Split ssl3_get_client_key_exchange() into separate per algorithm functions.

ok beck@

1 files changed, 388 insertions, 320 deletions

diff --git a/src/lib/libssl/s3_srvr.c b/src/lib/libssl/s3_srvr.c
index f364955716..65625cef26 100644
--- a/src/lib/libssl/s3_srvr.c
+++ b/src/lib/libssl/s3_srvr.c
@@ -1,4 +1,4 @@
-/* $OpenBSD: s3_srvr.c,v 1.131 2016/11/06 14:44:35 jsing Exp $ */
+/* $OpenBSD: s3_srvr.c,v 1.132 2016/11/06 15:06:52 jsing Exp $ */
 /* Copyright (C) 1995-1998 Eric Young (eay@cryptsoft.com)
  * All rights reserved.
  *
@@ -1629,369 +1629,443 @@ err:
         return (-1);
 }
 
-int
-ssl3_get_client_key_exchange(SSL *s)
+static int
+ssl3_get_client_kex_rsa(SSL *s, unsigned char *p, long n)
 {
-        int i, al, ok;
-        long n;
-        unsigned long alg_k;
-        unsigned char *d, *p;
+        char fakekey[SSL_MAX_MASTER_KEY_LENGTH];
+        unsigned char *d;
         RSA *rsa = NULL;
         EVP_PKEY *pkey = NULL;
-        BIGNUM *pub = NULL;
-        DH *dh_srvr;
+        int i, al;
 
-        EC_KEY *srvr_ecdh = NULL;
-        EVP_PKEY *clnt_pub_pkey = NULL;
-        EC_POINT *clnt_ecpoint = NULL;
-        BN_CTX *bn_ctx = NULL;
+        d = p;
 
-        /* 2048 maxlen is a guess.  How long a key does that permit? */
-        n = s->method->ssl_get_message(s, SSL3_ST_SR_KEY_EXCH_A,
-            SSL3_ST_SR_KEY_EXCH_B, SSL3_MT_CLIENT_KEY_EXCHANGE, 2048, &ok);
-        if (!ok)
-                return ((int)n);
-        d = p = (unsigned char *)s->init_msg;
-
-        alg_k = s->s3->tmp.new_cipher->algorithm_mkey;
+        arc4random_buf(fakekey, sizeof(fakekey));
+        fakekey[0] = s->client_version >> 8;
+        fakekey[1] = s->client_version & 0xff;
 
-        if (alg_k & SSL_kRSA) {
-                char fakekey[SSL_MAX_MASTER_KEY_LENGTH];
+        pkey = s->cert->pkeys[SSL_PKEY_RSA_ENC].privatekey;
+        if ((pkey == NULL) || (pkey->type != EVP_PKEY_RSA) ||
+            (pkey->pkey.rsa == NULL)) {
+                al = SSL_AD_HANDSHAKE_FAILURE;
+                SSLerr(SSL_F_SSL3_GET_CLIENT_KEY_EXCHANGE,
+                    SSL_R_MISSING_RSA_CERTIFICATE);
+                goto f_err;
+        }
+        rsa = pkey->pkey.rsa;
 
-                arc4random_buf(fakekey, sizeof(fakekey));
-                fakekey[0] = s->client_version >> 8;
-                fakekey[1] = s->client_version & 0xff;
+        if (2 > n)
+                goto truncated;
+        n2s(p, i);
+        if (n != i + 2) {
+                SSLerr(SSL_F_SSL3_GET_CLIENT_KEY_EXCHANGE,
+                    SSL_R_TLS_RSA_ENCRYPTED_VALUE_LENGTH_IS_WRONG);
+                goto err;
+        } else
+                n = i;
 
-                pkey = s->cert->pkeys[SSL_PKEY_RSA_ENC].privatekey;
-                if ((pkey == NULL) || (pkey->type != EVP_PKEY_RSA) ||
-                    (pkey->pkey.rsa == NULL)) {
-                        al = SSL_AD_HANDSHAKE_FAILURE;
-                        SSLerr(SSL_F_SSL3_GET_CLIENT_KEY_EXCHANGE,
-                            SSL_R_MISSING_RSA_CERTIFICATE);
-                        goto f_err;
-                }
-                rsa = pkey->pkey.rsa;
+        i = RSA_private_decrypt((int)n, p, p, rsa, RSA_PKCS1_PADDING);
 
