node/deps/openssl/patches/snap_start.patch

commit ca77729f0395a16f08ff5d54968e05dbd84b331f
Author: Adam Langley <agl@chromium.org>
Date:   Thu Nov 4 16:09:48 2010 -0400

    snap_start.patch

diff --git a/apps/s_server.c b/apps/s_server.c
index c4e19c9..37db8f9 100644
--- a/apps/s_server.c
+++ b/apps/s_server.c
@@ -802,6 +802,7 @@ int MAIN(int argc, char *argv[])
         tlsextctx tlsextcbp = {NULL, NULL, SSL_TLSEXT_ERR_ALERT_WARNING};
 	const char *next_proto_neg_in = NULL;
 	tlsextnextprotoctx next_proto;
+	char snapstart = 0;
 #endif
 
 #if !defined(OPENSSL_NO_SSL2) && !defined(OPENSSL_NO_SSL3)
@@ -1105,6 +1106,10 @@ int MAIN(int argc, char *argv[])
 			if (--argc < 1) goto bad;
 			next_proto_neg_in = *(++argv);
 			}
+		else if	(strcmp(*argv,"-snapstart") == 0)
+			{
+			snapstart = 1;
+			}
 #endif
 #ifndef OPENSSL_NO_JPAKE
 		else if (strcmp(*argv,"-jpake") == 0)
@@ -1389,6 +1394,11 @@ bad:
 		}
 #endif 
 
+	if (snapstart)
+		{
+		static const unsigned char orbit[8] = {1, 2, 3, 4, 5, 6, 7, 8};
+		SSL_CTX_set_snap_start_orbit(ctx, orbit);
+		}
 
 #ifndef OPENSSL_NO_DH
 	if (!no_dhe)
@@ -2031,6 +2041,7 @@ static int init_ssl_connection(SSL *con)
 	unsigned next_proto_neg_len;
 #endif
 
+again:
 	if ((i=SSL_accept(con)) <= 0)
 		{
 		if (BIO_sock_should_retry(i))
@@ -2039,6 +2050,12 @@ static int init_ssl_connection(SSL *con)
 			return(1);
 			}
 
+		if (SSL_get_error(con, i) == SSL_ERROR_SERVER_RANDOM_VALIDATION_PENDING)
+			{
+			SSL_set_suggested_server_random_validity(con, 1);
+			goto again;
+			}
+
 		BIO_printf(bio_err,"ERROR\n");
 		verify_error=SSL_get_verify_result(con);
 		if (verify_error != X509_V_OK)
@@ -2224,6 +2241,9 @@ static int www_body(char *hostname, int s, unsigned char *context)
 			case SSL_ERROR_WANT_READ:
 			case SSL_ERROR_WANT_X509_LOOKUP:
 				continue;
+			case SSL_ERROR_SERVER_RANDOM_VALIDATION_PENDING:
+				SSL_set_suggested_server_random_validity(con, 1);
+				continue;
 			case SSL_ERROR_SYSCALL:
 			case SSL_ERROR_SSL:
 			case SSL_ERROR_ZERO_RETURN:
diff --git a/ssl/s3_enc.c b/ssl/s3_enc.c
index 06e5466..e32f97d 100644
--- a/ssl/s3_enc.c
+++ b/ssl/s3_enc.c
@@ -111,6 +111,7 @@
 
 #include <stdio.h>
 #include "ssl_locl.h"
+#include "fnv1a64.h"
 #include <openssl/evp.h>
 #include <openssl/md5.h>
 
@@ -529,6 +530,11 @@ void ssl3_finish_mac(SSL *s, const unsigned char *buf, int len)
 	{
 	EVP_DigestUpdate(&(s->s3->finish_dgst1),buf,len);
 	EVP_DigestUpdate(&(s->s3->finish_dgst2),buf,len);
+	if (s->s3->snap_start_requested)
+		{
+		/* Compute Fowler-Noll-Vo (FNV) hash for Snap Start handshake */
+		fnv1a64_update((FNV1A64*) s->s3->response_hash, buf, len);
+		}
 	}
 
 int ssl3_cert_verify_mac(SSL *s, EVP_MD_CTX *ctx, unsigned char *p)
diff --git a/ssl/s3_lib.c b/ssl/s3_lib.c
index 84bff8d..1058b4e 100644
--- a/ssl/s3_lib.c
+++ b/ssl/s3_lib.c
@@ -1701,6 +1701,12 @@ void ssl3_free(SSL *s)
 	pq_64bit_free(&(s->s3->rrec.seq_num));
 	pq_64bit_free(&(s->s3->wrec.seq_num));
 
