summaryrefslogtreecommitdiff
path: root/src
diff options
context:
space:
mode:
authorbeck <>2017-01-26 10:40:21 +0000
committerbeck <>2017-01-26 10:40:21 +0000
commita4abf558fd44464a5a48bfeb5393b01002f66c5e (patch)
treee105a2b33d3aefb54727a955e9c746cc8edb0e50 /src
parentb7978753e566fd60946300b252a9d9d89559733e (diff)
downloadopenbsd-a4abf558fd44464a5a48bfeb5393b01002f66c5e.tar.gz
openbsd-a4abf558fd44464a5a48bfeb5393b01002f66c5e.tar.bz2
openbsd-a4abf558fd44464a5a48bfeb5393b01002f66c5e.zip
Send the error function codes to rot in the depths of hell where they belong
We leave a single funciton code (0xFFF) to say "SSL_internal" so the public API will not break, and we replace all internal use of the two argument SSL_err() with the internal only SSL_error() that only takes a reason code. ok jsing@
Diffstat (limited to '')
-rw-r--r--src/lib/libssl/d1_both.c18
-rw-r--r--src/lib/libssl/d1_clnt.c8
-rw-r--r--src/lib/libssl/d1_lib.c4
-rw-r--r--src/lib/libssl/d1_pkt.c42
-rw-r--r--src/lib/libssl/d1_srtp.c32
-rw-r--r--src/lib/libssl/d1_srvr.c12
-rw-r--r--src/lib/libssl/s3_lib.c48
-rw-r--r--src/lib/libssl/ssl_asn1.c4
-rw-r--r--src/lib/libssl/ssl_both.c26
-rw-r--r--src/lib/libssl/ssl_cert.c32
-rw-r--r--src/lib/libssl/ssl_ciph.c12
-rw-r--r--src/lib/libssl/ssl_clnt.c262
-rw-r--r--src/lib/libssl/ssl_err.c224
-rw-r--r--src/lib/libssl/ssl_lib.c98
-rw-r--r--src/lib/libssl/ssl_locl.h4
-rw-r--r--src/lib/libssl/ssl_packet.c18
-rw-r--r--src/lib/libssl/ssl_pkt.c74
-rw-r--r--src/lib/libssl/ssl_rsa.c104
-rw-r--r--src/lib/libssl/ssl_sess.c30
-rw-r--r--src/lib/libssl/ssl_srvr.c220
-rw-r--r--src/lib/libssl/ssl_txt.c4
-rw-r--r--src/lib/libssl/t1_enc.c44
-rw-r--r--src/lib/libssl/t1_lib.c26
-rw-r--r--src/lib/libssl/t1_reneg.c24
24 files changed, 572 insertions, 798 deletions
diff --git a/src/lib/libssl/d1_both.c b/src/lib/libssl/d1_both.c
index a9a4c1a13b..fb7e289d96 100644
--- a/src/lib/libssl/d1_both.c
+++ b/src/lib/libssl/d1_both.c
@@ -1,4 +1,4 @@
1/* $OpenBSD: d1_both.c,v 1.46 2017/01/23 13:36:12 jsing Exp $ */ 1/* $OpenBSD: d1_both.c,v 1.47 2017/01/26 10:40:21 beck Exp $ */
2/* 2/*
3 * DTLS implementation written by Nagendra Modadugu 3 * DTLS implementation written by Nagendra Modadugu
4 * (nagendra@cs.stanford.edu) for the OpenSSL project 2005. 4 * (nagendra@cs.stanford.edu) for the OpenSSL project 2005.
@@ -410,7 +410,7 @@ dtls1_get_message(SSL *s, int st1, int stn, int mt, long max, int *ok)
410 S3I(s)->tmp.reuse_message = 0; 410 S3I(s)->tmp.reuse_message = 0;
411 if ((mt >= 0) && (S3I(s)->tmp.message_type != mt)) { 411 if ((mt >= 0) && (S3I(s)->tmp.message_type != mt)) {
412 al = SSL_AD_UNEXPECTED_MESSAGE; 412 al = SSL_AD_UNEXPECTED_MESSAGE;
413 SSLerr(SSL_F_DTLS1_GET_MESSAGE, 413 SSLerror(
414 SSL_R_UNEXPECTED_MESSAGE); 414 SSL_R_UNEXPECTED_MESSAGE);
415 goto f_err; 415 goto f_err;
416 } 416 }
@@ -476,13 +476,13 @@ dtls1_preprocess_fragment(SSL *s, struct hm_header_st *msg_hdr, int max)
476 476
477 /* sanity checking */ 477 /* sanity checking */
478 if ((frag_off + frag_len) > msg_len) { 478 if ((frag_off + frag_len) > msg_len) {
479 SSLerr(SSL_F_DTLS1_PREPROCESS_FRAGMENT, 479 SSLerror(
480 SSL_R_EXCESSIVE_MESSAGE_SIZE); 480 SSL_R_EXCESSIVE_MESSAGE_SIZE);
481 return SSL_AD_ILLEGAL_PARAMETER; 481 return SSL_AD_ILLEGAL_PARAMETER;
482 } 482 }
483 483
484 if ((frag_off + frag_len) > (unsigned long)max) { 484 if ((frag_off + frag_len) > (unsigned long)max) {
485 SSLerr(SSL_F_DTLS1_PREPROCESS_FRAGMENT, 485 SSLerror(
486 SSL_R_EXCESSIVE_MESSAGE_SIZE); 486 SSL_R_EXCESSIVE_MESSAGE_SIZE);
487 return SSL_AD_ILLEGAL_PARAMETER; 487 return SSL_AD_ILLEGAL_PARAMETER;
488 } 488 }
@@ -495,7 +495,7 @@ dtls1_preprocess_fragment(SSL *s, struct hm_header_st *msg_hdr, int max)
495 */ 495 */
496 if (!BUF_MEM_grow_clean(s->internal->init_buf, 496 if (!BUF_MEM_grow_clean(s->internal->init_buf,
497 msg_len + DTLS1_HM_HEADER_LENGTH)) { 497 msg_len + DTLS1_HM_HEADER_LENGTH)) {
498 SSLerr(SSL_F_DTLS1_PREPROCESS_FRAGMENT, ERR_R_BUF_LIB); 498 SSLerror(ERR_R_BUF_LIB);
499 return SSL_AD_INTERNAL_ERROR; 499 return SSL_AD_INTERNAL_ERROR;
500 } 500 }
501 501
@@ -509,7 +509,7 @@ dtls1_preprocess_fragment(SSL *s, struct hm_header_st *msg_hdr, int max)
509 * They must be playing with us! BTW, failure to enforce 509 * They must be playing with us! BTW, failure to enforce
510 * upper limit would open possibility for buffer overrun. 510 * upper limit would open possibility for buffer overrun.
511 */ 511 */
512 SSLerr(SSL_F_DTLS1_PREPROCESS_FRAGMENT, 512 SSLerror(
513 SSL_R_EXCESSIVE_MESSAGE_SIZE); 513 SSL_R_EXCESSIVE_MESSAGE_SIZE);
514 return SSL_AD_ILLEGAL_PARAMETER; 514 return SSL_AD_ILLEGAL_PARAMETER;
515 } 515 }
@@ -803,7 +803,7 @@ again:
803 /* parse the message fragment header */ 803 /* parse the message fragment header */
804 dtls1_get_message_header(wire, &msg_hdr) == 0) { 804 dtls1_get_message_header(wire, &msg_hdr) == 0) {
805 al = SSL_AD_UNEXPECTED_MESSAGE; 805 al = SSL_AD_UNEXPECTED_MESSAGE;
806 SSLerr(SSL_F_DTLS1_GET_MESSAGE_FRAGMENT, 806 SSLerror(
807 SSL_R_UNEXPECTED_MESSAGE); 807 SSL_R_UNEXPECTED_MESSAGE);
808 goto f_err; 808 goto f_err;
809 } 809 }
@@ -846,7 +846,7 @@ again:
846 else /* Incorrectly formated Hello request */ 846 else /* Incorrectly formated Hello request */
847 { 847 {
848 al = SSL_AD_UNEXPECTED_MESSAGE; 848 al = SSL_AD_UNEXPECTED_MESSAGE;
849 SSLerr(SSL_F_DTLS1_GET_MESSAGE_FRAGMENT, 849 SSLerror(
850 SSL_R_UNEXPECTED_MESSAGE); 850 SSL_R_UNEXPECTED_MESSAGE);
851 goto f_err; 851 goto f_err;
852 } 852 }
@@ -878,7 +878,7 @@ again:
878 */ 878 */
879 if (i != (int)frag_len) { 879 if (i != (int)frag_len) {
880 al = SSL3_AD_ILLEGAL_PARAMETER; 880 al = SSL3_AD_ILLEGAL_PARAMETER;
881 SSLerr(SSL_F_DTLS1_GET_MESSAGE_FRAGMENT, 881 SSLerror(
882 SSL3_AD_ILLEGAL_PARAMETER); 882 SSL3_AD_ILLEGAL_PARAMETER);
883 goto f_err; 883 goto f_err;
884 } 884 }
diff --git a/src/lib/libssl/d1_clnt.c b/src/lib/libssl/d1_clnt.c
index c0f90dce6f..fd981c5f8e 100644
--- a/src/lib/libssl/d1_clnt.c
+++ b/src/lib/libssl/d1_clnt.c
@@ -1,4 +1,4 @@
1/* $OpenBSD: d1_clnt.c,v 1.71 2017/01/26 06:32:58 jsing Exp $ */ 1/* $OpenBSD: d1_clnt.c,v 1.72 2017/01/26 10:40:21 beck Exp $ */
2/* 2/*
3 * DTLS implementation written by Nagendra Modadugu 3 * DTLS implementation written by Nagendra Modadugu
4 * (nagendra@cs.stanford.edu) for the OpenSSL project 2005. 4 * (nagendra@cs.stanford.edu) for the OpenSSL project 2005.
@@ -216,7 +216,7 @@ dtls1_connect(SSL *s)
216 cb(s, SSL_CB_HANDSHAKE_START, 1); 216 cb(s, SSL_CB_HANDSHAKE_START, 1);
217 217
218 if ((s->version & 0xff00 ) != (DTLS1_VERSION & 0xff00)) { 218 if ((s->version & 0xff00 ) != (DTLS1_VERSION & 0xff00)) {
219 SSLerr(SSL_F_DTLS1_CONNECT, 219 SSLerror(
220 ERR_R_INTERNAL_ERROR); 220 ERR_R_INTERNAL_ERROR);
221 ret = -1; 221 ret = -1;
222 goto end; 222 goto end;
@@ -571,7 +571,7 @@ dtls1_connect(SSL *s)
571 /* break; */ 571 /* break; */
572 572
573 default: 573 default:
574 SSLerr(SSL_F_DTLS1_CONNECT, SSL_R_UNKNOWN_STATE); 574 SSLerror(SSL_R_UNKNOWN_STATE);
575 ret = -1; 575 ret = -1;
576 goto end; 576 goto end;
577 /* break; */ 577 /* break; */
@@ -632,7 +632,7 @@ dtls1_get_hello_verify(SSL *s)
632 goto truncated; 632 goto truncated;
633 633
634 if (ssl_version != s->version) { 634 if (ssl_version != s->version) {
635 SSLerr(SSL_F_DTLS1_GET_HELLO_VERIFY, SSL_R_WRONG_SSL_VERSION); 635 SSLerror(SSL_R_WRONG_SSL_VERSION);
636 s->version = (s->version & 0xff00) | (ssl_version & 0xff); 636 s->version = (s->version & 0xff00) | (ssl_version & 0xff);
637 al = SSL_AD_PROTOCOL_VERSION; 637 al = SSL_AD_PROTOCOL_VERSION;
638 goto f_err; 638 goto f_err;
diff --git a/src/lib/libssl/d1_lib.c b/src/lib/libssl/d1_lib.c
index e193d4ab81..bd78494e66 100644
--- a/src/lib/libssl/d1_lib.c
+++ b/src/lib/libssl/d1_lib.c
@@ -1,4 +1,4 @@
1/* $OpenBSD: d1_lib.c,v 1.39 2017/01/26 06:32:58 jsing Exp $ */ 1/* $OpenBSD: d1_lib.c,v 1.40 2017/01/26 10:40:21 beck Exp $ */
2/* 2/*
3 * DTLS implementation written by Nagendra Modadugu 3 * DTLS implementation written by Nagendra Modadugu
4 * (nagendra@cs.stanford.edu) for the OpenSSL project 2005. 4 * (nagendra@cs.stanford.edu) for the OpenSSL project 2005.
@@ -406,7 +406,7 @@ dtls1_check_timeout_num(SSL *s)
406 406
407 if (D1I(s)->timeout.num_alerts > DTLS1_TMO_ALERT_COUNT) { 407 if (D1I(s)->timeout.num_alerts > DTLS1_TMO_ALERT_COUNT) {
408 /* fail the connection, enough alerts have been sent */ 408 /* fail the connection, enough alerts have been sent */
409 SSLerr(SSL_F_DTLS1_CHECK_TIMEOUT_NUM, SSL_R_READ_TIMEOUT_EXPIRED); 409 SSLerror(SSL_R_READ_TIMEOUT_EXPIRED);
410 return -1; 410 return -1;
411 } 411 }
412 412
diff --git a/src/lib/libssl/d1_pkt.c b/src/lib/libssl/d1_pkt.c
index 3ea02700b5..5e33a966de 100644
--- a/src/lib/libssl/d1_pkt.c
+++ b/src/lib/libssl/d1_pkt.c
@@ -1,4 +1,4 @@
1/* $OpenBSD: d1_pkt.c,v 1.60 2017/01/26 06:32:58 jsing Exp $ */ 1/* $OpenBSD: d1_pkt.c,v 1.61 2017/01/26 10:40:21 beck Exp $ */
2/* 2/*
3 * DTLS implementation written by Nagendra Modadugu 3 * DTLS implementation written by Nagendra Modadugu
4 * (nagendra@cs.stanford.edu) for the OpenSSL project 2005. 4 * (nagendra@cs.stanford.edu) for the OpenSSL project 2005.
@@ -255,7 +255,7 @@ err:
255 free(rdata->rbuf.buf); 255 free(rdata->rbuf.buf);
256 256
257init_err: 257init_err:
258 SSLerr(SSL_F_DTLS1_BUFFER_RECORD, ERR_R_INTERNAL_ERROR); 258 SSLerror(ERR_R_INTERNAL_ERROR);
259 free(rdata); 259 free(rdata);
260 pitem_free(item); 260 pitem_free(item);
261 return (-1); 261 return (-1);
@@ -354,7 +354,7 @@ dtls1_process_record(SSL *s)
354 /* check is not needed I believe */ 354 /* check is not needed I believe */
355 if (rr->length > SSL3_RT_MAX_ENCRYPTED_LENGTH) { 355 if (rr->length > SSL3_RT_MAX_ENCRYPTED_LENGTH) {
356 al = SSL_AD_RECORD_OVERFLOW; 356 al = SSL_AD_RECORD_OVERFLOW;
357 SSLerr(SSL_F_DTLS1_PROCESS_RECORD, SSL_R_ENCRYPTED_LENGTH_TOO_LONG); 357 SSLerror(SSL_R_ENCRYPTED_LENGTH_TOO_LONG);
358 goto f_err; 358 goto f_err;
359 } 359 }
360 360
@@ -396,7 +396,7 @@ dtls1_process_record(SSL *s)
396 (EVP_CIPHER_CTX_mode(s->enc_read_ctx) == EVP_CIPH_CBC_MODE && 396 (EVP_CIPHER_CTX_mode(s->enc_read_ctx) == EVP_CIPH_CBC_MODE &&
397 orig_len < mac_size + 1)) { 397 orig_len < mac_size + 1)) {
398 al = SSL_AD_DECODE_ERROR; 398 al = SSL_AD_DECODE_ERROR;
399 SSLerr(SSL_F_DTLS1_PROCESS_RECORD, SSL_R_LENGTH_TOO_SHORT); 399 SSLerror(SSL_R_LENGTH_TOO_SHORT);
400 goto f_err; 400 goto f_err;
401 } 401 }
402 402
@@ -433,7 +433,7 @@ dtls1_process_record(SSL *s)
433 433
434 if (rr->length > SSL3_RT_MAX_PLAIN_LENGTH) { 434 if (rr->length > SSL3_RT_MAX_PLAIN_LENGTH) {
435 al = SSL_AD_RECORD_OVERFLOW; 435 al = SSL_AD_RECORD_OVERFLOW;
436 SSLerr(SSL_F_DTLS1_PROCESS_RECORD, SSL_R_DATA_LENGTH_TOO_LONG); 436 SSLerror(SSL_R_DATA_LENGTH_TOO_LONG);
437 goto f_err; 437 goto f_err;
438 } 438 }
439 439
@@ -650,7 +650,7 @@ dtls1_read_bytes(SSL *s, int type, unsigned char *buf, int len, int peek)
650 if ((type && 650 if ((type &&
651 type != SSL3_RT_APPLICATION_DATA && type != SSL3_RT_HANDSHAKE) || 651 type != SSL3_RT_APPLICATION_DATA && type != SSL3_RT_HANDSHAKE) ||
652 (peek && (type != SSL3_RT_APPLICATION_DATA))) { 652 (peek && (type != SSL3_RT_APPLICATION_DATA))) {
653 SSLerr(SSL_F_DTLS1_READ_BYTES, ERR_R_INTERNAL_ERROR); 653 SSLerror(ERR_R_INTERNAL_ERROR);
654 return -1; 654 return -1;
655 } 655 }
656 656
@@ -667,7 +667,7 @@ dtls1_read_bytes(SSL *s, int type, unsigned char *buf, int len, int peek)
667 if (i < 0) 667 if (i < 0)
668 return (i); 668 return (i);
669 if (i == 0) { 669 if (i == 0) {
670 SSLerr(SSL_F_DTLS1_READ_BYTES, SSL_R_SSL_HANDSHAKE_FAILURE); 670 SSLerror(SSL_R_SSL_HANDSHAKE_FAILURE);
671 return (-1); 671 return (-1);
672 } 672 }
673 } 673 }
@@ -731,7 +731,7 @@ start:
731 */ 731 */
732 if (dtls1_buffer_record(s, &(D1I(s)->buffered_app_data), 732 if (dtls1_buffer_record(s, &(D1I(s)->buffered_app_data),
733 rr->seq_num) < 0) { 733 rr->seq_num) < 0) {
734 SSLerr(SSL_F_DTLS1_READ_BYTES, ERR_R_INTERNAL_ERROR); 734 SSLerror(ERR_R_INTERNAL_ERROR);
735 return (-1); 735 return (-1);
736 } 736 }
737 rr->length = 0; 737 rr->length = 0;
@@ -754,7 +754,7 @@ start:
754 if (SSL_in_init(s) && (type == SSL3_RT_APPLICATION_DATA) && 754 if (SSL_in_init(s) && (type == SSL3_RT_APPLICATION_DATA) &&
755 (s->enc_read_ctx == NULL)) { 755 (s->enc_read_ctx == NULL)) {
756 al = SSL_AD_UNEXPECTED_MESSAGE; 756 al = SSL_AD_UNEXPECTED_MESSAGE;
757 SSLerr(SSL_F_DTLS1_READ_BYTES, SSL_R_APP_DATA_IN_HANDSHAKE); 757 SSLerror(SSL_R_APP_DATA_IN_HANDSHAKE);
758 goto f_err; 758 goto f_err;
759 } 759 }
760 760
@@ -817,7 +817,7 @@ start:
817 817
818 /* Not certain if this is the right error handling */ 818 /* Not certain if this is the right error handling */
819 al = SSL_AD_UNEXPECTED_MESSAGE; 819 al = SSL_AD_UNEXPECTED_MESSAGE;
820 SSLerr(SSL_F_DTLS1_READ_BYTES, SSL_R_UNEXPECTED_RECORD); 820 SSLerror(SSL_R_UNEXPECTED_RECORD);
821 goto f_err; 821 goto f_err;
822 } 822 }
823 823
@@ -862,7 +862,7 @@ start:
862 (D1I(s)->handshake_fragment[2] != 0) || 862 (D1I(s)->handshake_fragment[2] != 0) ||
863 (D1I(s)->handshake_fragment[3] != 0)) { 863 (D1I(s)->handshake_fragment[3] != 0)) {
864 al = SSL_AD_DECODE_ERROR; 864 al = SSL_AD_DECODE_ERROR;
865 SSLerr(SSL_F_DTLS1_READ_BYTES, SSL_R_BAD_HELLO_REQUEST); 865 SSLerror(SSL_R_BAD_HELLO_REQUEST);
866 goto err; 866 goto err;
867 } 867 }
868 868
@@ -883,7 +883,7 @@ start:
883 if (i < 0) 883 if (i < 0)
884 return (i); 884 return (i);
885 if (i == 0) { 885 if (i == 0) {
886 SSLerr(SSL_F_DTLS1_READ_BYTES, SSL_R_SSL_HANDSHAKE_FAILURE); 886 SSLerror(SSL_R_SSL_HANDSHAKE_FAILURE);
887 return (-1); 887 return (-1);
888 } 888 }
889 889
@@ -940,7 +940,7 @@ start:
940 { 940 {
941 s->internal->rwstate = SSL_NOTHING; 941 s->internal->rwstate = SSL_NOTHING;
942 S3I(s)->fatal_alert = alert_descr; 942 S3I(s)->fatal_alert = alert_descr;
943 SSLerr(SSL_F_DTLS1_READ_BYTES, SSL_AD_REASON_OFFSET + alert_descr); 943 SSLerror(SSL_AD_REASON_OFFSET + alert_descr);
944 ERR_asprintf_error_data("SSL alert number %d", 944 ERR_asprintf_error_data("SSL alert number %d",
945 alert_descr); 945 alert_descr);
946 s->internal->shutdown|=SSL_RECEIVED_SHUTDOWN; 946 s->internal->shutdown|=SSL_RECEIVED_SHUTDOWN;
@@ -948,7 +948,7 @@ start:
948 return (0); 948 return (0);
949 } else { 949 } else {
950 al = SSL_AD_ILLEGAL_PARAMETER; 950 al = SSL_AD_ILLEGAL_PARAMETER;
951 SSLerr(SSL_F_DTLS1_READ_BYTES, SSL_R_UNKNOWN_ALERT_TYPE); 951 SSLerror(SSL_R_UNKNOWN_ALERT_TYPE);
952 goto f_err; 952 goto f_err;
953 } 953 }
954 954
@@ -974,7 +974,7 @@ start:
974 if ((rr->length != ccs_hdr_len) || 974 if ((rr->length != ccs_hdr_len) ||
975 (rr->off != 0) || (rr->data[0] != SSL3_MT_CCS)) { 975 (rr->off != 0) || (rr->data[0] != SSL3_MT_CCS)) {
976 i = SSL_AD_ILLEGAL_PARAMETER; 976 i = SSL_AD_ILLEGAL_PARAMETER;
977 SSLerr(SSL_F_DTLS1_READ_BYTES, SSL_R_BAD_CHANGE_CIPHER_SPEC); 977 SSLerror(SSL_R_BAD_CHANGE_CIPHER_SPEC);
978 goto err; 978 goto err;
979 } 979 }
980 980
@@ -1038,7 +1038,7 @@ start:
1038 if (i < 0) 1038 if (i < 0)
1039 return (i); 1039 return (i);
1040 if (i == 0) { 1040 if (i == 0) {
1041 SSLerr(SSL_F_DTLS1_READ_BYTES, SSL_R_SSL_HANDSHAKE_FAILURE); 1041 SSLerror(SSL_R_SSL_HANDSHAKE_FAILURE);
1042 return (-1); 1042 return (-1);
1043 } 1043 }
1044 1044
@@ -1068,7 +1068,7 @@ start:
1068 goto start; 1068 goto start;
1069 } 1069 }
1070 al = SSL_AD_UNEXPECTED_MESSAGE; 1070 al = SSL_AD_UNEXPECTED_MESSAGE;
1071 SSLerr(SSL_F_DTLS1_READ_BYTES, SSL_R_UNEXPECTED_RECORD); 1071 SSLerror(SSL_R_UNEXPECTED_RECORD);
1072 goto f_err; 1072 goto f_err;
1073 case SSL3_RT_CHANGE_CIPHER_SPEC: 1073 case SSL3_RT_CHANGE_CIPHER_SPEC:
1074 case SSL3_RT_ALERT: 1074 case SSL3_RT_ALERT:
@@ -1077,7 +1077,7 @@ start:
1077 * of SSL3_RT_HANDSHAKE when s->internal->in_handshake is set, but that 1077 * of SSL3_RT_HANDSHAKE when s->internal->in_handshake is set, but that
1078 * should not happen when type != rr->type */ 1078 * should not happen when type != rr->type */
1079 al = SSL_AD_UNEXPECTED_MESSAGE; 1079 al = SSL_AD_UNEXPECTED_MESSAGE;
1080 SSLerr(SSL_F_DTLS1_READ_BYTES, ERR_R_INTERNAL_ERROR); 1080 SSLerror(ERR_R_INTERNAL_ERROR);
1081 goto f_err; 1081 goto f_err;
1082 case SSL3_RT_APPLICATION_DATA: 1082 case SSL3_RT_APPLICATION_DATA:
1083 /* At this point, we were expecting handshake data, 1083 /* At this point, we were expecting handshake data,
@@ -1099,7 +1099,7 @@ start:
1099 return (-1); 1099 return (-1);
1100 } else { 1100 } else {
1101 al = SSL_AD_UNEXPECTED_MESSAGE; 1101 al = SSL_AD_UNEXPECTED_MESSAGE;
1102 SSLerr(SSL_F_DTLS1_READ_BYTES, SSL_R_UNEXPECTED_RECORD); 1102 SSLerror(SSL_R_UNEXPECTED_RECORD);
1103 goto f_err; 1103 goto f_err;
1104 } 1104 }
1105 } 1105 }
@@ -1122,13 +1122,13 @@ dtls1_write_app_data_bytes(SSL *s, int type, const void *buf_, int len)
1122 if (i < 0) 1122 if (i < 0)
1123 return (i); 1123 return (i);
1124 if (i == 0) { 1124 if (i == 0) {
1125 SSLerr(SSL_F_DTLS1_WRITE_APP_DATA_BYTES, SSL_R_SSL_HANDSHAKE_FAILURE); 1125 SSLerror(SSL_R_SSL_HANDSHAKE_FAILURE);
1126 return -1; 1126 return -1;
1127 } 1127 }
1128 } 1128 }
1129 1129
1130 if (len > SSL3_RT_MAX_PLAIN_LENGTH) { 1130 if (len > SSL3_RT_MAX_PLAIN_LENGTH) {
1131 SSLerr(SSL_F_DTLS1_WRITE_APP_DATA_BYTES, SSL_R_DTLS_MESSAGE_TOO_BIG); 1131 SSLerror(SSL_R_DTLS_MESSAGE_TOO_BIG);
1132 return -1; 1132 return -1;
1133 } 1133 }
1134 1134
diff --git a/src/lib/libssl/d1_srtp.c b/src/lib/libssl/d1_srtp.c
index a9f45a2d9a..b98c04b7cf 100644
--- a/src/lib/libssl/d1_srtp.c
+++ b/src/lib/libssl/d1_srtp.c
@@ -1,4 +1,4 @@
1/* $OpenBSD: d1_srtp.c,v 1.18 2017/01/24 15:04:12 jsing Exp $ */ 1/* $OpenBSD: d1_srtp.c,v 1.19 2017/01/26 10:40:21 beck Exp $ */
2/* Copyright (C) 1995-1998 Eric Young (eay@cryptsoft.com) 2/* Copyright (C) 1995-1998 Eric Young (eay@cryptsoft.com)
3 * All rights reserved. 3 * All rights reserved.
4 * 4 *
@@ -187,7 +187,7 @@ ssl_ctx_make_profiles(const char *profiles_string,
187 SRTP_PROTECTION_PROFILE *p; 187 SRTP_PROTECTION_PROFILE *p;
188 188
189 if (!(profiles = sk_SRTP_PROTECTION_PROFILE_new_null())) { 189 if (!(profiles = sk_SRTP_PROTECTION_PROFILE_new_null())) {
190 SSLerr(SSL_F_SSL_CTX_MAKE_PROFILES, 190 SSLerror(
191 SSL_R_SRTP_COULD_NOT_ALLOCATE_PROFILES); 191 SSL_R_SRTP_COULD_NOT_ALLOCATE_PROFILES);
192 return 1; 192 return 1;
193 } 193 }
@@ -199,7 +199,7 @@ ssl_ctx_make_profiles(const char *profiles_string,
199 col ? col - ptr : (int)strlen(ptr))) { 199 col ? col - ptr : (int)strlen(ptr))) {
200 sk_SRTP_PROTECTION_PROFILE_push(profiles, p); 200 sk_SRTP_PROTECTION_PROFILE_push(profiles, p);
201 } else { 201 } else {
202 SSLerr(SSL_F_SSL_CTX_MAKE_PROFILES, 202 SSLerror(
203 SSL_R_SRTP_UNKNOWN_PROTECTION_PROFILE); 203 SSL_R_SRTP_UNKNOWN_PROTECTION_PROFILE);
204 sk_SRTP_PROTECTION_PROFILE_free(profiles); 204 sk_SRTP_PROTECTION_PROFILE_free(profiles);
205 return 1; 205 return 1;
@@ -264,13 +264,13 @@ ssl_add_clienthello_use_srtp_ext(SSL *s, unsigned char *p, int *len, int maxlen)
264 264
265 if (p) { 265 if (p) {
266 if (ct == 0) { 266 if (ct == 0) {
267 SSLerr(SSL_F_SSL_ADD_CLIENTHELLO_USE_SRTP_EXT, 267 SSLerror(
268 SSL_R_EMPTY_SRTP_PROTECTION_PROFILE_LIST); 268 SSL_R_EMPTY_SRTP_PROTECTION_PROFILE_LIST);
269 return 1; 269 return 1;
270 } 270 }
271 271
272 if ((2 + ct * 2 + 1) > maxlen) { 272 if ((2 + ct * 2 + 1) > maxlen) {
273 SSLerr(SSL_F_SSL_ADD_CLIENTHELLO_USE_SRTP_EXT, 273 SSLerror(
274 SSL_R_SRTP_PROTECTION_PROFILE_LIST_TOO_LONG); 274 SSL_R_SRTP_PROTECTION_PROFILE_LIST_TOO_LONG);
275 return 1; 275 return 1;
276 } 276 }
@@ -304,7 +304,7 @@ ssl_parse_clienthello_use_srtp_ext(SSL *s, const unsigned char *d, int len,
304 CBS cbs, ciphers, mki; 304 CBS cbs, ciphers, mki;
305 305
306 if (len < 0) { 306 if (len < 0) {
307 SSLerr(SSL_F_SSL_PARSE_CLIENTHELLO_USE_SRTP_EXT, 307 SSLerror(
308 SSL_R_BAD_SRTP_PROTECTION_PROFILE_LIST); 308 SSL_R_BAD_SRTP_PROTECTION_PROFILE_LIST);
309 *al = SSL_AD_DECODE_ERROR; 309 *al = SSL_AD_DECODE_ERROR;
310 goto done; 310 goto done;
@@ -314,7 +314,7 @@ ssl_parse_clienthello_use_srtp_ext(SSL *s, const unsigned char *d, int len,
314 /* Pull off the cipher suite list */ 314 /* Pull off the cipher suite list */
315 if (!CBS_get_u16_length_prefixed(&cbs, &ciphers) || 315 if (!CBS_get_u16_length_prefixed(&cbs, &ciphers) ||
316 CBS_len(&ciphers) % 2) { 316 CBS_len(&ciphers) % 2) {
317 SSLerr(SSL_F_SSL_PARSE_CLIENTHELLO_USE_SRTP_EXT, 317 SSLerror(
318 SSL_R_BAD_SRTP_PROTECTION_PROFILE_LIST); 318 SSL_R_BAD_SRTP_PROTECTION_PROFILE_LIST);
319 *al = SSL_AD_DECODE_ERROR; 319 *al = SSL_AD_DECODE_ERROR;
320 goto done; 320 goto done;
@@ -324,7 +324,7 @@ ssl_parse_clienthello_use_srtp_ext(SSL *s, const unsigned char *d, int len,
324 324
325 while (CBS_len(&ciphers) > 0) { 325 while (CBS_len(&ciphers) > 0) {
326 if (!CBS_get_u16(&ciphers, &id)) { 326 if (!CBS_get_u16(&ciphers, &id)) {
327 SSLerr(SSL_F_SSL_PARSE_CLIENTHELLO_USE_SRTP_EXT, 327 SSLerror(
328 SSL_R_BAD_SRTP_PROTECTION_PROFILE_LIST); 328 SSL_R_BAD_SRTP_PROTECTION_PROFILE_LIST);
329 *al = SSL_AD_DECODE_ERROR; 329 *al = SSL_AD_DECODE_ERROR;
330 goto done; 330 goto done;
@@ -339,7 +339,7 @@ ssl_parse_clienthello_use_srtp_ext(SSL *s, const unsigned char *d, int len,
339 /* Extract the MKI value as a sanity check, but discard it for now. */ 339 /* Extract the MKI value as a sanity check, but discard it for now. */
340 if (!CBS_get_u8_length_prefixed(&cbs, &mki) || 340 if (!CBS_get_u8_length_prefixed(&cbs, &mki) ||
341 CBS_len(&cbs) != 0) { 341 CBS_len(&cbs) != 0) {
342 SSLerr(SSL_F_SSL_PARSE_CLIENTHELLO_USE_SRTP_EXT, 342 SSLerror(
343 SSL_R_BAD_SRTP_MKI_VALUE); 343 SSL_R_BAD_SRTP_MKI_VALUE);
344 *al = SSL_AD_DECODE_ERROR; 344 *al = SSL_AD_DECODE_ERROR;
345 goto done; 345 goto done;
@@ -381,13 +381,13 @@ ssl_add_serverhello_use_srtp_ext(SSL *s, unsigned char *p, int *len, int maxlen)
381{ 381{
382 if (p) { 382 if (p) {
383 if (maxlen < 5) { 383 if (maxlen < 5) {
384 SSLerr(SSL_F_SSL_ADD_SERVERHELLO_USE_SRTP_EXT, 384 SSLerror(
385 SSL_R_SRTP_PROTECTION_PROFILE_LIST_TOO_LONG); 385 SSL_R_SRTP_PROTECTION_PROFILE_LIST_TOO_LONG);
386 return 1; 386 return 1;
387 } 387 }
388 388
389 if (s->internal->srtp_profile == 0) { 389 if (s->internal->srtp_profile == 0) {
390 SSLerr(SSL_F_SSL_ADD_SERVERHELLO_USE_SRTP_EXT, 390 SSLerror(
391 SSL_R_USE_SRTP_NOT_NEGOTIATED); 391 SSL_R_USE_SRTP_NOT_NEGOTIATED);
392 return 1; 392 return 1;
393 } 393 }
@@ -411,7 +411,7 @@ ssl_parse_serverhello_use_srtp_ext(SSL *s, const unsigned char *d, int len, int
411 CBS cbs, profile_ids, mki; 411 CBS cbs, profile_ids, mki;
412 412
413 if (len < 0) { 413 if (len < 0) {
414 SSLerr(SSL_F_SSL_PARSE_SERVERHELLO_USE_SRTP_EXT, 414 SSLerror(
415 SSL_R_BAD_SRTP_PROTECTION_PROFILE_LIST); 415 SSL_R_BAD_SRTP_PROTECTION_PROFILE_LIST);
416 *al = SSL_AD_DECODE_ERROR; 416 *al = SSL_AD_DECODE_ERROR;
417 return 1; 417 return 1;
@@ -425,7 +425,7 @@ ssl_parse_serverhello_use_srtp_ext(SSL *s, const unsigned char *d, int len, int
425 */ 425 */
426 if (!CBS_get_u16_length_prefixed(&cbs, &profile_ids) || 426 if (!CBS_get_u16_length_prefixed(&cbs, &profile_ids) ||
427 !CBS_get_u16(&profile_ids, &id) || CBS_len(&profile_ids) != 0) { 427 !CBS_get_u16(&profile_ids, &id) || CBS_len(&profile_ids) != 0) {
428 SSLerr(SSL_F_SSL_PARSE_SERVERHELLO_USE_SRTP_EXT, 428 SSLerror(
429 SSL_R_BAD_SRTP_PROTECTION_PROFILE_LIST); 429 SSL_R_BAD_SRTP_PROTECTION_PROFILE_LIST);
430 *al = SSL_AD_DECODE_ERROR; 430 *al = SSL_AD_DECODE_ERROR;
431 return 1; 431 return 1;
@@ -433,7 +433,7 @@ ssl_parse_serverhello_use_srtp_ext(SSL *s, const unsigned char *d, int len, int
433 433
434 /* Must be no MKI, since we never offer one. */ 434 /* Must be no MKI, since we never offer one. */
435 if (!CBS_get_u8_length_prefixed(&cbs, &mki) || CBS_len(&mki) != 0) { 435 if (!CBS_get_u8_length_prefixed(&cbs, &mki) || CBS_len(&mki) != 0) {
436 SSLerr(SSL_F_SSL_PARSE_SERVERHELLO_USE_SRTP_EXT, 436 SSLerror(
437 SSL_R_BAD_SRTP_MKI_VALUE); 437 SSL_R_BAD_SRTP_MKI_VALUE);
438 *al = SSL_AD_ILLEGAL_PARAMETER; 438 *al = SSL_AD_ILLEGAL_PARAMETER;
439 return 1; 439 return 1;
@@ -443,7 +443,7 @@ ssl_parse_serverhello_use_srtp_ext(SSL *s, const unsigned char *d, int len, int
443 443
444 /* Throw an error if the server gave us an unsolicited extension. */ 444 /* Throw an error if the server gave us an unsolicited extension. */
445 if (clnt == NULL) { 445 if (clnt == NULL) {
446 SSLerr(SSL_F_SSL_PARSE_SERVERHELLO_USE_SRTP_EXT, 446 SSLerror(
447 SSL_R_NO_SRTP_PROFILES); 447 SSL_R_NO_SRTP_PROFILES);
448 *al = SSL_AD_DECODE_ERROR; 448 *al = SSL_AD_DECODE_ERROR;
449 return 1; 449 return 1;
@@ -463,7 +463,7 @@ ssl_parse_serverhello_use_srtp_ext(SSL *s, const unsigned char *d, int len, int
463 } 463 }
464 } 464 }
465 465
466 SSLerr(SSL_F_SSL_PARSE_SERVERHELLO_USE_SRTP_EXT, 466 SSLerror(
467 SSL_R_BAD_SRTP_PROTECTION_PROFILE_LIST); 467 SSL_R_BAD_SRTP_PROTECTION_PROFILE_LIST);
468 *al = SSL_AD_DECODE_ERROR; 468 *al = SSL_AD_DECODE_ERROR;
469 return 1; 469 return 1;
diff --git a/src/lib/libssl/d1_srvr.c b/src/lib/libssl/d1_srvr.c
index f36d3f40cd..80d7d639c3 100644
--- a/src/lib/libssl/d1_srvr.c
+++ b/src/lib/libssl/d1_srvr.c
@@ -1,4 +1,4 @@
1/* $OpenBSD: d1_srvr.c,v 1.81 2017/01/26 06:32:58 jsing Exp $ */ 1/* $OpenBSD: d1_srvr.c,v 1.82 2017/01/26 10:40:21 beck Exp $ */
2/* 2/*
3 * DTLS implementation written by Nagendra Modadugu 3 * DTLS implementation written by Nagendra Modadugu
4 * (nagendra@cs.stanford.edu) for the OpenSSL project 2005. 4 * (nagendra@cs.stanford.edu) for the OpenSSL project 2005.
@@ -202,7 +202,7 @@ dtls1_accept(SSL *s)
202 D1I(s)->listen = listen; 202 D1I(s)->listen = listen;
203 203
204 if (s->cert == NULL) { 204 if (s->cert == NULL) {
205 SSLerr(SSL_F_DTLS1_ACCEPT, SSL_R_NO_CERTIFICATE_SET); 205 SSLerror(SSL_R_NO_CERTIFICATE_SET);
206 ret = -1; 206 ret = -1;
207 goto end; 207 goto end;
208 } 208 }
@@ -225,7 +225,7 @@ dtls1_accept(SSL *s)
225 cb(s, SSL_CB_HANDSHAKE_START, 1); 225 cb(s, SSL_CB_HANDSHAKE_START, 1);
226 226
227 if ((s->version & 0xff00) != (DTLS1_VERSION & 0xff00)) { 227 if ((s->version & 0xff00) != (DTLS1_VERSION & 0xff00)) {
228 SSLerr(SSL_F_DTLS1_ACCEPT, ERR_R_INTERNAL_ERROR); 228 SSLerror(ERR_R_INTERNAL_ERROR);
229 ret = -1; 229 ret = -1;
230 goto end; 230 goto end;
231 } 231 }
@@ -506,7 +506,7 @@ dtls1_accept(SSL *s)
506 * at this point and digest cached records. 506 * at this point and digest cached records.
507 */ 507 */
508 if (!S3I(s)->handshake_buffer) { 508 if (!S3I(s)->handshake_buffer) {
509 SSLerr(SSL_F_SSL3_ACCEPT, 509 SSLerror(
510 ERR_R_INTERNAL_ERROR); 510 ERR_R_INTERNAL_ERROR);
511 ret = -1; 511 ret = -1;
512 goto end; 512 goto end;
@@ -659,7 +659,7 @@ dtls1_accept(SSL *s)
659 /* break; */ 659 /* break; */
660 660
661 default: 661 default:
662 SSLerr(SSL_F_DTLS1_ACCEPT, SSL_R_UNKNOWN_STATE); 662 SSLerror(SSL_R_UNKNOWN_STATE);
663 ret = -1; 663 ret = -1;
664 goto end; 664 goto end;
665 /* break; */ 665 /* break; */
@@ -706,7 +706,7 @@ dtls1_send_hello_verify_request(SSL *s)
706 if (s->ctx->internal->app_gen_cookie_cb == NULL || 706 if (s->ctx->internal->app_gen_cookie_cb == NULL ||
707 s->ctx->internal->app_gen_cookie_cb(s, 707 s->ctx->internal->app_gen_cookie_cb(s,
708 D1I(s)->cookie, &(D1I(s)->cookie_len)) == 0) { 708 D1I(s)->cookie, &(D1I(s)->cookie_len)) == 0) {
709 SSLerr(SSL_F_DTLS1_SEND_HELLO_VERIFY_REQUEST, 709 SSLerror(
710 ERR_R_INTERNAL_ERROR); 710 ERR_R_INTERNAL_ERROR);
711 return 0; 711 return 0;
712 } 712 }
diff --git a/src/lib/libssl/s3_lib.c b/src/lib/libssl/s3_lib.c
index 977c170403..6287f6cbc6 100644
--- a/src/lib/libssl/s3_lib.c
+++ b/src/lib/libssl/s3_lib.c
@@ -1,4 +1,4 @@
1/* $OpenBSD: s3_lib.c,v 1.131 2017/01/24 14:57:31 jsing Exp $ */ 1/* $OpenBSD: s3_lib.c,v 1.132 2017/01/26 10:40:21 beck Exp $ */
2/* Copyright (C) 1995-1998 Eric Young (eay@cryptsoft.com) 2/* Copyright (C) 1995-1998 Eric Young (eay@cryptsoft.com)
3 * All rights reserved. 3 * All rights reserved.