-                if (2 > n)
-                        goto truncated;
-                n2s(p, i);
-                if (n != i + 2) {
-                        SSLerr(SSL_F_SSL3_GET_CLIENT_KEY_EXCHANGE,
-                            SSL_R_TLS_RSA_ENCRYPTED_VALUE_LENGTH_IS_WRONG);
-                        goto err;
-                } else
-                        n = i;
-
-                i = RSA_private_decrypt((int)n, p, p, rsa, RSA_PKCS1_PADDING);
+        ERR_clear_error();
 
-                ERR_clear_error();
+        al = -1;
 
-                al = -1;
+        if (i != SSL_MAX_MASTER_KEY_LENGTH) {
+                al = SSL_AD_DECODE_ERROR;
+                /* SSLerr(SSL_F_SSL3_GET_CLIENT_KEY_EXCHANGE,SSL_R_BAD_RSA_DECRYPT); */
+        }
 
-                if (i != SSL_MAX_MASTER_KEY_LENGTH) {
+        if (p - d + 2 > n)      /* needed in the SSL3 case */
+                goto truncated;
+        if ((al == -1) && !((p[0] == (s->client_version >> 8)) &&
+            (p[1] == (s->client_version & 0xff)))) {
+                /*
+                 * The premaster secret must contain the same version
+                 * number as the ClientHello to detect version rollback
+                 * attacks (strangely, the protocol does not offer such
+                 * protection for DH ciphersuites).
+                 * However, buggy clients exist that send the negotiated
+                 * protocol version instead if the server does not
+                 * support the requested protocol version.
+                 * If SSL_OP_TLS_ROLLBACK_BUG is set, tolerate such
+                 * clients.
+                 */
+                if (!((s->options & SSL_OP_TLS_ROLLBACK_BUG) &&
+                    (p[0] == (s->version >> 8)) &&
+                    (p[1] == (s->version & 0xff)))) {
                         al = SSL_AD_DECODE_ERROR;
-                        /* SSLerr(SSL_F_SSL3_GET_CLIENT_KEY_EXCHANGE,SSL_R_BAD_RSA_DECRYPT); */
-                }
+                        /* SSLerr(SSL_F_SSL3_GET_CLIENT_KEY_EXCHANGE,SSL_R_BAD_PROTOCOL_VERSION_NUMBER); */
 
-                if (p - d + 2 > n)      /* needed in the SSL3 case */
-                        goto truncated;
-                if ((al == -1) && !((p[0] == (s->client_version >> 8)) &&
-                    (p[1] == (s->client_version & 0xff)))) {
                         /*
-                         * The premaster secret must contain the same version
-                         * number as the ClientHello to detect version rollback
-                         * attacks (strangely, the protocol does not offer such
-                         * protection for DH ciphersuites).
-                         * However, buggy clients exist that send the negotiated
-                         * protocol version instead if the server does not
-                         * support the requested protocol version.
-                         * If SSL_OP_TLS_ROLLBACK_BUG is set, tolerate such
-                         * clients.
+                         * The Klima-Pokorny-Rosa extension of
+                         * Bleichenbacher's attack
+                         * (http://eprint.iacr.org/2003/052/) exploits
+                         * the version number check as a "bad version
+                         * oracle" -- an alert would reveal that the
+                         * plaintext corresponding to some ciphertext
+                         * made up by the adversary is properly
+                         * formatted except that the version number is
+                         * wrong.
+                         * To avoid such attacks, we should treat this
+                         * just like any other decryption error.
                          */
-                        if (!((s->options & SSL_OP_TLS_ROLLBACK_BUG) &&
-                            (p[0] == (s->version >> 8)) &&
-                            (p[1] == (s->version & 0xff)))) {
-                                al = SSL_AD_DECODE_ERROR;
-                                /* SSLerr(SSL_F_SSL3_GET_CLIENT_KEY_EXCHANGE,SSL_R_BAD_PROTOCOL_VERSION_NUMBER); */
-
-                                /*
-                                 * The Klima-Pokorny-Rosa extension of
-                                 * Bleichenbacher's attack
-                                 * (http://eprint.iacr.org/2003/052/) exploits
-                                 * the version number check as a "bad version
-                                 * oracle" -- an alert would reveal that the
-                                 * plaintext corresponding to some ciphertext
-                                 * made up by the adversary is properly
-                                 * formatted except that the version number is
-                                 * wrong.
-                                 * To avoid such attacks, we should treat this
-                                 * just like any other decryption error.
-                                 */
-                        }
                 }
+        }
 
