tlsext s->session->tlsext_ellipticcurvelist (length=%i) ", s->session->tlsext_ellipticcurvelist_length);
+			sdata = s->session->tlsext_ellipticcurvelist;
+			for (i = 0; i < s->session->tlsext_ellipticcurvelist_length; i++)
+				fprintf(stderr,"%i ",*(sdata++));
+			fprintf(stderr,"\n");
+#endif
+			}
+#endif /* OPENSSL_NO_EC */
+#ifdef TLSEXT_TYPE_opaque_prf_input
+		else if (type == TLSEXT_TYPE_opaque_prf_input &&
+	             s->version != DTLS1_VERSION)
+			{
+			unsigned char *sdata = data;
+
+			if (size < 2)
+				{
+				*al = SSL_AD_DECODE_ERROR;
+				return 0;
+				}
+			n2s(sdata, s->s3->client_opaque_prf_input_len);
+			if (s->s3->client_opaque_prf_input_len != size - 2)
+				{
+				*al = SSL_AD_DECODE_ERROR;
+				return 0;
+				}
+
+			if (s->s3->client_opaque_prf_input != NULL) /* shouldn't really happen */
+				OPENSSL_free(s->s3->client_opaque_prf_input);
+			if (s->s3->client_opaque_prf_input_len == 0)
+				s->s3->client_opaque_prf_input = OPENSSL_malloc(1); /* dummy byte just to get non-NULL */
+			else
+				s->s3->client_opaque_prf_input = BUF_memdup(sdata, s->s3->client_opaque_prf_input_len);
+			if (s->s3->client_opaque_prf_input == NULL)
+				{
+				*al = TLS1_AD_INTERNAL_ERROR;
+				return 0;
+				}
+			}
+#endif
+		else if (type == TLSEXT_TYPE_session_ticket)
+			{
+			if (s->tls_session_ticket_ext_cb &&
+			    !s->tls_session_ticket_ext_cb(s, data, size, s->tls_session_ticket_ext_cb_arg))
+				{
+				*al = TLS1_AD_INTERNAL_ERROR;
+				return 0;
+				}
+			}
+		else if (type == TLSEXT_TYPE_renegotiate)
+			{
+			if(!ssl_parse_clienthello_renegotiate_ext(s, data, size, al))
+				return 0;
+			renegotiate_seen = 1;
+			}
+		else if (type == TLSEXT_TYPE_status_request &&
+		         s->version != DTLS1_VERSION && s->ctx->tlsext_status_cb)
+			{
+		
+			if (size < 5) 
+				{
+				*al = SSL_AD_DECODE_ERROR;
+				return 0;
+				}
+
+			s->tlsext_status_type = *data++;
+			size--;
+			if (s->tlsext_status_type == TLSEXT_STATUSTYPE_ocsp)
+				{
+				const unsigned char *sdata;
+				int dsize;
+				/* Read in responder_id_list */
+				n2s(data,dsize);
+				size -= 2;
+				if (dsize > size  ) 
+					{
+					*al = SSL_AD_DECODE_ERROR;
+					return 0;
+					}
+				while (dsize > 0)
+					{
+					OCSP_RESPID *id;
+					int idsize;
+					if (dsize < 4)
+						{
+						*al = SSL_AD_DECODE_ERROR;
+						return 0;
+						}
+					n2s(data, idsize);
+					dsize -= 2 + idsize;
+					size -= 2 + idsize;
+					if (dsize < 0)
+						{
+						*al = SSL_AD_DECODE_ERROR;
+						return 0;
+						}
+					sdata = data;
+					data += idsize;
+					id = d2i_OCSP_RESPID(NULL,
+								&sdata, idsize);
+					if (!id)
+						{
+						*al = SSL_AD_DECODE_ERROR;
+						return 0;
+						}
+					if (data != sdata)
+						{
+						OCSP_RESPID_free(id);
+						*al = SSL_AD_DECODE_ERROR;
+						return 0;
+						}
+					if (!s->tlsext_ocsp_ids
+						&& !(s->tlsext_ocsp_ids =
+						sk_OCSP_RESPID_new_null()))
+						{
+						OCSP_RESPID_free(id);
+						*al = SSL_AD_INTERNAL_ERROR;
+						return 0;
+						}
+					if (!sk_OCSP_RESPID_push(
+							s->tlsext_ocsp_ids, id))
+						{
+						OCSP_RESPID_free(id);
+						*al = SSL_AD_INTERNAL_ERROR;
+						return 0;
+						}
+					}
+
+				/* Read in request_extensions */
+				if (size < 2)
+					{
+					*al = SSL_AD_DECODE_ERROR;
+					return 0;
+					}
+				n2s(data,dsize);
+				size -= 2;
+				if (dsize != size)
+					{
+					*al = SSL_AD_DECODE_ERROR;
+					return 0;
+					}
+				sdata = data;
+				if (dsize > 0)
+					{
+					s->tlsext_ocsp_exts =
+						d2i_X509_EXTENSIONS(NULL,
+							&sdata, dsize);
+					if (!s->tlsext_ocsp_exts
+						|| (data + dsize != sdata))
+						{
+						*al = SSL_AD_DECODE_ERROR;
+						return 0;
+						}
+					}
+				}
+				/* We don't know what to do with any other type
+ 			 	* so ignore it.