4 * 4 *
@@ -1980,7 +1980,7 @@ ssl3_ctrl(SSL *s, int cmd, long larg, void *parg)
1980 1980
1981 if (cmd == SSL_CTRL_SET_TMP_DH || cmd == SSL_CTRL_SET_TMP_DH_CB) { 1981 if (cmd == SSL_CTRL_SET_TMP_DH || cmd == SSL_CTRL_SET_TMP_DH_CB) {
1982 if (!ssl_cert_inst(&s->cert)) { 1982 if (!ssl_cert_inst(&s->cert)) {
1983 SSLerr(SSL_F_SSL3_CTRL, 1983 SSLerror(
1984 ERR_R_MALLOC_FAILURE); 1984 ERR_R_MALLOC_FAILURE);
1985 return (0); 1985 return (0);
1986 } 1986 }
@@ -2010,18 +2010,18 @@ ssl3_ctrl(SSL *s, int cmd, long larg, void *parg)
2010 break; 2010 break;
2011 case SSL_CTRL_SET_TMP_RSA: 2011 case SSL_CTRL_SET_TMP_RSA:
2012 case SSL_CTRL_SET_TMP_RSA_CB: 2012 case SSL_CTRL_SET_TMP_RSA_CB:
2013 SSLerr(SSL_F_SSL3_CTRL, ERR_R_SHOULD_NOT_HAVE_BEEN_CALLED); 2013 SSLerror(ERR_R_SHOULD_NOT_HAVE_BEEN_CALLED);
2014 break; 2014 break;
2015 case SSL_CTRL_SET_TMP_DH: 2015 case SSL_CTRL_SET_TMP_DH:
2016 { 2016 {
2017 DH *dh = (DH *)parg; 2017 DH *dh = (DH *)parg;
2018 if (dh == NULL) { 2018 if (dh == NULL) {
2019 SSLerr(SSL_F_SSL3_CTRL, 2019 SSLerror(
2020 ERR_R_PASSED_NULL_PARAMETER); 2020 ERR_R_PASSED_NULL_PARAMETER);
2021 return (ret); 2021 return (ret);
2022 } 2022 }
2023 if ((dh = DHparams_dup(dh)) == NULL) { 2023 if ((dh = DHparams_dup(dh)) == NULL) {
2024 SSLerr(SSL_F_SSL3_CTRL, 2024 SSLerror(
2025 ERR_R_DH_LIB); 2025 ERR_R_DH_LIB);
2026 return (ret); 2026 return (ret);
2027 } 2027 }
@@ -2032,7 +2032,7 @@ ssl3_ctrl(SSL *s, int cmd, long larg, void *parg)
2032 break; 2032 break;
2033 2033
2034 case SSL_CTRL_SET_TMP_DH_CB: 2034 case SSL_CTRL_SET_TMP_DH_CB:
2035 SSLerr(SSL_F_SSL3_CTRL, ERR_R_SHOULD_NOT_HAVE_BEEN_CALLED); 2035 SSLerror(ERR_R_SHOULD_NOT_HAVE_BEEN_CALLED);
2036 return (ret); 2036 return (ret);
2037 2037
2038 case SSL_CTRL_SET_DH_AUTO: 2038 case SSL_CTRL_SET_DH_AUTO:
@@ -2044,12 +2044,12 @@ ssl3_ctrl(SSL *s, int cmd, long larg, void *parg)
2044 EC_KEY *ecdh = NULL; 2044 EC_KEY *ecdh = NULL;
2045 2045
2046 if (parg == NULL) { 2046 if (parg == NULL) {
2047 SSLerr(SSL_F_SSL3_CTRL, 2047 SSLerror(
2048 ERR_R_PASSED_NULL_PARAMETER); 2048 ERR_R_PASSED_NULL_PARAMETER);
2049 return (ret); 2049 return (ret);
2050 } 2050 }
2051 if (!EC_KEY_up_ref((EC_KEY *)parg)) { 2051 if (!EC_KEY_up_ref((EC_KEY *)parg)) {
2052 SSLerr(SSL_F_SSL3_CTRL, 2052 SSLerror(
2053 ERR_R_ECDH_LIB); 2053 ERR_R_ECDH_LIB);
2054 return (ret); 2054 return (ret);
2055 } 2055 }
@@ -2057,7 +2057,7 @@ ssl3_ctrl(SSL *s, int cmd, long larg, void *parg)
2057 if (!(s->internal->options & SSL_OP_SINGLE_ECDH_USE)) { 2057 if (!(s->internal->options & SSL_OP_SINGLE_ECDH_USE)) {
2058 if (!EC_KEY_generate_key(ecdh)) { 2058 if (!EC_KEY_generate_key(ecdh)) {
2059 EC_KEY_free(ecdh); 2059 EC_KEY_free(ecdh);
2060 SSLerr(SSL_F_SSL3_CTRL, 2060 SSLerror(
2061 ERR_R_ECDH_LIB); 2061 ERR_R_ECDH_LIB);
2062 return (ret); 2062 return (ret);
2063 } 2063 }
@@ -2069,7 +2069,7 @@ ssl3_ctrl(SSL *s, int cmd, long larg, void *parg)
2069 break; 2069 break;
2070 case SSL_CTRL_SET_TMP_ECDH_CB: 2070 case SSL_CTRL_SET_TMP_ECDH_CB:
2071 { 2071 {
2072 SSLerr(SSL_F_SSL3_CTRL, 2072 SSLerror(
2073 ERR_R_SHOULD_NOT_HAVE_BEEN_CALLED); 2073 ERR_R_SHOULD_NOT_HAVE_BEEN_CALLED);
2074 return (ret); 2074 return (ret);
2075 } 2075 }
@@ -2083,18 +2083,18 @@ ssl3_ctrl(SSL *s, int cmd, long larg, void *parg)
2083 if (parg == NULL) 2083 if (parg == NULL)
2084 break; 2084 break;
2085 if (strlen((char *)parg) > TLSEXT_MAXLEN_host_name) { 2085 if (strlen((char *)parg) > TLSEXT_MAXLEN_host_name) {
2086 SSLerr(SSL_F_SSL3_CTRL, 2086 SSLerror(
2087 SSL_R_SSL3_EXT_INVALID_SERVERNAME); 2087 SSL_R_SSL3_EXT_INVALID_SERVERNAME);
2088 return 0; 2088 return 0;
2089 } 2089 }
2090 if ((s->tlsext_hostname = strdup((char *)parg)) 2090 if ((s->tlsext_hostname = strdup((char *)parg))
2091 == NULL) { 2091 == NULL) {
2092 SSLerr(SSL_F_SSL3_CTRL, 2092 SSLerror(
2093 ERR_R_INTERNAL_ERROR); 2093 ERR_R_INTERNAL_ERROR);
2094 return 0; 2094 return 0;
2095 } 2095 }
2096 } else { 2096 } else {
2097 SSLerr(SSL_F_SSL3_CTRL, 2097 SSLerror(
2098 SSL_R_SSL3_EXT_INVALID_SERVERNAME_TYPE); 2098 SSL_R_SSL3_EXT_INVALID_SERVERNAME_TYPE);
2099 return 0; 2099 return 0;
2100 } 2100 }
@@ -2177,7 +2177,7 @@ ssl3_callback_ctrl(SSL *s, int cmd, void (*fp)(void))
2177 2177
2178 if (cmd == SSL_CTRL_SET_TMP_DH_CB) { 2178 if (cmd == SSL_CTRL_SET_TMP_DH_CB) {
2179 if (!ssl_cert_inst(&s->cert)) { 2179 if (!ssl_cert_inst(&s->cert)) {
2180 SSLerr(SSL_F_SSL3_CALLBACK_CTRL, 2180 SSLerror(
2181 ERR_R_MALLOC_FAILURE); 2181 ERR_R_MALLOC_FAILURE);
2182 return (0); 2182 return (0);
2183 } 2183 }
@@ -2185,7 +2185,7 @@ ssl3_callback_ctrl(SSL *s, int cmd, void (*fp)(void))
2185 2185
2186 switch (cmd) { 2186 switch (cmd) {
2187 case SSL_CTRL_SET_TMP_RSA_CB: 2187 case SSL_CTRL_SET_TMP_RSA_CB:
2188 SSLerr(SSL_F_SSL3_CTRL, ERR_R_SHOULD_NOT_HAVE_BEEN_CALLED); 2188 SSLerror(ERR_R_SHOULD_NOT_HAVE_BEEN_CALLED);
2189 break; 2189 break;
2190 case SSL_CTRL_SET_TMP_DH_CB: 2190 case SSL_CTRL_SET_TMP_DH_CB:
2191 s->cert->dh_tmp_cb = (DH *(*)(SSL *, int, int))fp; 2191 s->cert->dh_tmp_cb = (DH *(*)(SSL *, int, int))fp;
@@ -2215,7 +2215,7 @@ ssl3_ctx_ctrl(SSL_CTX *ctx, int cmd, long larg, void *parg)
2215 return (0); 2215 return (0);
2216 case SSL_CTRL_SET_TMP_RSA: 2216 case SSL_CTRL_SET_TMP_RSA:
2217 case SSL_CTRL_SET_TMP_RSA_CB: 2217 case SSL_CTRL_SET_TMP_RSA_CB:
2218 SSLerr(SSL_F_SSL3_CTX_CTRL, ERR_R_SHOULD_NOT_HAVE_BEEN_CALLED); 2218 SSLerror(ERR_R_SHOULD_NOT_HAVE_BEEN_CALLED);
2219 return (0); 2219 return (0);
2220 case SSL_CTRL_SET_TMP_DH: 2220 case SSL_CTRL_SET_TMP_DH:
2221 { 2221 {
@@ -2223,7 +2223,7 @@ ssl3_ctx_ctrl(SSL_CTX *ctx, int cmd, long larg, void *parg)
2223 2223
2224 dh = (DH *)parg; 2224 dh = (DH *)parg;
2225 if ((new = DHparams_dup(dh)) == NULL) { 2225 if ((new = DHparams_dup(dh)) == NULL) {
2226 SSLerr(SSL_F_SSL3_CTX_CTRL, 2226 SSLerror(
2227 ERR_R_DH_LIB); 2227 ERR_R_DH_LIB);
2228 return 0; 2228 return 0;
2229 } 2229 }
@@ -2234,7 +2234,7 @@ ssl3_ctx_ctrl(SSL_CTX *ctx, int cmd, long larg, void *parg)
2234 /*break; */ 2234 /*break; */
2235 2235
2236 case SSL_CTRL_SET_TMP_DH_CB: 2236 case SSL_CTRL_SET_TMP_DH_CB:
2237 SSLerr(SSL_F_SSL3_CTX_CTRL, ERR_R_SHOULD_NOT_HAVE_BEEN_CALLED); 2237 SSLerror(ERR_R_SHOULD_NOT_HAVE_BEEN_CALLED);
2238 return (0); 2238 return (0);
2239 2239
2240 case SSL_CTRL_SET_DH_AUTO: 2240 case SSL_CTRL_SET_DH_AUTO:
@@ -2246,20 +2246,20 @@ ssl3_ctx_ctrl(SSL_CTX *ctx, int cmd, long larg, void *parg)
2246 EC_KEY *ecdh = NULL; 2246 EC_KEY *ecdh = NULL;
2247 2247
2248 if (parg == NULL) { 2248 if (parg == NULL) {
2249 SSLerr(SSL_F_SSL3_CTX_CTRL, 2249 SSLerror(
2250 ERR_R_ECDH_LIB); 2250 ERR_R_ECDH_LIB);
2251 return 0; 2251 return 0;
2252 } 2252 }
2253 ecdh = EC_KEY_dup((EC_KEY *)parg); 2253 ecdh = EC_KEY_dup((EC_KEY *)parg);
2254 if (ecdh == NULL) { 2254 if (ecdh == NULL) {
2255 SSLerr(SSL_F_SSL3_CTX_CTRL, 2255 SSLerror(
2256 ERR_R_EC_LIB); 2256 ERR_R_EC_LIB);
2257 return 0; 2257 return 0;
2258 } 2258 }
2259 if (!(ctx->internal->options & SSL_OP_SINGLE_ECDH_USE)) { 2259 if (!(ctx->internal->options & SSL_OP_SINGLE_ECDH_USE)) {
2260 if (!EC_KEY_generate_key(ecdh)) { 2260 if (!EC_KEY_generate_key(ecdh)) {
2261 EC_KEY_free(ecdh); 2261 EC_KEY_free(ecdh);
2262 SSLerr(SSL_F_SSL3_CTX_CTRL, 2262 SSLerror(
2263 ERR_R_ECDH_LIB); 2263 ERR_R_ECDH_LIB);
2264 return 0; 2264 return 0;
2265 } 2265 }
@@ -2272,7 +2272,7 @@ ssl3_ctx_ctrl(SSL_CTX *ctx, int cmd, long larg, void *parg)
2272 /* break; */ 2272 /* break; */
2273 case SSL_CTRL_SET_TMP_ECDH_CB: 2273 case SSL_CTRL_SET_TMP_ECDH_CB:
2274 { 2274 {
2275 SSLerr(SSL_F_SSL3_CTX_CTRL, 2275 SSLerror(
2276 ERR_R_SHOULD_NOT_HAVE_BEEN_CALLED); 2276 ERR_R_SHOULD_NOT_HAVE_BEEN_CALLED);
2277 return (0); 2277 return (0);
2278 } 2278 }
@@ -2287,7 +2287,7 @@ ssl3_ctx_ctrl(SSL_CTX *ctx, int cmd, long larg, void *parg)
2287 if (!keys) 2287 if (!keys)
2288 return 48; 2288 return 48;
2289 if (larg != 48) { 2289 if (larg != 48) {
2290 SSLerr(SSL_F_SSL3_CTX_CTRL, 2290 SSLerror(
2291 SSL_R_INVALID_TICKET_KEYS_LENGTH); 2291 SSL_R_INVALID_TICKET_KEYS_LENGTH);
2292 return 0; 2292 return 0;
2293 } 2293 }
@@ -2361,7 +2361,7 @@ ssl3_ctx_callback_ctrl(SSL_CTX *ctx, int cmd, void (*fp)(void))
2361 2361
2362 switch (cmd) { 2362 switch (cmd) {
2363 case SSL_CTRL_SET_TMP_RSA_CB: 2363 case SSL_CTRL_SET_TMP_RSA_CB:
2364 SSLerr(SSL_F_SSL3_CTX_CTRL, ERR_R_SHOULD_NOT_HAVE_BEEN_CALLED); 2364 SSLerror(ERR_R_SHOULD_NOT_HAVE_BEEN_CALLED);
2365 return (0); 2365 return (0);
2366 case SSL_CTRL_SET_TMP_DH_CB: 2366 case SSL_CTRL_SET_TMP_DH_CB:
2367 cert->dh_tmp_cb = (DH *(*)(SSL *, int, int))fp; 2367 cert->dh_tmp_cb = (DH *(*)(SSL *, int, int))fp;
diff --git a/src/lib/libssl/ssl_asn1.c b/src/lib/libssl/ssl_asn1.c
index 707dc24d08..bcd1ddf83c 100644
--- a/src/lib/libssl/ssl_asn1.c
+++ b/src/lib/libssl/ssl_asn1.c
@@ -1,4 +1,4 @@
1/* $OpenBSD: ssl_asn1.c,v 1.47 2016/12/26 15:34:01 jsing Exp $ */ 1/* $OpenBSD: ssl_asn1.c,v 1.48 2017/01/26 10:40:21 beck Exp $ */
2 2
3/* 3/*
4 * Copyright (c) 2016 Joel Sing <jsing@openbsd.org> 4 * Copyright (c) 2016 Joel Sing <jsing@openbsd.org>
@@ -232,7 +232,7 @@ d2i_SSL_SESSION(SSL_SESSION **a, const unsigned char **pp, long length)
232 232
233 if (s == NULL) { 233 if (s == NULL) {
234 if ((s = SSL_SESSION_new()) == NULL) { 234 if ((s = SSL_SESSION_new()) == NULL) {
235 SSLerr(SSL_F_D2I_SSL_SESSION, ERR_R_MALLOC_FAILURE); 235 SSLerror(ERR_R_MALLOC_FAILURE);
236 return (NULL); 236 return (NULL);
237 } 237 }
238 } 238 }
diff --git a/src/lib/libssl/ssl_both.c b/src/lib/libssl/ssl_both.c
index 9d0dadef83..707feb6d09 100644
--- a/src/lib/libssl/ssl_both.c
+++ b/src/lib/libssl/ssl_both.c
@@ -1,4 +1,4 @@
1/* $OpenBSD: ssl_both.c,v 1.2 2017/01/26 06:32:58 jsing Exp $ */ 1/* $OpenBSD: ssl_both.c,v 1.3 2017/01/26 10:40:21 beck Exp $ */
2/* Copyright (C) 1995-1998 Eric Young (eay@cryptsoft.com) 2/* Copyright (C) 1995-1998 Eric Young (eay@cryptsoft.com)
3 * All rights reserved. 3 * All rights reserved.
4 * 4 *
@@ -244,7 +244,7 @@ ssl3_get_finished(SSL *s, int a, int b)
244 /* If this occurs, we have missed a message */ 244 /* If this occurs, we have missed a message */
245 if (!S3I(s)->change_cipher_spec) { 245 if (!S3I(s)->change_cipher_spec) {
246 al = SSL_AD_UNEXPECTED_MESSAGE; 246 al = SSL_AD_UNEXPECTED_MESSAGE;
247 SSLerr(SSL_F_SSL3_GET_FINISHED, SSL_R_GOT_A_FIN_BEFORE_A_CCS); 247 SSLerror(SSL_R_GOT_A_FIN_BEFORE_A_CCS);
248 goto f_err; 248 goto f_err;
249 } 249 }
250 S3I(s)->change_cipher_spec = 0; 250 S3I(s)->change_cipher_spec = 0;
@@ -253,7 +253,7 @@ ssl3_get_finished(SSL *s, int a, int b)
253 253
254 if (n < 0) { 254 if (n < 0) {
255 al = SSL_AD_DECODE_ERROR; 255 al = SSL_AD_DECODE_ERROR;
256 SSLerr(SSL_F_SSL3_GET_FINISHED, SSL_R_BAD_DIGEST_LENGTH); 256 SSLerror(SSL_R_BAD_DIGEST_LENGTH);
257 goto f_err; 257 goto f_err;
258 } 258 }
259 259
@@ -262,13 +262,13 @@ ssl3_get_finished(SSL *s, int a, int b)
262 if (S3I(s)->tmp.peer_finish_md_len != md_len || 262 if (S3I(s)->tmp.peer_finish_md_len != md_len ||
263 CBS_len(&cbs) != md_len) { 263 CBS_len(&cbs) != md_len) {
264 al = SSL_AD_DECODE_ERROR; 264 al = SSL_AD_DECODE_ERROR;
265 SSLerr(SSL_F_SSL3_GET_FINISHED, SSL_R_BAD_DIGEST_LENGTH); 265 SSLerror(SSL_R_BAD_DIGEST_LENGTH);
266 goto f_err; 266 goto f_err;
267 } 267 }
268 268
269 if (!CBS_mem_equal(&cbs, S3I(s)->tmp.peer_finish_md, CBS_len(&cbs))) { 269 if (!CBS_mem_equal(&cbs, S3I(s)->tmp.peer_finish_md, CBS_len(&cbs))) {
270 al = SSL_AD_DECRYPT_ERROR; 270 al = SSL_AD_DECRYPT_ERROR;
271 SSLerr(SSL_F_SSL3_GET_FINISHED, SSL_R_DIGEST_CHECK_FAILED); 271 SSLerror(SSL_R_DIGEST_CHECK_FAILED);
272 goto f_err; 272 goto f_err;
273 } 273 }
274 274
@@ -365,7 +365,7 @@ ssl3_output_cert_chain(SSL *s, CBB *cbb, X509 *x)
365 365
366 if (!X509_STORE_CTX_init(&xs_ctx, s->ctx->cert_store, 366 if (!X509_STORE_CTX_init(&xs_ctx, s->ctx->cert_store,
367 x, NULL)) { 367 x, NULL)) {
368 SSLerr(SSL_F_SSL3_OUTPUT_CERT_CHAIN, 368 SSLerror(
369 ERR_R_X509_LIB); 369 ERR_R_X509_LIB);
370 goto err; 370 goto err;
371 } 371 }
@@ -420,7 +420,7 @@ ssl3_get_message(SSL *s, int st1, int stn, int mt, long max, int *ok)
420 S3I(s)->tmp.reuse_message = 0; 420 S3I(s)->tmp.reuse_message = 0;
421 if ((mt >= 0) && (S3I(s)->tmp.message_type != mt)) { 421 if ((mt >= 0) && (S3I(s)->tmp.message_type != mt)) {
422 al = SSL_AD_UNEXPECTED_MESSAGE; 422 al = SSL_AD_UNEXPECTED_MESSAGE;
423 SSLerr(SSL_F_SSL3_GET_MESSAGE, 423 SSLerror(
424 SSL_R_UNEXPECTED_MESSAGE); 424 SSL_R_UNEXPECTED_MESSAGE);
425 goto f_err; 425 goto f_err;
426 } 426 }
@@ -473,7 +473,7 @@ ssl3_get_message(SSL *s, int st1, int stn, int mt, long max, int *ok)
473 473
474 if ((mt >= 0) && (*p != mt)) { 474 if ((mt >= 0) && (*p != mt)) {
475 al = SSL_AD_UNEXPECTED_MESSAGE; 475 al = SSL_AD_UNEXPECTED_MESSAGE;
476 SSLerr(SSL_F_SSL3_GET_MESSAGE, 476 SSLerror(
477 SSL_R_UNEXPECTED_MESSAGE); 477 SSL_R_UNEXPECTED_MESSAGE);
478 goto f_err; 478 goto f_err;
479 } 479 }
@@ -481,19 +481,19 @@ ssl3_get_message(SSL *s, int st1, int stn, int mt, long max, int *ok)
481 CBS_init(&cbs, p, 4); 481 CBS_init(&cbs, p, 4);
482 if (!CBS_get_u8(&cbs, &u8) || 482 if (!CBS_get_u8(&cbs, &u8) ||
483 !CBS_get_u24(&cbs, &l)) { 483 !CBS_get_u24(&cbs, &l)) {
484 SSLerr(SSL_F_SSL3_GET_MESSAGE, ERR_R_BUF_LIB); 484 SSLerror(ERR_R_BUF_LIB);
485 goto err; 485 goto err;
486 } 486 }
487 S3I(s)->tmp.message_type = u8; 487 S3I(s)->tmp.message_type = u8;
488 488
489 if (l > (unsigned long)max) { 489 if (l > (unsigned long)max) {
490 al = SSL_AD_ILLEGAL_PARAMETER; 490 al = SSL_AD_ILLEGAL_PARAMETER;
491 SSLerr(SSL_F_SSL3_GET_MESSAGE, 491 SSLerror(
492 SSL_R_EXCESSIVE_MESSAGE_SIZE); 492 SSL_R_EXCESSIVE_MESSAGE_SIZE);
493 goto f_err; 493 goto f_err;
494 } 494 }
495 if (l && !BUF_MEM_grow_clean(s->internal->init_buf, l + 4)) { 495 if (l && !BUF_MEM_grow_clean(s->internal->init_buf, l + 4)) {
496 SSLerr(SSL_F_SSL3_GET_MESSAGE, ERR_R_BUF_LIB); 496 SSLerror(ERR_R_BUF_LIB);
497 goto err; 497 goto err;
498 } 498 }
499 S3I(s)->tmp.message_size = l; 499 S3I(s)->tmp.message_size = l;
@@ -684,7 +684,7 @@ ssl3_setup_read_buffer(SSL *s)
684 return 1; 684 return 1;
685 685
686err: 686err:
687 SSLerr(SSL_F_SSL3_SETUP_READ_BUFFER, ERR_R_MALLOC_FAILURE); 687 SSLerror(ERR_R_MALLOC_FAILURE);
688 return 0; 688 return 0;
689} 689}
690 690
@@ -717,7 +717,7 @@ ssl3_setup_write_buffer(SSL *s)
717 return 1; 717 return 1;
718 718
719err: 719err:
720 SSLerr(SSL_F_SSL3_SETUP_WRITE_BUFFER, ERR_R_MALLOC_FAILURE); 720 SSLerror(ERR_R_MALLOC_FAILURE);
721 return 0; 721 return 0;
722} 722}
723 723
diff --git a/src/lib/libssl/ssl_cert.c b/src/lib/libssl/ssl_cert.c
index 218a55c197..4f714f751a 100644
--- a/src/lib/libssl/ssl_cert.c
+++ b/src/lib/libssl/ssl_cert.c
@@ -1,4 +1,4 @@
1/* $OpenBSD: ssl_cert.c,v 1.60 2017/01/24 15:04:12 jsing Exp $ */ 1/* $OpenBSD: ssl_cert.c,v 1.61 2017/01/26 10:40:21 beck Exp $ */
2/* Copyright (C) 1995-1998 Eric Young (eay@cryptsoft.com) 2/* Copyright (C) 1995-1998 Eric Young (eay@cryptsoft.com)
3 * All rights reserved. 3 * All rights reserved.
4 * 4 *
@@ -178,7 +178,7 @@ ssl_cert_new(void)
178 178
179 ret = calloc(1, sizeof(CERT)); 179 ret = calloc(1, sizeof(CERT));
180 if (ret == NULL) { 180 if (ret == NULL) {
181 SSLerr(SSL_F_SSL_CERT_NEW, ERR_R_MALLOC_FAILURE); 181 SSLerror(ERR_R_MALLOC_FAILURE);
182 return (NULL); 182 return (NULL);
183 } 183 }
184 ret->key = &(ret->pkeys[SSL_PKEY_RSA_ENC]); 184 ret->key = &(ret->pkeys[SSL_PKEY_RSA_ENC]);
@@ -195,7 +195,7 @@ ssl_cert_dup(CERT *cert)
195 195
196 ret = calloc(1, sizeof(CERT)); 196 ret = calloc(1, sizeof(CERT));
197 if (ret == NULL) { 197 if (ret == NULL) {
198 SSLerr(SSL_F_SSL_CERT_DUP, ERR_R_MALLOC_FAILURE); 198 SSLerror(ERR_R_MALLOC_FAILURE);
199 return (NULL); 199 return (NULL);
200 } 200 }
201 201
@@ -212,13 +212,13 @@ ssl_cert_dup(CERT *cert)
212 if (cert->dh_tmp != NULL) { 212 if (cert->dh_tmp != NULL) {
213 ret->dh_tmp = DHparams_dup(cert->dh_tmp); 213 ret->dh_tmp = DHparams_dup(cert->dh_tmp);
214 if (ret->dh_tmp == NULL) { 214 if (ret->dh_tmp == NULL) {
215 SSLerr(SSL_F_SSL_CERT_DUP, ERR_R_DH_LIB); 215 SSLerror(ERR_R_DH_LIB);
216 goto err; 216 goto err;
217 } 217 }
218 if (cert->dh_tmp->priv_key) { 218 if (cert->dh_tmp->priv_key) {
219 BIGNUM *b = BN_dup(cert->dh_tmp->priv_key); 219 BIGNUM *b = BN_dup(cert->dh_tmp->priv_key);
220 if (!b) { 220 if (!b) {
221 SSLerr(SSL_F_SSL_CERT_DUP, ERR_R_BN_LIB); 221 SSLerror(ERR_R_BN_LIB);
222 goto err; 222 goto err;
223 } 223 }
224 ret->dh_tmp->priv_key = b; 224 ret->dh_tmp->priv_key = b;
@@ -226,7 +226,7 @@ ssl_cert_dup(CERT *cert)
226 if (cert->dh_tmp->pub_key) { 226 if (cert->dh_tmp->pub_key) {
227 BIGNUM *b = BN_dup(cert->dh_tmp->pub_key); 227 BIGNUM *b = BN_dup(cert->dh_tmp->pub_key);
228 if (!b) { 228 if (!b) {
229 SSLerr(SSL_F_SSL_CERT_DUP, ERR_R_BN_LIB); 229 SSLerror(ERR_R_BN_LIB);
230 goto err; 230 goto err;
231 } 231 }
232 ret->dh_tmp->pub_key = b; 232 ret->dh_tmp->pub_key = b;
@@ -238,7 +238,7 @@ ssl_cert_dup(CERT *cert)
238 if (cert->ecdh_tmp) { 238 if (cert->ecdh_tmp) {
239 ret->ecdh_tmp = EC_KEY_dup(cert->ecdh_tmp); 239 ret->ecdh_tmp = EC_KEY_dup(cert->ecdh_tmp);
240 if (ret->ecdh_tmp == NULL) { 240 if (ret->ecdh_tmp == NULL) {
241 SSLerr(SSL_F_SSL_CERT_DUP, ERR_R_EC_LIB); 241 SSLerror(ERR_R_EC_LIB);
242 goto err; 242 goto err;
243 } 243 }
244 } 244 }
@@ -284,7 +284,7 @@ ssl_cert_dup(CERT *cert)
284 284
285 default: 285 default:
286 /* Can't happen. */ 286 /* Can't happen. */
287 SSLerr(SSL_F_SSL_CERT_DUP, SSL_R_LIBRARY_BUG); 287 SSLerror(SSL_R_LIBRARY_BUG);
288 } 288 }
289 } 289 }
290 } 290 }
@@ -354,12 +354,12 @@ ssl_cert_inst(CERT **o)
354 */ 354 */
355 355
356 if (o == NULL) { 356 if (o == NULL) {
357 SSLerr(SSL_F_SSL_CERT_INST, ERR_R_PASSED_NULL_PARAMETER); 357 SSLerror(ERR_R_PASSED_NULL_PARAMETER);
358 return (0); 358 return (0);
359 } 359 }
360 if (*o == NULL) { 360 if (*o == NULL) {
361 if ((*o = ssl_cert_new()) == NULL) { 361 if ((*o = ssl_cert_new()) == NULL) {
362 SSLerr(SSL_F_SSL_CERT_INST, ERR_R_MALLOC_FAILURE); 362 SSLerror(ERR_R_MALLOC_FAILURE);
363 return (0); 363 return (0);
364 } 364 }
365 } 365 }
@@ -374,7 +374,7 @@ ssl_sess_cert_new(void)
374 374
375 ret = calloc(1, sizeof *ret); 375 ret = calloc(1, sizeof *ret);
376 if (ret == NULL) { 376 if (ret == NULL) {
377 SSLerr(SSL_F_SSL_SESS_CERT_NEW, ERR_R_MALLOC_FAILURE); 377 SSLerror(ERR_R_MALLOC_FAILURE);
378 return NULL; 378 return NULL;
379 } 379 }
380 ret->peer_key = &(ret->peer_pkeys[SSL_PKEY_RSA_ENC]); 380 ret->peer_key = &(ret->peer_pkeys[SSL_PKEY_RSA_ENC]);
@@ -418,7 +418,7 @@ ssl_verify_cert_chain(SSL *s, STACK_OF(X509) *sk)
418 418
419 x = sk_X509_value(sk, 0); 419 x = sk_X509_value(sk, 0);
420 if (!X509_STORE_CTX_init(&ctx, s->ctx->cert_store, x, sk)) { 420 if (!X509_STORE_CTX_init(&ctx, s->ctx->cert_store, x, sk)) {
421 SSLerr(SSL_F_SSL_VERIFY_CERT_CHAIN, ERR_R_X509_LIB); 421 SSLerror(ERR_R_X509_LIB);
422 return (0); 422 return (0);
423 } 423 }
424 X509_STORE_CTX_set_ex_data(&ctx, 424 X509_STORE_CTX_set_ex_data(&ctx,
@@ -574,7 +574,7 @@ SSL_load_client_CA_file(const char *file)
574 in = BIO_new(BIO_s_file_internal()); 574 in = BIO_new(BIO_s_file_internal());
575 575
576 if ((sk == NULL) || (in == NULL)) { 576 if ((sk == NULL) || (in == NULL)) {
577 SSLerr(SSL_F_SSL_LOAD_CLIENT_CA_FILE, ERR_R_MALLOC_FAILURE); 577 SSLerror(ERR_R_MALLOC_FAILURE);
578 goto err; 578 goto err;
579 } 579 }
580 580
@@ -587,7 +587,7 @@ SSL_load_client_CA_file(const char *file)
587 if (ret == NULL) { 587 if (ret == NULL) {
588 ret = sk_X509_NAME_new_null(); 588 ret = sk_X509_NAME_new_null();
589 if (ret == NULL) { 589 if (ret == NULL) {
590 SSLerr(SSL_F_SSL_LOAD_CLIENT_CA_FILE, 590 SSLerror(
591 ERR_R_MALLOC_FAILURE); 591 ERR_R_MALLOC_FAILURE);
592 goto err; 592 goto err;
593 } 593 }
@@ -643,7 +643,7 @@ SSL_add_file_cert_subjects_to_stack(STACK_OF(X509_NAME) *stack,
643 in = BIO_new(BIO_s_file_internal()); 643 in = BIO_new(BIO_s_file_internal());
644 644
645 if (in == NULL) { 645 if (in == NULL) {
646 SSLerr(SSL_F_SSL_ADD_FILE_CERT_SUBJECTS_TO_STACK, 646 SSLerror(
647 ERR_R_MALLOC_FAILURE); 647 ERR_R_MALLOC_FAILURE);
648 goto err; 648 goto err;
649 } 649 }
@@ -713,7 +713,7 @@ SSL_add_dir_cert_subjects_to_stack(STACK_OF(X509_NAME) *stack, const char *dir)
713 if (!ret) { 713 if (!ret) {
714 SYSerr(SYS_F_OPENDIR, errno); 714 SYSerr(SYS_F_OPENDIR, errno);
715 ERR_asprintf_error_data("opendir ('%s')", dir); 715 ERR_asprintf_error_data("opendir ('%s')", dir);
716 SSLerr(SSL_F_SSL_ADD_DIR_CERT_SUBJECTS_TO_STACK, ERR_R_SYS_LIB); 716 SSLerror(ERR_R_SYS_LIB);
717 } 717 }
718 return ret; 718 return ret;
719} 719}
diff --git a/src/lib/libssl/ssl_ciph.c b/src/lib/libssl/ssl_ciph.c
index 5a5bb165d8..c1dee99e58 100644
--- a/src/lib/libssl/ssl_ciph.c
+++ b/src/lib/libssl/ssl_ciph.c
@@ -1,4 +1,4 @@
1/* $OpenBSD: ssl_ciph.c,v 1.90 2017/01/24 01:44:00 jsing Exp $ */ 1/* $OpenBSD: ssl_ciph.c,v 1.91 2017/01/26 10:40:21 beck Exp $ */
2/* Copyright (C) 1995-1998 Eric Young (eay@cryptsoft.com) 2/* Copyright (C) 1995-1998 Eric Young (eay@cryptsoft.com)
3 * All rights reserved. 3 * All rights reserved.
4 * 4 *
@@ -1072,7 +1072,7 @@ ssl_cipher_strength_sort(CIPHER_ORDER **head_p, CIPHER_ORDER **tail_p)
1072 1072
1073 number_uses = calloc((max_strength_bits + 1), sizeof(int)); 1073 number_uses = calloc((max_strength_bits + 1), sizeof(int));
1074 if (!number_uses) { 1074 if (!number_uses) {
1075 SSLerr(SSL_F_SSL_CIPHER_STRENGTH_SORT, ERR_R_MALLOC_FAILURE); 1075 SSLerror(ERR_R_MALLOC_FAILURE);
1076 return (0); 1076 return (0);
1077 } 1077 }
1078 1078
@@ -1162,7 +1162,7 @@ ssl_cipher_process_rulestr(const char *rule_str, CIPHER_ORDER **head_p,
1162 * it is no command or separator nor 1162 * it is no command or separator nor
1163 * alphanumeric, so we call this an error. 1163 * alphanumeric, so we call this an error.
1164 */ 1164 */
1165 SSLerr(SSL_F_SSL_CIPHER_PROCESS_RULESTR, 1165 SSLerror(
1166 SSL_R_INVALID_COMMAND); 1166 SSL_R_INVALID_COMMAND);
1167 retval = found = 0; 1167 retval = found = 0;
1168 l++; 1168 l++;
@@ -1309,7 +1309,7 @@ ssl_cipher_process_rulestr(const char *rule_str, CIPHER_ORDER **head_p,
1309 if ((buflen == 8) && !strncmp(buf, "STRENGTH", 8)) 1309 if ((buflen == 8) && !strncmp(buf, "STRENGTH", 8))
1310 ok = ssl_cipher_strength_sort(head_p, tail_p); 1310 ok = ssl_cipher_strength_sort(head_p, tail_p);
1311 else 1311 else
1312 SSLerr(SSL_F_SSL_CIPHER_PROCESS_RULESTR, 1312 SSLerror(
1313 SSL_R_INVALID_COMMAND); 1313 SSL_R_INVALID_COMMAND);
1314 if (ok == 0) 1314 if (ok == 0)
1315 retval = 0; 1315 retval = 0;
@@ -1379,7 +1379,7 @@ ssl_create_cipher_list(const SSL_METHOD *ssl_method,
1379 num_of_ciphers = ssl_method->num_ciphers(); 1379 num_of_ciphers = ssl_method->num_ciphers();
1380 co_list = reallocarray(NULL, num_of_ciphers, sizeof(CIPHER_ORDER)); 1380 co_list = reallocarray(NULL, num_of_ciphers, sizeof(CIPHER_ORDER));
1381 if (co_list == NULL) { 1381 if (co_list == NULL) {
1382 SSLerr(SSL_F_SSL_CREATE_CIPHER_LIST, ERR_R_MALLOC_FAILURE); 1382 SSLerror(ERR_R_MALLOC_FAILURE);
1383 return(NULL); /* Failure */ 1383 return(NULL); /* Failure */
1384 } 1384 }
1385 1385
@@ -1459,7 +1459,7 @@ ssl_create_cipher_list(const SSL_METHOD *ssl_method,
1459 ca_list = reallocarray(NULL, num_of_alias_max, sizeof(SSL_CIPHER *)); 1459 ca_list = reallocarray(NULL, num_of_alias_max, sizeof(SSL_CIPHER *));
1460 if (ca_list == NULL) { 1460 if (ca_list == NULL) {
1461 free(co_list); 1461 free(co_list);
1462 SSLerr(SSL_F_SSL_CREATE_CIPHER_LIST, ERR_R_MALLOC_FAILURE); 1462 SSLerror(ERR_R_MALLOC_FAILURE);
1463 return(NULL); /* Failure */ 1463 return(NULL); /* Failure */
1464 } 1464 }
1465 ssl_cipher_collect_aliases(ca_list, num_of_group_aliases, 1465 ssl_cipher_collect_aliases(ca_list, num_of_group_aliases,
diff --git a/src/lib/libssl/ssl_clnt.c b/src/lib/libssl/ssl_clnt.c
index f7bbca0d78..c8d4aca1c3 100644
--- a/src/lib/libssl/ssl_clnt.c
+++ b/src/lib/libssl/ssl_clnt.c
@@ -1,4 +1,4 @@
1/* $OpenBSD: ssl_clnt.c,v 1.2 2017/01/26 06:32:58 jsing Exp $ */ 1/* $OpenBSD: ssl_clnt.c,v 1.3 2017/01/26 10:40:21 beck Exp $ */
2/* Copyright (C) 1995-1998 Eric Young (eay@cryptsoft.com) 2/* Copyright (C) 1995-1998 Eric Young (eay@cryptsoft.com)
3 * All rights reserved. 3 * All rights reserved.
4 * 4 *
@@ -211,7 +211,7 @@ ssl3_connect(SSL *s)
211 cb(s, SSL_CB_HANDSHAKE_START, 1); 211 cb(s, SSL_CB_HANDSHAKE_START, 1);
212 212
213 if ((s->version & 0xff00 ) != 0x0300) { 213 if ((s->version & 0xff00 ) != 0x0300) {
214 SSLerr(SSL_F_SSL3_CONNECT, 214 SSLerror(
215 ERR_R_INTERNAL_ERROR); 215 ERR_R_INTERNAL_ERROR);
216 ret = -1; 216 ret = -1;
217 goto end; 217 goto end;
@@ -551,7 +551,7 @@ ssl3_connect(SSL *s)
551 /* break; */ 551 /* break; */
552 552
553 default: 553 default:
554 SSLerr(SSL_F_SSL3_CONNECT, 554 SSLerror(
555 SSL_R_UNKNOWN_STATE); 555 SSL_R_UNKNOWN_STATE);
556 ret = -1; 556 ret = -1;
557 goto end; 557 goto end;
@@ -597,7 +597,7 @@ ssl3_client_hello(SSL *s)
597 SSL_SESSION *sess = s->session; 597 SSL_SESSION *sess = s->session;
598 598
599 if (ssl_supported_version_range(s, NULL, &max_version) != 1) { 599 if (ssl_supported_version_range(s, NULL, &max_version) != 1) {
600 SSLerr(SSL_F_SSL3_CLIENT_HELLO, 600 SSLerror(
601 SSL_R_NO_PROTOCOLS_AVAILABLE); 601 SSL_R_NO_PROTOCOLS_AVAILABLE);
602 return (-1); 602 return (-1);
603 } 603 }
@@ -668,7 +668,7 @@ ssl3_client_hello(SSL *s)
668 *(p++) = i; 668 *(p++) = i;
669 if (i != 0) { 669 if (i != 0) {
670 if (i > (int)sizeof(s->session->session_id)) { 670 if (i > (int)sizeof(s->session->session_id)) {
671 SSLerr(SSL_F_SSL3_CLIENT_HELLO, 671 SSLerror(
672 ERR_R_INTERNAL_ERROR); 672 ERR_R_INTERNAL_ERROR);
673 goto err; 673 goto err;
674 } 674 }
@@ -679,7 +679,7 @@ ssl3_client_hello(SSL *s)
679 /* DTLS Cookie. */ 679 /* DTLS Cookie. */
680 if (SSL_IS_DTLS(s)) { 680 if (SSL_IS_DTLS(s)) {
681 if (D1I(s)->cookie_len > sizeof(D1I(s)->cookie)) { 681 if (D1I(s)->cookie_len > sizeof(D1I(s)->cookie)) {
682 SSLerr(SSL_F_DTLS1_CLIENT_HELLO, 682 SSLerror(
683 ERR_R_INTERNAL_ERROR); 683 ERR_R_INTERNAL_ERROR);
684 goto err; 684 goto err;
685 } 685 }
@@ -693,7 +693,7 @@ ssl3_client_hello(SSL *s)
693 bufend - &p[2], &outlen)) 693 bufend - &p[2], &outlen))
694 goto err; 694 goto err;
695 if (outlen == 0) { 695 if (outlen == 0) {
696 SSLerr(SSL_F_SSL3_CLIENT_HELLO, 696 SSLerror(
697 SSL_R_NO_CIPHERS_AVAILABLE); 697 SSL_R_NO_CIPHERS_AVAILABLE);
698 goto err; 698 goto err;
699 } 699 }
@@ -706,7 +706,7 @@ ssl3_client_hello(SSL *s)
706 706
707 /* TLS extensions*/ 707 /* TLS extensions*/
708 if ((p = ssl_add_clienthello_tlsext(s, p, bufend)) == NULL) { 708 if ((p = ssl_add_clienthello_tlsext(s, p, bufend)) == NULL) {
709 SSLerr(SSL_F_SSL3_CLIENT_HELLO, 709 SSLerror(
710 ERR_R_INTERNAL_ERROR); 710 ERR_R_INTERNAL_ERROR);
711 goto err; 711 goto err;
712 } 712 }
@@ -759,7 +759,7 @@ ssl3_get_server_hello(SSL *s)
759 } else { 759 } else {
760 /* Already sent a cookie. */ 760 /* Already sent a cookie. */
761 al = SSL_AD_UNEXPECTED_MESSAGE; 761 al = SSL_AD_UNEXPECTED_MESSAGE;
762 SSLerr(SSL_F_SSL3_GET_SERVER_HELLO, 762 SSLerror(
763 SSL_R_BAD_MESSAGE_TYPE); 763 SSL_R_BAD_MESSAGE_TYPE);
764 goto f_err; 764 goto f_err;
765 } 765 }
@@ -768,7 +768,7 @@ ssl3_get_server_hello(SSL *s)
768 768
769 if (S3I(s)->tmp.message_type != SSL3_MT_SERVER_HELLO) { 769 if (S3I(s)->tmp.message_type != SSL3_MT_SERVER_HELLO) {
770 al = SSL_AD_UNEXPECTED_MESSAGE; 770 al = SSL_AD_UNEXPECTED_MESSAGE;
771 SSLerr(SSL_F_SSL3_GET_SERVER_HELLO, 771 SSLerror(
772 SSL_R_BAD_MESSAGE_TYPE); 772 SSL_R_BAD_MESSAGE_TYPE);
773 goto f_err; 773 goto f_err;
774 } 774 }
@@ -777,13 +777,13 @@ ssl3_get_server_hello(SSL *s)
777 goto truncated; 777 goto truncated;
778 778
779 if (ssl_supported_version_range(s, &min_version, &max_version) != 1) { 779 if (ssl_supported_version_range(s, &min_version, &max_version) != 1) {
780 SSLerr(SSL_F_SSL3_GET_SERVER_HELLO, 780 SSLerror(
781 SSL_R_NO_PROTOCOLS_AVAILABLE); 781 SSL_R_NO_PROTOCOLS_AVAILABLE);
782 goto err; 782 goto err;
783 } 783 }
784 784
785 if (server_version < min_version || server_version > max_version) { 785 if (server_version < min_version || server_version > max_version) {
786 SSLerr(SSL_F_SSL3_GET_SERVER_HELLO, SSL_R_WRONG_SSL_VERSION); 786 SSLerror(SSL_R_WRONG_SSL_VERSION);
787 s->version = (s->version & 0xff00) | (server_version & 0xff); 787 s->version = (s->version & 0xff00) | (server_version & 0xff);
788 al = SSL_AD_PROTOCOL_VERSION; 788 al = SSL_AD_PROTOCOL_VERSION;
789 goto f_err; 789 goto f_err;
@@ -793,7 +793,7 @@ ssl3_get_server_hello(SSL *s)
793 if ((method = tls1_get_client_method(server_version)) == NULL) 793 if ((method = tls1_get_client_method(server_version)) == NULL)
794 method = dtls1_get_client_method(server_version); 794 method = dtls1_get_client_method(server_version);
795 if (method == NULL) { 795 if (method == NULL) {
796 SSLerr(SSL_F_SSL3_GET_SERVER_HELLO, ERR_R_INTERNAL_ERROR); 796 SSLerror(ERR_R_INTERNAL_ERROR);
797 goto err; 797 goto err;
798 } 798 }
799 s->method = method; 799 s->method = method;
@@ -812,7 +812,7 @@ ssl3_get_server_hello(SSL *s)
812 if ((CBS_len(&session_id) > sizeof(s->session->session_id)) || 812 if ((CBS_len(&session_id) > sizeof(s->session->session_id)) ||
813 (CBS_len(&session_id) > SSL3_SESSION_ID_SIZE)) { 813 (CBS_len(&session_id) > SSL3_SESSION_ID_SIZE)) {
814 al = SSL_AD_ILLEGAL_PARAMETER; 814 al = SSL_AD_ILLEGAL_PARAMETER;
815 SSLerr(SSL_F_SSL3_GET_SERVER_HELLO, 815 SSLerror(
816 SSL_R_SSL3_SESSION_ID_TOO_LONG); 816 SSL_R_SSL3_SESSION_ID_TOO_LONG);
817 goto f_err; 817 goto f_err;
818 } 818 }
@@ -845,7 +845,7 @@ ssl3_get_server_hello(SSL *s)
845 s->sid_ctx, s->sid_ctx_length) != 0) { 845 s->sid_ctx, s->sid_ctx_length) != 0) {
846 /* actually a client application bug */ 846 /* actually a client application bug */
847 al = SSL_AD_ILLEGAL_PARAMETER; 847 al = SSL_AD_ILLEGAL_PARAMETER;
848 SSLerr(SSL_F_SSL3_GET_SERVER_HELLO, 848 SSLerror(
849 SSL_R_ATTEMPT_TO_REUSE_SESSION_IN_DIFFERENT_CONTEXT); 849 SSL_R_ATTEMPT_TO_REUSE_SESSION_IN_DIFFERENT_CONTEXT);
850 goto f_err; 850 goto f_err;
851 } 851 }
@@ -878,7 +878,7 @@ ssl3_get_server_hello(SSL *s)
878 878
879 if ((cipher = ssl3_get_cipher_by_value(cipher_suite)) == NULL) { 879 if ((cipher = ssl3_get_cipher_by_value(cipher_suite)) == NULL) {
880 al = SSL_AD_ILLEGAL_PARAMETER; 880 al = SSL_AD_ILLEGAL_PARAMETER;
881 SSLerr(SSL_F_SSL3_GET_SERVER_HELLO, 881 SSLerror(
882 SSL_R_UNKNOWN_CIPHER_RETURNED); 882 SSL_R_UNKNOWN_CIPHER_RETURNED);
883 goto f_err; 883 goto f_err;
884 } 884 }
@@ -887,7 +887,7 @@ ssl3_get_server_hello(SSL *s)
887 if ((cipher->algorithm_ssl & SSL_TLSV1_2) && 887 if ((cipher->algorithm_ssl & SSL_TLSV1_2) &&
888 (TLS1_get_version(s) < TLS1_2_VERSION)) { 888 (TLS1_get_version(s) < TLS1_2_VERSION)) {
889 al = SSL_AD_ILLEGAL_PARAMETER; 889 al = SSL_AD_ILLEGAL_PARAMETER;
890 SSLerr(SSL_F_SSL3_GET_SERVER_HELLO, 890 SSLerror(
891 SSL_R_WRONG_CIPHER_RETURNED); 891 SSL_R_WRONG_CIPHER_RETURNED);
892 goto f_err; 892 goto f_err;
893 } 893 }
@@ -897,7 +897,7 @@ ssl3_get_server_hello(SSL *s)
897 if (i < 0) { 897 if (i < 0) {
898 /* we did not say we would use this cipher */ 898 /* we did not say we would use this cipher */
899 al = SSL_AD_ILLEGAL_PARAMETER; 899 al = SSL_AD_ILLEGAL_PARAMETER;
900 SSLerr(SSL_F_SSL3_GET_SERVER_HELLO, 900 SSLerror(
901 SSL_R_WRONG_CIPHER_RETURNED); 901 SSL_R_WRONG_CIPHER_RETURNED);
902 goto f_err; 902 goto f_err;
903 } 903 }
@@ -911,7 +911,7 @@ ssl3_get_server_hello(SSL *s)
911 s->session->cipher_id = s->session->cipher->id; 911 s->session->cipher_id = s->session->cipher->id;
912 if (s->internal->hit && (s->session->cipher_id != cipher->id)) { 912 if (s->internal->hit && (s->session->cipher_id != cipher->id)) {
913 al = SSL_AD_ILLEGAL_PARAMETER; 913 al = SSL_AD_ILLEGAL_PARAMETER;
914 SSLerr(SSL_F_SSL3_GET_SERVER_HELLO, 914 SSLerror(
915 SSL_R_OLD_SESSION_CIPHER_NOT_RETURNED); 915 SSL_R_OLD_SESSION_CIPHER_NOT_RETURNED);
916 goto f_err; 916 goto f_err;
917 } 917 }
@@ -933,7 +933,7 @@ ssl3_get_server_hello(SSL *s)
933 933
934 if (compression_method != 0) { 934 if (compression_method != 0) {
935 al = SSL_AD_ILLEGAL_PARAMETER; 935 al = SSL_AD_ILLEGAL_PARAMETER;
936 SSLerr(SSL_F_SSL3_GET_SERVER_HELLO, 936 SSLerror(
937 SSL_R_UNSUPPORTED_COMPRESSION_ALGORITHM); 937 SSL_R_UNSUPPORTED_COMPRESSION_ALGORITHM);
938 goto f_err; 938 goto f_err;
939 } 939 }
@@ -942,11 +942,11 @@ ssl3_get_server_hello(SSL *s)
942 p = (unsigned char *)CBS_data(&cbs); 942 p = (unsigned char *)CBS_data(&cbs);
943 if (!ssl_parse_serverhello_tlsext(s, &p, CBS_len(&cbs), &al)) { 943 if (!ssl_parse_serverhello_tlsext(s, &p, CBS_len(&cbs), &al)) {
944 /* 'al' set by ssl_parse_serverhello_tlsext */ 944 /* 'al' set by ssl_parse_serverhello_tlsext */
945 SSLerr(SSL_F_SSL3_GET_SERVER_HELLO, SSL_R_PARSE_TLSEXT); 945 SSLerror(SSL_R_PARSE_TLSEXT);
946 goto f_err; 946 goto f_err;
947 } 947 }
948 if (ssl_check_serverhello_tlsext(s) <= 0) { 948 if (ssl_check_serverhello_tlsext(s) <= 0) {
949 SSLerr(SSL_F_SSL3_GET_SERVER_HELLO, SSL_R_SERVERHELLO_TLSEXT); 949 SSLerror(SSL_R_SERVERHELLO_TLSEXT);
950 goto err; 950 goto err;
951 } 951 }
952 952
@@ -959,7 +959,7 @@ ssl3_get_server_hello(SSL *s)
959truncated: 959truncated:
960 /* wrong packet length */ 960 /* wrong packet length */
961 al = SSL_AD_DECODE_ERROR; 961 al = SSL_AD_DECODE_ERROR;
962 SSLerr(SSL_F_SSL3_GET_SERVER_HELLO, SSL_R_BAD_PACKET_LENGTH); 962 SSLerror(SSL_R_BAD_PACKET_LENGTH);
963f_err: 963f_err:
964 ssl3_send_alert(s, SSL3_AL_FATAL, al); 964 ssl3_send_alert(s, SSL3_AL_FATAL, al);
965err: 965err:
@@ -991,14 +991,14 @@ ssl3_get_server_certificate(SSL *s)
991 991
992 if (S3I(s)->tmp.message_type != SSL3_MT_CERTIFICATE) { 992 if (S3I(s)->tmp.message_type != SSL3_MT_CERTIFICATE) {
993 al = SSL_AD_UNEXPECTED_MESSAGE; 993 al = SSL_AD_UNEXPECTED_MESSAGE;
994 SSLerr(SSL_F_SSL3_GET_SERVER_CERTIFICATE, 994 SSLerror(
995 SSL_R_BAD_MESSAGE_TYPE); 995 SSL_R_BAD_MESSAGE_TYPE);
996 goto f_err; 996 goto f_err;
997 } 997 }
998 998
999 999
1000 if ((sk = sk_X509_new_null()) == NULL) { 1000 if ((sk = sk_X509_new_null()) == NULL) {
1001 SSLerr(SSL_F_SSL3_GET_SERVER_CERTIFICATE, 1001 SSLerror(
1002 ERR_R_MALLOC_FAILURE); 1002 ERR_R_MALLOC_FAILURE);
1003 goto err; 1003 goto err;
1004 } 1004 }
@@ -1013,7 +1013,7 @@ ssl3_get_server_certificate(SSL *s)
1013 if (!CBS_get_u24_length_prefixed(&cbs, &cert_list) || 1013 if (!CBS_get_u24_length_prefixed(&cbs, &cert_list) ||
1014 CBS_len(&cbs) != 0) { 1014 CBS_len(&cbs) != 0) {
1015 al = SSL_AD_DECODE_ERROR; 1015 al = SSL_AD_DECODE_ERROR;
1016 SSLerr(SSL_F_SSL3_GET_SERVER_CERTIFICATE, 1016 SSLerror(
1017 SSL_R_LENGTH_MISMATCH); 1017 SSL_R_LENGTH_MISMATCH);
1018 goto f_err; 1018 goto f_err;
1019 } 1019 }
@@ -1025,7 +1025,7 @@ ssl3_get_server_certificate(SSL *s)
1025 goto truncated; 1025 goto truncated;
1026 if (!CBS_get_u24_length_prefixed(&cert_list, &cert)) { 1026 if (!CBS_get_u24_length_prefixed(&cert_list, &cert)) {
1027 al = SSL_AD_DECODE_ERROR; 1027 al = SSL_AD_DECODE_ERROR;
1028 SSLerr(SSL_F_SSL3_GET_SERVER_CERTIFICATE, 1028 SSLerror(
1029 SSL_R_CERT_LENGTH_MISMATCH); 1029 SSL_R_CERT_LENGTH_MISMATCH);
1030 goto f_err; 1030 goto f_err;
1031 } 1031 }
@@ -1034,18 +1034,18 @@ ssl3_get_server_certificate(SSL *s)
1034 x = d2i_X509(NULL, &q, CBS_len(&cert)); 1034 x = d2i_X509(NULL, &q, CBS_len(&cert));
1035 if (x == NULL) { 1035 if (x == NULL) {
1036 al = SSL_AD_BAD_CERTIFICATE; 1036 al = SSL_AD_BAD_CERTIFICATE;
1037 SSLerr(SSL_F_SSL3_GET_SERVER_CERTIFICATE, 1037 SSLerror(
1038 ERR_R_ASN1_LIB); 1038 ERR_R_ASN1_LIB);
1039 goto f_err; 1039 goto f_err;
1040 } 1040 }
1041 if (q != CBS_data(&cert) + CBS_len(&cert)) { 1041 if (q != CBS_data(&cert) + CBS_len(&cert)) {
1042 al = SSL_AD_DECODE_ERROR; 1042 al = SSL_AD_DECODE_ERROR;
1043 SSLerr(SSL_F_SSL3_GET_SERVER_CERTIFICATE, 1043 SSLerror(
1044 SSL_R_CERT_LENGTH_MISMATCH); 1044 SSL_R_CERT_LENGTH_MISMATCH);
1045 goto f_err; 1045 goto f_err;
1046 } 1046 }
1047 if (!sk_X509_push(sk, x)) { 1047 if (!sk_X509_push(sk, x)) {
1048 SSLerr(SSL_F_SSL3_GET_SERVER_CERTIFICATE, 1048 SSLerror(
1049 ERR_R_MALLOC_FAILURE); 1049 ERR_R_MALLOC_FAILURE);
1050 goto err; 1050 goto err;
1051 } 1051 }
@@ -1055,7 +1055,7 @@ ssl3_get_server_certificate(SSL *s)
1055 i = ssl_verify_cert_chain(s, sk); 1055 i = ssl_verify_cert_chain(s, sk);
1056 if ((s->verify_mode != SSL_VERIFY_NONE) && (i <= 0)) { 1056 if ((s->verify_mode != SSL_VERIFY_NONE) && (i <= 0)) {
1057 al = ssl_verify_alarm_type(s->verify_result); 1057 al = ssl_verify_alarm_type(s->verify_result);
1058 SSLerr(SSL_F_SSL3_GET_SERVER_CERTIFICATE, 1058 SSLerror(
1059 SSL_R_CERTIFICATE_VERIFY_FAILED); 1059 SSL_R_CERTIFICATE_VERIFY_FAILED);
1060 goto f_err; 1060 goto f_err;
1061 1061
@@ -1082,7 +1082,7 @@ ssl3_get_server_certificate(SSL *s)
1082 if (pkey == NULL || EVP_PKEY_missing_parameters(pkey)) { 1082 if (pkey == NULL || EVP_PKEY_missing_parameters(pkey)) {
1083 x = NULL; 1083 x = NULL;
1084 al = SSL3_AL_FATAL; 1084 al = SSL3_AL_FATAL;
1085 SSLerr(SSL_F_SSL3_GET_SERVER_CERTIFICATE, 1085 SSLerror(
1086 SSL_R_UNABLE_TO_FIND_PUBLIC_KEY_PARAMETERS); 1086 SSL_R_UNABLE_TO_FIND_PUBLIC_KEY_PARAMETERS);
1087 goto f_err; 1087 goto f_err;
1088 } 1088 }
@@ -1091,7 +1091,7 @@ ssl3_get_server_certificate(SSL *s)
1091 if (i < 0) { 1091 if (i < 0) {
1092 x = NULL; 1092 x = NULL;
1093 al = SSL3_AL_FATAL; 1093 al = SSL3_AL_FATAL;
1094 SSLerr(SSL_F_SSL3_GET_SERVER_CERTIFICATE, 1094 SSLerror(
1095 SSL_R_UNKNOWN_CERTIFICATE_TYPE); 1095 SSL_R_UNKNOWN_CERTIFICATE_TYPE);
1096 goto f_err; 1096 goto f_err;
1097 } 1097 }
@@ -1118,7 +1118,7 @@ ssl3_get_server_certificate(SSL *s)
1118truncated: 1118truncated:
1119 /* wrong packet length */ 1119 /* wrong packet length */
1120 al = SSL_AD_DECODE_ERROR; 1120 al = SSL_AD_DECODE_ERROR;
1121 SSLerr(SSL_F_SSL3_GET_SERVER_CERTIFICATE, 1121 SSLerror(
1122 SSL_R_BAD_PACKET_LENGTH); 1122 SSL_R_BAD_PACKET_LENGTH);
1123f_err: 1123f_err:
1124 ssl3_send_alert(s, SSL3_AL_FATAL, al); 1124 ssl3_send_alert(s, SSL3_AL_FATAL, al);
@@ -1150,21 +1150,21 @@ ssl3_get_server_kex_dhe(SSL *s, EVP_PKEY **pkey, unsigned char **pp, long *nn)
1150 CBS_init(&cbs, *pp, *nn); 1150 CBS_init(&cbs, *pp, *nn);
1151 1151
1152 if ((dh = DH_new()) == NULL) { 1152 if ((dh = DH_new()) == NULL) {
1153 SSLerr(SSL_F_SSL3_GET_KEY_EXCHANGE, ERR_R_DH_LIB); 1153 SSLerror(ERR_R_DH_LIB);
1154 goto err; 1154 goto err;
1155 } 1155 }
1156 1156
1157 if (!CBS_get_u16_length_prefixed(&cbs, &dhp)) 1157 if (!CBS_get_u16_length_prefixed(&cbs, &dhp))
1158 goto truncated; 1158 goto truncated;
1159 if ((dh->p = BN_bin2bn(CBS_data(&dhp), CBS_len(&dhp), NULL)) == NULL) { 1159 if ((dh->p = BN_bin2bn(CBS_data(&dhp), CBS_len(&dhp), NULL)) == NULL) {
1160 SSLerr(SSL_F_SSL3_GET_KEY_EXCHANGE, ERR_R_BN_LIB); 1160 SSLerror(ERR_R_BN_LIB);
1161 goto err; 1161 goto err;
1162 } 1162 }
1163 1163
1164 if (!CBS_get_u16_length_prefixed(&cbs, &dhg)) 1164 if (!CBS_get_u16_length_prefixed(&cbs, &dhg))
1165 goto truncated; 1165 goto truncated;
1166 if ((dh->g = BN_bin2bn(CBS_data(&dhg), CBS_len(&dhg), NULL)) == NULL) { 1166 if ((dh->g = BN_bin2bn(CBS_data(&dhg), CBS_len(&dhg), NULL)) == NULL) {
1167 SSLerr(SSL_F_SSL3_GET_KEY_EXCHANGE, ERR_R_BN_LIB); 1167 SSLerror(ERR_R_BN_LIB);
1168 goto err; 1168 goto err;
1169 } 1169 }
1170 1170
@@ -1172,7 +1172,7 @@ ssl3_get_server_kex_dhe(SSL *s, EVP_PKEY **pkey, unsigned char **pp, long *nn)
1172 goto truncated; 1172 goto truncated;
1173 if ((dh->pub_key = BN_bin2bn(CBS_data(&dhpk), CBS_len(&dhpk), 1173 if ((dh->pub_key = BN_bin2bn(CBS_data(&dhpk), CBS_len(&dhpk),
1174 NULL)) == NULL) { 1174 NULL)) == NULL) {
1175 SSLerr(SSL_F_SSL3_GET_KEY_EXCHANGE, ERR_R_BN_LIB); 1175 SSLerror(ERR_R_BN_LIB);
1176 goto err; 1176 goto err;
1177 } 1177 }
1178 1178
@@ -1181,7 +1181,7 @@ ssl3_get_server_kex_dhe(SSL *s, EVP_PKEY **pkey, unsigned char **pp, long *nn)
1181 * Discard keys weaker than 1024 bits. 1181 * Discard keys weaker than 1024 bits.