-                if (al != -1) {
-                        /*
-                         * Some decryption failure -- use random value instead
-                         * as countermeasure against Bleichenbacher's attack
-                         * on PKCS #1 v1.5 RSA padding (see RFC 2246,
-                         * section 7.4.7.1).
-                         */
-                        i = SSL_MAX_MASTER_KEY_LENGTH;
-                        p = fakekey;
-                }
+        if (al != -1) {
+                /*
+                 * Some decryption failure -- use random value instead
+                 * as countermeasure against Bleichenbacher's attack
+                 * on PKCS #1 v1.5 RSA padding (see RFC 2246,
+                 * section 7.4.7.1).
+                 */
+                i = SSL_MAX_MASTER_KEY_LENGTH;
+                p = fakekey;
+        }
 
-                s->session->master_key_length =
-                    s->method->ssl3_enc->generate_master_secret(s,
-                    s->session->master_key,
-                    p, i);
-                explicit_bzero(p, i);
-        } else if (alg_k & SSL_kDHE) {
-                if (2 > n)
-                        goto truncated;
-                n2s(p, i);
-                if (n != i + 2) {
-                        SSLerr(SSL_F_SSL3_GET_CLIENT_KEY_EXCHANGE,
-                            SSL_R_DH_PUBLIC_VALUE_LENGTH_IS_WRONG);
-                        goto err;
-                }
+        s->session->master_key_length =
+            s->method->ssl3_enc->generate_master_secret(s,
+                s->session->master_key, p, i);
+
+        explicit_bzero(p, i);
+
+        return (1);
+truncated:
+        al = SSL_AD_DECODE_ERROR;
+        SSLerr(SSL_F_SSL3_GET_CLIENT_KEY_EXCHANGE, SSL_R_BAD_PACKET_LENGTH);
+f_err:
+        ssl3_send_alert(s, SSL3_AL_FATAL, al);
+err:
+        return (-1);
+}
 
-                if (n == 0L) {
-                        /* the parameters are in the cert */
+static int
+ssl3_get_client_kex_dhe(SSL *s, unsigned char *p, long n)
+{
+        BIGNUM *pub = NULL;
+        DH *dh_srvr;
+        int i, al;
+
+        if (2 > n)
+                goto truncated;
+        n2s(p, i);
+        if (n != i + 2) {
+                SSLerr(SSL_F_SSL3_GET_CLIENT_KEY_EXCHANGE,
+                    SSL_R_DH_PUBLIC_VALUE_LENGTH_IS_WRONG);
+                goto err;
+        }
+
+        if (n == 0L) {
+                /* the parameters are in the cert */
+                al = SSL_AD_HANDSHAKE_FAILURE;
+                SSLerr(SSL_F_SSL3_GET_CLIENT_KEY_EXCHANGE,
+                    SSL_R_UNABLE_TO_DECODE_DH_CERTS);
+                goto f_err;
+        } else {
+                if (s->s3->tmp.dh == NULL) {
                         al = SSL_AD_HANDSHAKE_FAILURE;
                         SSLerr(SSL_F_SSL3_GET_CLIENT_KEY_EXCHANGE,
-                            SSL_R_UNABLE_TO_DECODE_DH_CERTS);
+                            SSL_R_MISSING_TMP_DH_KEY);
                         goto f_err;
-                } else {
-                        if (s->s3->tmp.dh == NULL) {
-                                al = SSL_AD_HANDSHAKE_FAILURE;
-                                SSLerr(SSL_F_SSL3_GET_CLIENT_KEY_EXCHANGE,
-                                    SSL_R_MISSING_TMP_DH_KEY);
-                                goto f_err;
-                        } else
-                                dh_srvr = s->s3->tmp.dh;
-                }
+                } else
+                        dh_srvr = s->s3->tmp.dh;
+        }
 