+ 			 	*/
+				else
+					s->tlsext_status_type = -1;
+			}
+
+		/* session ticket processed earlier */
+		data+=size;
+		}
+				
+	*p = data;
+
+	ri_check:
+
+	/* Need RI if renegotiating */
+
+	if (!renegotiate_seen && s->new_session &&
+		!(s->options & SSL_OP_ALLOW_UNSAFE_LEGACY_RENEGOTIATION))
+		{
+		*al = SSL_AD_HANDSHAKE_FAILURE;
+	 	SSLerr(SSL_F_SSL_PARSE_CLIENTHELLO_TLSEXT,
+				SSL_R_UNSAFE_LEGACY_RENEGOTIATION_DISABLED);
+		return 0;
+		}
+
+	return 1;
+	}
+
+int ssl_parse_serverhello_tlsext(SSL *s, unsigned char **p, unsigned char *d, int n, int *al)
+	{
+	unsigned short length;
+	unsigned short type;
+	unsigned short size;
+	unsigned char *data = *p;
+	int tlsext_servername = 0;
+	int renegotiate_seen = 0;
+
+	if (data >= (d+n-2))
+		goto ri_check;
+
+	n2s(data,length);
+	if (data+length != d+n)
+		{
+		*al = SSL_AD_DECODE_ERROR;
+		return 0;
+		}
+
+	while(data <= (d+n-4))
+		{
+		n2s(data,type);
+		n2s(data,size);
+
+		if (data+size > (d+n))
+	   		goto ri_check;
+
+		if (s->tlsext_debug_cb)
+			s->tlsext_debug_cb(s, 1, type, data, size,
+						s->tlsext_debug_arg);
+
+		if (type == TLSEXT_TYPE_server_name)
+			{
+			if (s->tlsext_hostname == NULL || size > 0)
+				{
+				*al = TLS1_AD_UNRECOGNIZED_NAME;
+				return 0;
+				}
+			tlsext_servername = 1;   
+			}
+
+#ifndef OPENSSL_NO_EC
+		else if (type == TLSEXT_TYPE_ec_point_formats &&
+	             s->version != DTLS1_VERSION)
+			{
+			unsigned char *sdata = data;
+			int ecpointformatlist_length = *(sdata++);
+
+			if (ecpointformatlist_length != size - 1)
+				{
+				*al = TLS1_AD_DECODE_ERROR;
+				return 0;
+				}
+			s->session->tlsext_ecpointformatlist_length = 0;
+			if (s->session->tlsext_ecpointformatlist != NULL) OPENSSL_free(s->session->tlsext_ecpointformatlist);
+			if ((s->session->tlsext_ecpointformatlist = OPENSSL_malloc(ecpointformatlist_length)) == NULL)
+				{
+				*al = TLS1_AD_INTERNAL_ERROR;
+				return 0;
+				}
+			s->session->tlsext_ecpointformatlist_length = ecpointformatlist_length;
+			memcpy(s->session->tlsext_ecpointformatlist, sdata, ecpointformatlist_length);
+#if 0
+			fprintf(stderr,"ssl_parse_serverhello_tlsext s->session->tlsext_ecpointformatlist ");
+			sdata = s->session->tlsext_ecpointformatlist;
+			for (i = 0; i < s->session->tlsext_ecpointformatlist_length; i++)
+				fprintf(stderr,"%i ",*(sdata++));
+			fprintf(stderr,"\n");
+#endif
+			}
+#endif /* OPENSSL_NO_EC */
+
+		else if (type == TLSEXT_TYPE_session_ticket)
+			{
+			if (s->tls_session_ticket_ext_cb &&
+			    !s->tls_session_ticket_ext_cb(s, data, size, s->tls_session_ticket_ext_cb_arg))
+				{
+				*al = TLS1_AD_INTERNAL_ERROR;
+				return 0;
+				}
+			if ((SSL_get_options(s) & SSL_OP_NO_TICKET)
+				|| (size > 0))
+				{
+				*al = TLS1_AD_UNSUPPORTED_EXTENSION;
+				return 0;
+				}
+			s->tlsext_ticket_expected = 1;
+			}
+#ifdef TLSEXT_TYPE_opaque_prf_input