1182 */ 1182 */
1183 if (DH_size(dh) < 1024 / 8) { 1183 if (DH_size(dh) < 1024 / 8) {
1184 SSLerr(SSL_F_SSL3_GET_KEY_EXCHANGE, SSL_R_BAD_DH_P_LENGTH); 1184 SSLerror(SSL_R_BAD_DH_P_LENGTH);
1185 goto err; 1185 goto err;
1186 } 1186 }
1187 1187
@@ -1202,7 +1202,7 @@ ssl3_get_server_kex_dhe(SSL *s, EVP_PKEY **pkey, unsigned char **pp, long *nn)
1202 1202
1203 truncated: 1203 truncated:
1204 al = SSL_AD_DECODE_ERROR; 1204 al = SSL_AD_DECODE_ERROR;
1205 SSLerr(SSL_F_SSL3_GET_KEY_EXCHANGE, SSL_R_BAD_PACKET_LENGTH); 1205 SSLerror(SSL_R_BAD_PACKET_LENGTH);
1206 ssl3_send_alert(s, SSL3_AL_FATAL, al); 1206 ssl3_send_alert(s, SSL3_AL_FATAL, al);
1207 1207
1208 err: 1208 err:
@@ -1227,16 +1227,16 @@ ssl3_get_server_kex_ecdhe_ecp(SSL *s, SESS_CERT *sc, int nid, CBS *public)
1227 */ 1227 */
1228 1228
1229 if ((ecdh = EC_KEY_new()) == NULL) { 1229 if ((ecdh = EC_KEY_new()) == NULL) {
1230 SSLerr(SSL_F_SSL3_GET_KEY_EXCHANGE, ERR_R_MALLOC_FAILURE); 1230 SSLerror(ERR_R_MALLOC_FAILURE);
1231 goto err; 1231 goto err;
1232 } 1232 }
1233 1233
1234 if ((ngroup = EC_GROUP_new_by_curve_name(nid)) == NULL) { 1234 if ((ngroup = EC_GROUP_new_by_curve_name(nid)) == NULL) {
1235 SSLerr(SSL_F_SSL3_GET_KEY_EXCHANGE, ERR_R_EC_LIB); 1235 SSLerror(ERR_R_EC_LIB);
1236 goto err; 1236 goto err;
1237 } 1237 }
1238 if (EC_KEY_set_group(ecdh, ngroup) == 0) { 1238 if (EC_KEY_set_group(ecdh, ngroup) == 0) {
1239 SSLerr(SSL_F_SSL3_GET_KEY_EXCHANGE, ERR_R_EC_LIB); 1239 SSLerror(ERR_R_EC_LIB);
1240 goto err; 1240 goto err;
1241 } 1241 }
1242 1242
@@ -1244,13 +1244,13 @@ ssl3_get_server_kex_ecdhe_ecp(SSL *s, SESS_CERT *sc, int nid, CBS *public)
1244 1244
1245 if ((point = EC_POINT_new(group)) == NULL || 1245 if ((point = EC_POINT_new(group)) == NULL ||
1246 (bn_ctx = BN_CTX_new()) == NULL) { 1246 (bn_ctx = BN_CTX_new()) == NULL) {
1247 SSLerr(SSL_F_SSL3_GET_KEY_EXCHANGE, ERR_R_MALLOC_FAILURE); 1247 SSLerror(ERR_R_MALLOC_FAILURE);
1248 goto err; 1248 goto err;
1249 } 1249 }
1250 1250
1251 if (EC_POINT_oct2point(group, point, CBS_data(public), 1251 if (EC_POINT_oct2point(group, point, CBS_data(public),
1252 CBS_len(public), bn_ctx) == 0) { 1252 CBS_len(public), bn_ctx) == 0) {
1253 SSLerr(SSL_F_SSL3_GET_KEY_EXCHANGE, SSL_R_BAD_ECPOINT); 1253 SSLerror(SSL_R_BAD_ECPOINT);
1254 ssl3_send_alert(s, SSL3_AL_FATAL, SSL_AD_DECODE_ERROR); 1254 ssl3_send_alert(s, SSL3_AL_FATAL, SSL_AD_DECODE_ERROR);
1255 goto err; 1255 goto err;
1256 } 1256 }
@@ -1276,18 +1276,18 @@ ssl3_get_server_kex_ecdhe_ecx(SSL *s, SESS_CERT *sc, int nid, CBS *public)
1276 size_t outlen; 1276 size_t outlen;
1277 1277
1278 if (nid != NID_X25519) { 1278 if (nid != NID_X25519) {
1279 SSLerr(SSL_F_SSL3_GET_KEY_EXCHANGE, ERR_R_INTERNAL_ERROR); 1279 SSLerror(ERR_R_INTERNAL_ERROR);
1280 goto err; 1280 goto err;
1281 } 1281 }
1282 1282
1283 if (CBS_len(public) != X25519_KEY_LENGTH) { 1283 if (CBS_len(public) != X25519_KEY_LENGTH) {
1284 SSLerr(SSL_F_SSL3_GET_KEY_EXCHANGE, SSL_R_BAD_ECPOINT); 1284 SSLerror(SSL_R_BAD_ECPOINT);
1285 ssl3_send_alert(s, SSL3_AL_FATAL, SSL_AD_DECODE_ERROR); 1285 ssl3_send_alert(s, SSL3_AL_FATAL, SSL_AD_DECODE_ERROR);
1286 goto err; 1286 goto err;
1287 } 1287 }
1288 1288
1289 if (!CBS_stow(public, &sc->peer_x25519_tmp, &outlen)) { 1289 if (!CBS_stow(public, &sc->peer_x25519_tmp, &outlen)) {
1290 SSLerr(SSL_F_SSL3_GET_KEY_EXCHANGE, ERR_R_MALLOC_FAILURE); 1290 SSLerror(ERR_R_MALLOC_FAILURE);
1291 goto err; 1291 goto err;
1292 } 1292 }
1293 1293
@@ -1321,7 +1321,7 @@ ssl3_get_server_kex_ecdhe(SSL *s, EVP_PKEY **pkey, unsigned char **pp, long *nn)
1321 curve_type != NAMED_CURVE_TYPE || 1321 curve_type != NAMED_CURVE_TYPE ||
1322 !CBS_get_u16(&cbs, &curve_id)) { 1322 !CBS_get_u16(&cbs, &curve_id)) {
1323 al = SSL_AD_DECODE_ERROR; 1323 al = SSL_AD_DECODE_ERROR;
1324 SSLerr(SSL_F_SSL3_GET_KEY_EXCHANGE, SSL_R_LENGTH_TOO_SHORT); 1324 SSLerror(SSL_R_LENGTH_TOO_SHORT);
1325 goto f_err; 1325 goto f_err;
1326 } 1326 }
1327 1327
@@ -1331,13 +1331,13 @@ ssl3_get_server_kex_ecdhe(SSL *s, EVP_PKEY **pkey, unsigned char **pp, long *nn)
1331 */ 1331 */
1332 if (tls1_check_curve(s, curve_id) != 1) { 1332 if (tls1_check_curve(s, curve_id) != 1) {
1333 al = SSL_AD_DECODE_ERROR; 1333 al = SSL_AD_DECODE_ERROR;
1334 SSLerr(SSL_F_SSL3_GET_KEY_EXCHANGE, SSL_R_WRONG_CURVE); 1334 SSLerror(SSL_R_WRONG_CURVE);
1335 goto f_err; 1335 goto f_err;
1336 } 1336 }
1337 1337
1338 if ((nid = tls1_ec_curve_id2nid(curve_id)) == 0) { 1338 if ((nid = tls1_ec_curve_id2nid(curve_id)) == 0) {
1339 al = SSL_AD_INTERNAL_ERROR; 1339 al = SSL_AD_INTERNAL_ERROR;
1340 SSLerr(SSL_F_SSL3_GET_KEY_EXCHANGE, 1340 SSLerror(
1341 SSL_R_UNABLE_TO_FIND_ECDH_PARAMETERS); 1341 SSL_R_UNABLE_TO_FIND_ECDH_PARAMETERS);
1342 goto f_err; 1342 goto f_err;
1343 } 1343 }
@@ -1373,7 +1373,7 @@ ssl3_get_server_kex_ecdhe(SSL *s, EVP_PKEY **pkey, unsigned char **pp, long *nn)
1373 1373
1374 truncated: 1374 truncated:
1375 al = SSL_AD_DECODE_ERROR; 1375 al = SSL_AD_DECODE_ERROR;
1376 SSLerr(SSL_F_SSL3_GET_KEY_EXCHANGE, SSL_R_BAD_PACKET_LENGTH); 1376 SSLerror(SSL_R_BAD_PACKET_LENGTH);
1377 1377
1378 f_err: 1378 f_err:
1379 ssl3_send_alert(s, SSL3_AL_FATAL, al); 1379 ssl3_send_alert(s, SSL3_AL_FATAL, al);
@@ -1414,7 +1414,7 @@ ssl3_get_server_key_exchange(SSL *s)
1414 * ephemeral keys. 1414 * ephemeral keys.
1415 */ 1415 */
1416 if (alg_k & (SSL_kDHE|SSL_kECDHE)) { 1416 if (alg_k & (SSL_kDHE|SSL_kECDHE)) {
1417 SSLerr(SSL_F_SSL3_GET_KEY_EXCHANGE, 1417 SSLerror(
1418 SSL_R_UNEXPECTED_MESSAGE); 1418 SSL_R_UNEXPECTED_MESSAGE);
1419 al = SSL_AD_UNEXPECTED_MESSAGE; 1419 al = SSL_AD_UNEXPECTED_MESSAGE;
1420 goto f_err; 1420 goto f_err;
@@ -1451,7 +1451,7 @@ ssl3_get_server_key_exchange(SSL *s)
1451 goto err; 1451 goto err;
1452 } else if (alg_k != 0) { 1452 } else if (alg_k != 0) {
1453 al = SSL_AD_UNEXPECTED_MESSAGE; 1453 al = SSL_AD_UNEXPECTED_MESSAGE;
1454 SSLerr(SSL_F_SSL3_GET_KEY_EXCHANGE, SSL_R_UNEXPECTED_MESSAGE); 1454 SSLerror(SSL_R_UNEXPECTED_MESSAGE);
1455 goto f_err; 1455 goto f_err;
1456 } 1456 }
1457 1457
@@ -1463,7 +1463,7 @@ ssl3_get_server_key_exchange(SSL *s)
1463 int sigalg = tls12_get_sigid(pkey); 1463 int sigalg = tls12_get_sigid(pkey);
1464 /* Should never happen */ 1464 /* Should never happen */
1465 if (sigalg == -1) { 1465 if (sigalg == -1) {
1466 SSLerr(SSL_F_SSL3_GET_KEY_EXCHANGE, 1466 SSLerror(
1467 ERR_R_INTERNAL_ERROR); 1467 ERR_R_INTERNAL_ERROR);
1468 goto err; 1468 goto err;
1469 } 1469 }
@@ -1474,14 +1474,14 @@ ssl3_get_server_key_exchange(SSL *s)
1474 if (2 > n) 1474 if (2 > n)
1475 goto truncated; 1475 goto truncated;
1476 if (sigalg != (int)p[1]) { 1476 if (sigalg != (int)p[1]) {
1477 SSLerr(SSL_F_SSL3_GET_KEY_EXCHANGE, 1477 SSLerror(
1478 SSL_R_WRONG_SIGNATURE_TYPE); 1478 SSL_R_WRONG_SIGNATURE_TYPE);
1479 al = SSL_AD_DECODE_ERROR; 1479 al = SSL_AD_DECODE_ERROR;
1480 goto f_err; 1480 goto f_err;
1481 } 1481 }
1482 md = tls12_get_hash(p[0]); 1482 md = tls12_get_hash(p[0]);
1483 if (md == NULL) { 1483 if (md == NULL) {
1484 SSLerr(SSL_F_SSL3_GET_KEY_EXCHANGE, 1484 SSLerror(
1485 SSL_R_UNKNOWN_DIGEST); 1485 SSL_R_UNKNOWN_DIGEST);
1486 al = SSL_AD_DECODE_ERROR; 1486 al = SSL_AD_DECODE_ERROR;
1487 goto f_err; 1487 goto f_err;
@@ -1500,7 +1500,7 @@ ssl3_get_server_key_exchange(SSL *s)
1500 if (i != n || n > j) { 1500 if (i != n || n > j) {
1501 /* wrong packet length */ 1501 /* wrong packet length */
1502 al = SSL_AD_DECODE_ERROR; 1502 al = SSL_AD_DECODE_ERROR;
1503 SSLerr(SSL_F_SSL3_GET_KEY_EXCHANGE, 1503 SSLerror(
1504 SSL_R_WRONG_SIGNATURE_LENGTH); 1504 SSL_R_WRONG_SIGNATURE_LENGTH);
1505 goto f_err; 1505 goto f_err;
1506 } 1506 }
@@ -1533,14 +1533,14 @@ ssl3_get_server_key_exchange(SSL *s)
1533 p, n, pkey->pkey.rsa); 1533 p, n, pkey->pkey.rsa);
1534 if (i < 0) { 1534 if (i < 0) {
1535 al = SSL_AD_DECRYPT_ERROR; 1535 al = SSL_AD_DECRYPT_ERROR;
1536 SSLerr(SSL_F_SSL3_GET_KEY_EXCHANGE, 1536 SSLerror(
1537 SSL_R_BAD_RSA_DECRYPT); 1537 SSL_R_BAD_RSA_DECRYPT);
1538 goto f_err; 1538 goto f_err;
1539 } 1539 }
1540 if (i == 0) { 1540 if (i == 0) {
1541 /* bad signature */ 1541 /* bad signature */
1542 al = SSL_AD_DECRYPT_ERROR; 1542 al = SSL_AD_DECRYPT_ERROR;
1543 SSLerr(SSL_F_SSL3_GET_KEY_EXCHANGE, 1543 SSLerror(
1544 SSL_R_BAD_SIGNATURE); 1544 SSL_R_BAD_SIGNATURE);
1545 goto f_err; 1545 goto f_err;
1546 } 1546 }
@@ -1554,7 +1554,7 @@ ssl3_get_server_key_exchange(SSL *s)
1554 if (EVP_VerifyFinal(&md_ctx, p,(int)n, pkey) <= 0) { 1554 if (EVP_VerifyFinal(&md_ctx, p,(int)n, pkey) <= 0) {
1555 /* bad signature */ 1555 /* bad signature */
1556 al = SSL_AD_DECRYPT_ERROR; 1556 al = SSL_AD_DECRYPT_ERROR;
1557 SSLerr(SSL_F_SSL3_GET_KEY_EXCHANGE, 1557 SSLerror(
1558 SSL_R_BAD_SIGNATURE); 1558 SSL_R_BAD_SIGNATURE);
1559 goto f_err; 1559 goto f_err;
1560 } 1560 }
@@ -1562,14 +1562,14 @@ ssl3_get_server_key_exchange(SSL *s)
1562 } else { 1562 } else {
1563 /* aNULL does not need public keys. */ 1563 /* aNULL does not need public keys. */
1564 if (!(alg_a & SSL_aNULL)) { 1564 if (!(alg_a & SSL_aNULL)) {
1565 SSLerr(SSL_F_SSL3_GET_KEY_EXCHANGE, 1565 SSLerror(
1566 ERR_R_INTERNAL_ERROR); 1566 ERR_R_INTERNAL_ERROR);
1567 goto err; 1567 goto err;
1568 } 1568 }
1569 /* still data left over */ 1569 /* still data left over */
1570 if (n != 0) { 1570 if (n != 0) {
1571 al = SSL_AD_DECODE_ERROR; 1571 al = SSL_AD_DECODE_ERROR;
1572 SSLerr(SSL_F_SSL3_GET_KEY_EXCHANGE, 1572 SSLerror(
1573 SSL_R_EXTRA_DATA_IN_MESSAGE); 1573 SSL_R_EXTRA_DATA_IN_MESSAGE);
1574 goto f_err; 1574 goto f_err;
1575 } 1575 }
@@ -1583,7 +1583,7 @@ ssl3_get_server_key_exchange(SSL *s)
1583 truncated: 1583 truncated:
1584 /* wrong packet length */ 1584 /* wrong packet length */
1585 al = SSL_AD_DECODE_ERROR; 1585 al = SSL_AD_DECODE_ERROR;
1586 SSLerr(SSL_F_SSL3_GET_KEY_EXCHANGE, SSL_R_BAD_PACKET_LENGTH); 1586 SSLerror(SSL_R_BAD_PACKET_LENGTH);
1587 1587
1588 f_err: 1588 f_err:
1589 ssl3_send_alert(s, SSL3_AL_FATAL, al); 1589 ssl3_send_alert(s, SSL3_AL_FATAL, al);
@@ -1630,7 +1630,7 @@ ssl3_get_certificate_request(SSL *s)
1630 1630
1631 if (S3I(s)->tmp.message_type != SSL3_MT_CERTIFICATE_REQUEST) { 1631 if (S3I(s)->tmp.message_type != SSL3_MT_CERTIFICATE_REQUEST) {
1632 ssl3_send_alert(s, SSL3_AL_FATAL, SSL_AD_UNEXPECTED_MESSAGE); 1632 ssl3_send_alert(s, SSL3_AL_FATAL, SSL_AD_UNEXPECTED_MESSAGE);
1633 SSLerr(SSL_F_SSL3_GET_CERTIFICATE_REQUEST, 1633 SSLerror(
1634 SSL_R_WRONG_MESSAGE_TYPE); 1634 SSL_R_WRONG_MESSAGE_TYPE);
1635 goto err; 1635 goto err;
1636 } 1636 }
@@ -1638,7 +1638,7 @@ ssl3_get_certificate_request(SSL *s)
1638 /* TLS does not like anon-DH with client cert */ 1638 /* TLS does not like anon-DH with client cert */
1639 if (S3I(s)->tmp.new_cipher->algorithm_auth & SSL_aNULL) { 1639 if (S3I(s)->tmp.new_cipher->algorithm_auth & SSL_aNULL) {
1640 ssl3_send_alert(s, SSL3_AL_FATAL, SSL_AD_UNEXPECTED_MESSAGE); 1640 ssl3_send_alert(s, SSL3_AL_FATAL, SSL_AD_UNEXPECTED_MESSAGE);
1641 SSLerr(SSL_F_SSL3_GET_CERTIFICATE_REQUEST, 1641 SSLerror(
1642 SSL_R_TLS_CLIENT_CERT_REQ_WITH_ANON_CIPHER); 1642 SSL_R_TLS_CLIENT_CERT_REQ_WITH_ANON_CIPHER);
1643 goto err; 1643 goto err;
1644 } 1644 }
@@ -1648,7 +1648,7 @@ ssl3_get_certificate_request(SSL *s)
1648 CBS_init(&cert_request, s->internal->init_msg, n); 1648 CBS_init(&cert_request, s->internal->init_msg, n);
1649 1649
1650 if ((ca_sk = sk_X509_NAME_new(ca_dn_cmp)) == NULL) { 1650 if ((ca_sk = sk_X509_NAME_new(ca_dn_cmp)) == NULL) {
1651 SSLerr(SSL_F_SSL3_GET_CERTIFICATE_REQUEST, 1651 SSLerror(
1652 ERR_R_MALLOC_FAILURE); 1652 ERR_R_MALLOC_FAILURE);
1653 goto err; 1653 goto err;
1654 } 1654 }
@@ -1662,7 +1662,7 @@ ssl3_get_certificate_request(SSL *s)
1662 if (!CBS_get_bytes(&cert_request, &ctypes, ctype_num) || 1662 if (!CBS_get_bytes(&cert_request, &ctypes, ctype_num) ||
1663 !CBS_write_bytes(&ctypes, (uint8_t *)S3I(s)->tmp.ctype, 1663 !CBS_write_bytes(&ctypes, (uint8_t *)S3I(s)->tmp.ctype,
1664 sizeof(S3I(s)->tmp.ctype), NULL)) { 1664 sizeof(S3I(s)->tmp.ctype), NULL)) {
1665 SSLerr(SSL_F_SSL3_GET_CERTIFICATE_REQUEST, 1665 SSLerror(
1666 SSL_R_DATA_LENGTH_TOO_LONG); 1666 SSL_R_DATA_LENGTH_TOO_LONG);
1667 goto err; 1667 goto err;
1668 } 1668 }
@@ -1671,7 +1671,7 @@ ssl3_get_certificate_request(SSL *s)
1671 CBS sigalgs; 1671 CBS sigalgs;
1672 1672
1673 if (CBS_len(&cert_request) < 2) { 1673 if (CBS_len(&cert_request) < 2) {
1674 SSLerr(SSL_F_SSL3_GET_CERTIFICATE_REQUEST, 1674 SSLerror(
1675 SSL_R_DATA_LENGTH_TOO_LONG); 1675 SSL_R_DATA_LENGTH_TOO_LONG);
1676 goto err; 1676 goto err;
1677 } 1677 }
@@ -1681,7 +1681,7 @@ ssl3_get_certificate_request(SSL *s)
1681 */ 1681 */
1682 if (!CBS_get_u16_length_prefixed(&cert_request, &sigalgs)) { 1682 if (!CBS_get_u16_length_prefixed(&cert_request, &sigalgs)) {
1683 ssl3_send_alert(s, SSL3_AL_FATAL, SSL_AD_DECODE_ERROR); 1683 ssl3_send_alert(s, SSL3_AL_FATAL, SSL_AD_DECODE_ERROR);
1684 SSLerr(SSL_F_SSL3_GET_CERTIFICATE_REQUEST, 1684 SSLerror(
1685 SSL_R_DATA_LENGTH_TOO_LONG); 1685 SSL_R_DATA_LENGTH_TOO_LONG);
1686 goto err; 1686 goto err;
1687 } 1687 }
@@ -1689,7 +1689,7 @@ ssl3_get_certificate_request(SSL *s)
1689 !tls1_process_sigalgs(s, CBS_data(&sigalgs), 1689 !tls1_process_sigalgs(s, CBS_data(&sigalgs),
1690 CBS_len(&sigalgs))) { 1690 CBS_len(&sigalgs))) {
1691 ssl3_send_alert(s, SSL3_AL_FATAL, SSL_AD_DECODE_ERROR); 1691 ssl3_send_alert(s, SSL3_AL_FATAL, SSL_AD_DECODE_ERROR);
1692 SSLerr(SSL_F_SSL3_GET_CERTIFICATE_REQUEST, 1692 SSLerror(
1693 SSL_R_SIGNATURE_ALGORITHMS_ERROR); 1693 SSL_R_SIGNATURE_ALGORITHMS_ERROR);
1694 goto err; 1694 goto err;
1695 } 1695 }
@@ -1697,7 +1697,7 @@ ssl3_get_certificate_request(SSL *s)
1697 1697
1698 /* get the CA RDNs */ 1698 /* get the CA RDNs */
1699 if (CBS_len(&cert_request) < 2) { 1699 if (CBS_len(&cert_request) < 2) {
1700 SSLerr(SSL_F_SSL3_GET_CERTIFICATE_REQUEST, 1700 SSLerror(
1701 SSL_R_DATA_LENGTH_TOO_LONG); 1701 SSL_R_DATA_LENGTH_TOO_LONG);
1702 goto err; 1702 goto err;
1703 } 1703 }
@@ -1705,7 +1705,7 @@ ssl3_get_certificate_request(SSL *s)
1705 if (!CBS_get_u16_length_prefixed(&cert_request, &rdn_list) || 1705 if (!CBS_get_u16_length_prefixed(&cert_request, &rdn_list) ||
1706 CBS_len(&cert_request) != 0) { 1706 CBS_len(&cert_request) != 0) {
1707 ssl3_send_alert(s, SSL3_AL_FATAL, SSL_AD_DECODE_ERROR); 1707 ssl3_send_alert(s, SSL3_AL_FATAL, SSL_AD_DECODE_ERROR);
1708 SSLerr(SSL_F_SSL3_GET_CERTIFICATE_REQUEST, 1708 SSLerror(
1709 SSL_R_LENGTH_MISMATCH); 1709 SSL_R_LENGTH_MISMATCH);
1710 goto err; 1710 goto err;
1711 } 1711 }
@@ -1714,14 +1714,14 @@ ssl3_get_certificate_request(SSL *s)
1714 CBS rdn; 1714 CBS rdn;
1715 1715
1716 if (CBS_len(&rdn_list) < 2) { 1716 if (CBS_len(&rdn_list) < 2) {
1717 SSLerr(SSL_F_SSL3_GET_CERTIFICATE_REQUEST, 1717 SSLerror(
1718 SSL_R_DATA_LENGTH_TOO_LONG); 1718 SSL_R_DATA_LENGTH_TOO_LONG);
1719 goto err; 1719 goto err;
1720 } 1720 }
1721 1721
1722 if (!CBS_get_u16_length_prefixed(&rdn_list, &rdn)) { 1722 if (!CBS_get_u16_length_prefixed(&rdn_list, &rdn)) {
1723 ssl3_send_alert(s, SSL3_AL_FATAL, SSL_AD_DECODE_ERROR); 1723 ssl3_send_alert(s, SSL3_AL_FATAL, SSL_AD_DECODE_ERROR);
1724 SSLerr(SSL_F_SSL3_GET_CERTIFICATE_REQUEST, 1724 SSLerror(
1725 SSL_R_CA_DN_TOO_LONG); 1725 SSL_R_CA_DN_TOO_LONG);
1726 goto err; 1726 goto err;
1727 } 1727 }
@@ -1730,19 +1730,19 @@ ssl3_get_certificate_request(SSL *s)
1730 if ((xn = d2i_X509_NAME(NULL, &q, CBS_len(&rdn))) == NULL) { 1730 if ((xn = d2i_X509_NAME(NULL, &q, CBS_len(&rdn))) == NULL) {
1731 ssl3_send_alert(s, SSL3_AL_FATAL, 1731 ssl3_send_alert(s, SSL3_AL_FATAL,
1732 SSL_AD_DECODE_ERROR); 1732 SSL_AD_DECODE_ERROR);
1733 SSLerr(SSL_F_SSL3_GET_CERTIFICATE_REQUEST, 1733 SSLerror(
1734 ERR_R_ASN1_LIB); 1734 ERR_R_ASN1_LIB);
1735 goto err; 1735 goto err;
1736 } 1736 }
1737 1737
1738 if (q != CBS_data(&rdn) + CBS_len(&rdn)) { 1738 if (q != CBS_data(&rdn) + CBS_len(&rdn)) {
1739 ssl3_send_alert(s, SSL3_AL_FATAL, SSL_AD_DECODE_ERROR); 1739 ssl3_send_alert(s, SSL3_AL_FATAL, SSL_AD_DECODE_ERROR);
1740 SSLerr(SSL_F_SSL3_GET_CERTIFICATE_REQUEST, 1740 SSLerror(
1741 SSL_R_CA_DN_LENGTH_MISMATCH); 1741 SSL_R_CA_DN_LENGTH_MISMATCH);
1742 goto err; 1742 goto err;
1743 } 1743 }
1744 if (!sk_X509_NAME_push(ca_sk, xn)) { 1744 if (!sk_X509_NAME_push(ca_sk, xn)) {
1745 SSLerr(SSL_F_SSL3_GET_CERTIFICATE_REQUEST, 1745 SSLerror(
1746 ERR_R_MALLOC_FAILURE); 1746 ERR_R_MALLOC_FAILURE);
1747 goto err; 1747 goto err;
1748 } 1748 }
@@ -1759,7 +1759,7 @@ ssl3_get_certificate_request(SSL *s)
1759 ret = 1; 1759 ret = 1;
1760 if (0) { 1760 if (0) {
1761truncated: 1761truncated:
1762 SSLerr(SSL_F_SSL3_GET_CERTIFICATE_REQUEST, 1762 SSLerror(
1763 SSL_R_BAD_PACKET_LENGTH); 1763 SSL_R_BAD_PACKET_LENGTH);
1764 } 1764 }
1765err: 1765err:
@@ -1793,14 +1793,14 @@ ssl3_get_new_session_ticket(SSL *s)
1793 } 1793 }
1794 if (S3I(s)->tmp.message_type != SSL3_MT_NEWSESSION_TICKET) { 1794 if (S3I(s)->tmp.message_type != SSL3_MT_NEWSESSION_TICKET) {
1795 al = SSL_AD_UNEXPECTED_MESSAGE; 1795 al = SSL_AD_UNEXPECTED_MESSAGE;
1796 SSLerr(SSL_F_SSL3_GET_NEW_SESSION_TICKET, 1796 SSLerror(
1797 SSL_R_BAD_MESSAGE_TYPE); 1797 SSL_R_BAD_MESSAGE_TYPE);
1798 goto f_err; 1798 goto f_err;
1799 } 1799 }
1800 1800
1801 if (n < 0) { 1801 if (n < 0) {
1802 al = SSL_AD_DECODE_ERROR; 1802 al = SSL_AD_DECODE_ERROR;
1803 SSLerr(SSL_F_SSL3_GET_NEW_SESSION_TICKET, 1803 SSLerror(
1804 SSL_R_LENGTH_MISMATCH); 1804 SSL_R_LENGTH_MISMATCH);
1805 goto f_err; 1805 goto f_err;
1806 } 1806 }
@@ -1813,7 +1813,7 @@ ssl3_get_new_session_ticket(SSL *s)
1813 !CBS_get_u16_length_prefixed(&cbs, &session_ticket) || 1813 !CBS_get_u16_length_prefixed(&cbs, &session_ticket) ||
1814 CBS_len(&cbs) != 0) { 1814 CBS_len(&cbs) != 0) {
1815 al = SSL_AD_DECODE_ERROR; 1815 al = SSL_AD_DECODE_ERROR;
1816 SSLerr(SSL_F_SSL3_GET_NEW_SESSION_TICKET, 1816 SSLerror(
1817 SSL_R_LENGTH_MISMATCH); 1817 SSL_R_LENGTH_MISMATCH);
1818 goto f_err; 1818 goto f_err;
1819 } 1819 }
@@ -1821,7 +1821,7 @@ ssl3_get_new_session_ticket(SSL *s)
1821 1821
1822 if (!CBS_stow(&session_ticket, &s->session->tlsext_tick, 1822 if (!CBS_stow(&session_ticket, &s->session->tlsext_tick,
1823 &s->session->tlsext_ticklen)) { 1823 &s->session->tlsext_ticklen)) {
1824 SSLerr(SSL_F_SSL3_GET_NEW_SESSION_TICKET, 1824 SSLerror(
1825 ERR_R_MALLOC_FAILURE); 1825 ERR_R_MALLOC_FAILURE);
1826 goto err; 1826 goto err;
1827 } 1827 }
@@ -1872,7 +1872,7 @@ ssl3_get_cert_status(SSL *s)
1872 if (n < 0) { 1872 if (n < 0) {
1873 /* need at least status type + length */ 1873 /* need at least status type + length */
1874 al = SSL_AD_DECODE_ERROR; 1874 al = SSL_AD_DECODE_ERROR;
1875 SSLerr(SSL_F_SSL3_GET_CERT_STATUS, 1875 SSLerror(
1876 SSL_R_LENGTH_MISMATCH); 1876 SSL_R_LENGTH_MISMATCH);
1877 goto f_err; 1877 goto f_err;
1878 } 1878 }
@@ -1882,14 +1882,14 @@ ssl3_get_cert_status(SSL *s)
1882 CBS_len(&cert_status) < 3) { 1882 CBS_len(&cert_status) < 3) {
1883 /* need at least status type + length */ 1883 /* need at least status type + length */
1884 al = SSL_AD_DECODE_ERROR; 1884 al = SSL_AD_DECODE_ERROR;
1885 SSLerr(SSL_F_SSL3_GET_CERT_STATUS, 1885 SSLerror(
1886 SSL_R_LENGTH_MISMATCH); 1886 SSL_R_LENGTH_MISMATCH);
1887 goto f_err; 1887 goto f_err;
1888 } 1888 }
1889 1889
1890 if (status_type != TLSEXT_STATUSTYPE_ocsp) { 1890 if (status_type != TLSEXT_STATUSTYPE_ocsp) {
1891 al = SSL_AD_DECODE_ERROR; 1891 al = SSL_AD_DECODE_ERROR;
1892 SSLerr(SSL_F_SSL3_GET_CERT_STATUS, 1892 SSLerror(
1893 SSL_R_UNSUPPORTED_STATUS_TYPE); 1893 SSL_R_UNSUPPORTED_STATUS_TYPE);
1894 goto f_err; 1894 goto f_err;
1895 } 1895 }
@@ -1897,7 +1897,7 @@ ssl3_get_cert_status(SSL *s)
1897 if (!CBS_get_u24_length_prefixed(&cert_status, &response) || 1897 if (!CBS_get_u24_length_prefixed(&cert_status, &response) ||
1898 CBS_len(&cert_status) != 0) { 1898 CBS_len(&cert_status) != 0) {
1899 al = SSL_AD_DECODE_ERROR; 1899 al = SSL_AD_DECODE_ERROR;
1900 SSLerr(SSL_F_SSL3_GET_CERT_STATUS, 1900 SSLerror(
1901 SSL_R_LENGTH_MISMATCH); 1901 SSL_R_LENGTH_MISMATCH);
1902 goto f_err; 1902 goto f_err;
1903 } 1903 }
@@ -1906,7 +1906,7 @@ ssl3_get_cert_status(SSL *s)
1906 &stow_len) || stow_len > INT_MAX) { 1906 &stow_len) || stow_len > INT_MAX) {
1907 s->internal->tlsext_ocsp_resplen = 0; 1907 s->internal->tlsext_ocsp_resplen = 0;
1908 al = SSL_AD_INTERNAL_ERROR; 1908 al = SSL_AD_INTERNAL_ERROR;
1909 SSLerr(SSL_F_SSL3_GET_CERT_STATUS, 1909 SSLerror(
1910 ERR_R_MALLOC_FAILURE); 1910 ERR_R_MALLOC_FAILURE);
1911 goto f_err; 1911 goto f_err;
1912 } 1912 }
@@ -1918,13 +1918,13 @@ ssl3_get_cert_status(SSL *s)
1918 s->ctx->internal->tlsext_status_arg); 1918 s->ctx->internal->tlsext_status_arg);
1919 if (ret == 0) { 1919 if (ret == 0) {
1920 al = SSL_AD_BAD_CERTIFICATE_STATUS_RESPONSE; 1920 al = SSL_AD_BAD_CERTIFICATE_STATUS_RESPONSE;
1921 SSLerr(SSL_F_SSL3_GET_CERT_STATUS, 1921 SSLerror(
1922 SSL_R_INVALID_STATUS_RESPONSE); 1922 SSL_R_INVALID_STATUS_RESPONSE);
1923 goto f_err; 1923 goto f_err;
1924 } 1924 }
1925 if (ret < 0) { 1925 if (ret < 0) {
1926 al = SSL_AD_INTERNAL_ERROR; 1926 al = SSL_AD_INTERNAL_ERROR;
1927 SSLerr(SSL_F_SSL3_GET_CERT_STATUS, 1927 SSLerror(
1928 ERR_R_MALLOC_FAILURE); 1928 ERR_R_MALLOC_FAILURE);
1929 goto f_err; 1929 goto f_err;
1930 } 1930 }
@@ -1950,7 +1950,7 @@ ssl3_get_server_done(SSL *s)
1950 if (n > 0) { 1950 if (n > 0) {
1951 /* should contain no data */ 1951 /* should contain no data */
1952 ssl3_send_alert(s, SSL3_AL_FATAL, SSL_AD_DECODE_ERROR); 1952 ssl3_send_alert(s, SSL3_AL_FATAL, SSL_AD_DECODE_ERROR);
1953 SSLerr(SSL_F_SSL3_GET_SERVER_DONE, SSL_R_LENGTH_MISMATCH); 1953 SSLerror(SSL_R_LENGTH_MISMATCH);
1954 return (-1); 1954 return (-1);
1955 } 1955 }
1956 ret = 1; 1956 ret = 1;
@@ -1974,7 +1974,7 @@ ssl3_send_client_kex_rsa(SSL *s, SESS_CERT *sess_cert, CBB *cbb)
1974 pkey = X509_get_pubkey(sess_cert->peer_pkeys[SSL_PKEY_RSA_ENC].x509); 1974 pkey = X509_get_pubkey(sess_cert->peer_pkeys[SSL_PKEY_RSA_ENC].x509);
1975 if (pkey == NULL || pkey->type != EVP_PKEY_RSA || 1975 if (pkey == NULL || pkey->type != EVP_PKEY_RSA ||
1976 pkey->pkey.rsa == NULL) { 1976 pkey->pkey.rsa == NULL) {
1977 SSLerr(SSL_F_SSL3_SEND_CLIENT_KEY_EXCHANGE, 1977 SSLerror(
1978 ERR_R_INTERNAL_ERROR); 1978 ERR_R_INTERNAL_ERROR);
1979 goto err; 1979 goto err;
1980 } 1980 }
@@ -1984,7 +1984,7 @@ ssl3_send_client_kex_rsa(SSL *s, SESS_CERT *sess_cert, CBB *cbb)
1984 arc4random_buf(&pms[2], sizeof(pms) - 2); 1984 arc4random_buf(&pms[2], sizeof(pms) - 2);
1985 1985
1986 if ((enc_pms = malloc(RSA_size(pkey->pkey.rsa))) == NULL) { 1986 if ((enc_pms = malloc(RSA_size(pkey->pkey.rsa))) == NULL) {
1987 SSLerr(SSL_F_SSL3_SEND_CLIENT_KEY_EXCHANGE, 1987 SSLerror(
1988 ERR_R_MALLOC_FAILURE); 1988 ERR_R_MALLOC_FAILURE);
1989 goto err; 1989 goto err;
1990 } 1990 }
@@ -1992,7 +1992,7 @@ ssl3_send_client_kex_rsa(SSL *s, SESS_CERT *sess_cert, CBB *cbb)
1992 enc_len = RSA_public_encrypt(sizeof(pms), pms, enc_pms, pkey->pkey.rsa, 1992 enc_len = RSA_public_encrypt(sizeof(pms), pms, enc_pms, pkey->pkey.rsa,
1993 RSA_PKCS1_PADDING); 1993 RSA_PKCS1_PADDING);
1994 if (enc_len <= 0) { 1994 if (enc_len <= 0) {
1995 SSLerr(SSL_F_SSL3_SEND_CLIENT_KEY_EXCHANGE, 1995 SSLerror(
1996 SSL_R_BAD_RSA_ENCRYPT); 1996 SSL_R_BAD_RSA_ENCRYPT);
1997 goto err; 1997 goto err;
1998 } 1998 }
@@ -2031,7 +2031,7 @@ ssl3_send_client_kex_dhe(SSL *s, SESS_CERT *sess_cert, CBB *cbb)
2031 /* Ensure that we have an ephemeral key for DHE. */ 2031 /* Ensure that we have an ephemeral key for DHE. */
2032 if (sess_cert->peer_dh_tmp == NULL) { 2032 if (sess_cert->peer_dh_tmp == NULL) {
2033 ssl3_send_alert(s, SSL3_AL_FATAL, SSL_AD_HANDSHAKE_FAILURE); 2033 ssl3_send_alert(s, SSL3_AL_FATAL, SSL_AD_HANDSHAKE_FAILURE);
2034 SSLerr(SSL_F_SSL3_SEND_CLIENT_KEY_EXCHANGE, 2034 SSLerror(
2035 SSL_R_UNABLE_TO_FIND_DH_PARAMETERS); 2035 SSL_R_UNABLE_TO_FIND_DH_PARAMETERS);
2036 goto err; 2036 goto err;
2037 } 2037 }
@@ -2039,22 +2039,22 @@ ssl3_send_client_kex_dhe(SSL *s, SESS_CERT *sess_cert, CBB *cbb)
2039 2039
2040 /* Generate a new random key. */ 2040 /* Generate a new random key. */
2041 if ((dh_clnt = DHparams_dup(dh_srvr)) == NULL) { 2041 if ((dh_clnt = DHparams_dup(dh_srvr)) == NULL) {
2042 SSLerr(SSL_F_SSL3_SEND_CLIENT_KEY_EXCHANGE, ERR_R_DH_LIB); 2042 SSLerror(ERR_R_DH_LIB);
2043 goto err; 2043 goto err;
2044 } 2044 }
2045 if (!DH_generate_key(dh_clnt)) { 2045 if (!DH_generate_key(dh_clnt)) {
2046 SSLerr(SSL_F_SSL3_SEND_CLIENT_KEY_EXCHANGE, ERR_R_DH_LIB); 2046 SSLerror(ERR_R_DH_LIB);
2047 goto err; 2047 goto err;
2048 } 2048 }
2049 key_size = DH_size(dh_clnt); 2049 key_size = DH_size(dh_clnt);
2050 if ((key = malloc(key_size)) == NULL) { 2050 if ((key = malloc(key_size)) == NULL) {
2051 SSLerr(SSL_F_SSL3_SEND_CLIENT_KEY_EXCHANGE, 2051 SSLerror(
2052 ERR_R_MALLOC_FAILURE); 2052 ERR_R_MALLOC_FAILURE);
2053 goto err; 2053 goto err;
2054 } 2054 }
2055 key_len = DH_compute_key(key, dh_srvr->pub_key, dh_clnt); 2055 key_len = DH_compute_key(key, dh_srvr->pub_key, dh_clnt);
2056 if (key_len <= 0) { 2056 if (key_len <= 0) {
2057 SSLerr(SSL_F_SSL3_SEND_CLIENT_KEY_EXCHANGE, ERR_R_DH_LIB); 2057 SSLerror(ERR_R_DH_LIB);
2058 goto err; 2058 goto err;
2059 } 2059 }
2060 2060
@@ -2098,38 +2098,38 @@ ssl3_send_client_kex_ecdhe_ecp(SSL *s, SESS_CERT *sc, CBB *cbb)
2098 2098
2099 if ((group = EC_KEY_get0_group(sc->peer_ecdh_tmp)) == NULL || 2099 if ((group = EC_KEY_get0_group(sc->peer_ecdh_tmp)) == NULL ||
2100 (point = EC_KEY_get0_public_key(sc->peer_ecdh_tmp)) == NULL) { 2100 (point = EC_KEY_get0_public_key(sc->peer_ecdh_tmp)) == NULL) {
2101 SSLerr(SSL_F_SSL3_SEND_CLIENT_KEY_EXCHANGE, 2101 SSLerror(
2102 ERR_R_INTERNAL_ERROR); 2102 ERR_R_INTERNAL_ERROR);
2103 goto err; 2103 goto err;
2104 } 2104 }
2105 2105
2106 if ((ecdh = EC_KEY_new()) == NULL) { 2106 if ((ecdh = EC_KEY_new()) == NULL) {
2107 SSLerr(SSL_F_SSL3_SEND_CLIENT_KEY_EXCHANGE, 2107 SSLerror(
2108 ERR_R_MALLOC_FAILURE); 2108 ERR_R_MALLOC_FAILURE);
2109 goto err; 2109 goto err;
2110 } 2110 }
2111 2111
2112 if (!EC_KEY_set_group(ecdh, group)) { 2112 if (!EC_KEY_set_group(ecdh, group)) {
2113 SSLerr(SSL_F_SSL3_SEND_CLIENT_KEY_EXCHANGE, ERR_R_EC_LIB); 2113 SSLerror(ERR_R_EC_LIB);
2114 goto err; 2114 goto err;
2115 } 2115 }
2116 2116
2117 /* Generate a new ECDH key pair. */ 2117 /* Generate a new ECDH key pair. */
2118 if (!(EC_KEY_generate_key(ecdh))) { 2118 if (!(EC_KEY_generate_key(ecdh))) {
2119 SSLerr(SSL_F_SSL3_SEND_CLIENT_KEY_EXCHANGE, ERR_R_ECDH_LIB); 2119 SSLerror(ERR_R_ECDH_LIB);
2120 goto err; 2120 goto err;
2121 } 2121 }
2122 if ((key_size = ECDH_size(ecdh)) <= 0) { 2122 if ((key_size = ECDH_size(ecdh)) <= 0) {
2123 SSLerr(SSL_F_SSL3_SEND_CLIENT_KEY_EXCHANGE, ERR_R_ECDH_LIB); 2123 SSLerror(ERR_R_ECDH_LIB);
2124 goto err; 2124 goto err;
2125 } 2125 }
2126 if ((key = malloc(key_size)) == NULL) { 2126 if ((key = malloc(key_size)) == NULL) {
2127 SSLerr(SSL_F_SSL3_SEND_CLIENT_KEY_EXCHANGE, 2127 SSLerror(
2128 ERR_R_MALLOC_FAILURE); 2128 ERR_R_MALLOC_FAILURE);
2129 } 2129 }
2130 key_len = ECDH_compute_key(key, key_size, point, ecdh, NULL); 2130 key_len = ECDH_compute_key(key, key_size, point, ecdh, NULL);
2131 if (key_len <= 0) { 2131 if (key_len <= 0) {
2132 SSLerr(SSL_F_SSL3_SEND_CLIENT_KEY_EXCHANGE, ERR_R_ECDH_LIB); 2132 SSLerror(ERR_R_ECDH_LIB);
2133 goto err; 2133 goto err;
2134 } 2134 }
2135 2135