+	if (s->s3->snap_start_client_hello.buf)
+		{
+		/* s->s3->snap_start_records, if set, uses the same buffer */
+		OPENSSL_free(s->s3->snap_start_client_hello.buf);
+		}
+
 	OPENSSL_cleanse(s->s3,sizeof *s->s3);
 	OPENSSL_free(s->s3);
 	s->s3=NULL;
diff --git a/ssl/s3_pkt.c b/ssl/s3_pkt.c
index 6853058..61774b2 100644
--- a/ssl/s3_pkt.c
+++ b/ssl/s3_pkt.c
@@ -120,8 +120,51 @@ static int do_ssl3_write(SSL *s, int type, const unsigned char *buf,
 			 unsigned int len, int create_empty_fragment);
 static int ssl3_get_record(SSL *s);
 
+/* ssl3_read_snap_start_n reads from the opportunistic records contained within
+ * a Snap Start extension. |s->packet| and |s->packet_length| are set to frame
+ * a record within this area. Partial records are not allowed. The Snap Start
+ * records are held in |s->s3->snap_start_records| and the |left| member must
+ * be non-zero on entry.
+ *
+ * If |extend| is true then we'll expand the currently framed record by |n|
+ * bytes, otherwise we frame a new record. */
+static int ssl3_read_snap_start_n(SSL *s, int n, int extend)
+	{
+	if (!extend)
+		{
+		s->packet = s->s3->snap_start_records.buf + s->s3->snap_start_records.offset;
+		s->packet_length = 0;
+		}
+
+	if (s->s3->snap_start_records.left < n)
+		{
+		/* We aren't called unless .left is non-zero, therefore this
+		 * means that we wanted to read more than we have. Since
+		 * partial records aren't allowed, this is fatal. */
+		SSLerr(SSL_F_SSL3_READ_SNAP_START_N,SSL_R_BAD_PACKET_LENGTH);
+		return -1;
+		}
+
+	s->packet_length += n;
+	s->s3->snap_start_records.left -= n;
+	s->s3->snap_start_records.offset += n;
+
+	return n;
+	}
+
 int ssl3_read_n(SSL *s, int n, int max, int extend)
 	{
+	if (s->s3->snap_start_records.left)
+		return ssl3_read_snap_start_n(s, n, extend);
+	else if (s->s3->snap_start_client_hello.buf && !extend)
+		{
+		/* If we started reading the opportunistic records then we know
+		 * that we didn't enter recovery. Thus it's safe to free the
+		 * copy of the ClientHello now because we'll not need it again. */
+		OPENSSL_free(s->s3->snap_start_client_hello.buf);
+		s->s3->snap_start_client_hello.buf = NULL;
+		}
+
 	/* If extend == 0, obtain new n-byte packet; if extend == 1, increase
 	 * packet by another n bytes.
 	 * The packet will be in the sub-array of s->s3->rbuf.buf specified
diff --git a/ssl/s3_srvr.c b/ssl/s3_srvr.c
index 8e0a504..315b8f3 100644
--- a/ssl/s3_srvr.c
+++ b/ssl/s3_srvr.c
@@ -144,6 +144,7 @@
 #include <openssl/md5.h>
 