+		else if (type == TLSEXT_TYPE_opaque_prf_input &&
+	             s->version != DTLS1_VERSION)
+			{
+			unsigned char *sdata = data;
+
+			if (size < 2)
+				{
+				*al = SSL_AD_DECODE_ERROR;
+				return 0;
+				}
+			n2s(sdata, s->s3->server_opaque_prf_input_len);
+			if (s->s3->server_opaque_prf_input_len != size - 2)
+				{
+				*al = SSL_AD_DECODE_ERROR;
+				return 0;
+				}
+			
+			if (s->s3->server_opaque_prf_input != NULL) /* shouldn't really happen */
+				OPENSSL_free(s->s3->server_opaque_prf_input);
+			if (s->s3->server_opaque_prf_input_len == 0)
+				s->s3->server_opaque_prf_input = OPENSSL_malloc(1); /* dummy byte just to get non-NULL */
+			else
+				s->s3->server_opaque_prf_input = BUF_memdup(sdata, s->s3->server_opaque_prf_input_len);
+
+			if (s->s3->server_opaque_prf_input == NULL)
+				{
+				*al = TLS1_AD_INTERNAL_ERROR;
+				return 0;
+				}
+			}
+#endif
+		else if (type == TLSEXT_TYPE_status_request &&
+		         s->version != DTLS1_VERSION)
+			{
+			/* MUST be empty and only sent if we've requested
+			 * a status request message.
+			 */ 
+			if ((s->tlsext_status_type == -1) || (size > 0))
+				{
+				*al = TLS1_AD_UNSUPPORTED_EXTENSION;
+				return 0;
+				}
+			/* Set flag to expect CertificateStatus message */
+			s->tlsext_status_expected = 1;
+			}
+		else if (type == TLSEXT_TYPE_renegotiate)
+			{
+			if(!ssl_parse_serverhello_renegotiate_ext(s, data, size, al))
+				return 0;
+			renegotiate_seen = 1;
+			}
+		data+=size;		
+		}
+
+	if (data != d+n)
+		{
+		*al = SSL_AD_DECODE_ERROR;
+		return 0;
+		}
+
+	if (!s->hit && tlsext_servername == 1)
+		{
+ 		if (s->tlsext_hostname)
+			{
+			if (s->session->tlsext_hostname == NULL)
+				{
+				s->session->tlsext_hostname = BUF_strdup(s->tlsext_hostname);	
+				if (!s->session->tlsext_hostname)
+					{
+					*al = SSL_AD_UNRECOGNIZED_NAME;
+					return 0;
+					}
+				}
+			else 
+				{
+				*al = SSL_AD_DECODE_ERROR;
+				return 0;
+				}
+			}
+		}
+
+	*p = data;
+
+	ri_check:
+
+	/* Determine if we need to see RI. Strictly speaking if we want to
+	 * avoid an attack we should *always* see RI even on initial server
+	 * hello because the client doesn't see any renegotiation during an
+	 * attack. However this would mean we could not connect to any server
+	 * which doesn't support RI so for the immediate future tolerate RI
+	 * absence on initial connect only.
+	 */
+	if (!renegotiate_seen
+		&& !(s->options & SSL_OP_LEGACY_SERVER_CONNECT)
+		&& !(s->options & SSL_OP_ALLOW_UNSAFE_LEGACY_RENEGOTIATION))
+		{
+		*al = SSL_AD_HANDSHAKE_FAILURE;
+		SSLerr(SSL_F_SSL_PARSE_SERVERHELLO_TLSEXT,
+				SSL_R_UNSAFE_LEGACY_RENEGOTIATION_DISABLED);
+		return 0;
+		}
+
+	return 1;
+	}
+
+
+int ssl_prepare_clienthello_tlsext(SSL *s)
+	{
+#ifndef OPENSSL_NO_EC
+	/* If we are client and using an elliptic curve cryptography cipher suite, send the point formats 
+	 * and elliptic curves we support.