@@ -2141,12 +2141,12 @@ ssl3_send_client_kex_ecdhe_ecp(SSL *s, SESS_CERT *sc, CBB *cbb)
2141 encoded_len = EC_POINT_point2oct(group, EC_KEY_get0_public_key(ecdh), 2141 encoded_len = EC_POINT_point2oct(group, EC_KEY_get0_public_key(ecdh),
2142 POINT_CONVERSION_UNCOMPRESSED, NULL, 0, NULL); 2142 POINT_CONVERSION_UNCOMPRESSED, NULL, 0, NULL);
2143 if (encoded_len == 0) { 2143 if (encoded_len == 0) {
2144 SSLerr(SSL_F_SSL3_SEND_CLIENT_KEY_EXCHANGE, ERR_R_ECDH_LIB); 2144 SSLerror(ERR_R_ECDH_LIB);
2145 goto err; 2145 goto err;
2146 } 2146 }
2147 2147
2148 if ((bn_ctx = BN_CTX_new()) == NULL) { 2148 if ((bn_ctx = BN_CTX_new()) == NULL) {
2149 SSLerr(SSL_F_SSL3_SEND_CLIENT_KEY_EXCHANGE, 2149 SSLerror(
2150 ERR_R_MALLOC_FAILURE); 2150 ERR_R_MALLOC_FAILURE);
2151 goto err; 2151 goto err;
2152 } 2152 }
@@ -2233,7 +2233,7 @@ ssl3_send_client_kex_ecdhe(SSL *s, SESS_CERT *sc, CBB *cbb)
2233 goto err; 2233 goto err;
2234 } else { 2234 } else {
2235 ssl3_send_alert(s, SSL3_AL_FATAL, SSL_AD_HANDSHAKE_FAILURE); 2235 ssl3_send_alert(s, SSL3_AL_FATAL, SSL_AD_HANDSHAKE_FAILURE);
2236 SSLerr(SSL_F_SSL3_SEND_CLIENT_KEY_EXCHANGE, 2236 SSLerror(
2237 ERR_R_INTERNAL_ERROR); 2237 ERR_R_INTERNAL_ERROR);
2238 goto err; 2238 goto err;
2239 } 2239 }
@@ -2261,7 +2261,7 @@ ssl3_send_client_kex_gost(SSL *s, SESS_CERT *sess_cert, CBB *cbb)
2261 /* Get server sertificate PKEY and create ctx from it */ 2261 /* Get server sertificate PKEY and create ctx from it */
2262 peer_cert = sess_cert->peer_pkeys[SSL_PKEY_GOST01].x509; 2262 peer_cert = sess_cert->peer_pkeys[SSL_PKEY_GOST01].x509;
2263 if (peer_cert == NULL) { 2263 if (peer_cert == NULL) {
2264 SSLerr(SSL_F_SSL3_SEND_CLIENT_KEY_EXCHANGE, 2264 SSLerror(
2265 SSL_R_NO_GOST_CERTIFICATE_SENT_BY_PEER); 2265 SSL_R_NO_GOST_CERTIFICATE_SENT_BY_PEER);
2266 goto err; 2266 goto err;
2267 } 2267 }
@@ -2298,7 +2298,7 @@ ssl3_send_client_kex_gost(SSL *s, SESS_CERT *sess_cert, CBB *cbb)
2298 */ 2298 */
2299 ukm_hash = EVP_MD_CTX_create(); 2299 ukm_hash = EVP_MD_CTX_create();
2300 if (ukm_hash == NULL) { 2300 if (ukm_hash == NULL) {
2301 SSLerr(SSL_F_SSL3_SEND_CLIENT_KEY_EXCHANGE, 2301 SSLerror(
2302 ERR_R_MALLOC_FAILURE); 2302 ERR_R_MALLOC_FAILURE);
2303 goto err; 2303 goto err;
2304 } 2304 }
@@ -2315,7 +2315,7 @@ ssl3_send_client_kex_gost(SSL *s, SESS_CERT *sess_cert, CBB *cbb)
2315 EVP_MD_CTX_destroy(ukm_hash); 2315 EVP_MD_CTX_destroy(ukm_hash);
2316 if (EVP_PKEY_CTX_ctrl(pkey_ctx, -1, EVP_PKEY_OP_ENCRYPT, 2316 if (EVP_PKEY_CTX_ctrl(pkey_ctx, -1, EVP_PKEY_OP_ENCRYPT,
2317 EVP_PKEY_CTRL_SET_IV, 8, shared_ukm) < 0) { 2317 EVP_PKEY_CTRL_SET_IV, 8, shared_ukm) < 0) {
2318 SSLerr(SSL_F_SSL3_SEND_CLIENT_KEY_EXCHANGE, SSL_R_LIBRARY_BUG); 2318 SSLerror(SSL_R_LIBRARY_BUG);
2319 goto err; 2319 goto err;
2320 } 2320 }
2321 2321
@@ -2325,7 +2325,7 @@ ssl3_send_client_kex_gost(SSL *s, SESS_CERT *sess_cert, CBB *cbb)
2325 msglen = 255; 2325 msglen = 255;
2326 if (EVP_PKEY_encrypt(pkey_ctx, tmp, &msglen, premaster_secret, 2326 if (EVP_PKEY_encrypt(pkey_ctx, tmp, &msglen, premaster_secret,
2327 32) < 0) { 2327 32) < 0) {
2328 SSLerr(SSL_F_SSL3_SEND_CLIENT_KEY_EXCHANGE, SSL_R_LIBRARY_BUG); 2328 SSLerror(SSL_R_LIBRARY_BUG);
2329 goto err; 2329 goto err;
2330 } 2330 }
2331 2331
@@ -2371,7 +2371,7 @@ ssl3_send_client_key_exchange(SSL *s)
2371 if ((sess_cert = SSI(s)->sess_cert) == NULL) { 2371 if ((sess_cert = SSI(s)->sess_cert) == NULL) {
2372 ssl3_send_alert(s, SSL3_AL_FATAL, 2372 ssl3_send_alert(s, SSL3_AL_FATAL,
2373 SSL_AD_UNEXPECTED_MESSAGE); 2373 SSL_AD_UNEXPECTED_MESSAGE);
2374 SSLerr(SSL_F_SSL3_SEND_CLIENT_KEY_EXCHANGE, 2374 SSLerror(
2375 ERR_R_INTERNAL_ERROR); 2375 ERR_R_INTERNAL_ERROR);
2376 goto err; 2376 goto err;
2377 } 2377 }
@@ -2395,7 +2395,7 @@ ssl3_send_client_key_exchange(SSL *s)
2395 } else { 2395 } else {
2396 ssl3_send_alert(s, SSL3_AL_FATAL, 2396 ssl3_send_alert(s, SSL3_AL_FATAL,
2397 SSL_AD_HANDSHAKE_FAILURE); 2397 SSL_AD_HANDSHAKE_FAILURE);
2398 SSLerr(SSL_F_SSL3_SEND_CLIENT_KEY_EXCHANGE, 2398 SSLerror(
2399 ERR_R_INTERNAL_ERROR); 2399 ERR_R_INTERNAL_ERROR);
2400 goto err; 2400 goto err;
2401 } 2401 }
@@ -2458,7 +2458,7 @@ ssl3_send_client_verify(SSL *s)
2458 &hdata); 2458 &hdata);
2459 if (hdatalen <= 0 || 2459 if (hdatalen <= 0 ||
2460 !tls12_get_sigandhash(p, pkey, md)) { 2460 !tls12_get_sigandhash(p, pkey, md)) {
2461 SSLerr(SSL_F_SSL3_SEND_CLIENT_VERIFY, 2461 SSLerror(
2462 ERR_R_INTERNAL_ERROR); 2462 ERR_R_INTERNAL_ERROR);
2463 goto err; 2463 goto err;
2464 } 2464 }
@@ -2466,7 +2466,7 @@ ssl3_send_client_verify(SSL *s)
2466 if (!EVP_SignInit_ex(&mctx, md, NULL) || 2466 if (!EVP_SignInit_ex(&mctx, md, NULL) ||
2467 !EVP_SignUpdate(&mctx, hdata, hdatalen) || 2467 !EVP_SignUpdate(&mctx, hdata, hdatalen) ||
2468 !EVP_SignFinal(&mctx, p + 2, &u, pkey)) { 2468 !EVP_SignFinal(&mctx, p + 2, &u, pkey)) {
2469 SSLerr(SSL_F_SSL3_SEND_CLIENT_VERIFY, 2469 SSLerror(
2470 ERR_R_EVP_LIB); 2470 ERR_R_EVP_LIB);
2471 goto err; 2471 goto err;
2472 } 2472 }
@@ -2480,7 +2480,7 @@ ssl3_send_client_verify(SSL *s)
2480 if (RSA_sign(NID_md5_sha1, data, 2480 if (RSA_sign(NID_md5_sha1, data,
2481 MD5_DIGEST_LENGTH + SHA_DIGEST_LENGTH, &(p[2]), 2481 MD5_DIGEST_LENGTH + SHA_DIGEST_LENGTH, &(p[2]),
2482 &u, pkey->pkey.rsa) <= 0 ) { 2482 &u, pkey->pkey.rsa) <= 0 ) {
2483 SSLerr(SSL_F_SSL3_SEND_CLIENT_VERIFY, 2483 SSLerror(
2484 ERR_R_RSA_LIB); 2484 ERR_R_RSA_LIB);
2485 goto err; 2485 goto err;
2486 } 2486 }
@@ -2491,7 +2491,7 @@ ssl3_send_client_verify(SSL *s)
2491 &(data[MD5_DIGEST_LENGTH]), 2491 &(data[MD5_DIGEST_LENGTH]),
2492 SHA_DIGEST_LENGTH, &(p[2]), 2492 SHA_DIGEST_LENGTH, &(p[2]),
2493 (unsigned int *)&j, pkey->pkey.dsa)) { 2493 (unsigned int *)&j, pkey->pkey.dsa)) {
2494 SSLerr(SSL_F_SSL3_SEND_CLIENT_VERIFY, 2494 SSLerror(
2495 ERR_R_DSA_LIB); 2495 ERR_R_DSA_LIB);
2496 goto err; 2496 goto err;
2497 } 2497 }
@@ -2502,7 +2502,7 @@ ssl3_send_client_verify(SSL *s)
2502 &(data[MD5_DIGEST_LENGTH]), 2502 &(data[MD5_DIGEST_LENGTH]),
2503 SHA_DIGEST_LENGTH, &(p[2]), 2503 SHA_DIGEST_LENGTH, &(p[2]),
2504 (unsigned int *)&j, pkey->pkey.ec)) { 2504 (unsigned int *)&j, pkey->pkey.ec)) {
2505 SSLerr(SSL_F_SSL3_SEND_CLIENT_VERIFY, 2505 SSLerror(
2506 ERR_R_ECDSA_LIB); 2506 ERR_R_ECDSA_LIB);
2507 goto err; 2507 goto err;
2508 } 2508 }
@@ -2520,13 +2520,13 @@ ssl3_send_client_verify(SSL *s)
2520 2520
2521 hdatalen = BIO_get_mem_data(S3I(s)->handshake_buffer, &hdata); 2521 hdatalen = BIO_get_mem_data(S3I(s)->handshake_buffer, &hdata);
2522 if (hdatalen <= 0) { 2522 if (hdatalen <= 0) {
2523 SSLerr(SSL_F_SSL3_SEND_CLIENT_VERIFY, 2523 SSLerror(
2524 ERR_R_INTERNAL_ERROR); 2524 ERR_R_INTERNAL_ERROR);
2525 goto err; 2525 goto err;
2526 } 2526 }
2527 if (!EVP_PKEY_get_default_digest_nid(pkey, &nid) || 2527 if (!EVP_PKEY_get_default_digest_nid(pkey, &nid) ||
2528 !(md = EVP_get_digestbynid(nid))) { 2528 !(md = EVP_get_digestbynid(nid))) {
2529 SSLerr(SSL_F_SSL3_SEND_CLIENT_VERIFY, 2529 SSLerror(
2530 ERR_R_EVP_LIB); 2530 ERR_R_EVP_LIB);
2531 goto err; 2531 goto err;
2532 } 2532 }
@@ -2540,7 +2540,7 @@ ssl3_send_client_verify(SSL *s)
2540 NULL) <= 0) || 2540 NULL) <= 0) ||
2541 (EVP_PKEY_sign(pctx, &(p[2]), &sigsize, 2541 (EVP_PKEY_sign(pctx, &(p[2]), &sigsize,
2542 signbuf, u) <= 0)) { 2542 signbuf, u) <= 0)) {
2543 SSLerr(SSL_F_SSL3_SEND_CLIENT_VERIFY, 2543 SSLerror(
2544 ERR_R_EVP_LIB); 2544 ERR_R_EVP_LIB);
2545 goto err; 2545 goto err;
2546 } 2546 }
@@ -2551,7 +2551,7 @@ ssl3_send_client_verify(SSL *s)
2551 n = j + 2; 2551 n = j + 2;
2552#endif 2552#endif
2553 } else { 2553 } else {
2554 SSLerr(SSL_F_SSL3_SEND_CLIENT_VERIFY, 2554 SSLerror(
2555 ERR_R_INTERNAL_ERROR); 2555 ERR_R_INTERNAL_ERROR);
2556 goto err; 2556 goto err;
2557 } 2557 }
@@ -2610,7 +2610,7 @@ ssl3_send_client_certificate(SSL *s)
2610 i = 0; 2610 i = 0;
2611 } else if (i == 1) { 2611 } else if (i == 1) {
2612 i = 0; 2612 i = 0;
2613 SSLerr(SSL_F_SSL3_SEND_CLIENT_CERTIFICATE, 2613 SSLerror(
2614 SSL_R_BAD_DATA_RETURNED_BY_CALLBACK); 2614 SSL_R_BAD_DATA_RETURNED_BY_CALLBACK);
2615 } 2615 }
2616 2616
@@ -2665,7 +2665,7 @@ ssl3_check_cert_and_algorithm(SSL *s)
2665 2665
2666 sc = SSI(s)->sess_cert; 2666 sc = SSI(s)->sess_cert;
2667 if (sc == NULL) { 2667 if (sc == NULL) {
2668 SSLerr(SSL_F_SSL3_CHECK_CERT_AND_ALGORITHM, 2668 SSLerror(
2669 ERR_R_INTERNAL_ERROR); 2669 ERR_R_INTERNAL_ERROR);
2670 goto err; 2670 goto err;
2671 } 2671 }
@@ -2678,7 +2678,7 @@ ssl3_check_cert_and_algorithm(SSL *s)
2678 if (ssl_check_srvr_ecc_cert_and_alg( 2678 if (ssl_check_srvr_ecc_cert_and_alg(
2679 sc->peer_pkeys[idx].x509, s) == 0) { 2679 sc->peer_pkeys[idx].x509, s) == 0) {
2680 /* check failed */ 2680 /* check failed */
2681 SSLerr(SSL_F_SSL3_CHECK_CERT_AND_ALGORITHM, 2681 SSLerror(
2682 SSL_R_BAD_ECC_CERT); 2682 SSL_R_BAD_ECC_CERT);
2683 goto f_err; 2683 goto f_err;
2684 } else { 2684 } else {
@@ -2691,24 +2691,24 @@ ssl3_check_cert_and_algorithm(SSL *s)
2691 2691
2692 /* Check that we have a certificate if we require one. */ 2692 /* Check that we have a certificate if we require one. */
2693 if ((alg_a & SSL_aRSA) && !has_bits(i, EVP_PK_RSA|EVP_PKT_SIGN)) { 2693 if ((alg_a & SSL_aRSA) && !has_bits(i, EVP_PK_RSA|EVP_PKT_SIGN)) {
2694 SSLerr(SSL_F_SSL3_CHECK_CERT_AND_ALGORITHM, 2694 SSLerror(
2695 SSL_R_MISSING_RSA_SIGNING_CERT); 2695 SSL_R_MISSING_RSA_SIGNING_CERT);
2696 goto f_err; 2696 goto f_err;
2697 } else if ((alg_a & SSL_aDSS) && 2697 } else if ((alg_a & SSL_aDSS) &&
2698 !has_bits(i, EVP_PK_DSA|EVP_PKT_SIGN)) { 2698 !has_bits(i, EVP_PK_DSA|EVP_PKT_SIGN)) {
2699 SSLerr(SSL_F_SSL3_CHECK_CERT_AND_ALGORITHM, 2699 SSLerror(
2700 SSL_R_MISSING_DSA_SIGNING_CERT); 2700 SSL_R_MISSING_DSA_SIGNING_CERT);
2701 goto f_err; 2701 goto f_err;
2702 } 2702 }
2703 if ((alg_k & SSL_kRSA) && 2703 if ((alg_k & SSL_kRSA) &&
2704 !has_bits(i, EVP_PK_RSA|EVP_PKT_ENC)) { 2704 !has_bits(i, EVP_PK_RSA|EVP_PKT_ENC)) {
2705 SSLerr(SSL_F_SSL3_CHECK_CERT_AND_ALGORITHM, 2705 SSLerror(
2706 SSL_R_MISSING_RSA_ENCRYPTING_CERT); 2706 SSL_R_MISSING_RSA_ENCRYPTING_CERT);
2707 goto f_err; 2707 goto f_err;
2708 } 2708 }
2709 if ((alg_k & SSL_kDHE) && 2709 if ((alg_k & SSL_kDHE) &&
2710 !(has_bits(i, EVP_PK_DH|EVP_PKT_EXCH) || (dh != NULL))) { 2710 !(has_bits(i, EVP_PK_DH|EVP_PKT_EXCH) || (dh != NULL))) {
2711 SSLerr(SSL_F_SSL3_CHECK_CERT_AND_ALGORITHM, 2711 SSLerror(
2712 SSL_R_MISSING_DH_KEY); 2712 SSL_R_MISSING_DH_KEY);
2713 goto f_err; 2713 goto f_err;
2714 } 2714 }
diff --git a/src/lib/libssl/ssl_err.c b/src/lib/libssl/ssl_err.c
index 967811f1fe..525ba2146b 100644
--- a/src/lib/libssl/ssl_err.c
+++ b/src/lib/libssl/ssl_err.c
@@ -1,4 +1,4 @@
1/* $OpenBSD: ssl_err.c,v 1.31 2017/01/26 09:16:01 jsing Exp $ */ 1/* $OpenBSD: ssl_err.c,v 1.32 2017/01/26 10:40:21 beck Exp $ */
2/* ==================================================================== 2/* ====================================================================
3 * Copyright (c) 1999-2011 The OpenSSL Project. All rights reserved. 3 * Copyright (c) 1999-2011 The OpenSSL Project. All rights reserved.
4 * 4 *
@@ -70,227 +70,7 @@
70#define ERR_REASON(reason) ERR_PACK(ERR_LIB_SSL,0,reason) 70#define ERR_REASON(reason) ERR_PACK(ERR_LIB_SSL,0,reason)
71 71
72static ERR_STRING_DATA SSL_str_functs[]= { 72static ERR_STRING_DATA SSL_str_functs[]= {
73 {ERR_FUNC(SSL_F_CLIENT_CERTIFICATE), "CLIENT_CERTIFICATE"}, 73 {ERR_FUNC(0xfff), "SSL_internal"},
74 {ERR_FUNC(SSL_F_CLIENT_FINISHED), "CLIENT_FINISHED"},
75 {ERR_FUNC(SSL_F_CLIENT_HELLO), "CLIENT_HELLO"},
76 {ERR_FUNC(SSL_F_CLIENT_MASTER_KEY), "CLIENT_MASTER_KEY"},
77 {ERR_FUNC(SSL_F_D2I_SSL_SESSION), "d2i_SSL_SESSION"},
78 {ERR_FUNC(SSL_F_DO_DTLS1_WRITE), "DO_DTLS1_WRITE"},
79 {ERR_FUNC(SSL_F_DO_SSL3_WRITE), "DO_SSL3_WRITE"},
80 {ERR_FUNC(SSL_F_DTLS1_ACCEPT), "DTLS1_ACCEPT"},
81 {ERR_FUNC(SSL_F_DTLS1_ADD_CERT_TO_BUF), "DTLS1_ADD_CERT_TO_BUF"},
82 {ERR_FUNC(SSL_F_DTLS1_BUFFER_RECORD), "DTLS1_BUFFER_RECORD"},
83 {ERR_FUNC(SSL_F_DTLS1_CHECK_TIMEOUT_NUM), "DTLS1_CHECK_TIMEOUT_NUM"},
84 {ERR_FUNC(SSL_F_DTLS1_CLIENT_HELLO), "DTLS1_CLIENT_HELLO"},
85 {ERR_FUNC(SSL_F_DTLS1_CONNECT), "DTLS1_CONNECT"},
86 {ERR_FUNC(SSL_F_DTLS1_ENC), "DTLS1_ENC"},
87 {ERR_FUNC(SSL_F_DTLS1_GET_HELLO_VERIFY), "DTLS1_GET_HELLO_VERIFY"},
88 {ERR_FUNC(SSL_F_DTLS1_GET_MESSAGE), "DTLS1_GET_MESSAGE"},
89 {ERR_FUNC(SSL_F_DTLS1_GET_MESSAGE_FRAGMENT), "DTLS1_GET_MESSAGE_FRAGMENT"},
90 {ERR_FUNC(SSL_F_DTLS1_GET_RECORD), "DTLS1_GET_RECORD"},
91 {ERR_FUNC(SSL_F_DTLS1_HANDLE_TIMEOUT), "DTLS1_HANDLE_TIMEOUT"},
92 {ERR_FUNC(SSL_F_DTLS1_HEARTBEAT), "DTLS1_HEARTBEAT"},
93 {ERR_FUNC(SSL_F_DTLS1_OUTPUT_CERT_CHAIN), "DTLS1_OUTPUT_CERT_CHAIN"},
94 {ERR_FUNC(SSL_F_DTLS1_PREPROCESS_FRAGMENT), "DTLS1_PREPROCESS_FRAGMENT"},
95 {ERR_FUNC(SSL_F_DTLS1_PROCESS_OUT_OF_SEQ_MESSAGE), "DTLS1_PROCESS_OUT_OF_SEQ_MESSAGE"},
96 {ERR_FUNC(SSL_F_DTLS1_PROCESS_RECORD), "DTLS1_PROCESS_RECORD"},
97 {ERR_FUNC(SSL_F_DTLS1_READ_BYTES), "DTLS1_READ_BYTES"},
98 {ERR_FUNC(SSL_F_DTLS1_READ_FAILED), "DTLS1_READ_FAILED"},
99 {ERR_FUNC(SSL_F_DTLS1_SEND_CERTIFICATE_REQUEST), "DTLS1_SEND_CERTIFICATE_REQUEST"},
100 {ERR_FUNC(SSL_F_DTLS1_SEND_CLIENT_CERTIFICATE), "DTLS1_SEND_CLIENT_CERTIFICATE"},
101 {ERR_FUNC(SSL_F_DTLS1_SEND_CLIENT_KEY_EXCHANGE), "DTLS1_SEND_CLIENT_KEY_EXCHANGE"},
102 {ERR_FUNC(SSL_F_DTLS1_SEND_CLIENT_VERIFY), "DTLS1_SEND_CLIENT_VERIFY"},
103 {ERR_FUNC(SSL_F_DTLS1_SEND_HELLO_VERIFY_REQUEST), "DTLS1_SEND_HELLO_VERIFY_REQUEST"},
104 {ERR_FUNC(SSL_F_DTLS1_SEND_SERVER_CERTIFICATE), "DTLS1_SEND_SERVER_CERTIFICATE"},
105 {ERR_FUNC(SSL_F_DTLS1_SEND_SERVER_HELLO), "DTLS1_SEND_SERVER_HELLO"},
106 {ERR_FUNC(SSL_F_DTLS1_SEND_SERVER_KEY_EXCHANGE), "DTLS1_SEND_SERVER_KEY_EXCHANGE"},
107 {ERR_FUNC(SSL_F_DTLS1_WRITE_APP_DATA_BYTES), "DTLS1_WRITE_APP_DATA_BYTES"},
108 {ERR_FUNC(SSL_F_GET_CLIENT_FINISHED), "GET_CLIENT_FINISHED"},
109 {ERR_FUNC(SSL_F_GET_CLIENT_HELLO), "GET_CLIENT_HELLO"},
110 {ERR_FUNC(SSL_F_GET_CLIENT_MASTER_KEY), "GET_CLIENT_MASTER_KEY"},
111 {ERR_FUNC(SSL_F_GET_SERVER_FINISHED), "GET_SERVER_FINISHED"},
112 {ERR_FUNC(SSL_F_GET_SERVER_HELLO), "GET_SERVER_HELLO"},
113 {ERR_FUNC(SSL_F_GET_SERVER_VERIFY), "GET_SERVER_VERIFY"},
114 {ERR_FUNC(SSL_F_I2D_SSL_SESSION), "i2d_SSL_SESSION"},
115 {ERR_FUNC(SSL_F_READ_N), "READ_N"},
116 {ERR_FUNC(SSL_F_REQUEST_CERTIFICATE), "REQUEST_CERTIFICATE"},
117 {ERR_FUNC(SSL_F_SERVER_FINISH), "SERVER_FINISH"},
118 {ERR_FUNC(SSL_F_SERVER_HELLO), "SERVER_HELLO"},
119 {ERR_FUNC(SSL_F_SERVER_VERIFY), "SERVER_VERIFY"},
120 {ERR_FUNC(SSL_F_SSL23_ACCEPT), "SSL23_ACCEPT"},
121 {ERR_FUNC(SSL_F_SSL23_CLIENT_HELLO), "SSL23_CLIENT_HELLO"},
122 {ERR_FUNC(SSL_F_SSL23_CONNECT), "SSL23_CONNECT"},
123 {ERR_FUNC(SSL_F_SSL23_GET_CLIENT_HELLO), "SSL23_GET_CLIENT_HELLO"},
124 {ERR_FUNC(SSL_F_SSL23_GET_SERVER_HELLO), "SSL23_GET_SERVER_HELLO"},
125 {ERR_FUNC(SSL_F_SSL23_PEEK), "SSL23_PEEK"},
126 {ERR_FUNC(SSL_F_SSL23_READ), "SSL23_READ"},
127 {ERR_FUNC(SSL_F_SSL23_WRITE), "SSL23_WRITE"},
128 {ERR_FUNC(SSL_F_SSL2_ACCEPT), "SSL2_ACCEPT"},
129 {ERR_FUNC(SSL_F_SSL2_CONNECT), "SSL2_CONNECT"},
130 {ERR_FUNC(SSL_F_SSL2_ENC_INIT), "SSL2_ENC_INIT"},
131 {ERR_FUNC(SSL_F_SSL2_GENERATE_KEY_MATERIAL), "SSL2_GENERATE_KEY_MATERIAL"},
132 {ERR_FUNC(SSL_F_SSL2_PEEK), "SSL2_PEEK"},
133 {ERR_FUNC(SSL_F_SSL2_READ), "SSL2_READ"},
134 {ERR_FUNC(SSL_F_SSL2_READ_INTERNAL), "SSL2_READ_INTERNAL"},
135 {ERR_FUNC(SSL_F_SSL2_SET_CERTIFICATE), "SSL2_SET_CERTIFICATE"},
136 {ERR_FUNC(SSL_F_SSL2_WRITE), "SSL2_WRITE"},
137 {ERR_FUNC(SSL_F_SSL3_ACCEPT), "SSL3_ACCEPT"},
138 {ERR_FUNC(SSL_F_SSL3_ADD_CERT_TO_BUF), "SSL3_ADD_CERT_TO_BUF"},
139 {ERR_FUNC(SSL_F_SSL3_CALLBACK_CTRL), "SSL3_CALLBACK_CTRL"},
140 {ERR_FUNC(SSL_F_SSL3_CHANGE_CIPHER_STATE), "SSL3_CHANGE_CIPHER_STATE"},
141 {ERR_FUNC(SSL_F_SSL3_CHECK_CERT_AND_ALGORITHM), "SSL3_CHECK_CERT_AND_ALGORITHM"},
142 {ERR_FUNC(SSL_F_SSL3_CHECK_CLIENT_HELLO), "SSL3_CHECK_CLIENT_HELLO"},
143 {ERR_FUNC(SSL_F_SSL3_CLIENT_HELLO), "SSL3_CLIENT_HELLO"},
144 {ERR_FUNC(SSL_F_SSL3_CONNECT), "SSL3_CONNECT"},
145 {ERR_FUNC(SSL_F_SSL3_CTRL), "SSL3_CTRL"},
146 {ERR_FUNC(SSL_F_SSL3_CTX_CTRL), "SSL3_CTX_CTRL"},
147 {ERR_FUNC(SSL_F_SSL3_DIGEST_CACHED_RECORDS), "SSL3_DIGEST_CACHED_RECORDS"},
148 {ERR_FUNC(SSL_F_SSL3_DO_CHANGE_CIPHER_SPEC), "SSL3_DO_CHANGE_CIPHER_SPEC"},
149 {ERR_FUNC(SSL_F_SSL3_ENC), "SSL3_ENC"},
150 {ERR_FUNC(SSL_F_SSL3_GENERATE_KEY_BLOCK), "SSL3_GENERATE_KEY_BLOCK"},
151 {ERR_FUNC(SSL_F_SSL3_GET_CERTIFICATE_REQUEST), "SSL3_GET_CERTIFICATE_REQUEST"},
152 {ERR_FUNC(SSL_F_SSL3_GET_CERT_STATUS), "SSL3_GET_CERT_STATUS"},
153 {ERR_FUNC(SSL_F_SSL3_GET_CERT_VERIFY), "SSL3_GET_CERT_VERIFY"},
154 {ERR_FUNC(SSL_F_SSL3_GET_CLIENT_CERTIFICATE), "SSL3_GET_CLIENT_CERTIFICATE"},
155 {ERR_FUNC(SSL_F_SSL3_GET_CLIENT_HELLO), "SSL3_GET_CLIENT_HELLO"},
156 {ERR_FUNC(SSL_F_SSL3_GET_CLIENT_KEY_EXCHANGE), "SSL3_GET_CLIENT_KEY_EXCHANGE"},
157 {ERR_FUNC(SSL_F_SSL3_GET_FINISHED), "SSL3_GET_FINISHED"},
158 {ERR_FUNC(SSL_F_SSL3_GET_KEY_EXCHANGE), "SSL3_GET_KEY_EXCHANGE"},
159 {ERR_FUNC(SSL_F_SSL3_GET_MESSAGE), "SSL3_GET_MESSAGE"},
160 {ERR_FUNC(SSL_F_SSL3_GET_NEW_SESSION_TICKET), "SSL3_GET_NEW_SESSION_TICKET"},
161 {ERR_FUNC(SSL_F_SSL3_GET_NEXT_PROTO), "SSL3_GET_NEXT_PROTO"},
162 {ERR_FUNC(SSL_F_SSL3_GET_RECORD), "SSL3_GET_RECORD"},
163 {ERR_FUNC(SSL_F_SSL3_GET_SERVER_CERTIFICATE), "SSL3_GET_SERVER_CERTIFICATE"},
164 {ERR_FUNC(SSL_F_SSL3_GET_SERVER_DONE), "SSL3_GET_SERVER_DONE"},
165 {ERR_FUNC(SSL_F_SSL3_GET_SERVER_HELLO), "SSL3_GET_SERVER_HELLO"},
166 {ERR_FUNC(SSL_F_SSL3_HANDSHAKE_MAC), "ssl3_handshake_mac"},
167 {ERR_FUNC(SSL_F_SSL3_NEW_SESSION_TICKET), "SSL3_NEW_SESSION_TICKET"},
168 {ERR_FUNC(SSL_F_SSL3_OUTPUT_CERT_CHAIN), "SSL3_OUTPUT_CERT_CHAIN"},
169 {ERR_FUNC(SSL_F_SSL3_PEEK), "SSL3_PEEK"},
170 {ERR_FUNC(SSL_F_SSL3_READ_BYTES), "SSL3_READ_BYTES"},
171 {ERR_FUNC(SSL_F_SSL3_READ_N), "SSL3_READ_N"},
172 {ERR_FUNC(SSL_F_SSL3_SEND_CERTIFICATE_REQUEST), "SSL3_SEND_CERTIFICATE_REQUEST"},
173 {ERR_FUNC(SSL_F_SSL3_SEND_CLIENT_CERTIFICATE), "SSL3_SEND_CLIENT_CERTIFICATE"},
174 {ERR_FUNC(SSL_F_SSL3_SEND_CLIENT_KEY_EXCHANGE), "SSL3_SEND_CLIENT_KEY_EXCHANGE"},
175 {ERR_FUNC(SSL_F_SSL3_SEND_CLIENT_VERIFY), "SSL3_SEND_CLIENT_VERIFY"},
176 {ERR_FUNC(SSL_F_SSL3_SEND_SERVER_CERTIFICATE), "SSL3_SEND_SERVER_CERTIFICATE"},
177 {ERR_FUNC(SSL_F_SSL3_SEND_SERVER_HELLO), "SSL3_SEND_SERVER_HELLO"},
178 {ERR_FUNC(SSL_F_SSL3_SEND_SERVER_KEY_EXCHANGE), "SSL3_SEND_SERVER_KEY_EXCHANGE"},
179 {ERR_FUNC(SSL_F_SSL3_SETUP_KEY_BLOCK), "SSL3_SETUP_KEY_BLOCK"},
180 {ERR_FUNC(SSL_F_SSL3_SETUP_READ_BUFFER), "SSL3_SETUP_READ_BUFFER"},
181 {ERR_FUNC(SSL_F_SSL3_SETUP_WRITE_BUFFER), "SSL3_SETUP_WRITE_BUFFER"},
182 {ERR_FUNC(SSL_F_SSL3_WRITE_BYTES), "SSL3_WRITE_BYTES"},
183 {ERR_FUNC(SSL_F_SSL3_WRITE_PENDING), "SSL3_WRITE_PENDING"},
184 {ERR_FUNC(SSL_F_SSL_ADD_CLIENTHELLO_RENEGOTIATE_EXT), "SSL_ADD_CLIENTHELLO_RENEGOTIATE_EXT"},
185 {ERR_FUNC(SSL_F_SSL_ADD_CLIENTHELLO_TLSEXT), "SSL_ADD_CLIENTHELLO_TLSEXT"},
186 {ERR_FUNC(SSL_F_SSL_ADD_CLIENTHELLO_USE_SRTP_EXT), "SSL_ADD_CLIENTHELLO_USE_SRTP_EXT"},
187 {ERR_FUNC(SSL_F_SSL_ADD_DIR_CERT_SUBJECTS_TO_STACK), "SSL_add_dir_cert_subjects_to_stack"},
188 {ERR_FUNC(SSL_F_SSL_ADD_FILE_CERT_SUBJECTS_TO_STACK), "SSL_add_file_cert_subjects_to_stack"},
189 {ERR_FUNC(SSL_F_SSL_ADD_SERVERHELLO_RENEGOTIATE_EXT), "SSL_ADD_SERVERHELLO_RENEGOTIATE_EXT"},
190 {ERR_FUNC(SSL_F_SSL_ADD_SERVERHELLO_TLSEXT), "SSL_ADD_SERVERHELLO_TLSEXT"},
191 {ERR_FUNC(SSL_F_SSL_ADD_SERVERHELLO_USE_SRTP_EXT), "SSL_ADD_SERVERHELLO_USE_SRTP_EXT"},
192 {ERR_FUNC(SSL_F_SSL_BAD_METHOD), "SSL_BAD_METHOD"},
193 {ERR_FUNC(SSL_F_SSL_BYTES_TO_CIPHER_LIST), "SSL_BYTES_TO_CIPHER_LIST"},
194 {ERR_FUNC(SSL_F_SSL_CERT_DUP), "SSL_CERT_DUP"},
195 {ERR_FUNC(SSL_F_SSL_CERT_INST), "SSL_CERT_INST"},
196 {ERR_FUNC(SSL_F_SSL_CERT_INSTANTIATE), "SSL_CERT_INSTANTIATE"},
197 {ERR_FUNC(SSL_F_SSL_CERT_NEW), "SSL_CERT_NEW"},
198 {ERR_FUNC(SSL_F_SSL_CHECK_PRIVATE_KEY), "SSL_check_private_key"},
199 {ERR_FUNC(SSL_F_SSL_CHECK_SERVERHELLO_TLSEXT), "SSL_CHECK_SERVERHELLO_TLSEXT"},
200 {ERR_FUNC(SSL_F_SSL_CHECK_SRVR_ECC_CERT_AND_ALG), "SSL_CHECK_SRVR_ECC_CERT_AND_ALG"},
201 {ERR_FUNC(SSL_F_SSL_CIPHER_PROCESS_RULESTR), "SSL_CIPHER_PROCESS_RULESTR"},
202 {ERR_FUNC(SSL_F_SSL_CIPHER_STRENGTH_SORT), "SSL_CIPHER_STRENGTH_SORT"},
203 {ERR_FUNC(SSL_F_SSL_CLEAR), "SSL_clear"},
204 {ERR_FUNC(SSL_F_SSL_COMP_ADD_COMPRESSION_METHOD), "SSL_COMP_add_compression_method"},
205 {ERR_FUNC(SSL_F_SSL_CREATE_CIPHER_LIST), "SSL_CREATE_CIPHER_LIST"},
206 {ERR_FUNC(SSL_F_SSL_CTRL), "SSL_ctrl"},
207 {ERR_FUNC(SSL_F_SSL_CTX_CHECK_PRIVATE_KEY), "SSL_CTX_check_private_key"},
208 {ERR_FUNC(SSL_F_SSL_CTX_MAKE_PROFILES), "SSL_CTX_MAKE_PROFILES"},
209 {ERR_FUNC(SSL_F_SSL_CTX_NEW), "SSL_CTX_new"},
210 {ERR_FUNC(SSL_F_SSL_CTX_SET_CIPHER_LIST), "SSL_CTX_set_cipher_list"},
211 {ERR_FUNC(SSL_F_SSL_CTX_SET_CLIENT_CERT_ENGINE), "SSL_CTX_set_client_cert_engine"},
212 {ERR_FUNC(SSL_F_SSL_CTX_SET_PURPOSE), "SSL_CTX_set_purpose"},
213 {ERR_FUNC(SSL_F_SSL_CTX_SET_SESSION_ID_CONTEXT), "SSL_CTX_set_session_id_context"},
214 {ERR_FUNC(SSL_F_SSL_CTX_SET_SSL_VERSION), "SSL_CTX_set_ssl_version"},
215 {ERR_FUNC(SSL_F_SSL_CTX_SET_TRUST), "SSL_CTX_set_trust"},
216 {ERR_FUNC(SSL_F_SSL_CTX_USE_CERTIFICATE), "SSL_CTX_use_certificate"},
217 {ERR_FUNC(SSL_F_SSL_CTX_USE_CERTIFICATE_ASN1), "SSL_CTX_use_certificate_ASN1"},
218 {ERR_FUNC(SSL_F_SSL_CTX_USE_CERTIFICATE_CHAIN_FILE), "SSL_CTX_use_certificate_chain_file"},
219 {ERR_FUNC(SSL_F_SSL_CTX_USE_CERTIFICATE_FILE), "SSL_CTX_use_certificate_file"},
220 {ERR_FUNC(SSL_F_SSL_CTX_USE_PRIVATEKEY), "SSL_CTX_use_PrivateKey"},
221 {ERR_FUNC(SSL_F_SSL_CTX_USE_PRIVATEKEY_ASN1), "SSL_CTX_use_PrivateKey_ASN1"},
222 {ERR_FUNC(SSL_F_SSL_CTX_USE_PRIVATEKEY_FILE), "SSL_CTX_use_PrivateKey_file"},
223 {ERR_FUNC(SSL_F_SSL_CTX_USE_PSK_IDENTITY_HINT), "SSL_CTX_use_psk_identity_hint"},
224 {ERR_FUNC(SSL_F_SSL_CTX_USE_RSAPRIVATEKEY), "SSL_CTX_use_RSAPrivateKey"},
225 {ERR_FUNC(SSL_F_SSL_CTX_USE_RSAPRIVATEKEY_ASN1), "SSL_CTX_use_RSAPrivateKey_ASN1"},
226 {ERR_FUNC(SSL_F_SSL_CTX_USE_RSAPRIVATEKEY_FILE), "SSL_CTX_use_RSAPrivateKey_file"},
227 {ERR_FUNC(SSL_F_SSL_DO_HANDSHAKE), "SSL_do_handshake"},
228 {ERR_FUNC(SSL_F_SSL_GET_NEW_SESSION), "SSL_GET_NEW_SESSION"},
229 {ERR_FUNC(SSL_F_SSL_GET_PREV_SESSION), "SSL_GET_PREV_SESSION"},
230 {ERR_FUNC(SSL_F_SSL_GET_SERVER_SEND_CERT), "SSL_GET_SERVER_SEND_CERT"},
231 {ERR_FUNC(SSL_F_SSL_GET_SERVER_SEND_PKEY), "SSL_GET_SERVER_SEND_PKEY"},
232 {ERR_FUNC(SSL_F_SSL_GET_SIGN_PKEY), "SSL_GET_SIGN_PKEY"},
233 {ERR_FUNC(SSL_F_SSL_INIT_WBIO_BUFFER), "SSL_INIT_WBIO_BUFFER"},
234 {ERR_FUNC(SSL_F_SSL_LOAD_CLIENT_CA_FILE), "SSL_load_client_CA_file"},
235 {ERR_FUNC(SSL_F_SSL_NEW), "SSL_new"},
236 {ERR_FUNC(SSL_F_SSL_PARSE_CLIENTHELLO_RENEGOTIATE_EXT), "SSL_PARSE_CLIENTHELLO_RENEGOTIATE_EXT"},
237 {ERR_FUNC(SSL_F_SSL_PARSE_CLIENTHELLO_TLSEXT), "SSL_PARSE_CLIENTHELLO_TLSEXT"},
238 {ERR_FUNC(SSL_F_SSL_PARSE_CLIENTHELLO_USE_SRTP_EXT), "SSL_PARSE_CLIENTHELLO_USE_SRTP_EXT"},
239 {ERR_FUNC(SSL_F_SSL_PARSE_SERVERHELLO_RENEGOTIATE_EXT), "SSL_PARSE_SERVERHELLO_RENEGOTIATE_EXT"},
240 {ERR_FUNC(SSL_F_SSL_PARSE_SERVERHELLO_TLSEXT), "SSL_PARSE_SERVERHELLO_TLSEXT"},
241 {ERR_FUNC(SSL_F_SSL_PARSE_SERVERHELLO_USE_SRTP_EXT), "SSL_PARSE_SERVERHELLO_USE_SRTP_EXT"},
242 {ERR_FUNC(SSL_F_SSL_PEEK), "SSL_peek"},
243 {ERR_FUNC(SSL_F_SSL_PREPARE_CLIENTHELLO_TLSEXT), "SSL_PREPARE_CLIENTHELLO_TLSEXT"},
244 {ERR_FUNC(SSL_F_SSL_PREPARE_SERVERHELLO_TLSEXT), "SSL_PREPARE_SERVERHELLO_TLSEXT"},
245 {ERR_FUNC(SSL_F_SSL_READ), "SSL_read"},
246 {ERR_FUNC(SSL_F_SSL_RSA_PRIVATE_DECRYPT), "SSL_RSA_PRIVATE_DECRYPT"},
247 {ERR_FUNC(SSL_F_SSL_RSA_PUBLIC_ENCRYPT), "SSL_RSA_PUBLIC_ENCRYPT"},
248 {ERR_FUNC(SSL_F_SSL_SESSION_NEW), "SSL_SESSION_new"},
249 {ERR_FUNC(SSL_F_SSL_SESSION_PRINT_FP), "SSL_SESSION_print_fp"},
250 {ERR_FUNC(SSL_F_SSL_SESSION_SET1_ID_CONTEXT), "SSL_SESSION_set1_id_context"},
251 {ERR_FUNC(SSL_F_SSL_SESS_CERT_NEW), "SSL_SESS_CERT_NEW"},
252 {ERR_FUNC(SSL_F_SSL_SET_CERT), "SSL_SET_CERT"},
253 {ERR_FUNC(SSL_F_SSL_SET_CIPHER_LIST), "SSL_set_cipher_list"},
254 {ERR_FUNC(SSL_F_SSL_SET_FD), "SSL_set_fd"},
255 {ERR_FUNC(SSL_F_SSL_SET_PKEY), "SSL_SET_PKEY"},
256 {ERR_FUNC(SSL_F_SSL_SET_PURPOSE), "SSL_set_purpose"},
257 {ERR_FUNC(SSL_F_SSL_SET_RFD), "SSL_set_rfd"},
258 {ERR_FUNC(SSL_F_SSL_SET_SESSION), "SSL_set_session"},
259 {ERR_FUNC(SSL_F_SSL_SET_SESSION_ID_CONTEXT), "SSL_set_session_id_context"},
260 {ERR_FUNC(SSL_F_SSL_SET_SESSION_TICKET_EXT), "SSL_set_session_ticket_ext"},
261 {ERR_FUNC(SSL_F_SSL_SET_TRUST), "SSL_set_trust"},
262 {ERR_FUNC(SSL_F_SSL_SET_WFD), "SSL_set_wfd"},
263 {ERR_FUNC(SSL_F_SSL_SHUTDOWN), "SSL_shutdown"},
264 {ERR_FUNC(SSL_F_SSL_SRP_CTX_INIT), "SSL_SRP_CTX_init"},
265 {ERR_FUNC(SSL_F_SSL_UNDEFINED_CONST_FUNCTION), "SSL_UNDEFINED_CONST_FUNCTION"},
266 {ERR_FUNC(SSL_F_SSL_UNDEFINED_FUNCTION), "SSL_UNDEFINED_FUNCTION"},
267 {ERR_FUNC(SSL_F_SSL_UNDEFINED_VOID_FUNCTION), "SSL_UNDEFINED_VOID_FUNCTION"},
268 {ERR_FUNC(SSL_F_SSL_USE_CERTIFICATE), "SSL_use_certificate"},
269 {ERR_FUNC(SSL_F_SSL_USE_CERTIFICATE_ASN1), "SSL_use_certificate_ASN1"},
270 {ERR_FUNC(SSL_F_SSL_USE_CERTIFICATE_FILE), "SSL_use_certificate_file"},
271 {ERR_FUNC(SSL_F_SSL_USE_PRIVATEKEY), "SSL_use_PrivateKey"},
272 {ERR_FUNC(SSL_F_SSL_USE_PRIVATEKEY_ASN1), "SSL_use_PrivateKey_ASN1"},
273 {ERR_FUNC(SSL_F_SSL_USE_PRIVATEKEY_FILE), "SSL_use_PrivateKey_file"},
274 {ERR_FUNC(SSL_F_SSL_USE_PSK_IDENTITY_HINT), "SSL_use_psk_identity_hint"},
275 {ERR_FUNC(SSL_F_SSL_USE_RSAPRIVATEKEY), "SSL_use_RSAPrivateKey"},
276 {ERR_FUNC(SSL_F_SSL_USE_RSAPRIVATEKEY_ASN1), "SSL_use_RSAPrivateKey_ASN1"},
277 {ERR_FUNC(SSL_F_SSL_USE_RSAPRIVATEKEY_FILE), "SSL_use_RSAPrivateKey_file"},
278 {ERR_FUNC(SSL_F_SSL_VERIFY_CERT_CHAIN), "SSL_VERIFY_CERT_CHAIN"},
279 {ERR_FUNC(SSL_F_SSL_WRITE), "SSL_write"},
280 {ERR_FUNC(SSL_F_TLS1_AEAD_CTX_INIT), "TLS1_AEAD_CTX_INIT"},
281 {ERR_FUNC(SSL_F_TLS1_CERT_VERIFY_MAC), "tls1_cert_verify_mac"},
282 {ERR_FUNC(SSL_F_TLS1_CHANGE_CIPHER_STATE), "TLS1_CHANGE_CIPHER_STATE"},
283 {ERR_FUNC(SSL_F_TLS1_CHANGE_CIPHER_STATE_AEAD), "TLS1_CHANGE_CIPHER_STATE_AEAD"},
284 {ERR_FUNC(SSL_F_TLS1_CHANGE_CIPHER_STATE_CIPHER), "TLS1_CHANGE_CIPHER_STATE_CIPHER"},
285 {ERR_FUNC(SSL_F_TLS1_CHECK_SERVERHELLO_TLSEXT), "TLS1_CHECK_SERVERHELLO_TLSEXT"},
286 {ERR_FUNC(SSL_F_TLS1_ENC), "TLS1_ENC"},
287 {ERR_FUNC(SSL_F_TLS1_EXPORT_KEYING_MATERIAL), "TLS1_EXPORT_KEYING_MATERIAL"},
288 {ERR_FUNC(SSL_F_TLS1_HEARTBEAT), "SSL_F_TLS1_HEARTBEAT"},
289 {ERR_FUNC(SSL_F_TLS1_PREPARE_CLIENTHELLO_TLSEXT), "TLS1_PREPARE_CLIENTHELLO_TLSEXT"},
290 {ERR_FUNC(SSL_F_TLS1_PREPARE_SERVERHELLO_TLSEXT), "TLS1_PREPARE_SERVERHELLO_TLSEXT"},
291 {ERR_FUNC(SSL_F_TLS1_PRF), "tls1_prf"},
292 {ERR_FUNC(SSL_F_TLS1_SETUP_KEY_BLOCK), "TLS1_SETUP_KEY_BLOCK"},
293 {ERR_FUNC(SSL_F_WRITE_PENDING), "WRITE_PENDING"},
294 {0, NULL} 74 {0, NULL}
295}; 75};
296 76
diff --git a/src/lib/libssl/ssl_lib.c b/src/lib/libssl/ssl_lib.c
index 6d5d5c468b..605fc428ad 100644
--- a/src/lib/libssl/ssl_lib.c
+++ b/src/lib/libssl/ssl_lib.c
@@ -1,4 +1,4 @@
1/* $OpenBSD: ssl_lib.c,v 1.153 2017/01/26 06:32:58 jsing Exp $ */ 1/* $OpenBSD: ssl_lib.c,v 1.154 2017/01/26 10:40:21 beck Exp $ */
2/* Copyright (C) 1995-1998 Eric Young (eay@cryptsoft.com) 2/* Copyright (C) 1995-1998 Eric Young (eay@cryptsoft.com)
3 * All rights reserved. 3 * All rights reserved.