 static SSL_METHOD *ssl3_get_server_method(int ver);
+static int ssl3_snap_start_evaluate_handshake(SSL* s);
 #ifndef OPENSSL_NO_ECDH
 static int nid2curve_id(int nid);
 #endif
@@ -300,10 +301,36 @@ int ssl3_accept(SSL *s)
 		case SSL3_ST_SW_SRVR_HELLO_A:
 		case SSL3_ST_SW_SRVR_HELLO_B:
 			ret=ssl3_send_server_hello(s);
+			if (ret == SERVER_RANDOM_VALIDATION_PENDING)
+				{
+				s->rwstate = SSL_SERVER_RANDOM_VALIDATE;
+				s->state = SSL3_ST_SW_SRVR_HELLO_A;
+				s->init_num = 0;
+				goto end;
+				}
 			if (ret <= 0) goto end;
 #ifndef OPENSSL_NO_TLSEXT
+			if ((s->s3->tmp.new_cipher->algorithms & SSL_MKEY_MASK) != SSL_kRSA &&
+			    (s->s3->tmp.new_cipher->algorithms & SSL_MKEY_MASK) != SSL_kKRB5 &&
+			    (s->s3->tmp.new_cipher->algorithms & SSL_MKEY_MASK) != SSL_kDHr &&
+			    (s->s3->tmp.new_cipher->algorithms & SSL_MKEY_MASK) != SSL_kDHd &&
+			    (s->s3->tmp.new_cipher->algorithms & SSL_MKEY_MASK) != SSL_kECDH &&
+			    s->s3->snap_start_requested)
+				{
+				/* There's no point in carrying on with a Snap
+				 * Start handshake if we're using a cipher
+				 * suite which is going to send a
+				 * ServerKeyExchange message. */
+				ssl3_snap_start_reset_for_recovery(s);
+				s->state = SSL3_ST_SW_SRVR_HELLO_A;
+				break;
+				}
+
 			if (s->hit)
 				{
+				if (ssl3_snap_start_evaluate_handshake(s))
+					break;
+
 				if (s->tlsext_ticket_expected)
 					s->state=SSL3_ST_SW_SESSION_TICKET_A;
 				else
@@ -440,8 +467,19 @@ int ssl3_accept(SSL *s)
 		case SSL3_ST_SW_SRVR_DONE_B:
 			ret=ssl3_send_server_done(s);
 			if (ret <= 0) goto end;
-			s->s3->tmp.next_state=SSL3_ST_SR_CERT_A;
-			s->state=SSL3_ST_SW_FLUSH;
+
+			if (s->s3->snap_start_requested)
+				{
+				if (ssl3_snap_start_evaluate_handshake(s))
+					break;
+				s->state = SSL3_ST_SR_CERT_A;
+				}
+			else
+				{
+					s->s3->tmp.next_state=SSL3_ST_SR_CERT_A;
+					s->state=SSL3_ST_SW_FLUSH;
+				}
+
 			s->init_num=0;
 			break;
 		
@@ -1152,11 +1190,19 @@ int ssl3_send_server_hello(SSL *s)
 	if (s->state == SSL3_ST_SW_SRVR_HELLO_A)
 		{
 		buf=(unsigned char *)s->init_buf->data;
-		p=s->s3->server_random;
-		Time=(unsigned long)time(NULL);			/* Time */
-		l2n(Time,p);
-		if (RAND_pseudo_bytes(p,SSL3_RANDOM_SIZE-4) <= 0)
-			return -1;
+		if (!s->s3->snap_start_requested)
+			{
+			p=s->s3->server_random;
+			Time=(unsigned long)time(NULL);			/* Time */
+			l2n(Time,p);
+			if (RAND_pseudo_bytes(p,SSL3_RANDOM_SIZE-4) <= 0)
+				return -1;
+			}
+		else if (s->s3->server_random_suggestion_valid == 0)
+			{
+			return SERVER_RANDOM_VALIDATION_PENDING;
+			}
+
 		/* Do the message type and length last */
 		d=p= &(buf[4]);
 