-                pub = BN_bin2bn(p, i, NULL);
-                if (pub == NULL) {
-                        SSLerr(SSL_F_SSL3_GET_CLIENT_KEY_EXCHANGE,
-                            SSL_R_BN_LIB);
-                        goto err;
-                }
+        pub = BN_bin2bn(p, i, NULL);
+        if (pub == NULL) {
+                SSLerr(SSL_F_SSL3_GET_CLIENT_KEY_EXCHANGE,
+                    SSL_R_BN_LIB);
+                goto err;
+        }
 
-                i = DH_compute_key(p, pub, dh_srvr);
+        i = DH_compute_key(p, pub, dh_srvr);
 
-                if (i <= 0) {
+        if (i <= 0) {
+                SSLerr(SSL_F_SSL3_GET_CLIENT_KEY_EXCHANGE,
+                    ERR_R_DH_LIB);
+                BN_clear_free(pub);
+                goto err;
+        }
+
+        DH_free(s->s3->tmp.dh);
+        s->s3->tmp.dh = NULL;
+
+        BN_clear_free(pub);
+        pub = NULL;
+
+        s->session->master_key_length =
+            s->method->ssl3_enc->generate_master_secret(
+                s, s->session->master_key, p, i);
+
+        explicit_bzero(p, i);
+
+        return (1);
+
+ truncated:
+        al = SSL_AD_DECODE_ERROR;
+        SSLerr(SSL_F_SSL3_GET_CLIENT_KEY_EXCHANGE, SSL_R_BAD_PACKET_LENGTH);
+ f_err:
+        ssl3_send_alert(s, SSL3_AL_FATAL, al);
+ err:
+        return (-1);
+}
+
+static int
+ssl3_get_client_kex_ecdhe(SSL *s, unsigned char *p, long n)
+{
+        EC_KEY *srvr_ecdh = NULL;
+        EVP_PKEY *clnt_pub_pkey = NULL;
+        EC_POINT *clnt_ecpoint = NULL;
+        BN_CTX *bn_ctx = NULL;
+        int i, al;
+
+        int ret = 1;
+        int key_size;
+        const EC_KEY   *tkey;
+        const EC_GROUP *group;
+        const BIGNUM *priv_key;
+
+        /* Initialize structures for server's ECDH key pair. */
+        if ((srvr_ecdh = EC_KEY_new()) == NULL) {
+                SSLerr(SSL_F_SSL3_GET_CLIENT_KEY_EXCHANGE,
+                    ERR_R_MALLOC_FAILURE);
+                goto err;
+        }
+
+        /*
+         * Use the ephemeral values we saved when
+         * generating the ServerKeyExchange message.
+         */
+        tkey = s->s3->tmp.ecdh;
+
+        group = EC_KEY_get0_group(tkey);
+        priv_key = EC_KEY_get0_private_key(tkey);
+
+        if (!EC_KEY_set_group(srvr_ecdh, group) ||
+            !EC_KEY_set_private_key(srvr_ecdh, priv_key)) {
+                SSLerr(SSL_F_SSL3_GET_CLIENT_KEY_EXCHANGE,
+                    ERR_R_EC_LIB);
+                goto err;
+        }
+
+        /* Let's get client's public key */
+        if ((clnt_ecpoint = EC_POINT_new(group)) == NULL) {
+                SSLerr(SSL_F_SSL3_GET_CLIENT_KEY_EXCHANGE,
+                    ERR_R_MALLOC_FAILURE);
+                goto err;
+        }
+
+        if (n == 0L) {
+                /* Client Publickey was in Client Certificate */
+                if (((clnt_pub_pkey = X509_get_pubkey(
+                    s->session->peer)) == NULL) ||
+                    (clnt_pub_pkey->type != EVP_PKEY_EC)) {
+                        /*
+                         * XXX: For now, we do not support client
+                         * authentication using ECDH certificates
+                         * so this branch (n == 0L) of the code is
+                         * never executed. When that support is
+                         * added, we ought to ensure the key
+                         * received in the certificate is
+                         * authorized for key agreement.
+                         * ECDH_compute_key implicitly checks that
+                         * the two ECDH shares are for the same
+                         * group.
+                         */
+                        al = SSL_AD_HANDSHAKE_FAILURE;
                         SSLerr(SSL_F_SSL3_GET_CLIENT_KEY_EXCHANGE,
-                            ERR_R_DH_LIB);
-                        BN_clear_free(pub);
-                        goto err;
+                            SSL_R_UNABLE_TO_DECODE_ECDH_CERTS);
+                        goto f_err;
                 }
 