4 * 4 *
@@ -163,7 +163,7 @@ int
163SSL_clear(SSL *s) 163SSL_clear(SSL *s)
164{ 164{
165 if (s->method == NULL) { 165 if (s->method == NULL) {
166 SSLerr(SSL_F_SSL_CLEAR, SSL_R_NO_METHOD_SPECIFIED); 166 SSLerror(SSL_R_NO_METHOD_SPECIFIED);
167 return (0); 167 return (0);
168 } 168 }
169 169
@@ -177,7 +177,7 @@ SSL_clear(SSL *s)
177 s->internal->shutdown = 0; 177 s->internal->shutdown = 0;
178 178
179 if (s->internal->renegotiate) { 179 if (s->internal->renegotiate) {
180 SSLerr(SSL_F_SSL_CLEAR, ERR_R_INTERNAL_ERROR); 180 SSLerror(ERR_R_INTERNAL_ERROR);
181 return (0); 181 return (0);
182 } 182 }
183 183
@@ -226,7 +226,7 @@ SSL_CTX_set_ssl_version(SSL_CTX *ctx, const SSL_METHOD *meth)
226 sk = ssl_create_cipher_list(ctx->method, &(ctx->cipher_list), 226 sk = ssl_create_cipher_list(ctx->method, &(ctx->cipher_list),
227 &(ctx->internal->cipher_list_by_id), SSL_DEFAULT_CIPHER_LIST); 227 &(ctx->internal->cipher_list_by_id), SSL_DEFAULT_CIPHER_LIST);
228 if ((sk == NULL) || (sk_SSL_CIPHER_num(sk) <= 0)) { 228 if ((sk == NULL) || (sk_SSL_CIPHER_num(sk) <= 0)) {
229 SSLerr(SSL_F_SSL_CTX_SET_SSL_VERSION, 229 SSLerror(
230 SSL_R_SSL_LIBRARY_HAS_NO_CIPHERS); 230 SSL_R_SSL_LIBRARY_HAS_NO_CIPHERS);
231 return (0); 231 return (0);
232 } 232 }
@@ -239,21 +239,21 @@ SSL_new(SSL_CTX *ctx)
239 SSL *s; 239 SSL *s;
240 240
241 if (ctx == NULL) { 241 if (ctx == NULL) {
242 SSLerr(SSL_F_SSL_NEW, SSL_R_NULL_SSL_CTX); 242 SSLerror(SSL_R_NULL_SSL_CTX);
243 return (NULL); 243 return (NULL);
244 } 244 }
245 if (ctx->method == NULL) { 245 if (ctx->method == NULL) {
246 SSLerr(SSL_F_SSL_NEW, SSL_R_SSL_CTX_HAS_NO_DEFAULT_SSL_VERSION); 246 SSLerror(SSL_R_SSL_CTX_HAS_NO_DEFAULT_SSL_VERSION);
247 return (NULL); 247 return (NULL);
248 } 248 }
249 249
250 if ((s = calloc(1, sizeof(*s))) == NULL) { 250 if ((s = calloc(1, sizeof(*s))) == NULL) {
251 SSLerr(SSL_F_SSL_NEW, ERR_R_MALLOC_FAILURE); 251 SSLerror(ERR_R_MALLOC_FAILURE);
252 return (NULL); 252 return (NULL);
253 } 253 }
254 if ((s->internal = calloc(1, sizeof(*s->internal))) == NULL) { 254 if ((s->internal = calloc(1, sizeof(*s->internal))) == NULL) {
255 free(s); 255 free(s);
256 SSLerr(SSL_F_SSL_NEW, ERR_R_MALLOC_FAILURE); 256 SSLerror(ERR_R_MALLOC_FAILURE);
257 return (NULL); 257 return (NULL);
258 } 258 }
259 259
@@ -372,7 +372,7 @@ SSL_new(SSL_CTX *ctx)
372 372
373 err: 373 err:
374 SSL_free(s); 374 SSL_free(s);
375 SSLerr(SSL_F_SSL_NEW, ERR_R_MALLOC_FAILURE); 375 SSLerror(ERR_R_MALLOC_FAILURE);
376 return (NULL); 376 return (NULL);
377} 377}
378 378
@@ -381,7 +381,7 @@ SSL_CTX_set_session_id_context(SSL_CTX *ctx, const unsigned char *sid_ctx,
381 unsigned int sid_ctx_len) 381 unsigned int sid_ctx_len)
382{ 382{
383 if (sid_ctx_len > sizeof ctx->sid_ctx) { 383 if (sid_ctx_len > sizeof ctx->sid_ctx) {
384 SSLerr(SSL_F_SSL_CTX_SET_SESSION_ID_CONTEXT, 384 SSLerror(
385 SSL_R_SSL_SESSION_ID_CONTEXT_TOO_LONG); 385 SSL_R_SSL_SESSION_ID_CONTEXT_TOO_LONG);
386 return (0); 386 return (0);
387 } 387 }
@@ -396,7 +396,7 @@ SSL_set_session_id_context(SSL *ssl, const unsigned char *sid_ctx,
396 unsigned int sid_ctx_len) 396 unsigned int sid_ctx_len)
397{ 397{
398 if (sid_ctx_len > SSL_MAX_SID_CTX_LENGTH) { 398 if (sid_ctx_len > SSL_MAX_SID_CTX_LENGTH) {
399 SSLerr(SSL_F_SSL_SET_SESSION_ID_CONTEXT, 399 SSLerror(
400 SSL_R_SSL_SESSION_ID_CONTEXT_TOO_LONG); 400 SSL_R_SSL_SESSION_ID_CONTEXT_TOO_LONG);
401 return (0); 401 return (0);
402 } 402 }
@@ -634,7 +634,7 @@ SSL_set_fd(SSL *s, int fd)
634 bio = BIO_new(BIO_s_socket()); 634 bio = BIO_new(BIO_s_socket());
635 635
636 if (bio == NULL) { 636 if (bio == NULL) {
637 SSLerr(SSL_F_SSL_SET_FD, ERR_R_BUF_LIB); 637 SSLerror(ERR_R_BUF_LIB);
638 goto err; 638 goto err;
639 } 639 }
640 BIO_set_fd(bio, fd, BIO_NOCLOSE); 640 BIO_set_fd(bio, fd, BIO_NOCLOSE);
@@ -655,7 +655,7 @@ SSL_set_wfd(SSL *s, int fd)
655 bio = BIO_new(BIO_s_socket()); 655 bio = BIO_new(BIO_s_socket());
656 656
657 if (bio == NULL) { 657 if (bio == NULL) {
658 SSLerr(SSL_F_SSL_SET_WFD, ERR_R_BUF_LIB); 658 SSLerror(ERR_R_BUF_LIB);
659 goto err; 659 goto err;
660 } 660 }
661 BIO_set_fd(bio, fd, BIO_NOCLOSE); 661 BIO_set_fd(bio, fd, BIO_NOCLOSE);
@@ -678,7 +678,7 @@ SSL_set_rfd(SSL *s, int fd)
678 bio = BIO_new(BIO_s_socket()); 678 bio = BIO_new(BIO_s_socket());
679 679
680 if (bio == NULL) { 680 if (bio == NULL) {
681 SSLerr(SSL_F_SSL_SET_RFD, ERR_R_BUF_LIB); 681 SSLerror(ERR_R_BUF_LIB);
682 goto err; 682 goto err;
683 } 683 }
684 BIO_set_fd(bio, fd, BIO_NOCLOSE); 684 BIO_set_fd(bio, fd, BIO_NOCLOSE);
@@ -873,12 +873,12 @@ SSL_CTX_check_private_key(const SSL_CTX *ctx)
873{ 873{
874 if ((ctx == NULL) || (ctx->internal->cert == NULL) || 874 if ((ctx == NULL) || (ctx->internal->cert == NULL) ||
875 (ctx->internal->cert->key->x509 == NULL)) { 875 (ctx->internal->cert->key->x509 == NULL)) {
876 SSLerr(SSL_F_SSL_CTX_CHECK_PRIVATE_KEY, 876 SSLerror(
877 SSL_R_NO_CERTIFICATE_ASSIGNED); 877 SSL_R_NO_CERTIFICATE_ASSIGNED);
878 return (0); 878 return (0);
879 } 879 }
880 if (ctx->internal->cert->key->privatekey == NULL) { 880 if (ctx->internal->cert->key->privatekey == NULL) {
881 SSLerr(SSL_F_SSL_CTX_CHECK_PRIVATE_KEY, 881 SSLerror(
882 SSL_R_NO_PRIVATE_KEY_ASSIGNED); 882 SSL_R_NO_PRIVATE_KEY_ASSIGNED);
883 return (0); 883 return (0);
884 } 884 }
@@ -891,22 +891,22 @@ int
891SSL_check_private_key(const SSL *ssl) 891SSL_check_private_key(const SSL *ssl)
892{ 892{
893 if (ssl == NULL) { 893 if (ssl == NULL) {
894 SSLerr(SSL_F_SSL_CHECK_PRIVATE_KEY, 894 SSLerror(
895 ERR_R_PASSED_NULL_PARAMETER); 895 ERR_R_PASSED_NULL_PARAMETER);
896 return (0); 896 return (0);
897 } 897 }
898 if (ssl->cert == NULL) { 898 if (ssl->cert == NULL) {
899 SSLerr(SSL_F_SSL_CHECK_PRIVATE_KEY, 899 SSLerror(
900 SSL_R_NO_CERTIFICATE_ASSIGNED); 900 SSL_R_NO_CERTIFICATE_ASSIGNED);
901 return (0); 901 return (0);
902 } 902 }
903 if (ssl->cert->key->x509 == NULL) { 903 if (ssl->cert->key->x509 == NULL) {
904 SSLerr(SSL_F_SSL_CHECK_PRIVATE_KEY, 904 SSLerror(
905 SSL_R_NO_CERTIFICATE_ASSIGNED); 905 SSL_R_NO_CERTIFICATE_ASSIGNED);
906 return (0); 906 return (0);
907 } 907 }
908 if (ssl->cert->key->privatekey == NULL) { 908 if (ssl->cert->key->privatekey == NULL) {
909 SSLerr(SSL_F_SSL_CHECK_PRIVATE_KEY, 909 SSLerror(
910 SSL_R_NO_PRIVATE_KEY_ASSIGNED); 910 SSL_R_NO_PRIVATE_KEY_ASSIGNED);
911 return (0); 911 return (0);
912 } 912 }
@@ -942,7 +942,7 @@ int
942SSL_read(SSL *s, void *buf, int num) 942SSL_read(SSL *s, void *buf, int num)
943{ 943{
944 if (s->internal->handshake_func == NULL) { 944 if (s->internal->handshake_func == NULL) {
945 SSLerr(SSL_F_SSL_READ, SSL_R_UNINITIALIZED); 945 SSLerror(SSL_R_UNINITIALIZED);
946 return (-1); 946 return (-1);
947 } 947 }
948 948
@@ -957,7 +957,7 @@ int
957SSL_peek(SSL *s, void *buf, int num) 957SSL_peek(SSL *s, void *buf, int num)
958{ 958{
959 if (s->internal->handshake_func == NULL) { 959 if (s->internal->handshake_func == NULL) {
960 SSLerr(SSL_F_SSL_PEEK, SSL_R_UNINITIALIZED); 960 SSLerror(SSL_R_UNINITIALIZED);
961 return (-1); 961 return (-1);
962 } 962 }
963 963
@@ -971,13 +971,13 @@ int
971SSL_write(SSL *s, const void *buf, int num) 971SSL_write(SSL *s, const void *buf, int num)
972{ 972{
973 if (s->internal->handshake_func == NULL) { 973 if (s->internal->handshake_func == NULL) {
974 SSLerr(SSL_F_SSL_WRITE, SSL_R_UNINITIALIZED); 974 SSLerror(SSL_R_UNINITIALIZED);
975 return (-1); 975 return (-1);
976 } 976 }
977 977
978 if (s->internal->shutdown & SSL_SENT_SHUTDOWN) { 978 if (s->internal->shutdown & SSL_SENT_SHUTDOWN) {
979 s->internal->rwstate = SSL_NOTHING; 979 s->internal->rwstate = SSL_NOTHING;
980 SSLerr(SSL_F_SSL_WRITE, SSL_R_PROTOCOL_IS_SHUTDOWN); 980 SSLerror(SSL_R_PROTOCOL_IS_SHUTDOWN);
981 return (-1); 981 return (-1);
982 } 982 }
983 return (s->method->internal->ssl_write(s, buf, num)); 983 return (s->method->internal->ssl_write(s, buf, num));
@@ -994,7 +994,7 @@ SSL_shutdown(SSL *s)
994 */ 994 */
995 995
996 if (s->internal->handshake_func == NULL) { 996 if (s->internal->handshake_func == NULL) {
997 SSLerr(SSL_F_SSL_SHUTDOWN, SSL_R_UNINITIALIZED); 997 SSLerror(SSL_R_UNINITIALIZED);
998 return (-1); 998 return (-1);
999 } 999 }
1000 1000
@@ -1306,7 +1306,7 @@ SSL_CTX_set_cipher_list(SSL_CTX *ctx, const char *str)
1306 if (sk == NULL) 1306 if (sk == NULL)
1307 return (0); 1307 return (0);
1308 else if (sk_SSL_CIPHER_num(sk) == 0) { 1308 else if (sk_SSL_CIPHER_num(sk) == 0) {
1309 SSLerr(SSL_F_SSL_CTX_SET_CIPHER_LIST, SSL_R_NO_CIPHER_MATCH); 1309 SSLerror(SSL_R_NO_CIPHER_MATCH);
1310 return (0); 1310 return (0);
1311 } 1311 }
1312 return (1); 1312 return (1);
@@ -1324,7 +1324,7 @@ SSL_set_cipher_list(SSL *s, const char *str)
1324 if (sk == NULL) 1324 if (sk == NULL)
1325 return (0); 1325 return (0);
1326 else if (sk_SSL_CIPHER_num(sk) == 0) { 1326 else if (sk_SSL_CIPHER_num(sk) == 0) {
1327 SSLerr(SSL_F_SSL_SET_CIPHER_LIST, SSL_R_NO_CIPHER_MATCH); 1327 SSLerror(SSL_R_NO_CIPHER_MATCH);
1328 return (0); 1328 return (0);
1329 } 1329 }
1330 return (1); 1330 return (1);
@@ -1428,20 +1428,20 @@ ssl_bytes_to_cipher_list(SSL *s, const unsigned char *p, int num)
1428 * RFC 5246 section 7.4.1.2 defines the interval as [2,2^16-2]. 1428 * RFC 5246 section 7.4.1.2 defines the interval as [2,2^16-2].
1429 */ 1429 */
1430 if (num < 2 || num > 0x10000 - 2) { 1430 if (num < 2 || num > 0x10000 - 2) {
1431 SSLerr(SSL_F_SSL_BYTES_TO_CIPHER_LIST, 1431 SSLerror(
1432 SSL_R_ERROR_IN_RECEIVED_CIPHER_LIST); 1432 SSL_R_ERROR_IN_RECEIVED_CIPHER_LIST);
1433 return (NULL); 1433 return (NULL);
1434 } 1434 }
1435 1435
1436 if ((sk = sk_SSL_CIPHER_new_null()) == NULL) { 1436 if ((sk = sk_SSL_CIPHER_new_null()) == NULL) {
1437 SSLerr(SSL_F_SSL_BYTES_TO_CIPHER_LIST, ERR_R_MALLOC_FAILURE); 1437 SSLerror(ERR_R_MALLOC_FAILURE);
1438 goto err; 1438 goto err;
1439 } 1439 }
1440 1440
1441 CBS_init(&cbs, p, num); 1441 CBS_init(&cbs, p, num);
1442 while (CBS_len(&cbs) > 0) { 1442 while (CBS_len(&cbs) > 0) {
1443 if (!CBS_get_u16(&cbs, &cipher_value)) { 1443 if (!CBS_get_u16(&cbs, &cipher_value)) {
1444 SSLerr(SSL_F_SSL_BYTES_TO_CIPHER_LIST, 1444 SSLerror(
1445 SSL_R_ERROR_IN_RECEIVED_CIPHER_LIST); 1445 SSL_R_ERROR_IN_RECEIVED_CIPHER_LIST);
1446 goto err; 1446 goto err;
1447 } 1447 }
@@ -1454,7 +1454,7 @@ ssl_bytes_to_cipher_list(SSL *s, const unsigned char *p, int num)
1454 * renegotiating. 1454 * renegotiating.
1455 */ 1455 */
1456 if (s->internal->renegotiate) { 1456 if (s->internal->renegotiate) {
1457 SSLerr(SSL_F_SSL_BYTES_TO_CIPHER_LIST, 1457 SSLerror(
1458 SSL_R_SCSV_RECEIVED_WHEN_RENEGOTIATING); 1458 SSL_R_SCSV_RECEIVED_WHEN_RENEGOTIATING);
1459 ssl3_send_alert(s, SSL3_AL_FATAL, 1459 ssl3_send_alert(s, SSL3_AL_FATAL,
1460 SSL_AD_HANDSHAKE_FAILURE); 1460 SSL_AD_HANDSHAKE_FAILURE);
@@ -1474,7 +1474,7 @@ ssl_bytes_to_cipher_list(SSL *s, const unsigned char *p, int num)
1474 */ 1474 */
1475 max_version = ssl_max_server_version(s); 1475 max_version = ssl_max_server_version(s);
1476 if (max_version == 0 || s->version < max_version) { 1476 if (max_version == 0 || s->version < max_version) {
1477 SSLerr(SSL_F_SSL_BYTES_TO_CIPHER_LIST, 1477 SSLerror(
1478 SSL_R_INAPPROPRIATE_FALLBACK); 1478 SSL_R_INAPPROPRIATE_FALLBACK);
1479 if (s->s3 != NULL) 1479 if (s->s3 != NULL)
1480 ssl3_send_alert(s, SSL3_AL_FATAL, 1480 ssl3_send_alert(s, SSL3_AL_FATAL,
@@ -1486,7 +1486,7 @@ ssl_bytes_to_cipher_list(SSL *s, const unsigned char *p, int num)
1486 1486
1487 if ((c = ssl3_get_cipher_by_value(cipher_value)) != NULL) { 1487 if ((c = ssl3_get_cipher_by_value(cipher_value)) != NULL) {
1488 if (!sk_SSL_CIPHER_push(sk, c)) { 1488 if (!sk_SSL_CIPHER_push(sk, c)) {
1489 SSLerr(SSL_F_SSL_BYTES_TO_CIPHER_LIST, 1489 SSLerror(
1490 ERR_R_MALLOC_FAILURE); 1490 ERR_R_MALLOC_FAILURE);
1491 goto err; 1491 goto err;
1492 } 1492 }
@@ -1797,22 +1797,22 @@ SSL_CTX_new(const SSL_METHOD *meth)
1797 SSL_CTX *ret; 1797 SSL_CTX *ret;
1798 1798
1799 if (meth == NULL) { 1799 if (meth == NULL) {
1800 SSLerr(SSL_F_SSL_CTX_NEW, SSL_R_NULL_SSL_METHOD_PASSED); 1800 SSLerror(SSL_R_NULL_SSL_METHOD_PASSED);
1801 return (NULL); 1801 return (NULL);
1802 } 1802 }
1803 1803
1804 if ((ret = calloc(1, sizeof(*ret))) == NULL) { 1804 if ((ret = calloc(1, sizeof(*ret))) == NULL) {
1805 SSLerr(SSL_F_SSL_CTX_NEW, ERR_R_MALLOC_FAILURE); 1805 SSLerror(ERR_R_MALLOC_FAILURE);
1806 return (NULL); 1806 return (NULL);
1807 } 1807 }
1808 if ((ret->internal = calloc(1, sizeof(*ret->internal))) == NULL) { 1808 if ((ret->internal = calloc(1, sizeof(*ret->internal))) == NULL) {
1809 free(ret); 1809 free(ret);
1810 SSLerr(SSL_F_SSL_CTX_NEW, ERR_R_MALLOC_FAILURE); 1810 SSLerror(ERR_R_MALLOC_FAILURE);
1811 return (NULL); 1811 return (NULL);
1812 } 1812 }
1813 1813
1814 if (SSL_get_ex_data_X509_STORE_CTX_idx() < 0) { 1814 if (SSL_get_ex_data_X509_STORE_CTX_idx() < 0) {
1815 SSLerr(SSL_F_SSL_CTX_NEW, 1815 SSLerror(
1816 SSL_R_X509_VERIFICATION_SETUP_PROBLEMS); 1816 SSL_R_X509_VERIFICATION_SETUP_PROBLEMS);
1817 goto err; 1817 goto err;
1818 } 1818 }
@@ -1872,7 +1872,7 @@ SSL_CTX_new(const SSL_METHOD *meth)
1872 &ret->internal->cipher_list_by_id, SSL_DEFAULT_CIPHER_LIST); 1872 &ret->internal->cipher_list_by_id, SSL_DEFAULT_CIPHER_LIST);
1873 if (ret->cipher_list == NULL || 1873 if (ret->cipher_list == NULL ||
1874 sk_SSL_CIPHER_num(ret->cipher_list) <= 0) { 1874 sk_SSL_CIPHER_num(ret->cipher_list) <= 0) {
1875 SSLerr(SSL_F_SSL_CTX_NEW, SSL_R_LIBRARY_HAS_NO_CIPHERS); 1875 SSLerror(SSL_R_LIBRARY_HAS_NO_CIPHERS);
1876 goto err2; 1876 goto err2;
1877 } 1877 }
1878 1878
@@ -1881,12 +1881,12 @@ SSL_CTX_new(const SSL_METHOD *meth)
1881 goto err; 1881 goto err;
1882 1882
1883 if ((ret->internal->md5 = EVP_get_digestbyname("ssl3-md5")) == NULL) { 1883 if ((ret->internal->md5 = EVP_get_digestbyname("ssl3-md5")) == NULL) {
1884 SSLerr(SSL_F_SSL_CTX_NEW, 1884 SSLerror(
1885 SSL_R_UNABLE_TO_LOAD_SSL3_MD5_ROUTINES); 1885 SSL_R_UNABLE_TO_LOAD_SSL3_MD5_ROUTINES);
1886 goto err2; 1886 goto err2;
1887 } 1887 }
1888 if ((ret->internal->sha1 = EVP_get_digestbyname("ssl3-sha1")) == NULL) { 1888 if ((ret->internal->sha1 = EVP_get_digestbyname("ssl3-sha1")) == NULL) {
1889 SSLerr(SSL_F_SSL_CTX_NEW, 1889 SSLerror(
1890 SSL_R_UNABLE_TO_LOAD_SSL3_SHA1_ROUTINES); 1890 SSL_R_UNABLE_TO_LOAD_SSL3_SHA1_ROUTINES);
1891 goto err2; 1891 goto err2;
1892 } 1892 }
@@ -1942,7 +1942,7 @@ SSL_CTX_new(const SSL_METHOD *meth)
1942 1942
1943 return (ret); 1943 return (ret);
1944err: 1944err:
1945 SSLerr(SSL_F_SSL_CTX_NEW, ERR_R_MALLOC_FAILURE); 1945 SSLerror(ERR_R_MALLOC_FAILURE);
1946err2: 1946err2:
1947 SSL_CTX_free(ret); 1947 SSL_CTX_free(ret);
1948 return (NULL); 1948 return (NULL);
@@ -2126,7 +2126,7 @@ ssl_check_srvr_ecc_cert_and_alg(X509 *x, SSL *s)
2126 /* Key usage, if present, must allow signing. */ 2126 /* Key usage, if present, must allow signing. */
2127 if ((x->ex_flags & EXFLAG_KUSAGE) && 2127 if ((x->ex_flags & EXFLAG_KUSAGE) &&
2128 ((x->ex_kusage & X509v3_KU_DIGITAL_SIGNATURE) == 0)) { 2128 ((x->ex_kusage & X509v3_KU_DIGITAL_SIGNATURE) == 0)) {
2129 SSLerr(SSL_F_SSL_CHECK_SRVR_ECC_CERT_AND_ALG, 2129 SSLerror(
2130 SSL_R_ECC_CERT_NOT_FOR_SIGNING); 2130 SSL_R_ECC_CERT_NOT_FOR_SIGNING);
2131 return (0); 2131 return (0);
2132 } 2132 }
@@ -2159,7 +2159,7 @@ ssl_get_server_send_pkey(const SSL *s)
2159 } else if (alg_a & SSL_aGOST01) { 2159 } else if (alg_a & SSL_aGOST01) {
2160 i = SSL_PKEY_GOST01; 2160 i = SSL_PKEY_GOST01;
2161 } else { /* if (alg_a & SSL_aNULL) */ 2161 } else { /* if (alg_a & SSL_aNULL) */
2162 SSLerr(SSL_F_SSL_GET_SERVER_SEND_PKEY, ERR_R_INTERNAL_ERROR); 2162 SSLerror(ERR_R_INTERNAL_ERROR);
2163 return (NULL); 2163 return (NULL);
2164 } 2164 }
2165 2165
@@ -2199,7 +2199,7 @@ ssl_get_sign_pkey(SSL *s, const SSL_CIPHER *cipher, const EVP_MD **pmd)
2199 (c->pkeys[SSL_PKEY_ECC].privatekey != NULL)) 2199 (c->pkeys[SSL_PKEY_ECC].privatekey != NULL))
2200 idx = SSL_PKEY_ECC; 2200 idx = SSL_PKEY_ECC;
2201 if (idx == -1) { 2201 if (idx == -1) {
2202 SSLerr(SSL_F_SSL_GET_SIGN_PKEY, ERR_R_INTERNAL_ERROR); 2202 SSLerror(ERR_R_INTERNAL_ERROR);
2203 return (NULL); 2203 return (NULL);
2204 } 2204 }
2205 if (pmd) 2205 if (pmd)
@@ -2403,7 +2403,7 @@ SSL_do_handshake(SSL *s)
2403 int ret = 1; 2403 int ret = 1;
2404 2404
2405 if (s->internal->handshake_func == NULL) { 2405 if (s->internal->handshake_func == NULL) {
2406 SSLerr(SSL_F_SSL_DO_HANDSHAKE, SSL_R_CONNECTION_TYPE_NOT_SET); 2406 SSLerror(SSL_R_CONNECTION_TYPE_NOT_SET);
2407 return (-1); 2407 return (-1);
2408 } 2408 }
2409 2409
@@ -2448,7 +2448,7 @@ SSL_set_connect_state(SSL *s)
2448int 2448int
2449ssl_undefined_function(SSL *s) 2449ssl_undefined_function(SSL *s)
2450{ 2450{
2451 SSLerr(SSL_F_SSL_UNDEFINED_FUNCTION, 2451 SSLerror(
2452 ERR_R_SHOULD_NOT_HAVE_BEEN_CALLED); 2452 ERR_R_SHOULD_NOT_HAVE_BEEN_CALLED);
2453 return (0); 2453 return (0);
2454} 2454}
@@ -2456,7 +2456,7 @@ ssl_undefined_function(SSL *s)
2456int 2456int
2457ssl_undefined_void_function(void) 2457ssl_undefined_void_function(void)
2458{ 2458{
2459 SSLerr(SSL_F_SSL_UNDEFINED_VOID_FUNCTION, 2459 SSLerror(
2460 ERR_R_SHOULD_NOT_HAVE_BEEN_CALLED); 2460 ERR_R_SHOULD_NOT_HAVE_BEEN_CALLED);
2461 return (0); 2461 return (0);
2462} 2462}
@@ -2464,7 +2464,7 @@ ssl_undefined_void_function(void)
2464int 2464int
2465ssl_undefined_const_function(const SSL *s) 2465ssl_undefined_const_function(const SSL *s)
2466{ 2466{
2467 SSLerr(SSL_F_SSL_UNDEFINED_CONST_FUNCTION, 2467 SSLerror(
2468 ERR_R_SHOULD_NOT_HAVE_BEEN_CALLED); 2468 ERR_R_SHOULD_NOT_HAVE_BEEN_CALLED);
2469 return (0); 2469 return (0);
2470} 2470}
@@ -2700,7 +2700,7 @@ ssl_init_wbio_buffer(SSL *s, int push)
2700 (void)BIO_reset(bbio); 2700 (void)BIO_reset(bbio);
2701/* if (!BIO_set_write_buffer_size(bbio,16*1024)) */ 2701/* if (!BIO_set_write_buffer_size(bbio,16*1024)) */
2702 if (!BIO_set_read_buffer_size(bbio, 1)) { 2702 if (!BIO_set_read_buffer_size(bbio, 1)) {
2703 SSLerr(SSL_F_SSL_INIT_WBIO_BUFFER, ERR_R_BUF_LIB); 2703 SSLerror(ERR_R_BUF_LIB);
2704 return (0); 2704 return (0);
2705 } 2705 }
2706 if (push) { 2706 if (push) {
diff --git a/src/lib/libssl/ssl_locl.h b/src/lib/libssl/ssl_locl.h
index 215d4ad0b0..1ce9350ba6 100644
--- a/src/lib/libssl/ssl_locl.h
+++ b/src/lib/libssl/ssl_locl.h
@@ -1,4 +1,4 @@
1/* $OpenBSD: ssl_locl.h,v 1.171 2017/01/26 07:20:57 beck Exp $ */ 1/* $OpenBSD: ssl_locl.h,v 1.172 2017/01/26 10:40:21 beck Exp $ */
2/* Copyright (C) 1995-1998 Eric Young (eay@cryptsoft.com) 2/* Copyright (C) 1995-1998 Eric Young (eay@cryptsoft.com)
3 * All rights reserved. 3 * All rights reserved.
4 * 4 *
@@ -1368,6 +1368,8 @@ int ssl3_cbc_digest_record(const EVP_MD_CTX *ctx, unsigned char *md_out,
1368 size_t data_plus_mac_plus_padding_size, const unsigned char *mac_secret, 1368 size_t data_plus_mac_plus_padding_size, const unsigned char *mac_secret,
1369 unsigned mac_secret_length); 1369 unsigned mac_secret_length);
1370 1370
1371#define SSLerror(r) ERR_PUT_error(ERR_LIB_SSL,(0xfff),(r),__FILE__,__LINE__)
1372
1371__END_HIDDEN_DECLS 1373__END_HIDDEN_DECLS
1372 1374
1373#endif 1375#endif
diff --git a/src/lib/libssl/ssl_packet.c b/src/lib/libssl/ssl_packet.c
index 0c5b4c463b..a8462ffd84 100644
--- a/src/lib/libssl/ssl_packet.c
+++ b/src/lib/libssl/ssl_packet.c
@@ -106,12 +106,12 @@ ssl_convert_sslv2_client_hello(SSL *s)
106 return -1; 106 return -1;
107 107
108 if (record_length < 9) { 108 if (record_length < 9) {
109 SSLerr(SSL_F_SSL23_GET_CLIENT_HELLO, 109 SSLerror(
110 SSL_R_RECORD_LENGTH_MISMATCH); 110 SSL_R_RECORD_LENGTH_MISMATCH);
111 return -1; 111 return -1;
112 } 112 }
113 if (record_length > 4096) { 113 if (record_length > 4096) {
114 SSLerr(SSL_F_SSL23_GET_CLIENT_HELLO, SSL_R_RECORD_TOO_LARGE); 114 SSLerror(SSL_R_RECORD_TOO_LARGE);
115 return -1; 115 return -1;
116 } 116 }
117 117
@@ -150,7 +150,7 @@ ssl_convert_sslv2_client_hello(SSL *s)
150 if (!CBS_get_bytes(&cbs, &challenge, challenge_length)) 150 if (!CBS_get_bytes(&cbs, &challenge, challenge_length))
151 return -1; 151 return -1;
152 if (CBS_len(&cbs) != 0) { 152 if (CBS_len(&cbs) != 0) {
153 SSLerr(SSL_F_SSL23_GET_CLIENT_HELLO, 153 SSLerror(
154 SSL_R_RECORD_LENGTH_MISMATCH); 154 SSL_R_RECORD_LENGTH_MISMATCH);
155 return -1; 155 return -1;
156 } 156 }
@@ -236,7 +236,7 @@ ssl_server_legacy_first_packet(SSL *s)
236 if (ssl_is_sslv2_client_hello(&header) == 1) { 236 if (ssl_is_sslv2_client_hello(&header) == 1) {
237 /* Only permit SSLv2 client hellos if TLSv1.0 is enabled. */ 237 /* Only permit SSLv2 client hellos if TLSv1.0 is enabled. */
238 if (ssl_enabled_version_range(s, &min_version, NULL) != 1) { 238 if (ssl_enabled_version_range(s, &min_version, NULL) != 1) {
239 SSLerr(SSL_F_SSL23_CLIENT_HELLO, 239 SSLerror(
240 SSL_R_NO_PROTOCOLS_AVAILABLE); 240 SSL_R_NO_PROTOCOLS_AVAILABLE);
241 return -1; 241 return -1;
242 } 242 }
@@ -244,7 +244,7 @@ ssl_server_legacy_first_packet(SSL *s)
244 return 1; 244 return 1;
245 245
246 if (ssl_convert_sslv2_client_hello(s) != 1) { 246 if (ssl_convert_sslv2_client_hello(s) != 1) {
247 SSLerr(SSL_F_SSL23_CLIENT_HELLO, 247 SSLerror(
248 SSL_R_BAD_PACKET_LENGTH); 248 SSL_R_BAD_PACKET_LENGTH);
249 return -1; 249 return -1;
250 } 250 }
@@ -254,7 +254,7 @@ ssl_server_legacy_first_packet(SSL *s)
254 254
255 /* Ensure that we have SSL3_RT_HEADER_LENGTH (5 bytes) of the packet. */ 255 /* Ensure that we have SSL3_RT_HEADER_LENGTH (5 bytes) of the packet. */
256 if (CBS_len(&header) != SSL3_RT_HEADER_LENGTH) { 256 if (CBS_len(&header) != SSL3_RT_HEADER_LENGTH) {
257 SSLerr(SSL_F_SSL23_GET_CLIENT_HELLO, ERR_R_INTERNAL_ERROR); 257 SSLerror(ERR_R_INTERNAL_ERROR);
258 return -1; 258 return -1;
259 } 259 }
260 data = (const char *)CBS_data(&header); 260 data = (const char *)CBS_data(&header);
@@ -264,15 +264,15 @@ ssl_server_legacy_first_packet(SSL *s)
264 strncmp("POST ", data, 5) == 0 || 264 strncmp("POST ", data, 5) == 0 ||
265 strncmp("HEAD ", data, 5) == 0 || 265 strncmp("HEAD ", data, 5) == 0 ||
266 strncmp("PUT ", data, 4) == 0) { 266 strncmp("PUT ", data, 4) == 0) {
267 SSLerr(SSL_F_SSL23_GET_CLIENT_HELLO, SSL_R_HTTP_REQUEST); 267 SSLerror(SSL_R_HTTP_REQUEST);
268 return -1; 268 return -1;
269 } 269 }
270 if (strncmp("CONNE", data, 5) == 0) { 270 if (strncmp("CONNE", data, 5) == 0) {
271 SSLerr(SSL_F_SSL23_GET_CLIENT_HELLO, SSL_R_HTTPS_PROXY_REQUEST); 271 SSLerror(SSL_R_HTTPS_PROXY_REQUEST);
272 return -1; 272 return -1;
273 } 273 }
274 274
275 SSLerr(SSL_F_SSL23_GET_CLIENT_HELLO, SSL_R_UNKNOWN_PROTOCOL); 275 SSLerror(SSL_R_UNKNOWN_PROTOCOL);
276 276
277 return -1; 277 return -1;
278} 278}
diff --git a/src/lib/libssl/ssl_pkt.c b/src/lib/libssl/ssl_pkt.c
index 2fa7852b80..f354fb82bf 100644
--- a/src/lib/libssl/ssl_pkt.c
+++ b/src/lib/libssl/ssl_pkt.c
@@ -1,4 +1,4 @@
1/* $OpenBSD: ssl_pkt.c,v 1.5 2017/01/26 08:19:43 beck Exp $ */ 1/* $OpenBSD: ssl_pkt.c,v 1.6 2017/01/26 10:40:21 beck Exp $ */
2/* Copyright (C) 1995-1998 Eric Young (eay@cryptsoft.com) 2/* Copyright (C) 1995-1998 Eric Young (eay@cryptsoft.com)
3 * All rights reserved. 3 * All rights reserved.