@@ -2952,3 +2998,55 @@ int ssl3_send_cert_status(SSL *s)
 	return(ssl3_do_write(s,SSL3_RT_HANDSHAKE));
 	}
 #endif
+
+/* ssl3_snap_start_evaluate_handshake verifies the Snap Start prediction (if
+ * this is a Snap Start handshake). If it returns non-zero, then we are
+ * entering recovery and |s->state| has been set accordingly. */
+static int ssl3_snap_start_evaluate_handshake(SSL* s)
+	{
+	unsigned char digest[8];
+
+	if (!s->s3->snap_start_requested)
+		return 0;
+
+	/* Drop the currently queued messages. Either we're entering recovery,
+	 * in which case they're wrong, or we're doing snap start, in which
+	 * case we don't want to send them. */
+	if (!ssl_init_wbio_buffer(s, 1 /* push new BIO */))
+		return -1;
+
+	fnv1a64_final(digest, (FNV1A64*) s->s3->response_hash);
+
+	/* Turn off FNV hashing of handshake messages. */
+	s->s3->snap_start_requested = 0;
+
+	if (memcmp(digest, s->s3->predicted_response_hash, sizeof(digest)) != 0)
+		{
+		/* The predicted handshake didn't match. */
+		ssl3_snap_start_reset_for_recovery(s);
+		s->state = SSL3_ST_SW_SRVR_HELLO_A;
+		return 1;
+		}
+
+	return 0;
+	}
+
+/* ssl3_snap_start_reset_for_recovery is called is called when a Snap Start
+ * handshake is impossible because either the application layer has rejected
+ * the client's suggested server random, or predicated_response_hash failed to
+ * match response_hash */
+int ssl3_snap_start_reset_for_recovery(SSL* s)
+	{
+	s->s3->snap_start_requested = 0;
+	s->s3->snap_start_records.left = 0;
+	s->init_num = 0;
+
+	/* Reset the handshake hash and hash in the original ClientHello. */
+	ssl3_init_finished_mac(s);
+	ssl3_finish_mac(s, s->s3->snap_start_client_hello.buf, s->s3->snap_start_client_hello.left);
+
+	OPENSSL_free(s->s3->snap_start_client_hello.buf);
+	s->s3->snap_start_client_hello.buf = NULL;
+
+	return 0;
+	}
diff --git a/ssl/ssl.h b/ssl/ssl.h
index dc8dff8..bbe2543 100644
--- a/ssl/ssl.h
+++ b/ssl/ssl.h
@@ -770,6 +770,11 @@ struct ssl_ctx_st
 
 	X509_VERIFY_PARAM *param;
 
+	/* The configured Snap Start orbit value, if set. */
+	char snap_start_orbit_valid;
+	unsigned char snap_start_orbit[8];
+
+
 #if 0
 	int purpose;		/* Purpose setting */
 	int trust;		/* Trust setting */
@@ -876,10 +881,14 @@ void SSL_CTX_set_cookie_generate_cb(SSL_CTX *ctx, int (*app_gen_cookie_cb)(SSL *
 void SSL_CTX_set_cookie_verify_cb(SSL_CTX *ctx, int (*app_verify_cookie_cb)(SSL *ssl, unsigned char *cookie, unsigned int cookie_len));
 void SSL_CTX_set_next_protos_advertised_cb(SSL_CTX *s, int (*cb) (SSL *ssl, const unsigned char **out, unsigned int *outlen, void *arg), void *arg);
 void SSL_CTX_set_next_proto_select_cb(SSL_CTX *s, int (*cb) (SSL *ssl, unsigned char **out, unsigned char *outlen, const unsigned char *in, unsigned int inlen, void *arg), void *arg);
+void SSL_CTX_set_snap_start_orbit(SSL_CTX *s, const unsigned char orbit[8]);
 
 int SSL_select_next_proto(unsigned char **out, unsigned char *outlen, const unsigned char *in, unsigned int inlen, const unsigned char *client, unsigned int client_len);
 void SSL_get0_next_proto_negotiated(const SSL *s, const unsigned char **data, unsigned *len);
 
+void SSL_get0_suggested_server_random(const SSL *s, const unsigned char **data, unsigned *len);
+void SSL_set_suggested_server_random_validity(SSL *s, char is_valid);
+
 #define OPENSSL_NPN_UNSUPPORTED	0
 #define OPENSSL_NPN_NEGOTIATED	1
 #define OPENSSL_NPN_NO_OVERLAP	2
@@ -888,12 +897,14 @@ void SSL_get0_next_proto_negotiated(const SSL *s, const unsigned char **data, un
 #define SSL_WRITING	2
 #define SSL_READING	3
 #define SSL_X509_LOOKUP	4
+#define SSL_SERVER_RANDOM_VALIDATE	6
 
 /* These will only be used when doing non-blocking IO */
 #define SSL_want_nothing(s)	(SSL_want(s) == SSL_NOTHING)
 #define SSL_want_read(s)	(SSL_want(s) == SSL_READING)
 #define SSL_want_write(s)	(SSL_want(s) == SSL_WRITING)
 #define SSL_want_x509_lookup(s)	(SSL_want(s) == SSL_X509_LOOKUP)
+#define SSL_want_server_random_validation(s)	(SSL_want(s) == SSL_SERVER_RANDOM_VALIDATE)
 
 struct ssl_st
 	{
@@ -1255,6 +1266,7 @@ size_t SSL_get_peer_finished(const SSL *s, void *buf, size_t count);
 #define SSL_ERROR_ZERO_RETURN		6
 #define SSL_ERROR_WANT_CONNECT		7
 #define SSL_ERROR_WANT_ACCEPT		8
+#define SSL_ERROR_SERVER_RANDOM_VALIDATION_PENDING	10
 