+	 */
+	int using_ecc = 0;
+	int i;
+	unsigned char *j;
+	unsigned long alg_k, alg_a;
+	STACK_OF(SSL_CIPHER) *cipher_stack = SSL_get_ciphers(s);
+
+	for (i = 0; i < sk_SSL_CIPHER_num(cipher_stack); i++)
+		{
+		SSL_CIPHER *c = sk_SSL_CIPHER_value(cipher_stack, i);
+
+		alg_k = c->algorithm_mkey;
+		alg_a = c->algorithm_auth;
+		if ((alg_k & (SSL_kEECDH|SSL_kECDHr|SSL_kECDHe) || (alg_a & SSL_aECDSA)))
+			{
+			using_ecc = 1;
+			break;
+			}
+		}
+	using_ecc = using_ecc && (s->version == TLS1_VERSION);
+	if (using_ecc)
+		{
+		if (s->tlsext_ecpointformatlist != NULL) OPENSSL_free(s->tlsext_ecpointformatlist);
+		if ((s->tlsext_ecpointformatlist = OPENSSL_malloc(3)) == NULL)
+			{
+			SSLerr(SSL_F_SSL_PREPARE_CLIENTHELLO_TLSEXT,ERR_R_MALLOC_FAILURE);
+			return -1;
+			}
+		s->tlsext_ecpointformatlist_length = 3;
+		s->tlsext_ecpointformatlist[0] = TLSEXT_ECPOINTFORMAT_uncompressed;
+		s->tlsext_ecpointformatlist[1] = TLSEXT_ECPOINTFORMAT_ansiX962_compressed_prime;
+		s->tlsext_ecpointformatlist[2] = TLSEXT_ECPOINTFORMAT_ansiX962_compressed_char2;
+
+		/* we support all named elliptic curves in draft-ietf-tls-ecc-12 */
+		if (s->tlsext_ellipticcurvelist != NULL) OPENSSL_free(s->tlsext_ellipticcurvelist);
+		s->tlsext_ellipticcurvelist_length = sizeof(nid_list)/sizeof(nid_list[0]) * 2;
+		if ((s->tlsext_ellipticcurvelist = OPENSSL_malloc(s->tlsext_ellipticcurvelist_length)) == NULL)
+			{
+			s->tlsext_ellipticcurvelist_length = 0;
+			SSLerr(SSL_F_SSL_PREPARE_CLIENTHELLO_TLSEXT,ERR_R_MALLOC_FAILURE);
+			return -1;
+			}
+		for (i = 1, j = s->tlsext_ellipticcurvelist; (unsigned int)i <=
+				sizeof(nid_list)/sizeof(nid_list[0]); i++)
+			s2n(i,j);
+		}
+#endif /* OPENSSL_NO_EC */
+
+#ifdef TLSEXT_TYPE_opaque_prf_input
+ 	{
+		int r = 1;
+	
+		if (s->ctx->tlsext_opaque_prf_input_callback != 0)
+			{
+			r = s->ctx->tlsext_opaque_prf_input_callback(s, NULL, 0, s->ctx->tlsext_opaque_prf_input_callback_arg);
+			if (!r)
+				return -1;
+			}
+
+		if (s->tlsext_opaque_prf_input != NULL)
+			{
+			if (s->s3->client_opaque_prf_input != NULL) /* shouldn't really happen */
+				OPENSSL_free(s->s3->client_opaque_prf_input);
+
+			if (s->tlsext_opaque_prf_input_len == 0)
+				s->s3->client_opaque_prf_input = OPENSSL_malloc(1); /* dummy byte just to get non-NULL */
+			else
+				s->s3->client_opaque_prf_input = BUF_memdup(s->tlsext_opaque_prf_input, s->tlsext_opaque_prf_input_len);
+			if (s->s3->client_opaque_prf_input == NULL)
+				{
+				SSLerr(SSL_F_SSL_PREPARE_CLIENTHELLO_TLSEXT,ERR_R_MALLOC_FAILURE);
+				return -1;
+				}
+			s->s3->client_opaque_prf_input_len = s->tlsext_opaque_prf_input_len;
+			}
+
+		if (r == 2)
+			/* at callback's request, insist on receiving an appropriate server opaque PRF input */
+			s->s3->server_opaque_prf_input_len = s->tlsext_opaque_prf_input_len;
+	}
+#endif
+
+	return 1;
+	}
+
+int ssl_prepare_serverhello_tlsext(SSL *s)
+	{
+#ifndef OPENSSL_NO_EC
+	/* If we are server and using an ECC cipher suite, send the point formats we support 
+	 * if the client sent us an ECPointsFormat extension.  Note that the server is not
+	 * supposed to send an EllipticCurves extension.