4 * 4 *
@@ -224,7 +224,7 @@ ssl3_read_n(SSL *s, int n, int max, int extend)
224 224
225 if (n > (int)(rb->len - rb->offset)) { 225 if (n > (int)(rb->len - rb->offset)) {
226 /* does not happen */ 226 /* does not happen */
227 SSLerr(SSL_F_SSL3_READ_N, ERR_R_INTERNAL_ERROR); 227 SSLerror(ERR_R_INTERNAL_ERROR);
228 return -1; 228 return -1;
229 } 229 }
230 230
@@ -248,7 +248,7 @@ ssl3_read_n(SSL *s, int n, int max, int extend)
248 s->internal->rwstate = SSL_READING; 248 s->internal->rwstate = SSL_READING;
249 i = BIO_read(s->rbio, pkt + len + left, max - left); 249 i = BIO_read(s->rbio, pkt + len + left, max - left);
250 } else { 250 } else {
251 SSLerr(SSL_F_SSL3_READ_N, SSL_R_READ_BIO_NOT_SET); 251 SSLerror(SSL_R_READ_BIO_NOT_SET);
252 i = -1; 252 i = -1;
253 } 253 }
254 254
@@ -364,7 +364,7 @@ ssl3_get_record(SSL *s)
364 if (!CBS_get_u8(&header, &type) || 364 if (!CBS_get_u8(&header, &type) ||
365 !CBS_get_u16(&header, &ssl_version) || 365 !CBS_get_u16(&header, &ssl_version) ||
366 !CBS_get_u16(&header, &len)) { 366 !CBS_get_u16(&header, &len)) {
367 SSLerr(SSL_F_SSL3_GET_RECORD, 367 SSLerror(
368 SSL_R_BAD_PACKET_LENGTH); 368 SSL_R_BAD_PACKET_LENGTH);
369 goto err; 369 goto err;
370 } 370 }
@@ -374,7 +374,7 @@ ssl3_get_record(SSL *s)
374 374
375 /* Lets check version */ 375 /* Lets check version */
376 if (!s->internal->first_packet && ssl_version != s->version) { 376 if (!s->internal->first_packet && ssl_version != s->version) {
377 SSLerr(SSL_F_SSL3_GET_RECORD, 377 SSLerror(
378 SSL_R_WRONG_VERSION_NUMBER); 378 SSL_R_WRONG_VERSION_NUMBER);
379 if ((s->version & 0xFF00) == (ssl_version & 0xFF00) && 379 if ((s->version & 0xFF00) == (ssl_version & 0xFF00) &&
380 !s->internal->enc_write_ctx && !s->internal->write_hash) 380 !s->internal->enc_write_ctx && !s->internal->write_hash)
@@ -385,14 +385,14 @@ ssl3_get_record(SSL *s)
385 } 385 }
386 386
387 if ((ssl_version >> 8) != SSL3_VERSION_MAJOR) { 387 if ((ssl_version >> 8) != SSL3_VERSION_MAJOR) {
388 SSLerr(SSL_F_SSL3_GET_RECORD, 388 SSLerror(
389 SSL_R_WRONG_VERSION_NUMBER); 389 SSL_R_WRONG_VERSION_NUMBER);
390 goto err; 390 goto err;
391 } 391 }
392 392
393 if (rr->length > s->s3->rbuf.len - SSL3_RT_HEADER_LENGTH) { 393 if (rr->length > s->s3->rbuf.len - SSL3_RT_HEADER_LENGTH) {
394 al = SSL_AD_RECORD_OVERFLOW; 394 al = SSL_AD_RECORD_OVERFLOW;
395 SSLerr(SSL_F_SSL3_GET_RECORD, 395 SSLerror(
396 SSL_R_PACKET_LENGTH_TOO_LONG); 396 SSL_R_PACKET_LENGTH_TOO_LONG);
397 goto f_err; 397 goto f_err;
398 } 398 }
@@ -428,7 +428,7 @@ ssl3_get_record(SSL *s)
428 /* check is not needed I believe */ 428 /* check is not needed I believe */
429 if (rr->length > SSL3_RT_MAX_ENCRYPTED_LENGTH) { 429 if (rr->length > SSL3_RT_MAX_ENCRYPTED_LENGTH) {
430 al = SSL_AD_RECORD_OVERFLOW; 430 al = SSL_AD_RECORD_OVERFLOW;
431 SSLerr(SSL_F_SSL3_GET_RECORD, SSL_R_ENCRYPTED_LENGTH_TOO_LONG); 431 SSLerror(SSL_R_ENCRYPTED_LENGTH_TOO_LONG);
432 goto f_err; 432 goto f_err;
433 } 433 }
434 434
@@ -442,7 +442,7 @@ ssl3_get_record(SSL *s)
442 * -1: if the padding is invalid */ 442 * -1: if the padding is invalid */
443 if (enc_err == 0) { 443 if (enc_err == 0) {
444 al = SSL_AD_DECRYPTION_FAILED; 444 al = SSL_AD_DECRYPTION_FAILED;
445 SSLerr(SSL_F_SSL3_GET_RECORD, SSL_R_BLOCK_CIPHER_PAD_IS_WRONG); 445 SSLerror(SSL_R_BLOCK_CIPHER_PAD_IS_WRONG);
446 goto f_err; 446 goto f_err;
447 } 447 }
448 448
@@ -470,7 +470,7 @@ ssl3_get_record(SSL *s)
470 (EVP_CIPHER_CTX_mode(s->enc_read_ctx) == EVP_CIPH_CBC_MODE && 470 (EVP_CIPHER_CTX_mode(s->enc_read_ctx) == EVP_CIPH_CBC_MODE &&
471 orig_len < mac_size + 1)) { 471 orig_len < mac_size + 1)) {
472 al = SSL_AD_DECODE_ERROR; 472 al = SSL_AD_DECODE_ERROR;
473 SSLerr(SSL_F_SSL3_GET_RECORD, SSL_R_LENGTH_TOO_SHORT); 473 SSLerror(SSL_R_LENGTH_TOO_SHORT);
474 goto f_err; 474 goto f_err;
475 } 475 }
476 476
@@ -510,14 +510,14 @@ ssl3_get_record(SSL *s)
510 * (e.g. via a logfile) 510 * (e.g. via a logfile)
511 */ 511 */
512 al = SSL_AD_BAD_RECORD_MAC; 512 al = SSL_AD_BAD_RECORD_MAC;
513 SSLerr(SSL_F_SSL3_GET_RECORD, 513 SSLerror(
514 SSL_R_DECRYPTION_FAILED_OR_BAD_RECORD_MAC); 514 SSL_R_DECRYPTION_FAILED_OR_BAD_RECORD_MAC);
515 goto f_err; 515 goto f_err;
516 } 516 }
517 517
518 if (rr->length > SSL3_RT_MAX_PLAIN_LENGTH) { 518 if (rr->length > SSL3_RT_MAX_PLAIN_LENGTH) {
519 al = SSL_AD_RECORD_OVERFLOW; 519 al = SSL_AD_RECORD_OVERFLOW;
520 SSLerr(SSL_F_SSL3_GET_RECORD, SSL_R_DATA_LENGTH_TOO_LONG); 520 SSLerror(SSL_R_DATA_LENGTH_TOO_LONG);
521 goto f_err; 521 goto f_err;
522 } 522 }
523 523
@@ -543,7 +543,7 @@ ssl3_get_record(SSL *s)
543 * empty record without forcing want_read. 543 * empty record without forcing want_read.
544 */ 544 */
545 if (s->internal->empty_record_count++ > SSL_MAX_EMPTY_RECORDS) { 545 if (s->internal->empty_record_count++ > SSL_MAX_EMPTY_RECORDS) {
546 SSLerr(SSL_F_SSL3_GET_RECORD, 546 SSLerror(
547 SSL_R_PEER_BEHAVING_BADLY); 547 SSL_R_PEER_BEHAVING_BADLY);
548 return -1; 548 return -1;
549 } 549 }
@@ -575,7 +575,7 @@ ssl3_write_bytes(SSL *s, int type, const void *buf_, int len)
575 int i; 575 int i;
576 576
577 if (len < 0) { 577 if (len < 0) {
578 SSLerr(SSL_F_SSL3_WRITE_BYTES, ERR_R_INTERNAL_ERROR); 578 SSLerror(ERR_R_INTERNAL_ERROR);
579 return -1; 579 return -1;
580 } 580 }
581 581
@@ -588,7 +588,7 @@ ssl3_write_bytes(SSL *s, int type, const void *buf_, int len)
588 if (i < 0) 588 if (i < 0)
589 return (i); 589 return (i);
590 if (i == 0) { 590 if (i == 0) {
591 SSLerr(SSL_F_SSL3_WRITE_BYTES, 591 SSLerror(
592 SSL_R_SSL_HANDSHAKE_FAILURE); 592 SSL_R_SSL_HANDSHAKE_FAILURE);
593 return -1; 593 return -1;
594 } 594 }
@@ -698,7 +698,7 @@ do_ssl3_write(SSL *s, int type, const unsigned char *buf,
698 if (prefix_len > 698 if (prefix_len >
699 (SSL3_RT_HEADER_LENGTH + SSL3_RT_SEND_MAX_ENCRYPTED_OVERHEAD)) { 699 (SSL3_RT_HEADER_LENGTH + SSL3_RT_SEND_MAX_ENCRYPTED_OVERHEAD)) {
700 /* insufficient space */ 700 /* insufficient space */
701 SSLerr(SSL_F_DO_SSL3_WRITE, 701 SSLerror(
702 ERR_R_INTERNAL_ERROR); 702 ERR_R_INTERNAL_ERROR);
703 goto err; 703 goto err;
704 } 704 }
@@ -842,7 +842,7 @@ ssl3_write_pending(SSL *s, int type, const unsigned char *buf, unsigned int len)
842 if ((S3I(s)->wpend_tot > (int)len) || ((S3I(s)->wpend_buf != buf) && 842 if ((S3I(s)->wpend_tot > (int)len) || ((S3I(s)->wpend_buf != buf) &&
843 !(s->internal->mode & SSL_MODE_ACCEPT_MOVING_WRITE_BUFFER)) || 843 !(s->internal->mode & SSL_MODE_ACCEPT_MOVING_WRITE_BUFFER)) ||
844 (S3I(s)->wpend_type != type)) { 844 (S3I(s)->wpend_type != type)) {
845 SSLerr(SSL_F_SSL3_WRITE_PENDING, SSL_R_BAD_WRITE_RETRY); 845 SSLerror(SSL_R_BAD_WRITE_RETRY);
846 return (-1); 846 return (-1);
847 } 847 }
848 848
@@ -854,7 +854,7 @@ ssl3_write_pending(SSL *s, int type, const unsigned char *buf, unsigned int len)
854 (char *)&(wb->buf[wb->offset]), 854 (char *)&(wb->buf[wb->offset]),
855 (unsigned int)wb->left); 855 (unsigned int)wb->left);
856 } else { 856 } else {
857 SSLerr(SSL_F_SSL3_WRITE_PENDING, SSL_R_BIO_NOT_SET); 857 SSLerror(SSL_R_BIO_NOT_SET);
858 i = -1; 858 i = -1;
859 } 859 }
860 if (i == wb->left) { 860 if (i == wb->left) {
@@ -919,14 +919,14 @@ ssl3_read_bytes(SSL *s, int type, unsigned char *buf, int len, int peek)
919 return (-1); 919 return (-1);
920 920
921 if (len < 0) { 921 if (len < 0) {
922 SSLerr(SSL_F_SSL3_READ_BYTES, ERR_R_INTERNAL_ERROR); 922 SSLerror(ERR_R_INTERNAL_ERROR);
923 return -1; 923 return -1;
924 } 924 }
925 925
926 if ((type && type != SSL3_RT_APPLICATION_DATA && 926 if ((type && type != SSL3_RT_APPLICATION_DATA &&
927 type != SSL3_RT_HANDSHAKE) || 927 type != SSL3_RT_HANDSHAKE) ||
928 (peek && (type != SSL3_RT_APPLICATION_DATA))) { 928 (peek && (type != SSL3_RT_APPLICATION_DATA))) {
929 SSLerr(SSL_F_SSL3_READ_BYTES, ERR_R_INTERNAL_ERROR); 929 SSLerror(ERR_R_INTERNAL_ERROR);
930 return -1; 930 return -1;
931 } 931 }
932 932
@@ -961,7 +961,7 @@ ssl3_read_bytes(SSL *s, int type, unsigned char *buf, int len, int peek)
961 if (i < 0) 961 if (i < 0)
962 return (i); 962 return (i);
963 if (i == 0) { 963 if (i == 0) {
964 SSLerr(SSL_F_SSL3_READ_BYTES, 964 SSLerror(
965 SSL_R_SSL_HANDSHAKE_FAILURE); 965 SSL_R_SSL_HANDSHAKE_FAILURE);
966 return (-1); 966 return (-1);
967 } 967 }
@@ -1004,7 +1004,7 @@ start:
1004 * reset by ssl3_get_finished */ 1004 * reset by ssl3_get_finished */
1005 && (rr->type != SSL3_RT_HANDSHAKE)) { 1005 && (rr->type != SSL3_RT_HANDSHAKE)) {
1006 al = SSL_AD_UNEXPECTED_MESSAGE; 1006 al = SSL_AD_UNEXPECTED_MESSAGE;
1007 SSLerr(SSL_F_SSL3_READ_BYTES, 1007 SSLerror(
1008 SSL_R_DATA_BETWEEN_CCS_AND_FINISHED); 1008 SSL_R_DATA_BETWEEN_CCS_AND_FINISHED);
1009 goto f_err; 1009 goto f_err;
1010 } 1010 }
@@ -1025,7 +1025,7 @@ start:
1025 if (SSL_in_init(s) && (type == SSL3_RT_APPLICATION_DATA) && 1025 if (SSL_in_init(s) && (type == SSL3_RT_APPLICATION_DATA) &&
1026 (s->enc_read_ctx == NULL)) { 1026 (s->enc_read_ctx == NULL)) {
1027 al = SSL_AD_UNEXPECTED_MESSAGE; 1027 al = SSL_AD_UNEXPECTED_MESSAGE;
1028 SSLerr(SSL_F_SSL3_READ_BYTES, 1028 SSLerror(
1029 SSL_R_APP_DATA_IN_HANDSHAKE); 1029 SSL_R_APP_DATA_IN_HANDSHAKE);
1030 goto f_err; 1030 goto f_err;
1031 } 1031 }
@@ -1108,7 +1108,7 @@ start:
1108 (S3I(s)->handshake_fragment[2] != 0) || 1108 (S3I(s)->handshake_fragment[2] != 0) ||
1109 (S3I(s)->handshake_fragment[3] != 0)) { 1109 (S3I(s)->handshake_fragment[3] != 0)) {
1110 al = SSL_AD_DECODE_ERROR; 1110 al = SSL_AD_DECODE_ERROR;
1111 SSLerr(SSL_F_SSL3_READ_BYTES, SSL_R_BAD_HELLO_REQUEST); 1111 SSLerror(SSL_R_BAD_HELLO_REQUEST);
1112 goto f_err; 1112 goto f_err;
1113 } 1113 }
1114 1114
@@ -1126,7 +1126,7 @@ start:
1126 if (i < 0) 1126 if (i < 0)
1127 return (i); 1127 return (i);
1128 if (i == 0) { 1128 if (i == 0) {
1129 SSLerr(SSL_F_SSL3_READ_BYTES, 1129 SSLerror(
1130 SSL_R_SSL_HANDSHAKE_FAILURE); 1130 SSL_R_SSL_HANDSHAKE_FAILURE);
1131 return (-1); 1131 return (-1);
1132 } 1132 }
@@ -1200,14 +1200,14 @@ start:
1200 */ 1200 */
1201 else if (alert_descr == SSL_AD_NO_RENEGOTIATION) { 1201 else if (alert_descr == SSL_AD_NO_RENEGOTIATION) {
1202 al = SSL_AD_HANDSHAKE_FAILURE; 1202 al = SSL_AD_HANDSHAKE_FAILURE;
1203 SSLerr(SSL_F_SSL3_READ_BYTES, 1203 SSLerror(
1204 SSL_R_NO_RENEGOTIATION); 1204 SSL_R_NO_RENEGOTIATION);
1205 goto f_err; 1205 goto f_err;
1206 } 1206 }
1207 } else if (alert_level == SSL3_AL_FATAL) { 1207 } else if (alert_level == SSL3_AL_FATAL) {
1208 s->internal->rwstate = SSL_NOTHING; 1208 s->internal->rwstate = SSL_NOTHING;
1209 S3I(s)->fatal_alert = alert_descr; 1209 S3I(s)->fatal_alert = alert_descr;
1210 SSLerr(SSL_F_SSL3_READ_BYTES, 1210 SSLerror(
1211 SSL_AD_REASON_OFFSET + alert_descr); 1211 SSL_AD_REASON_OFFSET + alert_descr);
1212 ERR_asprintf_error_data("SSL alert number %d", 1212 ERR_asprintf_error_data("SSL alert number %d",
1213 alert_descr); 1213 alert_descr);
@@ -1216,7 +1216,7 @@ start:
1216 return (0); 1216 return (0);
1217 } else { 1217 } else {
1218 al = SSL_AD_ILLEGAL_PARAMETER; 1218 al = SSL_AD_ILLEGAL_PARAMETER;
1219 SSLerr(SSL_F_SSL3_READ_BYTES, SSL_R_UNKNOWN_ALERT_TYPE); 1219 SSLerror(SSL_R_UNKNOWN_ALERT_TYPE);
1220 goto f_err; 1220 goto f_err;
1221 } 1221 }
1222 1222
@@ -1236,7 +1236,7 @@ start:
1236 if ((rr->length != 1) || (rr->off != 0) || 1236 if ((rr->length != 1) || (rr->off != 0) ||
1237 (rr->data[0] != SSL3_MT_CCS)) { 1237 (rr->data[0] != SSL3_MT_CCS)) {
1238 al = SSL_AD_ILLEGAL_PARAMETER; 1238 al = SSL_AD_ILLEGAL_PARAMETER;
1239 SSLerr(SSL_F_SSL3_READ_BYTES, 1239 SSLerror(
1240 SSL_R_BAD_CHANGE_CIPHER_SPEC); 1240 SSL_R_BAD_CHANGE_CIPHER_SPEC);
1241 goto f_err; 1241 goto f_err;
1242 } 1242 }
@@ -1244,7 +1244,7 @@ start:
1244 /* Check we have a cipher to change to */ 1244 /* Check we have a cipher to change to */
1245 if (S3I(s)->tmp.new_cipher == NULL) { 1245 if (S3I(s)->tmp.new_cipher == NULL) {
1246 al = SSL_AD_UNEXPECTED_MESSAGE; 1246 al = SSL_AD_UNEXPECTED_MESSAGE;
1247 SSLerr(SSL_F_SSL3_READ_BYTES, 1247 SSLerror(
1248 SSL_R_CCS_RECEIVED_EARLY); 1248 SSL_R_CCS_RECEIVED_EARLY);
1249 goto f_err; 1249 goto f_err;
1250 } 1250 }
@@ -1252,7 +1252,7 @@ start:
1252 /* Check that we should be receiving a Change Cipher Spec. */ 1252 /* Check that we should be receiving a Change Cipher Spec. */
1253 if (!(s->s3->flags & SSL3_FLAGS_CCS_OK)) { 1253 if (!(s->s3->flags & SSL3_FLAGS_CCS_OK)) {
1254 al = SSL_AD_UNEXPECTED_MESSAGE; 1254 al = SSL_AD_UNEXPECTED_MESSAGE;
1255 SSLerr(SSL_F_SSL3_READ_BYTES, 1255 SSLerror(
1256 SSL_R_CCS_RECEIVED_EARLY); 1256 SSL_R_CCS_RECEIVED_EARLY);
1257 goto f_err; 1257 goto f_err;
1258 } 1258 }
@@ -1285,7 +1285,7 @@ start:
1285 if (i < 0) 1285 if (i < 0)
1286 return (i); 1286 return (i);
1287 if (i == 0) { 1287 if (i == 0) {
1288 SSLerr(SSL_F_SSL3_READ_BYTES, 1288 SSLerror(
1289 SSL_R_SSL_HANDSHAKE_FAILURE); 1289 SSL_R_SSL_HANDSHAKE_FAILURE);
1290 return (-1); 1290 return (-1);
1291 } 1291 }
@@ -1315,7 +1315,7 @@ start:
1315 goto start; 1315 goto start;
1316 } 1316 }
1317 al = SSL_AD_UNEXPECTED_MESSAGE; 1317 al = SSL_AD_UNEXPECTED_MESSAGE;
1318 SSLerr(SSL_F_SSL3_READ_BYTES, SSL_R_UNEXPECTED_RECORD); 1318 SSLerror(SSL_R_UNEXPECTED_RECORD);
1319 goto f_err; 1319 goto f_err;
1320 case SSL3_RT_CHANGE_CIPHER_SPEC: 1320 case SSL3_RT_CHANGE_CIPHER_SPEC:
1321 case SSL3_RT_ALERT: 1321 case SSL3_RT_ALERT:
@@ -1324,7 +1324,7 @@ start:
1324 * of SSL3_RT_HANDSHAKE when s->internal->in_handshake is set, but that 1324 * of SSL3_RT_HANDSHAKE when s->internal->in_handshake is set, but that
1325 * should not happen when type != rr->type */ 1325 * should not happen when type != rr->type */
1326 al = SSL_AD_UNEXPECTED_MESSAGE; 1326 al = SSL_AD_UNEXPECTED_MESSAGE;
1327 SSLerr(SSL_F_SSL3_READ_BYTES, ERR_R_INTERNAL_ERROR); 1327 SSLerror(ERR_R_INTERNAL_ERROR);
1328 goto f_err; 1328 goto f_err;
1329 case SSL3_RT_APPLICATION_DATA: 1329 case SSL3_RT_APPLICATION_DATA:
1330 /* At this point, we were expecting handshake data, 1330 /* At this point, we were expecting handshake data,
@@ -1346,7 +1346,7 @@ start:
1346 return (-1); 1346 return (-1);
1347 } else { 1347 } else {
1348 al = SSL_AD_UNEXPECTED_MESSAGE; 1348 al = SSL_AD_UNEXPECTED_MESSAGE;
1349 SSLerr(SSL_F_SSL3_READ_BYTES, SSL_R_UNEXPECTED_RECORD); 1349 SSLerror(SSL_R_UNEXPECTED_RECORD);
1350 goto f_err; 1350 goto f_err;
1351 } 1351 }
1352 } 1352 }
@@ -1373,7 +1373,7 @@ ssl3_do_change_cipher_spec(SSL *s)
1373 if (S3I(s)->tmp.key_block == NULL) { 1373 if (S3I(s)->tmp.key_block == NULL) {
1374 if (s->session == NULL || s->session->master_key_length == 0) { 1374 if (s->session == NULL || s->session->master_key_length == 0) {
1375 /* might happen if dtls1_read_bytes() calls this */ 1375 /* might happen if dtls1_read_bytes() calls this */
1376 SSLerr(SSL_F_SSL3_DO_CHANGE_CIPHER_SPEC, 1376 SSLerror(
1377 SSL_R_CCS_RECEIVED_EARLY); 1377 SSL_R_CCS_RECEIVED_EARLY);
1378 return (0); 1378 return (0);
1379 } 1379 }
@@ -1400,7 +1400,7 @@ ssl3_do_change_cipher_spec(SSL *s)
1400 i = tls1_final_finish_mac(s, sender, slen, 1400 i = tls1_final_finish_mac(s, sender, slen,
1401 S3I(s)->tmp.peer_finish_md); 1401 S3I(s)->tmp.peer_finish_md);
1402 if (i == 0) { 1402 if (i == 0) {
1403 SSLerr(SSL_F_SSL3_DO_CHANGE_CIPHER_SPEC, ERR_R_INTERNAL_ERROR); 1403 SSLerror(ERR_R_INTERNAL_ERROR);
1404 return 0; 1404 return 0;
1405 } 1405 }
1406 S3I(s)->tmp.peer_finish_md_len = i; 1406 S3I(s)->tmp.peer_finish_md_len = i;
diff --git a/src/lib/libssl/ssl_rsa.c b/src/lib/libssl/ssl_rsa.c
index 03eedc0d8a..3efed227f0 100644
--- a/src/lib/libssl/ssl_rsa.c
+++ b/src/lib/libssl/ssl_rsa.c
@@ -1,4 +1,4 @@
1/* $OpenBSD: ssl_rsa.c,v 1.25 2017/01/24 14:57:31 jsing Exp $ */ 1/* $OpenBSD: ssl_rsa.c,v 1.26 2017/01/26 10:40:21 beck Exp $ */
2/* Copyright (C) 1995-1998 Eric Young (eay@cryptsoft.com) 2/* Copyright (C) 1995-1998 Eric Young (eay@cryptsoft.com)
3 * All rights reserved. 3 * All rights reserved.
4 * 4 *
@@ -74,11 +74,11 @@ int
74SSL_use_certificate(SSL *ssl, X509 *x) 74SSL_use_certificate(SSL *ssl, X509 *x)
75{ 75{
76 if (x == NULL) { 76 if (x == NULL) {
77 SSLerr(SSL_F_SSL_USE_CERTIFICATE, ERR_R_PASSED_NULL_PARAMETER); 77 SSLerror(ERR_R_PASSED_NULL_PARAMETER);
78 return (0); 78 return (0);
79 } 79 }
80 if (!ssl_cert_inst(&ssl->cert)) { 80 if (!ssl_cert_inst(&ssl->cert)) {
81 SSLerr(SSL_F_SSL_USE_CERTIFICATE, ERR_R_MALLOC_FAILURE); 81 SSLerror(ERR_R_MALLOC_FAILURE);
82 return (0); 82 return (0);
83 } 83 }
84 return (ssl_set_cert(ssl->cert, x)); 84 return (ssl_set_cert(ssl->cert, x));
@@ -94,12 +94,12 @@ SSL_use_certificate_file(SSL *ssl, const char *file, int type)
94 94
95 in = BIO_new(BIO_s_file_internal()); 95 in = BIO_new(BIO_s_file_internal());
96 if (in == NULL) { 96 if (in == NULL) {
97 SSLerr(SSL_F_SSL_USE_CERTIFICATE_FILE, ERR_R_BUF_LIB); 97 SSLerror(ERR_R_BUF_LIB);
98 goto end; 98 goto end;
99 } 99 }
100 100
101 if (BIO_read_filename(in, file) <= 0) { 101 if (BIO_read_filename(in, file) <= 0) {
102 SSLerr(SSL_F_SSL_USE_CERTIFICATE_FILE, ERR_R_SYS_LIB); 102 SSLerror(ERR_R_SYS_LIB);
103 goto end; 103 goto end;
104 } 104 }
105 if (type == SSL_FILETYPE_ASN1) { 105 if (type == SSL_FILETYPE_ASN1) {
@@ -111,12 +111,12 @@ SSL_use_certificate_file(SSL *ssl, const char *file, int type)
111 ssl->ctx->default_passwd_callback, 111 ssl->ctx->default_passwd_callback,
112 ssl->ctx->default_passwd_callback_userdata); 112 ssl->ctx->default_passwd_callback_userdata);
113 } else { 113 } else {
114 SSLerr(SSL_F_SSL_USE_CERTIFICATE_FILE, SSL_R_BAD_SSL_FILETYPE); 114 SSLerror(SSL_R_BAD_SSL_FILETYPE);
115 goto end; 115 goto end;
116 } 116 }
117 117
118 if (x == NULL) { 118 if (x == NULL) {
119 SSLerr(SSL_F_SSL_USE_CERTIFICATE_FILE, j); 119 SSLerror(j);
120 goto end; 120 goto end;
121 } 121 }
122 122
@@ -135,7 +135,7 @@ SSL_use_certificate_ASN1(SSL *ssl, const unsigned char *d, int len)
135 135
136 x = d2i_X509(NULL, &d,(long)len); 136 x = d2i_X509(NULL, &d,(long)len);
137 if (x == NULL) { 137 if (x == NULL) {
138 SSLerr(SSL_F_SSL_USE_CERTIFICATE_ASN1, ERR_R_ASN1_LIB); 138 SSLerror(ERR_R_ASN1_LIB);
139 return (0); 139 return (0);
140 } 140 }
141 141
@@ -151,15 +151,15 @@ SSL_use_RSAPrivateKey(SSL *ssl, RSA *rsa)
151 int ret; 151 int ret;
152 152
153 if (rsa == NULL) { 153 if (rsa == NULL) {
154 SSLerr(SSL_F_SSL_USE_RSAPRIVATEKEY, ERR_R_PASSED_NULL_PARAMETER); 154 SSLerror(ERR_R_PASSED_NULL_PARAMETER);
155 return (0); 155 return (0);
156 } 156 }
157 if (!ssl_cert_inst(&ssl->cert)) { 157 if (!ssl_cert_inst(&ssl->cert)) {
158 SSLerr(SSL_F_SSL_USE_RSAPRIVATEKEY, ERR_R_MALLOC_FAILURE); 158 SSLerror(ERR_R_MALLOC_FAILURE);
159 return (0); 159 return (0);
160 } 160 }
161 if ((pkey = EVP_PKEY_new()) == NULL) { 161 if ((pkey = EVP_PKEY_new()) == NULL) {
162 SSLerr(SSL_F_SSL_USE_RSAPRIVATEKEY, ERR_R_EVP_LIB); 162 SSLerror(ERR_R_EVP_LIB);
163 return (0); 163 return (0);
164 } 164 }
165 165
@@ -178,7 +178,7 @@ ssl_set_pkey(CERT *c, EVP_PKEY *pkey)
178 178
179 i = ssl_cert_type(NULL, pkey); 179 i = ssl_cert_type(NULL, pkey);
180 if (i < 0) { 180 if (i < 0) {
181 SSLerr(SSL_F_SSL_SET_PKEY, SSL_R_UNKNOWN_CERTIFICATE_TYPE); 181 SSLerror(SSL_R_UNKNOWN_CERTIFICATE_TYPE);
182 return (0); 182 return (0);
183 } 183 }
184 184
@@ -222,12 +222,12 @@ SSL_use_RSAPrivateKey_file(SSL *ssl, const char *file, int type)
222 222
223 in = BIO_new(BIO_s_file_internal()); 223 in = BIO_new(BIO_s_file_internal());
224 if (in == NULL) { 224 if (in == NULL) {
225 SSLerr(SSL_F_SSL_USE_RSAPRIVATEKEY_FILE, ERR_R_BUF_LIB); 225 SSLerror(ERR_R_BUF_LIB);
226 goto end; 226 goto end;
227 } 227 }
228 228
229 if (BIO_read_filename(in, file) <= 0) { 229 if (BIO_read_filename(in, file) <= 0) {
230 SSLerr(SSL_F_SSL_USE_RSAPRIVATEKEY_FILE, ERR_R_SYS_LIB); 230 SSLerror(ERR_R_SYS_LIB);
231 goto end; 231 goto end;
232 } 232 }
233 if (type == SSL_FILETYPE_ASN1) { 233 if (type == SSL_FILETYPE_ASN1) {
@@ -239,11 +239,11 @@ SSL_use_RSAPrivateKey_file(SSL *ssl, const char *file, int type)
239 ssl->ctx->default_passwd_callback, 239 ssl->ctx->default_passwd_callback,
240 ssl->ctx->default_passwd_callback_userdata); 240 ssl->ctx->default_passwd_callback_userdata);
241 } else { 241 } else {
242 SSLerr(SSL_F_SSL_USE_RSAPRIVATEKEY_FILE, SSL_R_BAD_SSL_FILETYPE); 242 SSLerror(SSL_R_BAD_SSL_FILETYPE);
243 goto end; 243 goto end;
244 } 244 }
245 if (rsa == NULL) { 245 if (rsa == NULL) {
246 SSLerr(SSL_F_SSL_USE_RSAPRIVATEKEY_FILE, j); 246 SSLerror(j);
247 goto end; 247 goto end;
248 } 248 }
249 ret = SSL_use_RSAPrivateKey(ssl, rsa); 249 ret = SSL_use_RSAPrivateKey(ssl, rsa);
@@ -262,7 +262,7 @@ SSL_use_RSAPrivateKey_ASN1(SSL *ssl, unsigned char *d, long len)
262 262
263 p = d; 263 p = d;
264 if ((rsa = d2i_RSAPrivateKey(NULL, &p,(long)len)) == NULL) { 264 if ((rsa = d2i_RSAPrivateKey(NULL, &p,(long)len)) == NULL) {
265 SSLerr(SSL_F_SSL_USE_RSAPRIVATEKEY_ASN1, ERR_R_ASN1_LIB); 265 SSLerror(ERR_R_ASN1_LIB);
266 return (0); 266 return (0);
267 } 267 }
268 268
@@ -277,11 +277,11 @@ SSL_use_PrivateKey(SSL *ssl, EVP_PKEY *pkey)
277 int ret; 277 int ret;
278 278
279 if (pkey == NULL) { 279 if (pkey == NULL) {
280 SSLerr(SSL_F_SSL_USE_PRIVATEKEY, ERR_R_PASSED_NULL_PARAMETER); 280 SSLerror(ERR_R_PASSED_NULL_PARAMETER);
281 return (0); 281 return (0);
282 } 282 }
283 if (!ssl_cert_inst(&ssl->cert)) { 283 if (!ssl_cert_inst(&ssl->cert)) {
284 SSLerr(SSL_F_SSL_USE_PRIVATEKEY, ERR_R_MALLOC_FAILURE); 284 SSLerror(ERR_R_MALLOC_FAILURE);
285 return (0); 285 return (0);
286 } 286 }
287 ret = ssl_set_pkey(ssl->cert, pkey); 287 ret = ssl_set_pkey(ssl->cert, pkey);
@@ -297,12 +297,12 @@ SSL_use_PrivateKey_file(SSL *ssl, const char *file, int type)
297 297
298 in = BIO_new(BIO_s_file_internal()); 298 in = BIO_new(BIO_s_file_internal());
299 if (in == NULL) { 299 if (in == NULL) {
300 SSLerr(SSL_F_SSL_USE_PRIVATEKEY_FILE, ERR_R_BUF_LIB); 300 SSLerror(ERR_R_BUF_LIB);
301 goto end; 301 goto end;
302 } 302 }
303 303
304 if (BIO_read_filename(in, file) <= 0) { 304 if (BIO_read_filename(in, file) <= 0) {
305 SSLerr(SSL_F_SSL_USE_PRIVATEKEY_FILE, ERR_R_SYS_LIB); 305 SSLerror(ERR_R_SYS_LIB);
306 goto end; 306 goto end;
307 } 307 }
308 if (type == SSL_FILETYPE_PEM) { 308 if (type == SSL_FILETYPE_PEM) {
@@ -314,11 +314,11 @@ SSL_use_PrivateKey_file(SSL *ssl, const char *file, int type)
314 j = ERR_R_ASN1_LIB; 314 j = ERR_R_ASN1_LIB;
315 pkey = d2i_PrivateKey_bio(in, NULL); 315 pkey = d2i_PrivateKey_bio(in, NULL);
316 } else { 316 } else {
317 SSLerr(SSL_F_SSL_USE_PRIVATEKEY_FILE, SSL_R_BAD_SSL_FILETYPE); 317 SSLerror(SSL_R_BAD_SSL_FILETYPE);
318 goto end; 318 goto end;
319 } 319 }
320 if (pkey == NULL) { 320 if (pkey == NULL) {
321 SSLerr(SSL_F_SSL_USE_PRIVATEKEY_FILE, j); 321 SSLerror(j);
322 goto end; 322 goto end;
323 } 323 }
324 ret = SSL_use_PrivateKey(ssl, pkey); 324 ret = SSL_use_PrivateKey(ssl, pkey);
@@ -337,7 +337,7 @@ SSL_use_PrivateKey_ASN1(int type, SSL *ssl, const unsigned char *d, long len)
337 337
338 p = d; 338 p = d;
339 if ((pkey = d2i_PrivateKey(type, NULL, &p,(long)len)) == NULL) { 339 if ((pkey = d2i_PrivateKey(type, NULL, &p,(long)len)) == NULL) {
340 SSLerr(SSL_F_SSL_USE_PRIVATEKEY_ASN1, ERR_R_ASN1_LIB); 340 SSLerror(ERR_R_ASN1_LIB);
341 return (0); 341 return (0);
342 } 342 }
343 343
@@ -350,11 +350,11 @@ int
350SSL_CTX_use_certificate(SSL_CTX *ctx, X509 *x) 350SSL_CTX_use_certificate(SSL_CTX *ctx, X509 *x)
351{ 351{
352 if (x == NULL) { 352 if (x == NULL) {
353 SSLerr(SSL_F_SSL_CTX_USE_CERTIFICATE, ERR_R_PASSED_NULL_PARAMETER); 353 SSLerror(ERR_R_PASSED_NULL_PARAMETER);
354 return (0); 354 return (0);
355 } 355 }
356 if (!ssl_cert_inst(&ctx->internal->cert)) { 356 if (!ssl_cert_inst(&ctx->internal->cert)) {
357 SSLerr(SSL_F_SSL_CTX_USE_CERTIFICATE, ERR_R_MALLOC_FAILURE); 357 SSLerror(ERR_R_MALLOC_FAILURE);
358 return (0); 358 return (0);
359 } 359 }
360 return (ssl_set_cert(ctx->internal->cert, x)); 360 return (ssl_set_cert(ctx->internal->cert, x));
@@ -368,13 +368,13 @@ ssl_set_cert(CERT *c, X509 *x)
368 368
369 pkey = X509_get_pubkey(x); 369 pkey = X509_get_pubkey(x);
370 if (pkey == NULL) { 370 if (pkey == NULL) {
371 SSLerr(SSL_F_SSL_SET_CERT, SSL_R_X509_LIB); 371 SSLerror(SSL_R_X509_LIB);
372 return (0); 372 return (0);
373 } 373 }
374 374
375 i = ssl_cert_type(x, pkey); 375 i = ssl_cert_type(x, pkey);
376 if (i < 0) { 376 if (i < 0) {
377 SSLerr(SSL_F_SSL_SET_CERT, SSL_R_UNKNOWN_CERTIFICATE_TYPE); 377 SSLerror(SSL_R_UNKNOWN_CERTIFICATE_TYPE);
378 EVP_PKEY_free(pkey); 378 EVP_PKEY_free(pkey);
379 return (0); 379 return (0);
380 } 380 }
@@ -427,12 +427,12 @@ SSL_CTX_use_certificate_file(SSL_CTX *ctx, const char *file, int type)
427 427
428 in = BIO_new(BIO_s_file_internal()); 428 in = BIO_new(BIO_s_file_internal());
429 if (in == NULL) { 429 if (in == NULL) {
430 SSLerr(SSL_F_SSL_CTX_USE_CERTIFICATE_FILE, ERR_R_BUF_LIB); 430 SSLerror(ERR_R_BUF_LIB);
431 goto end; 431 goto end;
432 } 432 }
433 433
434 if (BIO_read_filename(in, file) <= 0) { 434 if (BIO_read_filename(in, file) <= 0) {
435 SSLerr(SSL_F_SSL_CTX_USE_CERTIFICATE_FILE, ERR_R_SYS_LIB); 435 SSLerror(ERR_R_SYS_LIB);
436 goto end; 436 goto end;
437 } 437 }
438 if (type == SSL_FILETYPE_ASN1) { 438 if (type == SSL_FILETYPE_ASN1) {
@@ -443,12 +443,12 @@ SSL_CTX_use_certificate_file(SSL_CTX *ctx, const char *file, int type)
443 x = PEM_read_bio_X509(in, NULL, ctx->default_passwd_callback, 443 x = PEM_read_bio_X509(in, NULL, ctx->default_passwd_callback,
444 ctx->default_passwd_callback_userdata); 444 ctx->default_passwd_callback_userdata);
445 } else { 445 } else {
446 SSLerr(SSL_F_SSL_CTX_USE_CERTIFICATE_FILE, SSL_R_BAD_SSL_FILETYPE); 446 SSLerror(SSL_R_BAD_SSL_FILETYPE);
447 goto end; 447 goto end;
448 } 448 }
449 449
450 if (x == NULL) { 450 if (x == NULL) {
451 SSLerr(SSL_F_SSL_CTX_USE_CERTIFICATE_FILE, j); 451 SSLerror(j);
452 goto end; 452 goto end;
453 } 453 }
454 454
@@ -467,7 +467,7 @@ SSL_CTX_use_certificate_ASN1(SSL_CTX *ctx, int len, const unsigned char *d)
467 467
468 x = d2i_X509(NULL, &d,(long)len); 468 x = d2i_X509(NULL, &d,(long)len);
469 if (x == NULL) { 469 if (x == NULL) {
470 SSLerr(SSL_F_SSL_CTX_USE_CERTIFICATE_ASN1, ERR_R_ASN1_LIB); 470 SSLerror(ERR_R_ASN1_LIB);
471 return (0); 471 return (0);
472 } 472 }
473 473
@@ -483,15 +483,15 @@ SSL_CTX_use_RSAPrivateKey(SSL_CTX *ctx, RSA *rsa)
483 EVP_PKEY *pkey; 483 EVP_PKEY *pkey;
484 484
485 if (rsa == NULL) { 485 if (rsa == NULL) {
486 SSLerr(SSL_F_SSL_CTX_USE_RSAPRIVATEKEY, ERR_R_PASSED_NULL_PARAMETER); 486 SSLerror(ERR_R_PASSED_NULL_PARAMETER);
487 return (0); 487 return (0);
488 } 488 }
489 if (!ssl_cert_inst(&ctx->internal->cert)) { 489 if (!ssl_cert_inst(&ctx->internal->cert)) {
490 SSLerr(SSL_F_SSL_CTX_USE_RSAPRIVATEKEY, ERR_R_MALLOC_FAILURE); 490 SSLerror(ERR_R_MALLOC_FAILURE);
491 return (0); 491 return (0);
492 } 492 }
493 if ((pkey = EVP_PKEY_new()) == NULL) { 493 if ((pkey = EVP_PKEY_new()) == NULL) {
494 SSLerr(SSL_F_SSL_CTX_USE_RSAPRIVATEKEY, ERR_R_EVP_LIB); 494 SSLerror(ERR_R_EVP_LIB);
495 return (0); 495 return (0);
496 } 496 }
497 497
@@ -512,12 +512,12 @@ SSL_CTX_use_RSAPrivateKey_file(SSL_CTX *ctx, const char *file, int type)
512 512
513 in = BIO_new(BIO_s_file_internal()); 513 in = BIO_new(BIO_s_file_internal());
514 if (in == NULL) { 514 if (in == NULL) {
515 SSLerr(SSL_F_SSL_CTX_USE_RSAPRIVATEKEY_FILE, ERR_R_BUF_LIB); 515 SSLerror(ERR_R_BUF_LIB);
516 goto end; 516 goto end;
517 } 517 }
518 518
519 if (BIO_read_filename(in, file) <= 0) { 519 if (BIO_read_filename(in, file) <= 0) {
520 SSLerr(SSL_F_SSL_CTX_USE_RSAPRIVATEKEY_FILE, ERR_R_SYS_LIB); 520 SSLerror(ERR_R_SYS_LIB);
521 goto end; 521 goto end;
522 } 522 }
523 if (type == SSL_FILETYPE_ASN1) { 523 if (type == SSL_FILETYPE_ASN1) {
@@ -529,11 +529,11 @@ SSL_CTX_use_RSAPrivateKey_file(SSL_CTX *ctx, const char *file, int type)
529 ctx->default_passwd_callback, 529 ctx->default_passwd_callback,
530 ctx->default_passwd_callback_userdata); 530 ctx->default_passwd_callback_userdata);
531 } else { 531 } else {
532 SSLerr(SSL_F_SSL_CTX_USE_RSAPRIVATEKEY_FILE, SSL_R_BAD_SSL_FILETYPE); 532 SSLerror(SSL_R_BAD_SSL_FILETYPE);
533 goto end; 533 goto end;
534 } 534 }
535 if (rsa == NULL) { 535 if (rsa == NULL) {
536 SSLerr(SSL_F_SSL_CTX_USE_RSAPRIVATEKEY_FILE, j); 536 SSLerror(j);
537 goto end; 537 goto end;
538 } 538 }
539 ret = SSL_CTX_use_RSAPrivateKey(ctx, rsa); 539 ret = SSL_CTX_use_RSAPrivateKey(ctx, rsa);
@@ -552,7 +552,7 @@ SSL_CTX_use_RSAPrivateKey_ASN1(SSL_CTX *ctx, const unsigned char *d, long len)
552 552
553 p = d; 553 p = d;
554 if ((rsa = d2i_RSAPrivateKey(NULL, &p,(long)len)) == NULL) { 554 if ((rsa = d2i_RSAPrivateKey(NULL, &p,(long)len)) == NULL) {
555 SSLerr(SSL_F_SSL_CTX_USE_RSAPRIVATEKEY_ASN1, ERR_R_ASN1_LIB); 555 SSLerror(ERR_R_ASN1_LIB);
556 return (0); 556 return (0);
557 } 557 }
558 558
@@ -565,12 +565,12 @@ int
565SSL_CTX_use_PrivateKey(SSL_CTX *ctx, EVP_PKEY *pkey) 565SSL_CTX_use_PrivateKey(SSL_CTX *ctx, EVP_PKEY *pkey)
566{ 566{
567 if (pkey == NULL) { 567 if (pkey == NULL) {
568 SSLerr(SSL_F_SSL_CTX_USE_PRIVATEKEY, 568 SSLerror(
569 ERR_R_PASSED_NULL_PARAMETER); 569 ERR_R_PASSED_NULL_PARAMETER);
570 return (0); 570 return (0);
571 } 571 }
572 if (!ssl_cert_inst(&ctx->internal->cert)) { 572 if (!ssl_cert_inst(&ctx->internal->cert)) {
573 SSLerr(SSL_F_SSL_CTX_USE_PRIVATEKEY, ERR_R_MALLOC_FAILURE); 573 SSLerror(ERR_R_MALLOC_FAILURE);
574 return (0); 574 return (0);
575 } 575 }
576 return (ssl_set_pkey(ctx->internal->cert, pkey)); 576 return (ssl_set_pkey(ctx->internal->cert, pkey));
@@ -585,12 +585,12 @@ SSL_CTX_use_PrivateKey_file(SSL_CTX *ctx, const char *file, int type)
585 585
586 in = BIO_new(BIO_s_file_internal()); 586 in = BIO_new(BIO_s_file_internal());
587 if (in == NULL) { 587 if (in == NULL) {
588 SSLerr(SSL_F_SSL_CTX_USE_PRIVATEKEY_FILE, ERR_R_BUF_LIB); 588 SSLerror(ERR_R_BUF_LIB);
589 goto end; 589 goto end;
590 } 590 }
591 591
592 if (BIO_read_filename(in, file) <= 0) { 592 if (BIO_read_filename(in, file) <= 0) {
593 SSLerr(SSL_F_SSL_CTX_USE_PRIVATEKEY_FILE, ERR_R_SYS_LIB); 593 SSLerror(ERR_R_SYS_LIB);
594 goto end; 594 goto end;
595 } 595 }
596 if (type == SSL_FILETYPE_PEM) { 596 if (type == SSL_FILETYPE_PEM) {
@@ -602,12 +602,12 @@ SSL_CTX_use_PrivateKey_file(SSL_CTX *ctx, const char *file, int type)
602 j = ERR_R_ASN1_LIB; 602 j = ERR_R_ASN1_LIB;
603 pkey = d2i_PrivateKey_bio(in, NULL); 603 pkey = d2i_PrivateKey_bio(in, NULL);
604 } else { 604 } else {
605 SSLerr(SSL_F_SSL_CTX_USE_PRIVATEKEY_FILE, 605 SSLerror(
606 SSL_R_BAD_SSL_FILETYPE); 606 SSL_R_BAD_SSL_FILETYPE);
607 goto end; 607 goto end;
608 } 608 }
609 if (pkey == NULL) { 609 if (pkey == NULL) {
610 SSLerr(SSL_F_SSL_CTX_USE_PRIVATEKEY_FILE, j); 610 SSLerror(j);
611 goto end; 611 goto end;
612 } 612 }
613 ret = SSL_CTX_use_PrivateKey(ctx, pkey); 613 ret = SSL_CTX_use_PrivateKey(ctx, pkey);
@@ -627,7 +627,7 @@ SSL_CTX_use_PrivateKey_ASN1(int type, SSL_CTX *ctx, const unsigned char *d,
627 627
628 p = d; 628 p = d;
629 if ((pkey = d2i_PrivateKey(type, NULL, &p,(long)len)) == NULL) { 629 if ((pkey = d2i_PrivateKey(type, NULL, &p,(long)len)) == NULL) {
630 SSLerr(SSL_F_SSL_CTX_USE_PRIVATEKEY_ASN1, ERR_R_ASN1_LIB); 630 SSLerror(ERR_R_ASN1_LIB);
631 return (0); 631 return (0);
632 } 632 }
633 633
@@ -653,7 +653,7 @@ ssl_ctx_use_certificate_chain_bio(SSL_CTX *ctx, BIO *in)
653 x = PEM_read_bio_X509_AUX(in, NULL, ctx->default_passwd_callback, 653 x = PEM_read_bio_X509_AUX(in, NULL, ctx->default_passwd_callback,
654 ctx->default_passwd_callback_userdata); 654 ctx->default_passwd_callback_userdata);
655 if (x == NULL) { 655 if (x == NULL) {
656 SSLerr(SSL_F_SSL_CTX_USE_CERTIFICATE_CHAIN_FILE, ERR_R_PEM_LIB); 656 SSLerror(ERR_R_PEM_LIB);
657 goto end; 657 goto end;
658 } 658 }
659 659
@@ -713,12 +713,12 @@ SSL_CTX_use_certificate_chain_file(SSL_CTX *ctx, const char *file)
713 713
714 in = BIO_new(BIO_s_file_internal()); 714 in = BIO_new(BIO_s_file_internal());
715 if (in == NULL) { 715 if (in == NULL) {
716 SSLerr(SSL_F_SSL_CTX_USE_CERTIFICATE_CHAIN_FILE, ERR_R_BUF_LIB); 716 SSLerror(ERR_R_BUF_LIB);
717 goto end; 717 goto end;
718 } 718 }
719 719
720 if (BIO_read_filename(in, file) <= 0) { 720 if (BIO_read_filename(in, file) <= 0) {
721 SSLerr(SSL_F_SSL_CTX_USE_CERTIFICATE_CHAIN_FILE, ERR_R_SYS_LIB); 721 SSLerror(ERR_R_SYS_LIB);
722 goto end; 722 goto end;
723 } 723 }
724 724
@@ -737,7 +737,7 @@ SSL_CTX_use_certificate_chain_mem(SSL_CTX *ctx, void *buf, int len)
737 737
738 in = BIO_new_mem_buf(buf, len); 738 in = BIO_new_mem_buf(buf, len);
739 if (in == NULL) { 739 if (in == NULL) {
740 SSLerr(SSL_F_SSL_CTX_USE_CERTIFICATE_CHAIN_FILE, ERR_R_BUF_LIB); 740 SSLerror(ERR_R_BUF_LIB);
741 goto end; 741 goto end;
742 } 742 }
743 743
diff --git a/src/lib/libssl/ssl_sess.c b/src/lib/libssl/ssl_sess.c
index 8c802b170e..5cd531ef59 100644
--- a/src/lib/libssl/ssl_sess.c
+++ b/src/lib/libssl/ssl_sess.c
@@ -1,4 +1,4 @@
1/* $OpenBSD: ssl_sess.c,v 1.67 2017/01/24 09:03:21 jsing Exp $ */ 1/* $OpenBSD: ssl_sess.c,v 1.68 2017/01/26 10:40:21 beck Exp $ */
2/* Copyright (C) 1995-1998 Eric Young (eay@cryptsoft.com) 2/* Copyright (C) 1995-1998 Eric Young (eay@cryptsoft.com)
3 * All rights reserved. 3 * All rights reserved.