 #define SSL_CTRL_NEED_TMP_RSA			1
 #define SSL_CTRL_SET_TMP_RSA			2
@@ -1754,6 +1766,7 @@ void ERR_load_SSL_strings(void);
 #define SSL_F_GET_SERVER_VERIFY				 110
 #define SSL_F_I2D_SSL_SESSION				 111
 #define SSL_F_READ_N					 112
+#define SSL_F_SSL3_READ_SNAP_START_N			 300
 #define SSL_F_REQUEST_CERTIFICATE			 113
 #define SSL_F_SERVER_FINISH				 239
 #define SSL_F_SERVER_HELLO				 114
@@ -1907,7 +1920,7 @@ void ERR_load_SSL_strings(void);
 #define SSL_F_TLS1_ENC					 210
 #define SSL_F_TLS1_SETUP_KEY_BLOCK			 211
 #define SSL_F_WRITE_PENDING				 212
-/* Next entry: 299 */
+/* Next entry: 300 */
 
 /* Reason codes. */
 #define SSL_R_APP_DATA_IN_HANDSHAKE			 100
diff --git a/ssl/ssl3.h b/ssl/ssl3.h
index 54b73b7..4a6e8cf 100644
--- a/ssl/ssl3.h
+++ b/ssl/ssl3.h
@@ -452,6 +452,48 @@ typedef struct ssl3_state_st
         unsigned char previous_server_finished[EVP_MAX_MD_SIZE];
         unsigned char previous_server_finished_len;
         int send_connection_binding; /* TODOEKR */
+
+	/* Snap Start support (server-side only):
+	 *
+	 * Snap Start allows the client to 'suggest' the value of our random
+	 * nonce. Assuming that we accept this suggestion, then the client can
+	 * predict our exact reply and calculate a complete handshake based on
+	 * that. These opportunistic handshake messages are embedded in the
+	 * Snap Start extension, possibly including application data.
+	 *
+	 * (Note that if the handshake doesn't resume a session, the client
+	 * couldn't hope to predict the exact server reply unless it uses the
+	 * session ticket extension to suppress session ID generation.)
+	 *
+	 * All this allows for a TLS handshake that doesn't incur additional
+	 * latency if the client side sends application data first. */
+
+	/* Set if the client presented a Snap Start extension (empty or
+	 * otherwise and the SSL_CTX has a cell configured. Server side only. */
+	int snap_start_ext_seen;
+	/* Set if the client-suggested a server random value (which is stored
+	 * in |server_random|) */
+	char snap_start_requested;
+	/* Set if the appplication has indicated that the client's
+	 * server_random suggestion is acceptable (see
+	 * SSL_set_suggested_server_random_validity). If so, a Snap Start
+	 * handshake will be attempted. */
+	char server_random_suggestion_valid;
+	/* Client's predicted response_hash from client snap start extension.
+	 * Valid if |snap_start_requested| is set. */
+	unsigned char predicted_response_hash[8];
+	/* Actual server handshake message hash.  A Snap Start handshake is
+	 * possible only if predicated_response_hash matches this. */
+	unsigned char response_hash[8];
+	/* If we need to enter snap start recovery then we need to reset the
+	 * Finished hash with a different value for the ClientHello. Thus, we
+	 * need a copy of the whole ClientHello: */
+	SSL3_BUFFER snap_start_client_hello;
+	/* A snap start ClientHello can contain records embedded in an
+	 * extension. If we wish to read them then this points to the records
+	 * within |snap_start_client_hello|. */
+	SSL3_BUFFER snap_start_records;
+
 	} SSL3_STATE;
 
 
diff --git a/ssl/ssl_lib.c b/ssl/ssl_lib.c
index cfa70ec..88358fb 100644
--- a/ssl/ssl_lib.c
+++ b/ssl/ssl_lib.c
@@ -2119,6 +2119,9 @@ int SSL_get_error(const SSL *s,int i)
 			return(SSL_ERROR_SSL);
 		}
 