-                DH_free(s->s3->tmp.dh);
-                s->s3->tmp.dh = NULL;
-
-                BN_clear_free(pub);
-                pub = NULL;
-                s->session->master_key_length =
-                    s->method->ssl3_enc->generate_master_secret(
-                        s, s->session->master_key, p, i);
-                explicit_bzero(p, i);
-        } else if (alg_k & SSL_kECDHE) {
-                int ret = 1;
-                int key_size;
-                const EC_KEY   *tkey;
-                const EC_GROUP *group;
-                const BIGNUM *priv_key;
-
-                /* Initialize structures for server's ECDH key pair. */
-                if ((srvr_ecdh = EC_KEY_new()) == NULL) {
+                if (EC_POINT_copy(clnt_ecpoint,
+                    EC_KEY_get0_public_key(clnt_pub_pkey->pkey.ec))
+                    == 0) {
                         SSLerr(SSL_F_SSL3_GET_CLIENT_KEY_EXCHANGE,
-                            ERR_R_MALLOC_FAILURE);
+                            ERR_R_EC_LIB);
                         goto err;
                 }
-
+                ret = 2; /* Skip certificate verify processing */
+        } else {
                 /*
-                 * Use the ephemeral values we saved when
-                 * generating the ServerKeyExchange message.
+                 * Get client's public key from encoded point
+                 * in the ClientKeyExchange message.
                  */
-                tkey = s->s3->tmp.ecdh;
+                if ((bn_ctx = BN_CTX_new()) == NULL) {
+                        SSLerr(SSL_F_SSL3_GET_CLIENT_KEY_EXCHANGE,
+                            ERR_R_MALLOC_FAILURE);
+                        goto err;
+                }
 
-                group = EC_KEY_get0_group(tkey);
-                priv_key = EC_KEY_get0_private_key(tkey);
+                /* Get encoded point length */
+                i = *p;
 
-                if (!EC_KEY_set_group(srvr_ecdh, group) ||
-                    !EC_KEY_set_private_key(srvr_ecdh, priv_key)) {
+                p += 1;
+                if (n != 1 + i) {
                         SSLerr(SSL_F_SSL3_GET_CLIENT_KEY_EXCHANGE,
                             ERR_R_EC_LIB);
                         goto err;
                 }
-
-                /* Let's get client's public key */
-                if ((clnt_ecpoint = EC_POINT_new(group)) == NULL) {
+                if (EC_POINT_oct2point(group,
+                        clnt_ecpoint, p, i, bn_ctx) == 0) {
                         SSLerr(SSL_F_SSL3_GET_CLIENT_KEY_EXCHANGE,
-                            ERR_R_MALLOC_FAILURE);
+                            ERR_R_EC_LIB);
                         goto err;
                 }
+                /*
+                 * p is pointing to somewhere in the buffer
+                 * currently, so set it to the start.
+                 */
+                p = (unsigned char *)s->init_buf->data;
+        }
 
-                if (n == 0L) {
-                        /* Client Publickey was in Client Certificate */
-                        if (((clnt_pub_pkey = X509_get_pubkey(
-                            s->session->peer)) == NULL) ||
-                            (clnt_pub_pkey->type != EVP_PKEY_EC)) {
-                                /*
-                                 * XXX: For now, we do not support client
-                                 * authentication using ECDH certificates
-                                 * so this branch (n == 0L) of the code is
-                                 * never executed. When that support is
-                                 * added, we ought to ensure the key
-                                 * received in the certificate is
-                                 * authorized for key agreement.
-                                 * ECDH_compute_key implicitly checks that
-                                 * the two ECDH shares are for the same
-                                 * group.
-                                 */
-                                al = SSL_AD_HANDSHAKE_FAILURE;
-                                SSLerr(SSL_F_SSL3_GET_CLIENT_KEY_EXCHANGE,
-                                    SSL_R_UNABLE_TO_DECODE_ECDH_CERTS);
-                                goto f_err;
-                        }
+        /* Compute the shared pre-master secret */
+        key_size = ECDH_size(srvr_ecdh);
+        if (key_size <= 0) {
+                SSLerr(SSL_F_SSL3_GET_CLIENT_KEY_EXCHANGE,
+                    ERR_R_ECDH_LIB);
+                goto err;
+        }
+        i = ECDH_compute_key(p, key_size, clnt_ecpoint, srvr_ecdh,
+            NULL);
+        if (i <= 0) {
+                SSLerr(SSL_F_SSL3_GET_CLIENT_KEY_EXCHANGE,
+                    ERR_R_ECDH_LIB);
+                goto err;
+        }
 