+	 */
+
+	unsigned long alg_k = s->s3->tmp.new_cipher->algorithm_mkey;
+	unsigned long alg_a = s->s3->tmp.new_cipher->algorithm_auth;
+	int using_ecc = (alg_k & (SSL_kEECDH|SSL_kECDHr|SSL_kECDHe)) || (alg_a & SSL_aECDSA);
+	using_ecc = using_ecc && (s->session->tlsext_ecpointformatlist != NULL);
+	
+	if (using_ecc)
+		{
+		if (s->tlsext_ecpointformatlist != NULL) OPENSSL_free(s->tlsext_ecpointformatlist);
+		if ((s->tlsext_ecpointformatlist = OPENSSL_malloc(3)) == NULL)
+			{
+			SSLerr(SSL_F_SSL_PREPARE_SERVERHELLO_TLSEXT,ERR_R_MALLOC_FAILURE);
+			return -1;
+			}
+		s->tlsext_ecpointformatlist_length = 3;
+		s->tlsext_ecpointformatlist[0] = TLSEXT_ECPOINTFORMAT_uncompressed;
+		s->tlsext_ecpointformatlist[1] = TLSEXT_ECPOINTFORMAT_ansiX962_compressed_prime;
+		s->tlsext_ecpointformatlist[2] = TLSEXT_ECPOINTFORMAT_ansiX962_compressed_char2;
+		}
+#endif /* OPENSSL_NO_EC */
+
+	return 1;
+	}
+
+int ssl_check_clienthello_tlsext(SSL *s)
+	{
+	int ret=SSL_TLSEXT_ERR_NOACK;
+	int al = SSL_AD_UNRECOGNIZED_NAME;
+
+#ifndef OPENSSL_NO_EC
+	/* The handling of the ECPointFormats extension is done elsewhere, namely in 
+	 * ssl3_choose_cipher in s3_lib.c.
+	 */
+	/* The handling of the EllipticCurves extension is done elsewhere, namely in 
+	 * ssl3_choose_cipher in s3_lib.c.
+	 */
+#endif
+
+	if (s->ctx != NULL && s->ctx->tlsext_servername_callback != 0) 
+		ret = s->ctx->tlsext_servername_callback(s, &al, s->ctx->tlsext_servername_arg);
+	else if (s->initial_ctx != NULL && s->initial_ctx->tlsext_servername_callback != 0) 		
+		ret = s->initial_ctx->tlsext_servername_callback(s, &al, s->initial_ctx->tlsext_servername_arg);
+
+	/* If status request then ask callback what to do.
+ 	 * Note: this must be called after servername callbacks in case 
+ 	 * the certificate has changed.
+ 	 */
+	if ((s->tlsext_status_type != -1) && s->ctx && s->ctx->tlsext_status_cb)
+		{
+		int r;
+		r = s->ctx->tlsext_status_cb(s, s->ctx->tlsext_status_arg);
+		switch (r)
+			{
+			/* We don't want to send a status request response */
+			case SSL_TLSEXT_ERR_NOACK:
+				s->tlsext_status_expected = 0;
+				break;
+			/* status request response should be sent */
+			case SSL_TLSEXT_ERR_OK:
+				if (s->tlsext_ocsp_resp)
+					s->tlsext_status_expected = 1;
+				else
+					s->tlsext_status_expected = 0;
+				break;
+			/* something bad happened */
+			case SSL_TLSEXT_ERR_ALERT_FATAL:
+				ret = SSL_TLSEXT_ERR_ALERT_FATAL;
+				al = SSL_AD_INTERNAL_ERROR;
+				goto err;
+			}
+		}
+	else
+		s->tlsext_status_expected = 0;
+
+#ifdef TLSEXT_TYPE_opaque_prf_input
+ 	{
+		/* This sort of belongs into ssl_prepare_serverhello_tlsext(),
+		 * but we might be sending an alert in response to the client hello,
+		 * so this has to happen here in ssl_check_clienthello_tlsext(). */
+
+		int r = 1;
+	
+		if (s->ctx->tlsext_opaque_prf_input_callback != 0)
+			{
+			r = s->ctx->tlsext_opaque_prf_input_callback(s, NULL, 0, s->ctx->tlsext_opaque_prf_input_callback_arg);
+			if (!r)
+				{
+				ret = SSL_TLSEXT_ERR_ALERT_FATAL;
+				al = SSL_AD_INTERNAL_ERROR;
+				goto err;
+				}
+			}
+
+		if (s->s3->server_opaque_prf_input != NULL) /* shouldn't really happen */
+			OPENSSL_free(s->s3->server_opaque_prf_input);
+		s->s3->server_opaque_prf_input = NULL;
+
+		if (s->tlsext_opaque_prf_input != NULL)
+			{
+			if (s->s3->client_opaque_prf_input != NULL &&
+				s->s3->client_opaque_prf_input_len == s->tlsext_opaque_prf_input_len)
+				{
+				/* can only use this extension if we have a server opaque PRF input
+				 * of the same length as the client opaque PRF input! */
+
+				if (s->tlsext_opaque_prf_input_len == 0)
+					s->s3->server_opaque_prf_input = OPENSSL_malloc(1); /* dummy byte just to get non-NULL */
+				else
+					s->s3->server_opaque_prf_input = BUF_memdup(s->tlsext_opaque_prf_input, s->tlsext_opaque_prf_input_len);
+				if (s->s3->server_opaque_prf_input == NULL)
+					{
+					ret = SSL_TLSEXT_ERR_ALERT_FATAL;
+					al = SSL_AD_INTERNAL_ERROR;
+					goto err;
+					}
+				s->s3->server_opaque_prf_input_len = s->tlsext_opaque_prf_input_len;
+				}
+			}
+
+		if (r == 2 && s->s3->server_opaque_prf_input == NULL)
+			{
+			/* The callback wants to enforce use of the extension,
+			 * but we can't do that with the client opaque PRF input;
+			 * abort the handshake.