+	if ((i < 0) && SSL_want_server_random_validation(s))
+		return(SSL_ERROR_SERVER_RANDOM_VALIDATION_PENDING);
+
 	if ((i < 0) && SSL_want_read(s))
 		{
 		bio=SSL_get_rbio(s);
@@ -2876,6 +2879,61 @@ void SSL_CTX_set_next_proto_select_cb(SSL_CTX *ctx, int (*cb) (SSL *s, unsigned
 	ctx->next_proto_select_cb = cb;
 	ctx->next_proto_select_cb_arg = arg;
 	}
+
+/* SSL_CTX_set_snap_start_orbit sets the orbit value which will be echoed back
+ * to the client and enables Snap Start for this context.
+ *
+ * An orbit value can be used to spatially partition the state needed to support
+ * Snap Start. See the comments above SSL_set_suggested_server_random_validity
+ * (below).  */
+void SSL_CTX_set_snap_start_orbit(SSL_CTX *ctx, const unsigned char orbit[8])
+	{
+	memcpy(ctx->snap_start_orbit, orbit, sizeof(ctx->snap_start_orbit));
+	ctx->snap_start_orbit_valid = 1;
+	}
+
+/* Once SSL_accept has returned with SSL_SERVER_RANDOM_VALIDATE, then one can
+ * call this function in order to get the client's suggested server random
+ * value. */
+void SSL_get0_suggested_server_random(const SSL* s, const unsigned char **data, unsigned *length)
+	{
+	if (!s->s3->snap_start_requested)
+		{
+		*data = NULL;
+		*length = 0;
+		return;
+		}
+	*length = 32;
+	*data = s->s3->server_random;
+	}
+
+/* SSL_set_suggested_server_random_validity passes judgement on a
+ * client-suggested random value (obtained from
+ * SSL_get0_suggested_server_random). Rejecting the value triggers a recovery,
+ * while accepting the value /may/ result in a successful Snap Start, as long
+ * as the client predicted the handshake correctly.
+ *
+ * In order to accept a random value the user must ensure that it has NEVER
+ * been used before by this server, or any server configured with any of the
+ * same certificates. It may reject more if necessary.
+ *
+ * The first four bytes of the random value contain a timestamp (UNIX seconds
+ * since the epoch) which can be used to manage a time window.  Additionally,
+ * the following eight bytes contain the orbit which which can also bound the
+ * state required if geographically separate servers share certificates.
+ *
+ * It's recommended that the time window have a maximum size, independent of
+ * the resources available, in order to prevent an attacker from arbitrarily
+ * delaying a Snap Start handshake.
+ */
+void SSL_set_suggested_server_random_validity(SSL *s, char is_valid)
+	{
+	if (is_valid)
+		s->s3->server_random_suggestion_valid = 1;
+	else
+		ssl3_snap_start_reset_for_recovery(s);
+	}
+
 #endif
 
 int SSL_cutthrough_complete(const SSL *s)
diff --git a/ssl/ssl_locl.h b/ssl/ssl_locl.h
index a9183ff..639a185 100644
--- a/ssl/ssl_locl.h
+++ b/ssl/ssl_locl.h
@@ -392,6 +392,11 @@
 #define CERT_PRIVATE_KEY	2
 */
 
+/* This can be returned from ssl3_send_server_hello to indicate that an
+ * offline validation of a client-suggested server_random needs to be
+ * performed. */
+#define SERVER_RANDOM_VALIDATION_PENDING -(TLSEXT_TYPE_snap_start)
+
 #ifndef OPENSSL_NO_EC
 /* From ECC-TLS draft, used in encoding the curve type in 
  * ECParameters
@@ -915,6 +920,7 @@ int ssl3_get_client_certificate(SSL *s);
 int ssl3_get_client_key_exchange(SSL *s);
 int ssl3_get_cert_verify(SSL *s);
 int ssl3_get_next_proto(SSL *s);
+int ssl3_snap_start_reset_for_recovery(SSL* s);
 
 int dtls1_send_hello_request(SSL *s);
 int dtls1_send_server_hello(SSL *s);
diff --git a/ssl/t1_lib.c b/ssl/t1_lib.c
index fd35b18..ce33f16 100644
--- a/ssl/t1_lib.c
+++ b/ssl/t1_lib.c
@@ -62,6 +62,7 @@
 #include <openssl/hmac.h>
 #include <openssl/ocsp.h>
 #include "ssl_locl.h"
+#include "fnv1a64.h"
 
 const char tls1_version_str[]="TLSv1" OPENSSL_VERSION_PTEXT;
 