-                        if (EC_POINT_copy(clnt_ecpoint,
-                            EC_KEY_get0_public_key(clnt_pub_pkey->pkey.ec))
-                            == 0) {
-                                SSLerr(SSL_F_SSL3_GET_CLIENT_KEY_EXCHANGE,
-                                    ERR_R_EC_LIB);
-                                goto err;
-                        }
-                        ret = 2; /* Skip certificate verify processing */
-                } else {
-                        /*
-                         * Get client's public key from encoded point
-                         * in the ClientKeyExchange message.
-                         */
-                        if ((bn_ctx = BN_CTX_new()) == NULL) {
-                                SSLerr(SSL_F_SSL3_GET_CLIENT_KEY_EXCHANGE,
-                                    ERR_R_MALLOC_FAILURE);
-                                goto err;
-                        }
+        EVP_PKEY_free(clnt_pub_pkey);
+        EC_POINT_free(clnt_ecpoint);
+        EC_KEY_free(srvr_ecdh);
+        BN_CTX_free(bn_ctx);
+        EC_KEY_free(s->s3->tmp.ecdh);
+        s->s3->tmp.ecdh = NULL;
 
-                        /* Get encoded point length */
-                        i = *p;
+        /* Compute the master secret */
+        s->session->master_key_length =
+            s->method->ssl3_enc->generate_master_secret(
+                s, s->session->master_key, p, i);
 
-                        p += 1;
-                        if (n != 1 + i) {
-                                SSLerr(SSL_F_SSL3_GET_CLIENT_KEY_EXCHANGE,
-                                    ERR_R_EC_LIB);
-                                goto err;
-                        }
-                        if (EC_POINT_oct2point(group,
-                                clnt_ecpoint, p, i, bn_ctx) == 0) {
-                                SSLerr(SSL_F_SSL3_GET_CLIENT_KEY_EXCHANGE,
-                                    ERR_R_EC_LIB);
-                                goto err;
-                        }
-                        /*
-                         * p is pointing to somewhere in the buffer
-                         * currently, so set it to the start.
-                         */
-                        p = (unsigned char *)s->init_buf->data;
-                }
+        explicit_bzero(p, i);
+        return (ret);
 
-                /* Compute the shared pre-master secret */
-                key_size = ECDH_size(srvr_ecdh);
-                if (key_size <= 0) {
-                        SSLerr(SSL_F_SSL3_GET_CLIENT_KEY_EXCHANGE,
-                            ERR_R_ECDH_LIB);
-                        goto err;
-                }
-                i = ECDH_compute_key(p, key_size, clnt_ecpoint, srvr_ecdh,
-                    NULL);
-                if (i <= 0) {
-                        SSLerr(SSL_F_SSL3_GET_CLIENT_KEY_EXCHANGE,
-                            ERR_R_ECDH_LIB);
-                        goto err;
-                }
+ f_err:
+        ssl3_send_alert(s, SSL3_AL_FATAL, al);
+ err:
+        EVP_PKEY_free(clnt_pub_pkey);
+        EC_POINT_free(clnt_ecpoint);
+        EC_KEY_free(srvr_ecdh);
+        BN_CTX_free(bn_ctx);
+        return (-1);
+}
 
-                EVP_PKEY_free(clnt_pub_pkey);
-                EC_POINT_free(clnt_ecpoint);
-                EC_KEY_free(srvr_ecdh);
-                BN_CTX_free(bn_ctx);
-                EC_KEY_free(s->s3->tmp.ecdh);
-                s->s3->tmp.ecdh = NULL;
+static int
+ssl3_get_client_kex_gost(SSL *s, unsigned char *p, long n)
+{
 