4 * 4 *
@@ -200,12 +200,12 @@ SSL_SESSION_new(void)
200 SSL_SESSION *ss; 200 SSL_SESSION *ss;
201 201
202 if ((ss = calloc(1, sizeof(*ss))) == NULL) { 202 if ((ss = calloc(1, sizeof(*ss))) == NULL) {
203 SSLerr(SSL_F_SSL_SESSION_NEW, ERR_R_MALLOC_FAILURE); 203 SSLerror(ERR_R_MALLOC_FAILURE);
204 return (NULL); 204 return (NULL);
205 } 205 }
206 if ((ss->internal = calloc(1, sizeof(*ss->internal))) == NULL) { 206 if ((ss->internal = calloc(1, sizeof(*ss->internal))) == NULL) {
207 free(ss); 207 free(ss);
208 SSLerr(SSL_F_SSL_SESSION_NEW, ERR_R_MALLOC_FAILURE); 208 SSLerror(ERR_R_MALLOC_FAILURE);
209 return (NULL); 209 return (NULL);
210 } 210 }
211 211
@@ -312,7 +312,7 @@ ssl_get_new_session(SSL *s, int session)
312 ss->session_id_length = SSL3_SSL_SESSION_ID_LENGTH; 312 ss->session_id_length = SSL3_SSL_SESSION_ID_LENGTH;
313 break; 313 break;
314 default: 314 default:
315 SSLerr(SSL_F_SSL_GET_NEW_SESSION, 315 SSLerror(
316 SSL_R_UNSUPPORTED_SSL_VERSION); 316 SSL_R_UNSUPPORTED_SSL_VERSION);
317 SSL_SESSION_free(ss); 317 SSL_SESSION_free(ss);
318 return (0); 318 return (0);
@@ -336,7 +336,7 @@ ssl_get_new_session(SSL *s, int session)
336 tmp = ss->session_id_length; 336 tmp = ss->session_id_length;
337 if (!cb(s, ss->session_id, &tmp)) { 337 if (!cb(s, ss->session_id, &tmp)) {
338 /* The callback failed */ 338 /* The callback failed */
339 SSLerr(SSL_F_SSL_GET_NEW_SESSION, 339 SSLerror(
340 SSL_R_SSL_SESSION_ID_CALLBACK_FAILED); 340 SSL_R_SSL_SESSION_ID_CALLBACK_FAILED);
341 SSL_SESSION_free(ss); 341 SSL_SESSION_free(ss);
342 return (0); 342 return (0);
@@ -348,7 +348,7 @@ ssl_get_new_session(SSL *s, int session)
348 */ 348 */
349 if (!tmp || (tmp > ss->session_id_length)) { 349 if (!tmp || (tmp > ss->session_id_length)) {
350 /* The callback set an illegal length */ 350 /* The callback set an illegal length */
351 SSLerr(SSL_F_SSL_GET_NEW_SESSION, 351 SSLerror(
352 SSL_R_SSL_SESSION_ID_HAS_BAD_LENGTH); 352 SSL_R_SSL_SESSION_ID_HAS_BAD_LENGTH);
353 SSL_SESSION_free(ss); 353 SSL_SESSION_free(ss);
354 return (0); 354 return (0);
@@ -358,7 +358,7 @@ ssl_get_new_session(SSL *s, int session)
358 /* Finally, check for a conflict. */ 358 /* Finally, check for a conflict. */
359 if (SSL_has_matching_session_id(s, ss->session_id, 359 if (SSL_has_matching_session_id(s, ss->session_id,
360 ss->session_id_length)) { 360 ss->session_id_length)) {
361 SSLerr(SSL_F_SSL_GET_NEW_SESSION, 361 SSLerror(
362 SSL_R_SSL_SESSION_ID_CONFLICT); 362 SSL_R_SSL_SESSION_ID_CONFLICT);
363 SSL_SESSION_free(ss); 363 SSL_SESSION_free(ss);
364 return (0); 364 return (0);
@@ -368,7 +368,7 @@ sess_id_done:
368 if (s->tlsext_hostname) { 368 if (s->tlsext_hostname) {
369 ss->tlsext_hostname = strdup(s->tlsext_hostname); 369 ss->tlsext_hostname = strdup(s->tlsext_hostname);
370 if (ss->tlsext_hostname == NULL) { 370 if (ss->tlsext_hostname == NULL) {
371 SSLerr(SSL_F_SSL_GET_NEW_SESSION, 371 SSLerror(
372 ERR_R_INTERNAL_ERROR); 372 ERR_R_INTERNAL_ERROR);
373 SSL_SESSION_free(ss); 373 SSL_SESSION_free(ss);
374 return 0; 374 return 0;
@@ -379,7 +379,7 @@ sess_id_done:
379 } 379 }
380 380
381 if (s->sid_ctx_length > sizeof ss->sid_ctx) { 381 if (s->sid_ctx_length > sizeof ss->sid_ctx) {
382 SSLerr(SSL_F_SSL_GET_NEW_SESSION, ERR_R_INTERNAL_ERROR); 382 SSLerror(ERR_R_INTERNAL_ERROR);
383 SSL_SESSION_free(ss); 383 SSL_SESSION_free(ss);
384 return 0; 384 return 0;
385 } 385 }
@@ -528,7 +528,7 @@ ssl_get_prev_session(SSL *s, unsigned char *session_id, int len,
528 * applications to effectively disable the session cache by 528 * applications to effectively disable the session cache by
529 * accident without anyone noticing). 529 * accident without anyone noticing).
530 */ 530 */
531 SSLerr(SSL_F_SSL_GET_PREV_SESSION, 531 SSLerror(
532 SSL_R_SESSION_ID_CONTEXT_UNINITIALIZED); 532 SSL_R_SESSION_ID_CONTEXT_UNINITIALIZED);
533 fatal = 1; 533 fatal = 1;
534 goto err; 534 goto err;
@@ -729,7 +729,7 @@ SSL_set_session(SSL *s, SSL_SESSION *session)
729 if (meth == NULL) 729 if (meth == NULL)
730 meth = s->method->internal->get_ssl_method(session->ssl_version); 730 meth = s->method->internal->get_ssl_method(session->ssl_version);
731 if (meth == NULL) { 731 if (meth == NULL) {
732 SSLerr(SSL_F_SSL_SET_SESSION, 732 SSLerror(
733 SSL_R_UNABLE_TO_FIND_SSL_METHOD); 733 SSL_R_UNABLE_TO_FIND_SSL_METHOD);
734 return (0); 734 return (0);
735 } 735 }
@@ -810,7 +810,7 @@ SSL_SESSION_set1_id_context(SSL_SESSION *s, const unsigned char *sid_ctx,
810 unsigned int sid_ctx_len) 810 unsigned int sid_ctx_len)
811{ 811{
812 if (sid_ctx_len > SSL_MAX_SID_CTX_LENGTH) { 812 if (sid_ctx_len > SSL_MAX_SID_CTX_LENGTH) {
813 SSLerr(SSL_F_SSL_SESSION_SET1_ID_CONTEXT, 813 SSLerror(
814 SSL_R_SSL_SESSION_ID_CONTEXT_TOO_LONG); 814 SSL_R_SSL_SESSION_ID_CONTEXT_TOO_LONG);
815 return 0; 815 return 0;
816 } 816 }
@@ -872,7 +872,7 @@ SSL_set_session_ticket_ext(SSL *s, void *ext_data, int ext_len)
872 s->internal->tlsext_session_ticket = 872 s->internal->tlsext_session_ticket =
873 malloc(sizeof(TLS_SESSION_TICKET_EXT) + ext_len); 873 malloc(sizeof(TLS_SESSION_TICKET_EXT) + ext_len);
874 if (!s->internal->tlsext_session_ticket) { 874 if (!s->internal->tlsext_session_ticket) {
875 SSLerr(SSL_F_SSL_SET_SESSION_TICKET_EXT, 875 SSLerror(
876 ERR_R_MALLOC_FAILURE); 876 ERR_R_MALLOC_FAILURE);
877 return 0; 877 return 0;
878 } 878 }
@@ -1080,12 +1080,12 @@ int
1080SSL_CTX_set_client_cert_engine(SSL_CTX *ctx, ENGINE *e) 1080SSL_CTX_set_client_cert_engine(SSL_CTX *ctx, ENGINE *e)
1081{ 1081{
1082 if (!ENGINE_init(e)) { 1082 if (!ENGINE_init(e)) {
1083 SSLerr(SSL_F_SSL_CTX_SET_CLIENT_CERT_ENGINE, 1083 SSLerror(
1084 ERR_R_ENGINE_LIB); 1084 ERR_R_ENGINE_LIB);
1085 return 0; 1085 return 0;
1086 } 1086 }
1087 if (!ENGINE_get_ssl_client_cert_function(e)) { 1087 if (!ENGINE_get_ssl_client_cert_function(e)) {
1088 SSLerr(SSL_F_SSL_CTX_SET_CLIENT_CERT_ENGINE, 1088 SSLerror(
1089 SSL_R_NO_CLIENT_CERT_METHOD); 1089 SSL_R_NO_CLIENT_CERT_METHOD);
1090 ENGINE_finish(e); 1090 ENGINE_finish(e);
1091 return 0; 1091 return 0;
diff --git a/src/lib/libssl/ssl_srvr.c b/src/lib/libssl/ssl_srvr.c
index a716947ab9..46ca4d6c9c 100644
--- a/src/lib/libssl/ssl_srvr.c
+++ b/src/lib/libssl/ssl_srvr.c
@@ -1,4 +1,4 @@
1/* $OpenBSD: ssl_srvr.c,v 1.2 2017/01/26 06:32:58 jsing Exp $ */ 1/* $OpenBSD: ssl_srvr.c,v 1.3 2017/01/26 10:40:21 beck Exp $ */
2/* Copyright (C) 1995-1998 Eric Young (eay@cryptsoft.com) 2/* Copyright (C) 1995-1998 Eric Young (eay@cryptsoft.com)
3 * All rights reserved. 3 * All rights reserved.
4 * 4 *
@@ -189,7 +189,7 @@ ssl3_accept(SSL *s)
189 SSL_clear(s); 189 SSL_clear(s);
190 190
191 if (s->cert == NULL) { 191 if (s->cert == NULL) {
192 SSLerr(SSL_F_SSL3_ACCEPT, SSL_R_NO_CERTIFICATE_SET); 192 SSLerror(SSL_R_NO_CERTIFICATE_SET);
193 ret = -1; 193 ret = -1;
194 goto end; 194 goto end;
195 } 195 }
@@ -212,7 +212,7 @@ ssl3_accept(SSL *s)
212 cb(s, SSL_CB_HANDSHAKE_START, 1); 212 cb(s, SSL_CB_HANDSHAKE_START, 1);
213 213
214 if ((s->version >> 8) != 3) { 214 if ((s->version >> 8) != 3) {
215 SSLerr(SSL_F_SSL3_ACCEPT, ERR_R_INTERNAL_ERROR); 215 SSLerror(ERR_R_INTERNAL_ERROR);
216 ret = -1; 216 ret = -1;
217 goto end; 217 goto end;
218 } 218 }
@@ -253,7 +253,7 @@ ssl3_accept(SSL *s)
253 * client that doesn't support secure 253 * client that doesn't support secure
254 * renegotiation. 254 * renegotiation.
255 */ 255 */
256 SSLerr(SSL_F_SSL3_ACCEPT, 256 SSLerror(
257 SSL_R_UNSAFE_LEGACY_RENEGOTIATION_DISABLED); 257 SSL_R_UNSAFE_LEGACY_RENEGOTIATION_DISABLED);
258 ssl3_send_alert(s, SSL3_AL_FATAL, 258 ssl3_send_alert(s, SSL3_AL_FATAL,
259 SSL_AD_HANDSHAKE_FAILURE); 259 SSL_AD_HANDSHAKE_FAILURE);
@@ -484,7 +484,7 @@ ssl3_accept(SSL *s)
484 * at this point and digest cached records. 484 * at this point and digest cached records.
485 */ 485 */
486 if (!S3I(s)->handshake_buffer) { 486 if (!S3I(s)->handshake_buffer) {
487 SSLerr(SSL_F_SSL3_ACCEPT, 487 SSLerror(
488 ERR_R_INTERNAL_ERROR); 488 ERR_R_INTERNAL_ERROR);
489 ret = -1; 489 ret = -1;
490 goto end; 490 goto end;
@@ -673,7 +673,7 @@ ssl3_accept(SSL *s)
673 /* break; */ 673 /* break; */
674 674
675 default: 675 default:
676 SSLerr(SSL_F_SSL3_ACCEPT, 676 SSLerror(
677 SSL_R_UNKNOWN_STATE); 677 SSL_R_UNKNOWN_STATE);
678 ret = -1; 678 ret = -1;
679 goto end; 679 goto end;
@@ -765,7 +765,7 @@ ssl3_get_client_hello(SSL *s)
765 p += 2; 765 p += 2;
766 766
767 if (ssl_max_shared_version(s, s->client_version, &shared_version) != 1) { 767 if (ssl_max_shared_version(s, s->client_version, &shared_version) != 1) {
768 SSLerr(SSL_F_SSL3_GET_CLIENT_HELLO, SSL_R_WRONG_VERSION_NUMBER); 768 SSLerror(SSL_R_WRONG_VERSION_NUMBER);
769 if ((s->client_version >> 8) == SSL3_VERSION_MAJOR && 769 if ((s->client_version >> 8) == SSL3_VERSION_MAJOR &&
770 !s->internal->enc_write_ctx && !s->internal->write_hash) { 770 !s->internal->enc_write_ctx && !s->internal->write_hash) {
771 /* 771 /*
@@ -782,7 +782,7 @@ ssl3_get_client_hello(SSL *s)
782 if ((method = tls1_get_server_method(shared_version)) == NULL) 782 if ((method = tls1_get_server_method(shared_version)) == NULL)
783 method = dtls1_get_server_method(shared_version); 783 method = dtls1_get_server_method(shared_version);
784 if (method == NULL) { 784 if (method == NULL) {
785 SSLerr(SSL_F_SSL3_GET_CLIENT_HELLO, ERR_R_INTERNAL_ERROR); 785 SSLerror(ERR_R_INTERNAL_ERROR);
786 goto err; 786 goto err;
787 } 787 }
788 s->method = method; 788 s->method = method;
@@ -868,7 +868,7 @@ ssl3_get_client_hello(SSL *s)
868 if (cookie_len > sizeof(D1I(s)->rcvd_cookie)) { 868 if (cookie_len > sizeof(D1I(s)->rcvd_cookie)) {
869 /* too much data */ 869 /* too much data */
870 al = SSL_AD_DECODE_ERROR; 870 al = SSL_AD_DECODE_ERROR;
871 SSLerr(SSL_F_SSL3_GET_CLIENT_HELLO, 871 SSLerror(
872 SSL_R_COOKIE_MISMATCH); 872 SSL_R_COOKIE_MISMATCH);
873 goto f_err; 873 goto f_err;
874 } 874 }
@@ -885,7 +885,7 @@ ssl3_get_client_hello(SSL *s)
885 if (s->ctx->internal->app_verify_cookie_cb(s, 885 if (s->ctx->internal->app_verify_cookie_cb(s,
886 D1I(s)->rcvd_cookie, cookie_len) == 0) { 886 D1I(s)->rcvd_cookie, cookie_len) == 0) {
887 al = SSL_AD_HANDSHAKE_FAILURE; 887 al = SSL_AD_HANDSHAKE_FAILURE;
888 SSLerr(SSL_F_SSL3_GET_CLIENT_HELLO, 888 SSLerror(
889 SSL_R_COOKIE_MISMATCH); 889 SSL_R_COOKIE_MISMATCH);
890 goto f_err; 890 goto f_err;
891 } 891 }
@@ -894,7 +894,7 @@ ssl3_get_client_hello(SSL *s)
894 D1I(s)->cookie_len) != 0) { 894 D1I(s)->cookie_len) != 0) {
895 /* default verification */ 895 /* default verification */
896 al = SSL_AD_HANDSHAKE_FAILURE; 896 al = SSL_AD_HANDSHAKE_FAILURE;
897 SSLerr(SSL_F_SSL3_GET_CLIENT_HELLO, 897 SSLerror(
898 SSL_R_COOKIE_MISMATCH); 898 SSL_R_COOKIE_MISMATCH);
899 goto f_err; 899 goto f_err;
900 } 900 }
@@ -911,7 +911,7 @@ ssl3_get_client_hello(SSL *s)
911 if ((i == 0) && (j != 0)) { 911 if ((i == 0) && (j != 0)) {
912 /* we need a cipher if we are not resuming a session */ 912 /* we need a cipher if we are not resuming a session */
913 al = SSL_AD_ILLEGAL_PARAMETER; 913 al = SSL_AD_ILLEGAL_PARAMETER;
914 SSLerr(SSL_F_SSL3_GET_CLIENT_HELLO, 914 SSLerror(
915 SSL_R_NO_CIPHERS_SPECIFIED); 915 SSL_R_NO_CIPHERS_SPECIFIED);
916 goto f_err; 916 goto f_err;
917 } 917 }
@@ -941,7 +941,7 @@ ssl3_get_client_hello(SSL *s)
941 * list if we are asked to reuse it 941 * list if we are asked to reuse it
942 */ 942 */
943 al = SSL_AD_ILLEGAL_PARAMETER; 943 al = SSL_AD_ILLEGAL_PARAMETER;
944 SSLerr(SSL_F_SSL3_GET_CLIENT_HELLO, 944 SSLerror(
945 SSL_R_REQUIRED_CIPHER_MISSING); 945 SSL_R_REQUIRED_CIPHER_MISSING);
946 goto f_err; 946 goto f_err;
947 } 947 }
@@ -962,7 +962,7 @@ ssl3_get_client_hello(SSL *s)
962 if (j >= i) { 962 if (j >= i) {
963 /* no compress */ 963 /* no compress */
964 al = SSL_AD_DECODE_ERROR; 964 al = SSL_AD_DECODE_ERROR;
965 SSLerr(SSL_F_SSL3_GET_CLIENT_HELLO, 965 SSLerror(
966 SSL_R_NO_COMPRESSION_SPECIFIED); 966 SSL_R_NO_COMPRESSION_SPECIFIED);
967 goto f_err; 967 goto f_err;
968 } 968 }
@@ -970,11 +970,11 @@ ssl3_get_client_hello(SSL *s)
970 /* TLS extensions*/ 970 /* TLS extensions*/
971 if (!ssl_parse_clienthello_tlsext(s, &p, d, n, &al)) { 971 if (!ssl_parse_clienthello_tlsext(s, &p, d, n, &al)) {
972 /* 'al' set by ssl_parse_clienthello_tlsext */ 972 /* 'al' set by ssl_parse_clienthello_tlsext */
973 SSLerr(SSL_F_SSL3_GET_CLIENT_HELLO, SSL_R_PARSE_TLSEXT); 973 SSLerror(SSL_R_PARSE_TLSEXT);
974 goto f_err; 974 goto f_err;
975 } 975 }
976 if (ssl_check_clienthello_tlsext_early(s) <= 0) { 976 if (ssl_check_clienthello_tlsext_early(s) <= 0) {
977 SSLerr(SSL_F_SSL3_GET_CLIENT_HELLO, 977 SSLerror(
978 SSL_R_CLIENTHELLO_TLSEXT); 978 SSL_R_CLIENTHELLO_TLSEXT);
979 goto err; 979 goto err;
980 } 980 }
@@ -1006,7 +1006,7 @@ ssl3_get_client_hello(SSL *s)
1006 SSL_get_ciphers(s)); 1006 SSL_get_ciphers(s));
1007 if (pref_cipher == NULL) { 1007 if (pref_cipher == NULL) {
1008 al = SSL_AD_HANDSHAKE_FAILURE; 1008 al = SSL_AD_HANDSHAKE_FAILURE;
1009 SSLerr(SSL_F_SSL3_GET_CLIENT_HELLO, 1009 SSLerror(
1010 SSL_R_NO_SHARED_CIPHER); 1010 SSL_R_NO_SHARED_CIPHER);
1011 goto f_err; 1011 goto f_err;
1012 } 1012 }
@@ -1032,7 +1032,7 @@ ssl3_get_client_hello(SSL *s)
1032 s->session->ciphers = ciphers; 1032 s->session->ciphers = ciphers;
1033 if (ciphers == NULL) { 1033 if (ciphers == NULL) {
1034 al = SSL_AD_ILLEGAL_PARAMETER; 1034 al = SSL_AD_ILLEGAL_PARAMETER;
1035 SSLerr(SSL_F_SSL3_GET_CLIENT_HELLO, 1035 SSLerror(
1036 SSL_R_NO_CIPHERS_PASSED); 1036 SSL_R_NO_CIPHERS_PASSED);
1037 goto f_err; 1037 goto f_err;
1038 } 1038 }
@@ -1042,7 +1042,7 @@ ssl3_get_client_hello(SSL *s)
1042 1042
1043 if (c == NULL) { 1043 if (c == NULL) {
1044 al = SSL_AD_HANDSHAKE_FAILURE; 1044 al = SSL_AD_HANDSHAKE_FAILURE;
1045 SSLerr(SSL_F_SSL3_GET_CLIENT_HELLO, 1045 SSLerror(
1046 SSL_R_NO_SHARED_CIPHER); 1046 SSL_R_NO_SHARED_CIPHER);
1047 goto f_err; 1047 goto f_err;
1048 } 1048 }
@@ -1074,7 +1074,7 @@ ssl3_get_client_hello(SSL *s)
1074 1074
1075 /* Handles TLS extensions that we couldn't check earlier */ 1075 /* Handles TLS extensions that we couldn't check earlier */
1076 if (ssl_check_clienthello_tlsext_late(s) <= 0) { 1076 if (ssl_check_clienthello_tlsext_late(s) <= 0) {
1077 SSLerr(SSL_F_SSL3_GET_CLIENT_HELLO, SSL_R_CLIENTHELLO_TLSEXT); 1077 SSLerror(SSL_R_CLIENTHELLO_TLSEXT);
1078 goto err; 1078 goto err;
1079 } 1079 }
1080 1080
@@ -1083,7 +1083,7 @@ ssl3_get_client_hello(SSL *s)
1083 if (0) { 1083 if (0) {
1084truncated: 1084truncated:
1085 al = SSL_AD_DECODE_ERROR; 1085 al = SSL_AD_DECODE_ERROR;
1086 SSLerr(SSL_F_SSL3_GET_CLIENT_HELLO, SSL_R_BAD_PACKET_LENGTH); 1086 SSLerror(SSL_R_BAD_PACKET_LENGTH);
1087f_err: 1087f_err:
1088 ssl3_send_alert(s, SSL3_AL_FATAL, al); 1088 ssl3_send_alert(s, SSL3_AL_FATAL, al);
1089 } 1089 }
@@ -1142,7 +1142,7 @@ ssl3_send_server_hello(SSL *s)
1142 1142
1143 sl = s->session->session_id_length; 1143 sl = s->session->session_id_length;
1144 if (sl > (int)sizeof(s->session->session_id)) { 1144 if (sl > (int)sizeof(s->session->session_id)) {
1145 SSLerr(SSL_F_SSL3_SEND_SERVER_HELLO, 1145 SSLerror(
1146 ERR_R_INTERNAL_ERROR); 1146 ERR_R_INTERNAL_ERROR);
1147 goto err; 1147 goto err;
1148 } 1148 }
@@ -1166,7 +1166,7 @@ ssl3_send_server_hello(SSL *s)
1166 1166
1167 if ((p = ssl_add_serverhello_tlsext(s, p + outlen, 1167 if ((p = ssl_add_serverhello_tlsext(s, p + outlen,
1168 bufend)) == NULL) { 1168 bufend)) == NULL) {
1169 SSLerr(SSL_F_SSL3_SEND_SERVER_HELLO, 1169 SSLerror(
1170 ERR_R_INTERNAL_ERROR); 1170 ERR_R_INTERNAL_ERROR);
1171 goto err; 1171 goto err;
1172 } 1172 }
@@ -1208,7 +1208,7 @@ ssl3_send_server_kex_dhe(SSL *s, CBB *cbb)
1208 if (s->cert->dh_tmp_auto != 0) { 1208 if (s->cert->dh_tmp_auto != 0) {
1209 if ((dhp = ssl_get_auto_dh(s)) == NULL) { 1209 if ((dhp = ssl_get_auto_dh(s)) == NULL) {
1210 al = SSL_AD_INTERNAL_ERROR; 1210 al = SSL_AD_INTERNAL_ERROR;
1211 SSLerr(SSL_F_SSL3_SEND_SERVER_KEY_EXCHANGE, 1211 SSLerror(
1212 ERR_R_INTERNAL_ERROR); 1212 ERR_R_INTERNAL_ERROR);
1213 goto f_err; 1213 goto f_err;
1214 } 1214 }
@@ -1221,13 +1221,13 @@ ssl3_send_server_kex_dhe(SSL *s, CBB *cbb)
1221 1221
1222 if (dhp == NULL) { 1222 if (dhp == NULL) {
1223 al = SSL_AD_HANDSHAKE_FAILURE; 1223 al = SSL_AD_HANDSHAKE_FAILURE;
1224 SSLerr(SSL_F_SSL3_SEND_SERVER_KEY_EXCHANGE, 1224 SSLerror(
1225 SSL_R_MISSING_TMP_DH_KEY); 1225 SSL_R_MISSING_TMP_DH_KEY);
1226 goto f_err; 1226 goto f_err;
1227 } 1227 }
1228 1228
1229 if (S3I(s)->tmp.dh != NULL) { 1229 if (S3I(s)->tmp.dh != NULL) {
1230 SSLerr(SSL_F_SSL3_SEND_SERVER_KEY_EXCHANGE, 1230 SSLerror(
1231 ERR_R_INTERNAL_ERROR); 1231 ERR_R_INTERNAL_ERROR);
1232 goto err; 1232 goto err;
1233 } 1233 }
@@ -1235,12 +1235,12 @@ ssl3_send_server_kex_dhe(SSL *s, CBB *cbb)
1235 if (s->cert->dh_tmp_auto != 0) { 1235 if (s->cert->dh_tmp_auto != 0) {
1236 dh = dhp; 1236 dh = dhp;
1237 } else if ((dh = DHparams_dup(dhp)) == NULL) { 1237 } else if ((dh = DHparams_dup(dhp)) == NULL) {
1238 SSLerr(SSL_F_SSL3_SEND_SERVER_KEY_EXCHANGE, ERR_R_DH_LIB); 1238 SSLerror(ERR_R_DH_LIB);
1239 goto err; 1239 goto err;
1240 } 1240 }
1241 S3I(s)->tmp.dh = dh; 1241 S3I(s)->tmp.dh = dh;
1242 if (!DH_generate_key(dh)) { 1242 if (!DH_generate_key(dh)) {
1243 SSLerr(SSL_F_SSL3_SEND_SERVER_KEY_EXCHANGE, ERR_R_DH_LIB); 1243 SSLerror(ERR_R_DH_LIB);
1244 goto err; 1244 goto err;
1245 } 1245 }
1246 1246
@@ -1299,13 +1299,13 @@ ssl3_send_server_kex_ecdhe_ecp(SSL *s, int nid, CBB *cbb)
1299 } 1299 }
1300 if (ecdhp == NULL) { 1300 if (ecdhp == NULL) {
1301 al = SSL_AD_HANDSHAKE_FAILURE; 1301 al = SSL_AD_HANDSHAKE_FAILURE;
1302 SSLerr(SSL_F_SSL3_SEND_SERVER_KEY_EXCHANGE, 1302 SSLerror(
1303 SSL_R_MISSING_TMP_ECDH_KEY); 1303 SSL_R_MISSING_TMP_ECDH_KEY);
1304 goto f_err; 1304 goto f_err;
1305 } 1305 }
1306 1306
1307 if (S3I(s)->tmp.ecdh != NULL) { 1307 if (S3I(s)->tmp.ecdh != NULL) {
1308 SSLerr(SSL_F_SSL3_SEND_SERVER_KEY_EXCHANGE, 1308 SSLerror(
1309 ERR_R_INTERNAL_ERROR); 1309 ERR_R_INTERNAL_ERROR);
1310 goto err; 1310 goto err;
1311 } 1311 }
@@ -1314,7 +1314,7 @@ ssl3_send_server_kex_ecdhe_ecp(SSL *s, int nid, CBB *cbb)
1314 if (s->cert->ecdh_tmp_auto != 0) { 1314 if (s->cert->ecdh_tmp_auto != 0) {
1315 ecdh = ecdhp; 1315 ecdh = ecdhp;
1316 } else if ((ecdh = EC_KEY_dup(ecdhp)) == NULL) { 1316 } else if ((ecdh = EC_KEY_dup(ecdhp)) == NULL) {
1317 SSLerr(SSL_F_SSL3_SEND_SERVER_KEY_EXCHANGE, 1317 SSLerror(
1318 ERR_R_ECDH_LIB); 1318 ERR_R_ECDH_LIB);
1319 goto err; 1319 goto err;
1320 } 1320 }
@@ -1324,7 +1324,7 @@ ssl3_send_server_kex_ecdhe_ecp(SSL *s, int nid, CBB *cbb)
1324 (EC_KEY_get0_private_key(ecdh) == NULL) || 1324 (EC_KEY_get0_private_key(ecdh) == NULL) ||
1325 (s->internal->options & SSL_OP_SINGLE_ECDH_USE)) { 1325 (s->internal->options & SSL_OP_SINGLE_ECDH_USE)) {
1326 if (!EC_KEY_generate_key(ecdh)) { 1326 if (!EC_KEY_generate_key(ecdh)) {
1327 SSLerr(SSL_F_SSL3_SEND_SERVER_KEY_EXCHANGE, 1327 SSLerror(
1328 ERR_R_ECDH_LIB); 1328 ERR_R_ECDH_LIB);
1329 goto err; 1329 goto err;
1330 } 1330 }
@@ -1333,7 +1333,7 @@ ssl3_send_server_kex_ecdhe_ecp(SSL *s, int nid, CBB *cbb)
1333 if (((group = EC_KEY_get0_group(ecdh)) == NULL) || 1333 if (((group = EC_KEY_get0_group(ecdh)) == NULL) ||
1334 (EC_KEY_get0_public_key(ecdh) == NULL) || 1334 (EC_KEY_get0_public_key(ecdh) == NULL) ||
1335 (EC_KEY_get0_private_key(ecdh) == NULL)) { 1335 (EC_KEY_get0_private_key(ecdh) == NULL)) {
1336 SSLerr(SSL_F_SSL3_SEND_SERVER_KEY_EXCHANGE, 1336 SSLerror(
1337 ERR_R_ECDH_LIB); 1337 ERR_R_ECDH_LIB);
1338 goto err; 1338 goto err;
1339 } 1339 }
@@ -1344,7 +1344,7 @@ ssl3_send_server_kex_ecdhe_ecp(SSL *s, int nid, CBB *cbb)
1344 */ 1344 */
1345 if ((curve_id = tls1_ec_nid2curve_id( 1345 if ((curve_id = tls1_ec_nid2curve_id(
1346 EC_GROUP_get_curve_name(group))) == 0) { 1346 EC_GROUP_get_curve_name(group))) == 0) {
1347 SSLerr(SSL_F_SSL3_SEND_SERVER_KEY_EXCHANGE, 1347 SSLerror(
1348 SSL_R_UNSUPPORTED_ELLIPTIC_CURVE); 1348 SSL_R_UNSUPPORTED_ELLIPTIC_CURVE);
1349 goto err; 1349 goto err;
1350 } 1350 }
@@ -1360,7 +1360,7 @@ ssl3_send_server_kex_ecdhe_ecp(SSL *s, int nid, CBB *cbb)
1360 1360
1361 bn_ctx = BN_CTX_new(); 1361 bn_ctx = BN_CTX_new();
1362 if ((encodedPoint == NULL) || (bn_ctx == NULL)) { 1362 if ((encodedPoint == NULL) || (bn_ctx == NULL)) {
1363 SSLerr(SSL_F_SSL3_SEND_SERVER_KEY_EXCHANGE, 1363 SSLerror(
1364 ERR_R_MALLOC_FAILURE); 1364 ERR_R_MALLOC_FAILURE);
1365 goto err; 1365 goto err;
1366 } 1366 }
@@ -1369,7 +1369,7 @@ ssl3_send_server_kex_ecdhe_ecp(SSL *s, int nid, CBB *cbb)
1369 POINT_CONVERSION_UNCOMPRESSED, encodedPoint, encodedlen, bn_ctx); 1369 POINT_CONVERSION_UNCOMPRESSED, encodedPoint, encodedlen, bn_ctx);
1370 1370
1371 if (encodedlen == 0) { 1371 if (encodedlen == 0) {
1372 SSLerr(SSL_F_SSL3_SEND_SERVER_KEY_EXCHANGE, ERR_R_ECDH_LIB); 1372 SSLerror(ERR_R_ECDH_LIB);
1373 goto err; 1373 goto err;
1374 } 1374 }
1375 1375
@@ -1421,7 +1421,7 @@ ssl3_send_server_kex_ecdhe_ecx(SSL *s, int nid, CBB *cbb)
1421 1421
1422 /* Generate an X25519 key pair. */ 1422 /* Generate an X25519 key pair. */
1423 if (S3I(s)->tmp.x25519 != NULL) { 1423 if (S3I(s)->tmp.x25519 != NULL) {
1424 SSLerr(SSL_F_SSL3_SEND_SERVER_KEY_EXCHANGE, 1424 SSLerror(
1425 ERR_R_INTERNAL_ERROR); 1425 ERR_R_INTERNAL_ERROR);
1426 goto err; 1426 goto err;
1427 } 1427 }
@@ -1433,7 +1433,7 @@ ssl3_send_server_kex_ecdhe_ecx(SSL *s, int nid, CBB *cbb)
1433 1433
1434 /* Serialize public key. */ 1434 /* Serialize public key. */
1435 if ((curve_id = tls1_ec_nid2curve_id(nid)) == 0) { 1435 if ((curve_id = tls1_ec_nid2curve_id(nid)) == 0) {
1436 SSLerr(SSL_F_SSL3_SEND_SERVER_KEY_EXCHANGE, 1436 SSLerror(
1437 SSL_R_UNSUPPORTED_ELLIPTIC_CURVE); 1437 SSL_R_UNSUPPORTED_ELLIPTIC_CURVE);
1438 goto err; 1438 goto err;
1439 } 1439 }
@@ -1509,7 +1509,7 @@ ssl3_send_server_key_exchange(SSL *s)
1509 goto err; 1509 goto err;
1510 } else { 1510 } else {
1511 al = SSL_AD_HANDSHAKE_FAILURE; 1511 al = SSL_AD_HANDSHAKE_FAILURE;
1512 SSLerr(SSL_F_SSL3_SEND_SERVER_KEY_EXCHANGE, 1512 SSLerror(
1513 SSL_R_UNKNOWN_KEY_EXCHANGE_TYPE); 1513 SSL_R_UNKNOWN_KEY_EXCHANGE_TYPE);
1514 goto f_err; 1514 goto f_err;
1515 } 1515 }
@@ -1531,7 +1531,7 @@ ssl3_send_server_key_exchange(SSL *s)
1531 1531
1532 if (!BUF_MEM_grow_clean(buf, ssl3_handshake_msg_hdr_len(s) + 1532 if (!BUF_MEM_grow_clean(buf, ssl3_handshake_msg_hdr_len(s) +
1533 params_len + kn)) { 1533 params_len + kn)) {
1534 SSLerr(SSL_F_SSL3_SEND_SERVER_KEY_EXCHANGE, 1534 SSLerror(
1535 ERR_LIB_BUF); 1535 ERR_LIB_BUF);
1536 goto err; 1536 goto err;
1537 } 1537 }
@@ -1575,9 +1575,7 @@ ssl3_send_server_key_exchange(SSL *s)
1575 } 1575 }
1576 if (RSA_sign(NID_md5_sha1, md_buf, j, 1576 if (RSA_sign(NID_md5_sha1, md_buf, j,
1577 &(p[2]), &u, pkey->pkey.rsa) <= 0) { 1577 &(p[2]), &u, pkey->pkey.rsa) <= 0) {
1578 SSLerr( 1578 SSLerror(ERR_R_RSA_LIB);
1579 SSL_F_SSL3_SEND_SERVER_KEY_EXCHANGE,
1580 ERR_LIB_RSA);
1581 goto err; 1579 goto err;
1582 } 1580 }
1583 s2n(u, p); 1581 s2n(u, p);
@@ -1588,9 +1586,7 @@ ssl3_send_server_key_exchange(SSL *s)
1588 if (!tls12_get_sigandhash(p, pkey, md)) { 1586 if (!tls12_get_sigandhash(p, pkey, md)) {
1589 /* Should never happen */ 1587 /* Should never happen */
1590 al = SSL_AD_INTERNAL_ERROR; 1588 al = SSL_AD_INTERNAL_ERROR;
1591 SSLerr( 1589 SSLerror(ERR_R_INTERNAL_ERROR);
1592 SSL_F_SSL3_SEND_SERVER_KEY_EXCHANGE,
1593 ERR_R_INTERNAL_ERROR);
1594 goto f_err; 1590 goto f_err;
1595 } 1591 }
1596 p += 2; 1592 p += 2;
@@ -1605,9 +1601,7 @@ ssl3_send_server_key_exchange(SSL *s)
1605 EVP_SignUpdate(&md_ctx, d, n); 1601 EVP_SignUpdate(&md_ctx, d, n);
1606 if (!EVP_SignFinal(&md_ctx, &p[2], 1602 if (!EVP_SignFinal(&md_ctx, &p[2],
1607 (unsigned int *)&i, pkey)) { 1603 (unsigned int *)&i, pkey)) {
1608 SSLerr( 1604 SSLerror(ERR_R_EVP_LIB);
1609 SSL_F_SSL3_SEND_SERVER_KEY_EXCHANGE,
1610 ERR_LIB_EVP);
1611 goto err; 1605 goto err;
1612 } 1606 }
1613 s2n(i, p); 1607 s2n(i, p);
@@ -1617,7 +1611,7 @@ ssl3_send_server_key_exchange(SSL *s)
1617 } else { 1611 } else {
1618 /* Is this error check actually needed? */ 1612 /* Is this error check actually needed? */
1619 al = SSL_AD_HANDSHAKE_FAILURE; 1613 al = SSL_AD_HANDSHAKE_FAILURE;
1620 SSLerr(SSL_F_SSL3_SEND_SERVER_KEY_EXCHANGE, 1614 SSLerror(
1621 SSL_R_UNKNOWN_PKEY_TYPE); 1615 SSL_R_UNKNOWN_PKEY_TYPE);
1622 goto f_err; 1616 goto f_err;
1623 } 1617 }
@@ -1684,9 +1678,7 @@ ssl3_send_certificate_request(SSL *s)
1684 if (!BUF_MEM_grow_clean(buf, 1678 if (!BUF_MEM_grow_clean(buf,
1685 ssl3_handshake_msg_hdr_len(s) + n + j 1679 ssl3_handshake_msg_hdr_len(s) + n + j
1686 + 2)) { 1680 + 2)) {
1687 SSLerr( 1681 SSLerror(ERR_R_BUF_LIB);
1688 SSL_F_SSL3_SEND_CERTIFICATE_REQUEST,
1689 ERR_R_BUF_LIB);
1690 goto err; 1682 goto err;
1691 } 1683 }
1692 p = ssl3_handshake_msg_start(s, 1684 p = ssl3_handshake_msg_start(s,
@@ -1732,7 +1724,7 @@ ssl3_get_client_kex_rsa(SSL *s, unsigned char *p, long n)
1732 if ((pkey == NULL) || (pkey->type != EVP_PKEY_RSA) || 1724 if ((pkey == NULL) || (pkey->type != EVP_PKEY_RSA) ||
1733 (pkey->pkey.rsa == NULL)) { 1725 (pkey->pkey.rsa == NULL)) {
1734 al = SSL_AD_HANDSHAKE_FAILURE; 1726 al = SSL_AD_HANDSHAKE_FAILURE;
1735 SSLerr(SSL_F_SSL3_GET_CLIENT_KEY_EXCHANGE, 1727 SSLerror(
1736 SSL_R_MISSING_RSA_CERTIFICATE); 1728 SSL_R_MISSING_RSA_CERTIFICATE);
1737 goto f_err; 1729 goto f_err;
1738 } 1730 }
@@ -1742,7 +1734,7 @@ ssl3_get_client_kex_rsa(SSL *s, unsigned char *p, long n)
1742 goto truncated; 1734 goto truncated;
1743 n2s(p, i); 1735 n2s(p, i);
1744 if (n != i + 2) { 1736 if (n != i + 2) {
1745 SSLerr(SSL_F_SSL3_GET_CLIENT_KEY_EXCHANGE, 1737 SSLerror(
1746 SSL_R_TLS_RSA_ENCRYPTED_VALUE_LENGTH_IS_WRONG); 1738 SSL_R_TLS_RSA_ENCRYPTED_VALUE_LENGTH_IS_WRONG);
1747 goto err; 1739 goto err;
1748 } else 1740 } else
@@ -1756,7 +1748,7 @@ ssl3_get_client_kex_rsa(SSL *s, unsigned char *p, long n)
1756 1748
1757 if (i != SSL_MAX_MASTER_KEY_LENGTH) { 1749 if (i != SSL_MAX_MASTER_KEY_LENGTH) {
1758 al = SSL_AD_DECODE_ERROR; 1750 al = SSL_AD_DECODE_ERROR;
1759 /* SSLerr(SSL_F_SSL3_GET_CLIENT_KEY_EXCHANGE,SSL_R_BAD_RSA_DECRYPT); */ 1751 /* SSLerror(SSL_R_BAD_RSA_DECRYPT); */
1760 } 1752 }
1761 1753
1762 if (p - d + 2 > n) /* needed in the SSL3 case */ 1754 if (p - d + 2 > n) /* needed in the SSL3 case */
@@ -1778,7 +1770,7 @@ ssl3_get_client_kex_rsa(SSL *s, unsigned char *p, long n)
1778 (p[0] == (s->version >> 8)) && 1770 (p[0] == (s->version >> 8)) &&
1779 (p[1] == (s->version & 0xff)))) { 1771 (p[1] == (s->version & 0xff)))) {
1780 al = SSL_AD_DECODE_ERROR; 1772 al = SSL_AD_DECODE_ERROR;
1781 /* SSLerr(SSL_F_SSL3_GET_CLIENT_KEY_EXCHANGE,SSL_R_BAD_PROTOCOL_VERSION_NUMBER); */ 1773 /* SSLerror(SSL_R_BAD_PROTOCOL_VERSION_NUMBER); */
1782 1774
1783 /* 1775 /*
1784 * The Klima-Pokorny-Rosa extension of 1776 * The Klima-Pokorny-Rosa extension of
@@ -1816,7 +1808,7 @@ ssl3_get_client_kex_rsa(SSL *s, unsigned char *p, long n)
1816 return (1); 1808 return (1);
1817truncated: 1809truncated:
1818 al = SSL_AD_DECODE_ERROR; 1810 al = SSL_AD_DECODE_ERROR;
1819 SSLerr(SSL_F_SSL3_GET_CLIENT_KEY_EXCHANGE, SSL_R_BAD_PACKET_LENGTH); 1811 SSLerror(SSL_R_BAD_PACKET_LENGTH);
1820f_err: 1812f_err:
1821 ssl3_send_alert(s, SSL3_AL_FATAL, al); 1813 ssl3_send_alert(s, SSL3_AL_FATAL, al);
1822err: 1814err:
@@ -1844,21 +1836,21 @@ ssl3_get_client_kex_dhe(SSL *s, unsigned char *p, long n)
1844 1836
1845 if (S3I(s)->tmp.dh == NULL) { 1837 if (S3I(s)->tmp.dh == NULL) {
1846 al = SSL_AD_HANDSHAKE_FAILURE; 1838 al = SSL_AD_HANDSHAKE_FAILURE;
1847 SSLerr(SSL_F_SSL3_GET_CLIENT_KEY_EXCHANGE, 1839 SSLerror(
1848 SSL_R_MISSING_TMP_DH_KEY); 1840 SSL_R_MISSING_TMP_DH_KEY);
1849 goto f_err; 1841 goto f_err;
1850 } 1842 }
1851 dh = S3I(s)->tmp.dh; 1843 dh = S3I(s)->tmp.dh;
1852 1844
1853 if ((bn = BN_bin2bn(CBS_data(&dh_Yc), CBS_len(&dh_Yc), NULL)) == NULL) { 1845 if ((bn = BN_bin2bn(CBS_data(&dh_Yc), CBS_len(&dh_Yc), NULL)) == NULL) {
1854 SSLerr(SSL_F_SSL3_GET_CLIENT_KEY_EXCHANGE, 1846 SSLerror(
1855 SSL_R_BN_LIB); 1847 SSL_R_BN_LIB);
1856 goto err; 1848 goto err;
1857 } 1849 }
1858 1850
1859 key_size = DH_compute_key(p, bn, dh); 1851 key_size = DH_compute_key(p, bn, dh);
1860 if (key_size <= 0) { 1852 if (key_size <= 0) {
1861 SSLerr(SSL_F_SSL3_GET_CLIENT_KEY_EXCHANGE, ERR_R_DH_LIB); 1853 SSLerror(ERR_R_DH_LIB);
1862 BN_clear_free(bn); 1854 BN_clear_free(bn);
1863 goto err; 1855 goto err;
1864 } 1856 }
@@ -1878,7 +1870,7 @@ ssl3_get_client_kex_dhe(SSL *s, unsigned char *p, long n)
1878 1870
1879 truncated: 1871 truncated:
1880 al = SSL_AD_DECODE_ERROR; 1872 al = SSL_AD_DECODE_ERROR;
1881 SSLerr(SSL_F_SSL3_GET_CLIENT_KEY_EXCHANGE, SSL_R_BAD_PACKET_LENGTH); 1873 SSLerror(SSL_R_BAD_PACKET_LENGTH);
1882 f_err: 1874 f_err:
1883 ssl3_send_alert(s, SSL3_AL_FATAL, al); 1875 ssl3_send_alert(s, SSL3_AL_FATAL, al);
1884 err: 1876 err:
@@ -1902,7 +1894,7 @@ ssl3_get_client_kex_ecdhe_ecp(SSL *s, unsigned char *p, long n)
1902 1894
1903 /* Initialize structures for server's ECDH key pair. */ 1895 /* Initialize structures for server's ECDH key pair. */
1904 if ((srvr_ecdh = EC_KEY_new()) == NULL) { 1896 if ((srvr_ecdh = EC_KEY_new()) == NULL) {
1905 SSLerr(SSL_F_SSL3_GET_CLIENT_KEY_EXCHANGE, 1897 SSLerror(
1906 ERR_R_MALLOC_FAILURE); 1898 ERR_R_MALLOC_FAILURE);
1907 goto err; 1899 goto err;
1908 } 1900 }
@@ -1918,14 +1910,14 @@ ssl3_get_client_kex_ecdhe_ecp(SSL *s, unsigned char *p, long n)
1918 1910
1919 if (!EC_KEY_set_group(srvr_ecdh, group) || 1911 if (!EC_KEY_set_group(srvr_ecdh, group) ||
1920 !EC_KEY_set_private_key(srvr_ecdh, priv_key)) { 1912 !EC_KEY_set_private_key(srvr_ecdh, priv_key)) {
1921 SSLerr(SSL_F_SSL3_GET_CLIENT_KEY_EXCHANGE, 1913 SSLerror(
1922 ERR_R_EC_LIB); 1914 ERR_R_EC_LIB);
1923 goto err; 1915 goto err;
1924 } 1916 }
1925 1917
1926 /* Let's get client's public key */ 1918 /* Let's get client's public key */
1927 if ((clnt_ecpoint = EC_POINT_new(group)) == NULL) { 1919 if ((clnt_ecpoint = EC_POINT_new(group)) == NULL) {
1928 SSLerr(SSL_F_SSL3_GET_CLIENT_KEY_EXCHANGE, 1920 SSLerror(
1929 ERR_R_MALLOC_FAILURE); 1921 ERR_R_MALLOC_FAILURE);
1930 goto err; 1922 goto err;
1931 } 1923 }
@@ -1948,7 +1940,7 @@ ssl3_get_client_kex_ecdhe_ecp(SSL *s, unsigned char *p, long n)
1948 * group. 1940 * group.