+			 */
+			ret = SSL_TLSEXT_ERR_ALERT_FATAL;
+			al = SSL_AD_HANDSHAKE_FAILURE;
+			}
+	}
+
+#endif
+ err:
+	switch (ret)
+		{
+		case SSL_TLSEXT_ERR_ALERT_FATAL:
+			ssl3_send_alert(s,SSL3_AL_FATAL,al); 
+			return -1;
+
+		case SSL_TLSEXT_ERR_ALERT_WARNING:
+			ssl3_send_alert(s,SSL3_AL_WARNING,al);
+			return 1; 
+					
+		case SSL_TLSEXT_ERR_NOACK:
+			s->servername_done=0;
+			default:
+		return 1;
+		}
+	}
+
+int ssl_check_serverhello_tlsext(SSL *s)
+	{
+	int ret=SSL_TLSEXT_ERR_NOACK;
+	int al = SSL_AD_UNRECOGNIZED_NAME;
+
+#ifndef OPENSSL_NO_EC
+	/* If we are client and using an elliptic curve cryptography cipher
+	 * suite, then if server returns an EC point formats lists extension
+	 * it must contain uncompressed.
+	 */
+	unsigned long alg_k = s->s3->tmp.new_cipher->algorithm_mkey;
+	unsigned long alg_a = s->s3->tmp.new_cipher->algorithm_auth;
+	if ((s->tlsext_ecpointformatlist != NULL) && (s->tlsext_ecpointformatlist_length > 0) && 
+	    (s->session->tlsext_ecpointformatlist != NULL) && (s->session->tlsext_ecpointformatlist_length > 0) && 
+	    ((alg_k & (SSL_kEECDH|SSL_kECDHr|SSL_kECDHe)) || (alg_a & SSL_aECDSA)))
+		{
+		/* we are using an ECC cipher */
+		size_t i;
+		unsigned char *list;
+		int found_uncompressed = 0;
+		list = s->session->tlsext_ecpointformatlist;
+		for (i = 0; i < s->session->tlsext_ecpointformatlist_length; i++)
+			{
+			if (*(list++) == TLSEXT_ECPOINTFORMAT_uncompressed)
+				{
+				found_uncompressed = 1;
+				break;
+				}
+			}
+		if (!found_uncompressed)
+			{
+			SSLerr(SSL_F_SSL_CHECK_SERVERHELLO_TLSEXT,SSL_R_TLS_INVALID_ECPOINTFORMAT_LIST);
+			return -1;
+			}
+		}
+	ret = SSL_TLSEXT_ERR_OK;
+#endif /* OPENSSL_NO_EC */
+
+	if (s->ctx != NULL && s->ctx->tlsext_servername_callback != 0) 
+		ret = s->ctx->tlsext_servername_callback(s, &al, s->ctx->tlsext_servername_arg);
+	else if (s->initial_ctx != NULL && s->initial_ctx->tlsext_servername_callback != 0) 		
+		ret = s->initial_ctx->tlsext_servername_callback(s, &al, s->initial_ctx->tlsext_servername_arg);
+
+#ifdef TLSEXT_TYPE_opaque_prf_input
+	if (s->s3->server_opaque_prf_input_len > 0)
+		{
+		/* This case may indicate that we, as a client, want to insist on using opaque PRF inputs.