@@ -368,6 +369,21 @@ unsigned char *ssl_add_serverhello_tlsext(SSL *s, unsigned char *p, unsigned cha
 			}
 		}
 
+	if (s->s3->snap_start_ext_seen)
+		{
+		if ((long)(limit - ret - 14) < 0) return NULL;
+		s2n(TLSEXT_TYPE_snap_start,ret);
+		s2n(10,ret); /* extension length */
+		memcpy(ret, s->ctx->snap_start_orbit, 8);
+		ret += 8;
+		/* This is the ciphersuite that we would pick in the event of a
+		 * Snap Start handshake. (Maybe the server wants to do EDH
+		 * unless the client is Snap Start capable). At the moment we
+		 * don't have any logic to pick a different cipher suite so we
+		 * repeat the choice from the ServerHello. */
+		s2n(s->s3->tmp.new_cipher->id & 0xffff,ret);
+		}
+
 	if ((extdatalen = ret-p-2)== 0) 
 		return p;
 
@@ -375,6 +391,174 @@ unsigned char *ssl_add_serverhello_tlsext(SSL *s, unsigned char *p, unsigned cha
 	return ret;
 	}
 
+
+static int ssl_hash_snap_start_client_hello(SSL* s,
+					    const char* data,
+					    unsigned len,
+					    unsigned ext_len)
+	{
+	/* We walk the ClientHello from the beginning, writing
+	 * adjusted lengths into |b| and hashing as we go.
+	 *
+	 * The resulting ClientHello is going to be shorter by the length of
+	 * this extension, which is |ext_len + 4| (two bytes for the type and two for
+	 * the length). */
+
+	const unsigned char *p;
+	unsigned remaining;
+	unsigned char b[3], *c;
+	unsigned long l;
+
+	p = (unsigned char*) data;
+	remaining = len;
+	/* Handshake header: type */
+	if (!remaining)
+		return 0;
+	ssl3_finish_mac(s, p, 1);
+	p++;
+	remaining--;
+	/* Handshake header: length */
+	if (remaining < 3)
+		return 0;
+	n2l3(p, l);
+	l -= ext_len + 4;
+	c = b;
+	l2n3(l, c);
+	ssl3_finish_mac(s, b, 3);
+	remaining -= 3;
+	/* ClientHello: version and random */
+	if (remaining < 34)
+		return 0;
+	ssl3_finish_mac(s, p, 34);
+	p += 34;
+	remaining -= 34;
+	/* ClientHello: session id length */
+	if (!remaining)
+		return 0;
+	l = *p;
+	ssl3_finish_mac(s, p, 1);
+	p++;
+	remaining--;
+	/* ClientHello: session id */
+	if (remaining < l)
+		return 0;
+	ssl3_finish_mac(s, p, l);
+	p += l;
+	remaining -= l;
+	/* ClientHello: cipher suites length */
+	if (remaining < 2)
+		return 0;
+	ssl3_finish_mac(s, p, 2);
+	n2s(p, l);
+	remaining -= 2;
+	/* ClientHello: cipher suites */
+	if (remaining < l)
+		return 0;
+	ssl3_finish_mac(s, p, l);
+	p += l;
+	remaining -= l;
+	/* ClientHello: compression methods length */
+	if (!remaining)
+		return 0;
+	l = *p;
+	ssl3_finish_mac(s, p, 1);
+	p++;
+	remaining--;
+	/* ClientHello: compression methods */
+	if (remaining < l)
+		return 0;
+	ssl3_finish_mac(s, p, l);
+	p += l;
+	remaining -= l;
+	/* ClientHello: extensions length (must exist given that we're already
+	 * parsing the extensions from it */
+	if (remaining < 2)
+		return 0;
+	n2s(p, l);
+	remaining -= 2;
+	if (l != remaining || l < ext_len + 4)
+		return 0;
+	l -= ext_len + 4;
+	c = b;
+	s2n(l, c);
+	ssl3_finish_mac(s, b, 2);
+
+	while (remaining)
+		{
+		unsigned long extension_type, extension_len;
+		if (remaining < 4)
+			return 0;
+		n2s(p, extension_type);