+        EVP_PKEY_CTX *pkey_ctx;
+        EVP_PKEY *client_pub_pkey = NULL, *pk = NULL;
+        unsigned char premaster_secret[32], *start;
+        size_t outlen = 32, inlen;
+        unsigned long alg_a;
+        int Ttag, Tclass;
+        long Tlen;
+        int al;
+        int ret = 0;
 
-                /* Compute the master secret */
-                s->session->master_key_length = s->method->ssl3_enc-> \
-                    generate_master_secret(s, s->session->master_key, p, i);
+        /* Get our certificate private key*/
+        alg_a = s->s3->tmp.new_cipher->algorithm_auth;
+        if (alg_a & SSL_aGOST01)
+                pk = s->cert->pkeys[SSL_PKEY_GOST01].privatekey;
 
-                explicit_bzero(p, i);
+        pkey_ctx = EVP_PKEY_CTX_new(pk, NULL);
+        EVP_PKEY_decrypt_init(pkey_ctx);
+        /*
+         * If client certificate is present and is of the same type,
+         * maybe use it for key exchange.
+         * Don't mind errors from EVP_PKEY_derive_set_peer, because
+         * it is completely valid to use a client certificate for
+         * authorization only.
+         */
+        client_pub_pkey = X509_get_pubkey(s->session->peer);
+        if (client_pub_pkey) {
+                if (EVP_PKEY_derive_set_peer(pkey_ctx,
+                    client_pub_pkey) <= 0)
+                        ERR_clear_error();
+        }
+        if (2 > n)
+                goto truncated;
+        /* Decrypt session key */
+        if (ASN1_get_object((const unsigned char **)&p, &Tlen, &Ttag,
+            &Tclass, n) != V_ASN1_CONSTRUCTED ||
+            Ttag != V_ASN1_SEQUENCE || Tclass != V_ASN1_UNIVERSAL) {
+                SSLerr(SSL_F_SSL3_GET_CLIENT_KEY_EXCHANGE,
+                    SSL_R_DECRYPTION_FAILED);
+                goto gerr;
+        }
+        start = p;
+        inlen = Tlen;
+        if (EVP_PKEY_decrypt(pkey_ctx, premaster_secret, &outlen,
+            start, inlen) <=0) {
+                SSLerr(SSL_F_SSL3_GET_CLIENT_KEY_EXCHANGE,
+                    SSL_R_DECRYPTION_FAILED);
+                goto gerr;
+        }
+        /* Generate master secret */
+        s->session->master_key_length =
+            s->method->ssl3_enc->generate_master_secret(
+                s, s->session->master_key, premaster_secret, 32);
+        /* Check if pubkey from client certificate was used */
+        if (EVP_PKEY_CTX_ctrl(pkey_ctx, -1, -1,
+            EVP_PKEY_CTRL_PEER_KEY, 2, NULL) > 0)
+                ret = 2;
+        else
+                ret = 1;
+ gerr:
+        EVP_PKEY_free(client_pub_pkey);
+        EVP_PKEY_CTX_free(pkey_ctx);
+        if (ret)
                 return (ret);
-        } else
-        if (alg_k & SSL_kGOST) {
-                int ret = 0;
-                EVP_PKEY_CTX *pkey_ctx;
-                EVP_PKEY *client_pub_pkey = NULL, *pk = NULL;
-                unsigned char premaster_secret[32], *start;
-                size_t outlen = 32, inlen;
-                unsigned long alg_a;
-                int Ttag, Tclass;
-                long Tlen;
-
-                /* Get our certificate private key*/
-                alg_a = s->s3->tmp.new_cipher->algorithm_auth;
-                if (alg_a & SSL_aGOST01)
-                        pk = s->cert->pkeys[SSL_PKEY_GOST01].privatekey;
-
-                pkey_ctx = EVP_PKEY_CTX_new(pk, NULL);
-                EVP_PKEY_decrypt_init(pkey_ctx);
-                /*
-                 * If client certificate is present and is of the same type,
-                 * maybe use it for key exchange.
-                 * Don't mind errors from EVP_PKEY_derive_set_peer, because
-                 * it is completely valid to use a client certificate for