+		 * So first verify that we really have a value from the server too. */
+
+		if (s->s3->server_opaque_prf_input == NULL)
+			{
+			ret = SSL_TLSEXT_ERR_ALERT_FATAL;
+			al = SSL_AD_HANDSHAKE_FAILURE;
+			}
+		
+		/* Anytime the server *has* sent an opaque PRF input, we need to check
+		 * that we have a client opaque PRF input of the same size. */
+		if (s->s3->client_opaque_prf_input == NULL ||
+		    s->s3->client_opaque_prf_input_len != s->s3->server_opaque_prf_input_len)
+			{
+			ret = SSL_TLSEXT_ERR_ALERT_FATAL;
+			al = SSL_AD_ILLEGAL_PARAMETER;
+			}
+		}
+#endif
+
+	/* If we've requested certificate status and we wont get one
+ 	 * tell the callback
+ 	 */
+	if ((s->tlsext_status_type != -1) && !(s->tlsext_status_expected)
+			&& s->ctx && s->ctx->tlsext_status_cb)
+		{
+		int r;
+		/* Set resp to NULL, resplen to -1 so callback knows
+ 		 * there is no response.
+ 		 */
+		if (s->tlsext_ocsp_resp)
+			{
+			OPENSSL_free(s->tlsext_ocsp_resp);
+			s->tlsext_ocsp_resp = NULL;
+			}
+		s->tlsext_ocsp_resplen = -1;
+		r = s->ctx->tlsext_status_cb(s, s->ctx->tlsext_status_arg);
+		if (r == 0)
+			{
+			al = SSL_AD_BAD_CERTIFICATE_STATUS_RESPONSE;
+			ret = SSL_TLSEXT_ERR_ALERT_FATAL;
+			}
+		if (r < 0)
+			{
+			al = SSL_AD_INTERNAL_ERROR;
+			ret = SSL_TLSEXT_ERR_ALERT_FATAL;
+			}
+		}
+
+	switch (ret)
+		{
+		case SSL_TLSEXT_ERR_ALERT_FATAL:
+			ssl3_send_alert(s,SSL3_AL_FATAL,al); 
+			return -1;
+
+		case SSL_TLSEXT_ERR_ALERT_WARNING:
+			ssl3_send_alert(s,SSL3_AL_WARNING,al);
+			return 1; 
+					
+		case SSL_TLSEXT_ERR_NOACK:
+			s->servername_done=0;
+			default:
+		return 1;
+		}
+	}
+
+/* Since the server cache lookup is done early on in the processing of client
+ * hello and other operations depend on the result we need to handle any TLS
+ * session ticket extension at the same time.
+ */
+
+int tls1_process_ticket(SSL *s, unsigned char *session_id, int len,
+				const unsigned char *limit, SSL_SESSION **ret)
+	{
+	/* Point after session ID in client hello */
+	const unsigned char *p = session_id + len;
+	unsigned short i;
+
+	/* If tickets disabled behave as if no ticket present
+ 	 * to permit stateful resumption.
+ 	 */
+	if (SSL_get_options(s) & SSL_OP_NO_TICKET)
+		return 1;
+
+	if ((s->version <= SSL3_VERSION) || !limit)
+		return 1;
+	if (p >= limit)
+		return -1;
+	/* Skip past DTLS cookie */
+	if (s->version == DTLS1_VERSION || s->version == DTLS1_BAD_VER)
+		{
+		i = *(p++);
+		p+= i;
+		if (p >= limit)
+			return -1;
+		}
+	/* Skip past cipher list */
+	n2s(p, i);
+	p+= i;
+	if (p >= limit)
+		return -1;
+	/* Skip past compression algorithm list */
+	i = *(p++);
+	p += i;
+	if (p > limit)
+		return -1;
+	/* Now at start of extensions */
+	if ((p + 2) >= limit)
+		return 1;
+	n2s(p, i);
+	while ((p + 4) <= limit)
+		{
+		unsigned short type, size;
+		n2s(p, type);
+		n2s(p, size);
+		if (p + size > limit)
+			return 1;
+		if (type == TLSEXT_TYPE_session_ticket)
+			{
+			/* If tickets disabled indicate cache miss which will
+ 			 * trigger a full handshake
+ 			 */
+			if (SSL_get_options(s) & SSL_OP_NO_TICKET)
+				return 1;
+			/* If zero length note client will accept a ticket
+ 			 * and indicate cache miss to trigger full handshake
+ 			 */
+			if (size == 0)
+				{