+		n2s(p, extension_len);
+		remaining -= 4;
+		if (remaining < extension_len)
+			return 0;
+		if (extension_type != TLSEXT_TYPE_snap_start)
+			ssl3_finish_mac(s, p - 4, extension_len + 4);
+		p += extension_len;
+		remaining -= extension_len;
+		}
+
+	return 1;
+	}
+
+static char ssl_parse_snap_start_tlsext(SSL *s, const unsigned char *data, unsigned short len)
+	{
+	ptrdiff_t extension_offset = data - (unsigned char *) s->init_buf->data;
+
+	if (len > 0 && len < 36)
+		return 0;
+	s->s3->snap_start_ext_seen = 1;
+	if (len == 0)
+		return 1;
+
+	fnv1a64_init((FNV1A64*) s->s3->response_hash);
+
+	/* We need to make a copy of the ClientHello because we'll be hashing a
+	 * modified version. However, if we enter recovery then we need to hash
+	 * the unchanged message.
+	 *
+	 * We are adding 4 bytes to the length here because we're including the
+	 * handshake header. */
+	s->s3->snap_start_client_hello.left = s->init_num + 4;
+	s->s3->snap_start_client_hello.offset = 0;
+	s->s3->snap_start_client_hello.buf = OPENSSL_malloc(s->init_num + 4);
+	if (!s->s3->snap_start_client_hello.buf)
+		{
+		/* If we're out of memory then we pretend that we
+		 * didn't see the extension. */
+		s->s3->snap_start_ext_seen = 0;
+		return 1;
+		}
+
+	memcpy(s->s3->snap_start_client_hello.buf, s->init_buf->data, s->init_num + 4);
+	memcpy(s->s3->server_random, s->s3->client_random, 4); /* time */
+	memcpy(s->s3->server_random + 4, data, 28); /* orbit and random bytes */
+	memcpy(s->s3->predicted_response_hash, data + 28, 8);
+
+	/* Point snap_start_records to within the copy of the ClientHello */
+	s->s3->snap_start_records.offset = 0;
+	s->s3->snap_start_records.left = len - 36;
+	s->s3->snap_start_records.buf = s->s3->snap_start_client_hello.buf + extension_offset + 36;
+
+	/* Reset the handshake hash */
+	ssl3_init_finished_mac(s);
+
+	/* Need to hash the ClientHello as if the snap start extension wasn't
+	 * included. */
+	if (!ssl_hash_snap_start_client_hello(
+			s,
+			s->init_buf->data,
+			s->init_num + 4 /* four bytes of handshake header */,
+			len))
+		{
+		return 0;
+		}
+
+	s->s3->snap_start_requested = 1;
+	return 1;
+	}
+
 int ssl_parse_clienthello_tlsext(SSL *s, unsigned char **p, unsigned char *d, int n, int *al)
 	{
 	unsigned short type;
@@ -627,6 +811,12 @@ int ssl_parse_clienthello_tlsext(SSL *s, unsigned char **p, unsigned char *d, in
 			s->s3->next_proto_neg_seen = 1;
 			}
 
+		else if (type == TLSEXT_TYPE_snap_start && s->ctx->snap_start_orbit_valid)
+			{
+			if (ssl_parse_snap_start_tlsext(s, data, size) == 0)
+				return 0;
+			}
+
 		/* session ticket processed earlier */
 
 		data+=size;		
diff --git a/ssl/tls1.h b/ssl/tls1.h
index 71d76de..52ff325 100644
--- a/ssl/tls1.h
+++ b/ssl/tls1.h
@@ -120,6 +120,8 @@ extern "C" {
 
 /* This is not an IANA defined extension number */
 #define TLSEXT_TYPE_next_proto_neg		13172
+  /* http://tools.ietf.org/html/draft-agl-tls-snapstart-00 */
+#define TLSEXT_TYPE_snap_start			13174
 
 /* NameType value from RFC 3546 */
 #define TLSEXT_NAMETYPE_host_name 0