-                 * authorization only.
-                 */
-                client_pub_pkey = X509_get_pubkey(s->session->peer);
-                if (client_pub_pkey) {
-                        if (EVP_PKEY_derive_set_peer(pkey_ctx,
-                            client_pub_pkey) <= 0)
-                                ERR_clear_error();
-                }
-                if (2 > n)
-                        goto truncated;
-                /* Decrypt session key */
-                if (ASN1_get_object((const unsigned char **)&p, &Tlen, &Ttag,
-                    &Tclass, n) != V_ASN1_CONSTRUCTED ||
-                    Ttag != V_ASN1_SEQUENCE || Tclass != V_ASN1_UNIVERSAL) {
-                        SSLerr(SSL_F_SSL3_GET_CLIENT_KEY_EXCHANGE,
-                            SSL_R_DECRYPTION_FAILED);
-                        goto gerr;
-                }
-                start = p;
-                inlen = Tlen;
-                if (EVP_PKEY_decrypt(pkey_ctx, premaster_secret, &outlen,
-                    start, inlen) <=0) {
-                        SSLerr(SSL_F_SSL3_GET_CLIENT_KEY_EXCHANGE,
-                            SSL_R_DECRYPTION_FAILED);
-                        goto gerr;
-                }
-                /* Generate master secret */
-                s->session->master_key_length =
-                    s->method->ssl3_enc->generate_master_secret(
-                    s, s->session->master_key, premaster_secret, 32);
-                /* Check if pubkey from client certificate was used */
-                if (EVP_PKEY_CTX_ctrl(pkey_ctx, -1, -1,
-                    EVP_PKEY_CTRL_PEER_KEY, 2, NULL) > 0)
-                        ret = 2;
-                else
-                        ret = 1;
-gerr:
-                EVP_PKEY_free(client_pub_pkey);
-                EVP_PKEY_CTX_free(pkey_ctx);
-                if (ret)
-                        return (ret);
-                else
+        else
+                goto err;
+
+ truncated:
+        al = SSL_AD_DECODE_ERROR;
+        SSLerr(SSL_F_SSL3_GET_CLIENT_KEY_EXCHANGE, SSL_R_BAD_PACKET_LENGTH);
+        ssl3_send_alert(s, SSL3_AL_FATAL, al);
+ err:
+        return (-1);
+}
+
+int
+ssl3_get_client_key_exchange(SSL *s)
+{
+        unsigned long alg_k;
+        unsigned char *p;
+        int al, ok;
+        long n;
+
+        /* 2048 maxlen is a guess.  How long a key does that permit? */
+        n = s->method->ssl_get_message(s, SSL3_ST_SR_KEY_EXCH_A,
+            SSL3_ST_SR_KEY_EXCH_B, SSL3_MT_CLIENT_KEY_EXCHANGE, 2048, &ok);
+        if (!ok)
+                return ((int)n);
+
+        p = (unsigned char *)s->init_msg;
+
+        alg_k = s->s3->tmp.new_cipher->algorithm_mkey;
+
+        if (alg_k & SSL_kRSA) {
+                if (ssl3_get_client_kex_rsa(s, p, n) != 1)
+                        goto err;
+        } else if (alg_k & SSL_kDHE) {
+                if (ssl3_get_client_kex_dhe(s, p, n) != 1)
+                        goto err;
+        } else if (alg_k & SSL_kECDHE) {
+                if (ssl3_get_client_kex_ecdhe(s, p, n) != 1)
+                        goto err;
+        } else if (alg_k & SSL_kGOST) {
+                if (ssl3_get_client_kex_gost(s, p, n) != 1)
                         goto err;
         } else {
                 al = SSL_AD_HANDSHAKE_FAILURE;
@@ -2001,16 +2075,10 @@ gerr:
         }
 
         return (1);
-truncated:
-        al = SSL_AD_DECODE_ERROR;
-        SSLerr(SSL_F_SSL3_GET_CLIENT_KEY_EXCHANGE, SSL_R_BAD_PACKET_LENGTH);
-f_err:
+
+ f_err:
         ssl3_send_alert(s, SSL3_AL_FATAL, al);
-err:
-        EVP_PKEY_free(clnt_pub_pkey);
-        EC_POINT_free(clnt_ecpoint);
-        EC_KEY_free(srvr_ecdh);
-        BN_CTX_free(bn_ctx);
+ err:
         return (-1);
 }