+				s->tlsext_ticket_expected = 1;
+				return 0;	/* Cache miss */
+				}
+			if (s->tls_session_secret_cb)
+				{
+				/* Indicate cache miss here and instead of
+				 * generating the session from ticket now,
+				 * trigger abbreviated handshake based on
+				 * external mechanism to calculate the master
+				 * secret later. */
+				return 0;
+				}
+			return tls_decrypt_ticket(s, p, size, session_id, len,
+									ret);
+			}
+		p += size;
+		}
+	return 1;
+	}
+
+static int tls_decrypt_ticket(SSL *s, const unsigned char *etick, int eticklen,
+				const unsigned char *sess_id, int sesslen,
+				SSL_SESSION **psess)
+	{
+	SSL_SESSION *sess;
+	unsigned char *sdec;
+	const unsigned char *p;
+	int slen, mlen, renew_ticket = 0;
+	unsigned char tick_hmac[EVP_MAX_MD_SIZE];
+	HMAC_CTX hctx;
+	EVP_CIPHER_CTX ctx;
+	SSL_CTX *tctx = s->initial_ctx;
+	/* Need at least keyname + iv + some encrypted data */
+	if (eticklen < 48)
+		goto tickerr;
+	/* Initialize session ticket encryption and HMAC contexts */
+	HMAC_CTX_init(&hctx);
+	EVP_CIPHER_CTX_init(&ctx);
+	if (tctx->tlsext_ticket_key_cb)
+		{
+		unsigned char *nctick = (unsigned char *)etick;
+		int rv = tctx->tlsext_ticket_key_cb(s, nctick, nctick + 16,
+							&ctx, &hctx, 0);
+		if (rv < 0)
+			return -1;
+		if (rv == 0)
+			goto tickerr;
+		if (rv == 2)
+			renew_ticket = 1;
+		}
+	else
+		{
+		/* Check key name matches */
+		if (memcmp(etick, tctx->tlsext_tick_key_name, 16))
+			goto tickerr;
+		HMAC_Init_ex(&hctx, tctx->tlsext_tick_hmac_key, 16,
+					tlsext_tick_md(), NULL);
+		EVP_DecryptInit_ex(&ctx, EVP_aes_128_cbc(), NULL,
+				tctx->tlsext_tick_aes_key, etick + 16);
+		}
+	/* Attempt to process session ticket, first conduct sanity and
+ 	 * integrity checks on ticket.
+ 	 */
+	mlen = HMAC_size(&hctx);
+	if (mlen < 0)
+		{
+		EVP_CIPHER_CTX_cleanup(&ctx);
+		return -1;
+		}
+	eticklen -= mlen;
+	/* Check HMAC of encrypted ticket */
+	HMAC_Update(&hctx, etick, eticklen);
+	HMAC_Final(&hctx, tick_hmac, NULL);
+	HMAC_CTX_cleanup(&hctx);
+	if (memcmp(tick_hmac, etick + eticklen, mlen))
+		goto tickerr;
+	/* Attempt to decrypt session data */
+	/* Move p after IV to start of encrypted ticket, update length */
+	p = etick + 16 + EVP_CIPHER_CTX_iv_length(&ctx);
+	eticklen -= 16 + EVP_CIPHER_CTX_iv_length(&ctx);
+	sdec = OPENSSL_malloc(eticklen);
+	if (!sdec)
+		{
+		EVP_CIPHER_CTX_cleanup(&ctx);
+		return -1;
+		}
+	EVP_DecryptUpdate(&ctx, sdec, &slen, p, eticklen);
+	if (EVP_DecryptFinal(&ctx, sdec + slen, &mlen) <= 0)
+		goto tickerr;
+	slen += mlen;
+	EVP_CIPHER_CTX_cleanup(&ctx);
+	p = sdec;
+		
+	sess = d2i_SSL_SESSION(NULL, &p, slen);
+	OPENSSL_free(sdec);
+	if (sess)
+		{
+		/* The session ID if non-empty is used by some clients to
+ 		 * detect that the ticket has been accepted. So we copy it to
+ 		 * the session structure. If it is empty set length to zero
+ 		 * as required by standard.
+ 		 */
+		if (sesslen)
+			memcpy(sess->session_id, sess_id, sesslen);
+		sess->session_id_length = sesslen;
+		*psess = sess;
+		s->tlsext_ticket_expected = renew_ticket;
+		return 1;
+		}
+	/* If session decrypt failure indicate a cache miss and set state to
+ 	 * send a new ticket
+ 	 */
+	tickerr:	
+	s->tlsext_ticket_expected = 1;
+	return 0;
+	}
+
+#endif