1949 */ 1941 */
1950 al = SSL_AD_HANDSHAKE_FAILURE; 1942 al = SSL_AD_HANDSHAKE_FAILURE;
1951 SSLerr(SSL_F_SSL3_GET_CLIENT_KEY_EXCHANGE, 1943 SSLerror(
1952 SSL_R_UNABLE_TO_DECODE_ECDH_CERTS); 1944 SSL_R_UNABLE_TO_DECODE_ECDH_CERTS);
1953 goto f_err; 1945 goto f_err;
1954 } 1946 }
@@ -1956,7 +1948,7 @@ ssl3_get_client_kex_ecdhe_ecp(SSL *s, unsigned char *p, long n)
1956 if (EC_POINT_copy(clnt_ecpoint, 1948 if (EC_POINT_copy(clnt_ecpoint,
1957 EC_KEY_get0_public_key(clnt_pub_pkey->pkey.ec)) 1949 EC_KEY_get0_public_key(clnt_pub_pkey->pkey.ec))
1958 == 0) { 1950 == 0) {
1959 SSLerr(SSL_F_SSL3_GET_CLIENT_KEY_EXCHANGE, 1951 SSLerror(
1960 ERR_R_EC_LIB); 1952 ERR_R_EC_LIB);
1961 goto err; 1953 goto err;
1962 } 1954 }
@@ -1967,7 +1959,7 @@ ssl3_get_client_kex_ecdhe_ecp(SSL *s, unsigned char *p, long n)
1967 * in the ClientKeyExchange message. 1959 * in the ClientKeyExchange message.
1968 */ 1960 */
1969 if ((bn_ctx = BN_CTX_new()) == NULL) { 1961 if ((bn_ctx = BN_CTX_new()) == NULL) {
1970 SSLerr(SSL_F_SSL3_GET_CLIENT_KEY_EXCHANGE, 1962 SSLerror(
1971 ERR_R_MALLOC_FAILURE); 1963 ERR_R_MALLOC_FAILURE);
1972 goto err; 1964 goto err;
1973 } 1965 }
@@ -1977,13 +1969,13 @@ ssl3_get_client_kex_ecdhe_ecp(SSL *s, unsigned char *p, long n)
1977 1969
1978 p += 1; 1970 p += 1;
1979 if (n != 1 + i) { 1971 if (n != 1 + i) {
1980 SSLerr(SSL_F_SSL3_GET_CLIENT_KEY_EXCHANGE, 1972 SSLerror(
1981 ERR_R_EC_LIB); 1973 ERR_R_EC_LIB);
1982 goto err; 1974 goto err;
1983 } 1975 }
1984 if (EC_POINT_oct2point(group, 1976 if (EC_POINT_oct2point(group,
1985 clnt_ecpoint, p, i, bn_ctx) == 0) { 1977 clnt_ecpoint, p, i, bn_ctx) == 0) {
1986 SSLerr(SSL_F_SSL3_GET_CLIENT_KEY_EXCHANGE, 1978 SSLerror(
1987 ERR_R_EC_LIB); 1979 ERR_R_EC_LIB);
1988 goto err; 1980 goto err;
1989 } 1981 }
@@ -1997,14 +1989,14 @@ ssl3_get_client_kex_ecdhe_ecp(SSL *s, unsigned char *p, long n)
1997 /* Compute the shared pre-master secret */ 1989 /* Compute the shared pre-master secret */
1998 key_size = ECDH_size(srvr_ecdh); 1990 key_size = ECDH_size(srvr_ecdh);
1999 if (key_size <= 0) { 1991 if (key_size <= 0) {
2000 SSLerr(SSL_F_SSL3_GET_CLIENT_KEY_EXCHANGE, 1992 SSLerror(
2001 ERR_R_ECDH_LIB); 1993 ERR_R_ECDH_LIB);
2002 goto err; 1994 goto err;
2003 } 1995 }
2004 i = ECDH_compute_key(p, key_size, clnt_ecpoint, srvr_ecdh, 1996 i = ECDH_compute_key(p, key_size, clnt_ecpoint, srvr_ecdh,
2005 NULL); 1997 NULL);
2006 if (i <= 0) { 1998 if (i <= 0) {
2007 SSLerr(SSL_F_SSL3_GET_CLIENT_KEY_EXCHANGE, 1999 SSLerror(
2008 ERR_R_ECDH_LIB); 2000 ERR_R_ECDH_LIB);
2009 goto err; 2001 goto err;
2010 } 2002 }
@@ -2122,7 +2114,7 @@ ssl3_get_client_kex_gost(SSL *s, unsigned char *p, long n)
2122 if (ASN1_get_object((const unsigned char **)&p, &Tlen, &Ttag, 2114 if (ASN1_get_object((const unsigned char **)&p, &Tlen, &Ttag,
2123 &Tclass, n) != V_ASN1_CONSTRUCTED || 2115 &Tclass, n) != V_ASN1_CONSTRUCTED ||
2124 Ttag != V_ASN1_SEQUENCE || Tclass != V_ASN1_UNIVERSAL) { 2116 Ttag != V_ASN1_SEQUENCE || Tclass != V_ASN1_UNIVERSAL) {
2125 SSLerr(SSL_F_SSL3_GET_CLIENT_KEY_EXCHANGE, 2117 SSLerror(
2126 SSL_R_DECRYPTION_FAILED); 2118 SSL_R_DECRYPTION_FAILED);
2127 goto gerr; 2119 goto gerr;
2128 } 2120 }
@@ -2130,7 +2122,7 @@ ssl3_get_client_kex_gost(SSL *s, unsigned char *p, long n)
2130 inlen = Tlen; 2122 inlen = Tlen;
2131 if (EVP_PKEY_decrypt(pkey_ctx, premaster_secret, &outlen, 2123 if (EVP_PKEY_decrypt(pkey_ctx, premaster_secret, &outlen,
2132 start, inlen) <=0) { 2124 start, inlen) <=0) {
2133 SSLerr(SSL_F_SSL3_GET_CLIENT_KEY_EXCHANGE, 2125 SSLerror(
2134 SSL_R_DECRYPTION_FAILED); 2126 SSL_R_DECRYPTION_FAILED);
2135 goto gerr; 2127 goto gerr;
2136 } 2128 }
@@ -2154,7 +2146,7 @@ ssl3_get_client_kex_gost(SSL *s, unsigned char *p, long n)
2154 2146
2155 truncated: 2147 truncated:
2156 al = SSL_AD_DECODE_ERROR; 2148 al = SSL_AD_DECODE_ERROR;
2157 SSLerr(SSL_F_SSL3_GET_CLIENT_KEY_EXCHANGE, SSL_R_BAD_PACKET_LENGTH); 2149 SSLerror(SSL_R_BAD_PACKET_LENGTH);
2158 ssl3_send_alert(s, SSL3_AL_FATAL, al); 2150 ssl3_send_alert(s, SSL3_AL_FATAL, al);
2159 err: 2151 err:
2160 return (-1); 2152 return (-1);
@@ -2192,7 +2184,7 @@ ssl3_get_client_key_exchange(SSL *s)
2192 goto err; 2184 goto err;
2193 } else { 2185 } else {
2194 al = SSL_AD_HANDSHAKE_FAILURE; 2186 al = SSL_AD_HANDSHAKE_FAILURE;
2195 SSLerr(SSL_F_SSL3_GET_CLIENT_KEY_EXCHANGE, 2187 SSLerror(
2196 SSL_R_UNKNOWN_CIPHER_TYPE); 2188 SSL_R_UNKNOWN_CIPHER_TYPE);
2197 goto f_err; 2189 goto f_err;
2198 } 2190 }
@@ -2236,7 +2228,7 @@ ssl3_get_cert_verify(SSL *s)
2236 S3I(s)->tmp.reuse_message = 1; 2228 S3I(s)->tmp.reuse_message = 1;
2237 if (peer != NULL) { 2229 if (peer != NULL) {
2238 al = SSL_AD_UNEXPECTED_MESSAGE; 2230 al = SSL_AD_UNEXPECTED_MESSAGE;
2239 SSLerr(SSL_F_SSL3_GET_CERT_VERIFY, 2231 SSLerror(
2240 SSL_R_MISSING_VERIFY_MESSAGE); 2232 SSL_R_MISSING_VERIFY_MESSAGE);
2241 goto f_err; 2233 goto f_err;
2242 } 2234 }
@@ -2245,21 +2237,21 @@ ssl3_get_cert_verify(SSL *s)
2245 } 2237 }
2246 2238
2247 if (peer == NULL) { 2239 if (peer == NULL) {
2248 SSLerr(SSL_F_SSL3_GET_CERT_VERIFY, 2240 SSLerror(
2249 SSL_R_NO_CLIENT_CERT_RECEIVED); 2241 SSL_R_NO_CLIENT_CERT_RECEIVED);
2250 al = SSL_AD_UNEXPECTED_MESSAGE; 2242 al = SSL_AD_UNEXPECTED_MESSAGE;
2251 goto f_err; 2243 goto f_err;
2252 } 2244 }
2253 2245
2254 if (!(type & EVP_PKT_SIGN)) { 2246 if (!(type & EVP_PKT_SIGN)) {
2255 SSLerr(SSL_F_SSL3_GET_CERT_VERIFY, 2247 SSLerror(
2256 SSL_R_SIGNATURE_FOR_NON_SIGNING_CERTIFICATE); 2248 SSL_R_SIGNATURE_FOR_NON_SIGNING_CERTIFICATE);
2257 al = SSL_AD_ILLEGAL_PARAMETER; 2249 al = SSL_AD_ILLEGAL_PARAMETER;
2258 goto f_err; 2250 goto f_err;
2259 } 2251 }
2260 2252
2261 if (S3I(s)->change_cipher_spec) { 2253 if (S3I(s)->change_cipher_spec) {
2262 SSLerr(SSL_F_SSL3_GET_CERT_VERIFY, 2254 SSLerror(
2263 SSL_R_CCS_RECEIVED_EARLY); 2255 SSL_R_CCS_RECEIVED_EARLY);
2264 al = SSL_AD_UNEXPECTED_MESSAGE; 2256 al = SSL_AD_UNEXPECTED_MESSAGE;
2265 goto f_err; 2257 goto f_err;
@@ -2281,7 +2273,7 @@ ssl3_get_cert_verify(SSL *s)
2281 int sigalg = tls12_get_sigid(pkey); 2273 int sigalg = tls12_get_sigid(pkey);
2282 /* Should never happen */ 2274 /* Should never happen */
2283 if (sigalg == -1) { 2275 if (sigalg == -1) {
2284 SSLerr(SSL_F_SSL3_GET_CERT_VERIFY, 2276 SSLerror(
2285 ERR_R_INTERNAL_ERROR); 2277 ERR_R_INTERNAL_ERROR);
2286 al = SSL_AD_INTERNAL_ERROR; 2278 al = SSL_AD_INTERNAL_ERROR;
2287 goto f_err; 2279 goto f_err;
@@ -2290,14 +2282,14 @@ ssl3_get_cert_verify(SSL *s)
2290 goto truncated; 2282 goto truncated;
2291 /* Check key type is consistent with signature */ 2283 /* Check key type is consistent with signature */
2292 if (sigalg != (int)p[1]) { 2284 if (sigalg != (int)p[1]) {
2293 SSLerr(SSL_F_SSL3_GET_CERT_VERIFY, 2285 SSLerror(
2294 SSL_R_WRONG_SIGNATURE_TYPE); 2286 SSL_R_WRONG_SIGNATURE_TYPE);
2295 al = SSL_AD_DECODE_ERROR; 2287 al = SSL_AD_DECODE_ERROR;
2296 goto f_err; 2288 goto f_err;
2297 } 2289 }
2298 md = tls12_get_hash(p[0]); 2290 md = tls12_get_hash(p[0]);
2299 if (md == NULL) { 2291 if (md == NULL) {
2300 SSLerr(SSL_F_SSL3_GET_CERT_VERIFY, 2292 SSLerror(
2301 SSL_R_UNKNOWN_DIGEST); 2293 SSL_R_UNKNOWN_DIGEST);
2302 al = SSL_AD_DECODE_ERROR; 2294 al = SSL_AD_DECODE_ERROR;
2303 goto f_err; 2295 goto f_err;
@@ -2314,7 +2306,7 @@ ssl3_get_cert_verify(SSL *s)
2314 } 2306 }
2315 j = EVP_PKEY_size(pkey); 2307 j = EVP_PKEY_size(pkey);
2316 if ((i > j) || (n > j) || (n <= 0)) { 2308 if ((i > j) || (n > j) || (n <= 0)) {
2317 SSLerr(SSL_F_SSL3_GET_CERT_VERIFY, 2309 SSLerror(
2318 SSL_R_WRONG_SIGNATURE_SIZE); 2310 SSL_R_WRONG_SIGNATURE_SIZE);
2319 al = SSL_AD_DECODE_ERROR; 2311 al = SSL_AD_DECODE_ERROR;
2320 goto f_err; 2312 goto f_err;
@@ -2325,14 +2317,14 @@ ssl3_get_cert_verify(SSL *s)
2325 void *hdata; 2317 void *hdata;
2326 hdatalen = BIO_get_mem_data(S3I(s)->handshake_buffer, &hdata); 2318 hdatalen = BIO_get_mem_data(S3I(s)->handshake_buffer, &hdata);
2327 if (hdatalen <= 0) { 2319 if (hdatalen <= 0) {
2328 SSLerr(SSL_F_SSL3_GET_CERT_VERIFY, 2320 SSLerror(
2329 ERR_R_INTERNAL_ERROR); 2321 ERR_R_INTERNAL_ERROR);
2330 al = SSL_AD_INTERNAL_ERROR; 2322 al = SSL_AD_INTERNAL_ERROR;
2331 goto f_err; 2323 goto f_err;
2332 } 2324 }
2333 if (!EVP_VerifyInit_ex(&mctx, md, NULL) || 2325 if (!EVP_VerifyInit_ex(&mctx, md, NULL) ||
2334 !EVP_VerifyUpdate(&mctx, hdata, hdatalen)) { 2326 !EVP_VerifyUpdate(&mctx, hdata, hdatalen)) {
2335 SSLerr(SSL_F_SSL3_GET_CERT_VERIFY, 2327 SSLerror(
2336 ERR_R_EVP_LIB); 2328 ERR_R_EVP_LIB);
2337 al = SSL_AD_INTERNAL_ERROR; 2329 al = SSL_AD_INTERNAL_ERROR;
2338 goto f_err; 2330 goto f_err;
@@ -2340,7 +2332,7 @@ ssl3_get_cert_verify(SSL *s)
2340 2332
2341 if (EVP_VerifyFinal(&mctx, p, i, pkey) <= 0) { 2333 if (EVP_VerifyFinal(&mctx, p, i, pkey) <= 0) {
2342 al = SSL_AD_DECRYPT_ERROR; 2334 al = SSL_AD_DECRYPT_ERROR;
2343 SSLerr(SSL_F_SSL3_GET_CERT_VERIFY, 2335 SSLerror(
2344 SSL_R_BAD_SIGNATURE); 2336 SSL_R_BAD_SIGNATURE);
2345 goto f_err; 2337 goto f_err;
2346 } 2338 }
@@ -2351,13 +2343,13 @@ ssl3_get_cert_verify(SSL *s)
2351 pkey->pkey.rsa); 2343 pkey->pkey.rsa);
2352 if (i < 0) { 2344 if (i < 0) {
2353 al = SSL_AD_DECRYPT_ERROR; 2345 al = SSL_AD_DECRYPT_ERROR;
2354 SSLerr(SSL_F_SSL3_GET_CERT_VERIFY, 2346 SSLerror(
2355 SSL_R_BAD_RSA_DECRYPT); 2347 SSL_R_BAD_RSA_DECRYPT);
2356 goto f_err; 2348 goto f_err;
2357 } 2349 }
2358 if (i == 0) { 2350 if (i == 0) {
2359 al = SSL_AD_DECRYPT_ERROR; 2351 al = SSL_AD_DECRYPT_ERROR;
2360 SSLerr(SSL_F_SSL3_GET_CERT_VERIFY, 2352 SSLerror(
2361 SSL_R_BAD_RSA_SIGNATURE); 2353 SSL_R_BAD_RSA_SIGNATURE);
2362 goto f_err; 2354 goto f_err;
2363 } 2355 }
@@ -2369,7 +2361,7 @@ ssl3_get_cert_verify(SSL *s)
2369 if (j <= 0) { 2361 if (j <= 0) {
2370 /* bad signature */ 2362 /* bad signature */
2371 al = SSL_AD_DECRYPT_ERROR; 2363 al = SSL_AD_DECRYPT_ERROR;
2372 SSLerr(SSL_F_SSL3_GET_CERT_VERIFY, 2364 SSLerror(
2373 SSL_R_BAD_DSA_SIGNATURE); 2365 SSL_R_BAD_DSA_SIGNATURE);
2374 goto f_err; 2366 goto f_err;
2375 } 2367 }
@@ -2381,7 +2373,7 @@ ssl3_get_cert_verify(SSL *s)
2381 if (j <= 0) { 2373 if (j <= 0) {
2382 /* bad signature */ 2374 /* bad signature */
2383 al = SSL_AD_DECRYPT_ERROR; 2375 al = SSL_AD_DECRYPT_ERROR;
2384 SSLerr(SSL_F_SSL3_GET_CERT_VERIFY, 2376 SSLerror(
2385 SSL_R_BAD_ECDSA_SIGNATURE); 2377 SSL_R_BAD_ECDSA_SIGNATURE);
2386 goto f_err; 2378 goto f_err;
2387 } 2379 }
@@ -2398,21 +2390,21 @@ ssl3_get_cert_verify(SSL *s)
2398 2390
2399 hdatalen = BIO_get_mem_data(S3I(s)->handshake_buffer, &hdata); 2391 hdatalen = BIO_get_mem_data(S3I(s)->handshake_buffer, &hdata);
2400 if (hdatalen <= 0) { 2392 if (hdatalen <= 0) {
2401 SSLerr(SSL_F_SSL3_GET_CERT_VERIFY, 2393 SSLerror(
2402 ERR_R_INTERNAL_ERROR); 2394 ERR_R_INTERNAL_ERROR);
2403 al = SSL_AD_INTERNAL_ERROR; 2395 al = SSL_AD_INTERNAL_ERROR;
2404 goto f_err; 2396 goto f_err;
2405 } 2397 }
2406 if (!EVP_PKEY_get_default_digest_nid(pkey, &nid) || 2398 if (!EVP_PKEY_get_default_digest_nid(pkey, &nid) ||
2407 !(md = EVP_get_digestbynid(nid))) { 2399 !(md = EVP_get_digestbynid(nid))) {
2408 SSLerr(SSL_F_SSL3_GET_CERT_VERIFY, 2400 SSLerror(
2409 ERR_R_EVP_LIB); 2401 ERR_R_EVP_LIB);
2410 al = SSL_AD_INTERNAL_ERROR; 2402 al = SSL_AD_INTERNAL_ERROR;
2411 goto f_err; 2403 goto f_err;
2412 } 2404 }
2413 pctx = EVP_PKEY_CTX_new(pkey, NULL); 2405 pctx = EVP_PKEY_CTX_new(pkey, NULL);
2414 if (!pctx) { 2406 if (!pctx) {
2415 SSLerr(SSL_F_SSL3_GET_CERT_VERIFY, 2407 SSLerror(
2416 ERR_R_EVP_LIB); 2408 ERR_R_EVP_LIB);
2417 al = SSL_AD_INTERNAL_ERROR; 2409 al = SSL_AD_INTERNAL_ERROR;
2418 goto f_err; 2410 goto f_err;
@@ -2426,7 +2418,7 @@ ssl3_get_cert_verify(SSL *s)
2426 EVP_PKEY_CTRL_GOST_SIG_FORMAT, 2418 EVP_PKEY_CTRL_GOST_SIG_FORMAT,
2427 GOST_SIG_FORMAT_RS_LE, 2419 GOST_SIG_FORMAT_RS_LE,
2428 NULL) <= 0)) { 2420 NULL) <= 0)) {
2429 SSLerr(SSL_F_SSL3_GET_CERT_VERIFY, 2421 SSLerror(
2430 ERR_R_EVP_LIB); 2422 ERR_R_EVP_LIB);
2431 al = SSL_AD_INTERNAL_ERROR; 2423 al = SSL_AD_INTERNAL_ERROR;
2432 EVP_PKEY_CTX_free(pctx); 2424 EVP_PKEY_CTX_free(pctx);
@@ -2435,7 +2427,7 @@ ssl3_get_cert_verify(SSL *s)
2435 2427
2436 if (EVP_PKEY_verify(pctx, p, i, signature, siglen) <= 0) { 2428 if (EVP_PKEY_verify(pctx, p, i, signature, siglen) <= 0) {
2437 al = SSL_AD_DECRYPT_ERROR; 2429 al = SSL_AD_DECRYPT_ERROR;
2438 SSLerr(SSL_F_SSL3_GET_CERT_VERIFY, 2430 SSLerror(
2439 SSL_R_BAD_SIGNATURE); 2431 SSL_R_BAD_SIGNATURE);
2440 EVP_PKEY_CTX_free(pctx); 2432 EVP_PKEY_CTX_free(pctx);
2441 goto f_err; 2433 goto f_err;
@@ -2445,7 +2437,7 @@ ssl3_get_cert_verify(SSL *s)
2445 } else 2437 } else
2446#endif 2438#endif
2447 { 2439 {
2448 SSLerr(SSL_F_SSL3_GET_CERT_VERIFY, 2440 SSLerror(
2449 ERR_R_INTERNAL_ERROR); 2441 ERR_R_INTERNAL_ERROR);
2450 al = SSL_AD_UNSUPPORTED_CERTIFICATE; 2442 al = SSL_AD_UNSUPPORTED_CERTIFICATE;
2451 goto f_err; 2443 goto f_err;
@@ -2456,7 +2448,7 @@ ssl3_get_cert_verify(SSL *s)
2456 if (0) { 2448 if (0) {
2457truncated: 2449truncated:
2458 al = SSL_AD_DECODE_ERROR; 2450 al = SSL_AD_DECODE_ERROR;
2459 SSLerr(SSL_F_SSL3_GET_CERT_VERIFY, SSL_R_BAD_PACKET_LENGTH); 2451 SSLerror(SSL_R_BAD_PACKET_LENGTH);
2460f_err: 2452f_err:
2461 ssl3_send_alert(s, SSL3_AL_FATAL, al); 2453 ssl3_send_alert(s, SSL3_AL_FATAL, al);
2462 } 2454 }
@@ -2490,7 +2482,7 @@ ssl3_get_client_certificate(SSL *s)
2490 if (S3I(s)->tmp.message_type == SSL3_MT_CLIENT_KEY_EXCHANGE) { 2482 if (S3I(s)->tmp.message_type == SSL3_MT_CLIENT_KEY_EXCHANGE) {
2491 if ((s->verify_mode & SSL_VERIFY_PEER) && 2483 if ((s->verify_mode & SSL_VERIFY_PEER) &&
2492 (s->verify_mode & SSL_VERIFY_FAIL_IF_NO_PEER_CERT)) { 2484 (s->verify_mode & SSL_VERIFY_FAIL_IF_NO_PEER_CERT)) {
2493 SSLerr(SSL_F_SSL3_GET_CLIENT_CERTIFICATE, 2485 SSLerror(
2494 SSL_R_PEER_DID_NOT_RETURN_A_CERTIFICATE); 2486 SSL_R_PEER_DID_NOT_RETURN_A_CERTIFICATE);
2495 al = SSL_AD_HANDSHAKE_FAILURE; 2487 al = SSL_AD_HANDSHAKE_FAILURE;
2496 goto f_err; 2488 goto f_err;
@@ -2500,7 +2492,7 @@ ssl3_get_client_certificate(SSL *s)
2500 * the client must return a 0 list. 2492 * the client must return a 0 list.
2501 */ 2493 */
2502 if (S3I(s)->tmp.cert_request) { 2494 if (S3I(s)->tmp.cert_request) {
2503 SSLerr(SSL_F_SSL3_GET_CLIENT_CERTIFICATE, 2495 SSLerror(
2504 SSL_R_TLS_PEER_DID_NOT_RESPOND_WITH_CERTIFICATE_LIST 2496 SSL_R_TLS_PEER_DID_NOT_RESPOND_WITH_CERTIFICATE_LIST
2505 ); 2497 );
2506 al = SSL_AD_UNEXPECTED_MESSAGE; 2498 al = SSL_AD_UNEXPECTED_MESSAGE;
@@ -2512,7 +2504,7 @@ ssl3_get_client_certificate(SSL *s)
2512 2504
2513 if (S3I(s)->tmp.message_type != SSL3_MT_CERTIFICATE) { 2505 if (S3I(s)->tmp.message_type != SSL3_MT_CERTIFICATE) {
2514 al = SSL_AD_UNEXPECTED_MESSAGE; 2506 al = SSL_AD_UNEXPECTED_MESSAGE;
2515 SSLerr(SSL_F_SSL3_GET_CLIENT_CERTIFICATE, 2507 SSLerror(
2516 SSL_R_WRONG_MESSAGE_TYPE); 2508 SSL_R_WRONG_MESSAGE_TYPE);
2517 goto f_err; 2509 goto f_err;
2518 } 2510 }
@@ -2523,7 +2515,7 @@ ssl3_get_client_certificate(SSL *s)
2523 CBS_init(&cbs, s->internal->init_msg, n); 2515 CBS_init(&cbs, s->internal->init_msg, n);
2524 2516
2525 if ((sk = sk_X509_new_null()) == NULL) { 2517 if ((sk = sk_X509_new_null()) == NULL) {
2526 SSLerr(SSL_F_SSL3_GET_CLIENT_CERTIFICATE, 2518 SSLerror(
2527 ERR_R_MALLOC_FAILURE); 2519 ERR_R_MALLOC_FAILURE);
2528 goto err; 2520 goto err;
2529 } 2521 }
@@ -2537,7 +2529,7 @@ ssl3_get_client_certificate(SSL *s)
2537 2529
2538 if (!CBS_get_u24_length_prefixed(&client_certs, &cert)) { 2530 if (!CBS_get_u24_length_prefixed(&client_certs, &cert)) {
2539 al = SSL_AD_DECODE_ERROR; 2531 al = SSL_AD_DECODE_ERROR;
2540 SSLerr(SSL_F_SSL3_GET_CLIENT_CERTIFICATE, 2532 SSLerror(
2541 SSL_R_CERT_LENGTH_MISMATCH); 2533 SSL_R_CERT_LENGTH_MISMATCH);
2542 goto f_err; 2534 goto f_err;
2543 } 2535 }
@@ -2545,18 +2537,18 @@ ssl3_get_client_certificate(SSL *s)
2545 q = CBS_data(&cert); 2537 q = CBS_data(&cert);
2546 x = d2i_X509(NULL, &q, CBS_len(&cert)); 2538 x = d2i_X509(NULL, &q, CBS_len(&cert));
2547 if (x == NULL) { 2539 if (x == NULL) {
2548 SSLerr(SSL_F_SSL3_GET_CLIENT_CERTIFICATE, 2540 SSLerror(
2549 ERR_R_ASN1_LIB); 2541 ERR_R_ASN1_LIB);
2550 goto err; 2542 goto err;
2551 } 2543 }
2552 if (q != CBS_data(&cert) + CBS_len(&cert)) { 2544 if (q != CBS_data(&cert) + CBS_len(&cert)) {
2553 al = SSL_AD_DECODE_ERROR; 2545 al = SSL_AD_DECODE_ERROR;
2554 SSLerr(SSL_F_SSL3_GET_CLIENT_CERTIFICATE, 2546 SSLerror(
2555 SSL_R_CERT_LENGTH_MISMATCH); 2547 SSL_R_CERT_LENGTH_MISMATCH);
2556 goto f_err; 2548 goto f_err;
2557 } 2549 }
2558 if (!sk_X509_push(sk, x)) { 2550 if (!sk_X509_push(sk, x)) {
2559 SSLerr(SSL_F_SSL3_GET_CLIENT_CERTIFICATE, 2551 SSLerror(
2560 ERR_R_MALLOC_FAILURE); 2552 ERR_R_MALLOC_FAILURE);
2561 goto err; 2553 goto err;
2562 } 2554 }
@@ -2570,7 +2562,7 @@ ssl3_get_client_certificate(SSL *s)
2570 */ 2562 */
2571 if ((s->verify_mode & SSL_VERIFY_PEER) && 2563 if ((s->verify_mode & SSL_VERIFY_PEER) &&
2572 (s->verify_mode & SSL_VERIFY_FAIL_IF_NO_PEER_CERT)) { 2564 (s->verify_mode & SSL_VERIFY_FAIL_IF_NO_PEER_CERT)) {
2573 SSLerr(SSL_F_SSL3_GET_CLIENT_CERTIFICATE, 2565 SSLerror(
2574 SSL_R_PEER_DID_NOT_RETURN_A_CERTIFICATE); 2566 SSL_R_PEER_DID_NOT_RETURN_A_CERTIFICATE);
2575 al = SSL_AD_HANDSHAKE_FAILURE; 2567 al = SSL_AD_HANDSHAKE_FAILURE;
2576 goto f_err; 2568 goto f_err;
@@ -2584,7 +2576,7 @@ ssl3_get_client_certificate(SSL *s)
2584 i = ssl_verify_cert_chain(s, sk); 2576 i = ssl_verify_cert_chain(s, sk);
2585 if (i <= 0) { 2577 if (i <= 0) {
2586 al = ssl_verify_alarm_type(s->verify_result); 2578 al = ssl_verify_alarm_type(s->verify_result);
2587 SSLerr(SSL_F_SSL3_GET_CLIENT_CERTIFICATE, 2579 SSLerror(
2588 SSL_R_NO_CERTIFICATE_RETURNED); 2580 SSL_R_NO_CERTIFICATE_RETURNED);
2589 goto f_err; 2581 goto f_err;
2590 } 2582 }
@@ -2601,7 +2593,7 @@ ssl3_get_client_certificate(SSL *s)
2601 if (SSI(s)->sess_cert == NULL) { 2593 if (SSI(s)->sess_cert == NULL) {
2602 SSI(s)->sess_cert = ssl_sess_cert_new(); 2594 SSI(s)->sess_cert = ssl_sess_cert_new();
2603 if (SSI(s)->sess_cert == NULL) { 2595 if (SSI(s)->sess_cert == NULL) {
2604 SSLerr(SSL_F_SSL3_GET_CLIENT_CERTIFICATE, 2596 SSLerror(
2605 ERR_R_MALLOC_FAILURE); 2597 ERR_R_MALLOC_FAILURE);
2606 goto err; 2598 goto err;
2607 } 2599 }
@@ -2620,7 +2612,7 @@ ssl3_get_client_certificate(SSL *s)
2620 if (0) { 2612 if (0) {
2621truncated: 2613truncated:
2622 al = SSL_AD_DECODE_ERROR; 2614 al = SSL_AD_DECODE_ERROR;
2623 SSLerr(SSL_F_SSL3_GET_CLIENT_CERTIFICATE, 2615 SSLerror(
2624 SSL_R_BAD_PACKET_LENGTH); 2616 SSL_R_BAD_PACKET_LENGTH);
2625f_err: 2617f_err:
2626 ssl3_send_alert(s, SSL3_AL_FATAL, al); 2618 ssl3_send_alert(s, SSL3_AL_FATAL, al);
@@ -2646,7 +2638,7 @@ ssl3_send_server_certificate(SSL *s)
2646 2638
2647 if (s->internal->state == SSL3_ST_SW_CERT_A) { 2639 if (s->internal->state == SSL3_ST_SW_CERT_A) {
2648 if ((x = ssl_get_server_send_cert(s)) == NULL) { 2640 if ((x = ssl_get_server_send_cert(s)) == NULL) {
2649 SSLerr(SSL_F_SSL3_SEND_SERVER_CERTIFICATE, 2641 SSLerror(
2650 ERR_R_INTERNAL_ERROR); 2642 ERR_R_INTERNAL_ERROR);
2651 return (0); 2643 return (0);
2652 } 2644 }
@@ -2865,7 +2857,7 @@ ssl3_get_next_proto(SSL *s)
2865 * extension in their ClientHello 2857 * extension in their ClientHello
2866 */ 2858 */
2867 if (!S3I(s)->next_proto_neg_seen) { 2859 if (!S3I(s)->next_proto_neg_seen) {
2868 SSLerr(SSL_F_SSL3_GET_NEXT_PROTO, 2860 SSLerror(
2869 SSL_R_GOT_NEXT_PROTO_WITHOUT_EXTENSION); 2861 SSL_R_GOT_NEXT_PROTO_WITHOUT_EXTENSION);
2870 return (-1); 2862 return (-1);
2871 } 2863 }
@@ -2882,7 +2874,7 @@ ssl3_get_next_proto(SSL *s)
2882 * by ssl3_get_finished). 2874 * by ssl3_get_finished).
2883 */ 2875 */
2884 if (!S3I(s)->change_cipher_spec) { 2876 if (!S3I(s)->change_cipher_spec) {
2885 SSLerr(SSL_F_SSL3_GET_NEXT_PROTO, 2877 SSLerror(
2886 SSL_R_GOT_NEXT_PROTO_BEFORE_A_CCS); 2878 SSL_R_GOT_NEXT_PROTO_BEFORE_A_CCS);
2887 return (-1); 2879 return (-1);
2888 } 2880 }
@@ -2913,7 +2905,7 @@ ssl3_get_next_proto(SSL *s)
2913 s->internal->next_proto_negotiated_len = 0; 2905 s->internal->next_proto_negotiated_len = 0;
2914 2906
2915 if (!CBS_stow(&proto, &s->internal->next_proto_negotiated, &len)) { 2907 if (!CBS_stow(&proto, &s->internal->next_proto_negotiated, &len)) {
2916 SSLerr(SSL_F_SSL3_GET_NEXT_PROTO, 2908 SSLerror(
2917 ERR_R_MALLOC_FAILURE); 2909 ERR_R_MALLOC_FAILURE);
2918 return (0); 2910 return (0);
2919 } 2911 }
diff --git a/src/lib/libssl/ssl_txt.c b/src/lib/libssl/ssl_txt.c
index c3626dc03a..f654d0b3a1 100644
--- a/src/lib/libssl/ssl_txt.c
+++ b/src/lib/libssl/ssl_txt.c
@@ -1,4 +1,4 @@
1/* $OpenBSD: ssl_txt.c,v 1.26 2014/12/14 15:30:50 jsing Exp $ */ 1/* $OpenBSD: ssl_txt.c,v 1.27 2017/01/26 10:40:21 beck Exp $ */
2/* Copyright (C) 1995-1998 Eric Young (eay@cryptsoft.com) 2/* Copyright (C) 1995-1998 Eric Young (eay@cryptsoft.com)
3 * All rights reserved. 3 * All rights reserved.
4 * 4 *
@@ -95,7 +95,7 @@ SSL_SESSION_print_fp(FILE *fp, const SSL_SESSION *x)
95 int ret; 95 int ret;
96 96
97 if ((b = BIO_new(BIO_s_file_internal())) == NULL) { 97 if ((b = BIO_new(BIO_s_file_internal())) == NULL) {
98 SSLerr(SSL_F_SSL_SESSION_PRINT_FP, ERR_R_BUF_LIB); 98 SSLerror(ERR_R_BUF_LIB);
99 return (0); 99 return (0);
100 } 100 }
101 BIO_set_fp(b, fp, BIO_NOCLOSE); 101 BIO_set_fp(b, fp, BIO_NOCLOSE);
diff --git a/src/lib/libssl/t1_enc.c b/src/lib/libssl/t1_enc.c
index 3181b63e39..f79219561a 100644
--- a/src/lib/libssl/t1_enc.c
+++ b/src/lib/libssl/t1_enc.c
@@ -1,4 +1,4 @@
1/* $OpenBSD: t1_enc.c,v 1.93 2017/01/23 14:35:42 jsing Exp $ */ 1/* $OpenBSD: t1_enc.c,v 1.94 2017/01/26 10:40:21 beck Exp $ */
2/* Copyright (C) 1995-1998 Eric Young (eay@cryptsoft.com) 2/* Copyright (C) 1995-1998 Eric Young (eay@cryptsoft.com)
3 * All rights reserved. 3 * All rights reserved.
4 * 4 *
@@ -203,7 +203,7 @@ tls1_finish_mac(SSL *s, const unsigned char *buf, int len)
203 if (S3I(s)->handshake_dgst[i] == NULL) 203 if (S3I(s)->handshake_dgst[i] == NULL)
204 continue; 204 continue;
205 if (!EVP_DigestUpdate(S3I(s)->handshake_dgst[i], buf, len)) { 205 if (!EVP_DigestUpdate(S3I(s)->handshake_dgst[i], buf, len)) {
206 SSLerr(SSL_F_SSL3_DIGEST_CACHED_RECORDS, ERR_R_EVP_LIB); 206 SSLerror(ERR_R_EVP_LIB);
207 return 0; 207 return 0;
208 } 208 }
209 } 209 }
@@ -223,12 +223,12 @@ tls1_digest_cached_records(SSL *s)
223 223
224 S3I(s)->handshake_dgst = calloc(SSL_MAX_DIGEST, sizeof(EVP_MD_CTX *)); 224 S3I(s)->handshake_dgst = calloc(SSL_MAX_DIGEST, sizeof(EVP_MD_CTX *));
225 if (S3I(s)->handshake_dgst == NULL) { 225 if (S3I(s)->handshake_dgst == NULL) {
226 SSLerr(SSL_F_SSL3_DIGEST_CACHED_RECORDS, ERR_R_MALLOC_FAILURE); 226 SSLerror(ERR_R_MALLOC_FAILURE);
227 goto err; 227 goto err;
228 } 228 }
229 hdatalen = BIO_get_mem_data(S3I(s)->handshake_buffer, &hdata); 229 hdatalen = BIO_get_mem_data(S3I(s)->handshake_buffer, &hdata);
230 if (hdatalen <= 0) { 230 if (hdatalen <= 0) {
231 SSLerr(SSL_F_SSL3_DIGEST_CACHED_RECORDS, 231 SSLerror(
232 SSL_R_BAD_HANDSHAKE_LENGTH); 232 SSL_R_BAD_HANDSHAKE_LENGTH);
233 goto err; 233 goto err;
234 } 234 }
@@ -240,17 +240,17 @@ tls1_digest_cached_records(SSL *s)
240 240
241 S3I(s)->handshake_dgst[i] = EVP_MD_CTX_create(); 241 S3I(s)->handshake_dgst[i] = EVP_MD_CTX_create();
242 if (S3I(s)->handshake_dgst[i] == NULL) { 242 if (S3I(s)->handshake_dgst[i] == NULL) {
243 SSLerr(SSL_F_SSL3_DIGEST_CACHED_RECORDS, 243 SSLerror(
244 ERR_R_MALLOC_FAILURE); 244 ERR_R_MALLOC_FAILURE);
245 goto err; 245 goto err;
246 } 246 }
247 if (!EVP_DigestInit_ex(S3I(s)->handshake_dgst[i], md, NULL)) { 247 if (!EVP_DigestInit_ex(S3I(s)->handshake_dgst[i], md, NULL)) {
248 SSLerr(SSL_F_SSL3_DIGEST_CACHED_RECORDS, ERR_R_EVP_LIB); 248 SSLerror(ERR_R_EVP_LIB);
249 goto err; 249 goto err;
250 } 250 }
251 if (!EVP_DigestUpdate(S3I(s)->handshake_dgst[i], hdata, 251 if (!EVP_DigestUpdate(S3I(s)->handshake_dgst[i], hdata,
252 hdatalen)) { 252 hdatalen)) {
253 SSLerr(SSL_F_SSL3_DIGEST_CACHED_RECORDS, ERR_R_EVP_LIB); 253 SSLerror(ERR_R_EVP_LIB);
254 goto err; 254 goto err;
255 } 255 }
256 } 256 }
@@ -385,7 +385,7 @@ tls1_PRF(long digest_mask, const void *seed1, int seed1_len, const void *seed2,
385 count++; 385 count++;
386 } 386 }
387 if (count == 0) { 387 if (count == 0) {
388 SSLerr(SSL_F_TLS1_PRF, 388 SSLerror(
389 SSL_R_SSL_HANDSHAKE_FAILURE); 389 SSL_R_SSL_HANDSHAKE_FAILURE);
390 goto err; 390 goto err;
391 } 391 }
@@ -397,7 +397,7 @@ tls1_PRF(long digest_mask, const void *seed1, int seed1_len, const void *seed2,
397 for (idx = 0; ssl_get_handshake_digest(idx, &m, &md); idx++) { 397 for (idx = 0; ssl_get_handshake_digest(idx, &m, &md); idx++) {
398 if ((m << TLS1_PRF_DGST_SHIFT) & digest_mask) { 398 if ((m << TLS1_PRF_DGST_SHIFT) & digest_mask) {
399 if (!md) { 399 if (!md) {
400 SSLerr(SSL_F_TLS1_PRF, 400 SSLerror(
401 SSL_R_UNSUPPORTED_DIGEST_TYPE); 401 SSL_R_UNSUPPORTED_DIGEST_TYPE);
402 goto err; 402 goto err;
403 } 403 }
@@ -446,7 +446,7 @@ tls1_aead_ctx_init(SSL_AEAD_CTX **aead_ctx)
446 446
447 *aead_ctx = malloc(sizeof(SSL_AEAD_CTX)); 447 *aead_ctx = malloc(sizeof(SSL_AEAD_CTX));
448 if (*aead_ctx == NULL) { 448 if (*aead_ctx == NULL) {
449 SSLerr(SSL_F_TLS1_AEAD_CTX_INIT, ERR_R_MALLOC_FAILURE); 449 SSLerror(ERR_R_MALLOC_FAILURE);
450 return (0); 450 return (0);
451 } 451 }
452 452
@@ -474,7 +474,7 @@ tls1_change_cipher_state_aead(SSL *s, char is_read, const unsigned char *key,
474 EVP_AEAD_DEFAULT_TAG_LENGTH, NULL)) 474 EVP_AEAD_DEFAULT_TAG_LENGTH, NULL))
475 return (0); 475 return (0);
476 if (iv_len > sizeof(aead_ctx->fixed_nonce)) { 476 if (iv_len > sizeof(aead_ctx->fixed_nonce)) {
477 SSLerr(SSL_F_TLS1_CHANGE_CIPHER_STATE_AEAD, 477 SSLerror(
478 ERR_R_INTERNAL_ERROR); 478 ERR_R_INTERNAL_ERROR);
479 return (0); 479 return (0);
480 } 480 }
@@ -491,14 +491,14 @@ tls1_change_cipher_state_aead(SSL *s, char is_read, const unsigned char *key,
491 if (aead_ctx->xor_fixed_nonce) { 491 if (aead_ctx->xor_fixed_nonce) {
492 if (aead_ctx->fixed_nonce_len != EVP_AEAD_nonce_length(aead) || 492 if (aead_ctx->fixed_nonce_len != EVP_AEAD_nonce_length(aead) ||
493 aead_ctx->variable_nonce_len > EVP_AEAD_nonce_length(aead)) { 493 aead_ctx->variable_nonce_len > EVP_AEAD_nonce_length(aead)) {
494 SSLerr(SSL_F_TLS1_CHANGE_CIPHER_STATE_AEAD, 494 SSLerror(
495 ERR_R_INTERNAL_ERROR); 495 ERR_R_INTERNAL_ERROR);
496 return (0); 496 return (0);
497 } 497 }
498 } else { 498 } else {
499 if (aead_ctx->variable_nonce_len + aead_ctx->fixed_nonce_len != 499 if (aead_ctx->variable_nonce_len + aead_ctx->fixed_nonce_len !=
500 EVP_AEAD_nonce_length(aead)) { 500 EVP_AEAD_nonce_length(aead)) {
501 SSLerr(SSL_F_TLS1_CHANGE_CIPHER_STATE_AEAD, 501 SSLerror(
502 ERR_R_INTERNAL_ERROR); 502 ERR_R_INTERNAL_ERROR);
503 return (0); 503 return (0);
504 } 504 }
@@ -610,7 +610,7 @@ tls1_change_cipher_state_cipher(SSL *s, char is_read, char use_client_keys,
610 return (1); 610 return (1);
611 611
612err: 612err:
613 SSLerr(SSL_F_TLS1_CHANGE_CIPHER_STATE_CIPHER, ERR_R_MALLOC_FAILURE); 613 SSLerror(ERR_R_MALLOC_FAILURE);
614 return (0); 614 return (0);
615} 615}
616 616
@@ -695,7 +695,7 @@ tls1_change_cipher_state(SSL *s, int which)
695 } 695 }
696 696
697 if (key_block - S3I(s)->tmp.key_block != S3I(s)->tmp.key_block_length) { 697 if (key_block - S3I(s)->tmp.key_block != S3I(s)->tmp.key_block_length) {
698 SSLerr(SSL_F_TLS1_CHANGE_CIPHER_STATE, ERR_R_INTERNAL_ERROR); 698 SSLerror(ERR_R_INTERNAL_ERROR);
699 goto err2; 699 goto err2;
700 } 700 }
701 701
@@ -736,7 +736,7 @@ tls1_setup_key_block(SSL *s)
736 if (s->session->cipher && 736 if (s->session->cipher &&
737 (s->session->cipher->algorithm2 & SSL_CIPHER_ALGORITHM2_AEAD)) { 737 (s->session->cipher->algorithm2 & SSL_CIPHER_ALGORITHM2_AEAD)) {
738 if (!ssl_cipher_get_evp_aead(s->session, &aead)) { 738 if (!ssl_cipher_get_evp_aead(s->session, &aead)) {
739 SSLerr(SSL_F_TLS1_SETUP_KEY_BLOCK, 739 SSLerror(
740 SSL_R_CIPHER_OR_HASH_UNAVAILABLE); 740 SSL_R_CIPHER_OR_HASH_UNAVAILABLE);
741 return (0); 741 return (0);
742 } 742 }
@@ -745,7 +745,7 @@ tls1_setup_key_block(SSL *s)
745 } else { 745 } else {
746 if (!ssl_cipher_get_evp(s->session, &cipher, &mac, &mac_type, 746 if (!ssl_cipher_get_evp(s->session, &cipher, &mac, &mac_type,
747 &mac_secret_size)) { 747 &mac_secret_size)) {
748 SSLerr(SSL_F_TLS1_SETUP_KEY_BLOCK, 748 SSLerror(
749 SSL_R_CIPHER_OR_HASH_UNAVAILABLE); 749 SSL_R_CIPHER_OR_HASH_UNAVAILABLE);
750 return (0); 750 return (0);
751 } 751 }
@@ -767,7 +767,7 @@ tls1_setup_key_block(SSL *s)
767 767
768 if ((key_block = reallocarray(NULL, mac_secret_size + key_len + iv_len, 768 if ((key_block = reallocarray(NULL, mac_secret_size + key_len + iv_len,
769 2)) == NULL) { 769 2)) == NULL) {
770 SSLerr(SSL_F_TLS1_SETUP_KEY_BLOCK, ERR_R_MALLOC_FAILURE); 770 SSLerror(ERR_R_MALLOC_FAILURE);
771 goto err; 771 goto err;
772 } 772 }
773 key_block_len = (mac_secret_size + key_len + iv_len) * 2; 773 key_block_len = (mac_secret_size + key_len + iv_len) * 2;
@@ -776,7 +776,7 @@ tls1_setup_key_block(SSL *s)
776 S3I(s)->tmp.key_block = key_block; 776 S3I(s)->tmp.key_block = key_block;
777 777
778 if ((tmp_block = malloc(key_block_len)) == NULL) { 778 if ((tmp_block = malloc(key_block_len)) == NULL) {
779 SSLerr(SSL_F_TLS1_SETUP_KEY_BLOCK, ERR_R_MALLOC_FAILURE); 779 SSLerror(ERR_R_MALLOC_FAILURE);
780 goto err; 780 goto err;
781 } 781 }
782 782
@@ -1114,7 +1114,7 @@ tls1_cert_verify_mac(SSL *s, int md_nid, unsigned char *out)
1114 } 1114 }
1115 } 1115 }
1116 if (d == NULL) { 1116 if (d == NULL) {
1117 SSLerr(SSL_F_TLS1_CERT_VERIFY_MAC, SSL_R_NO_REQUIRED_DIGEST); 1117 SSLerror(SSL_R_NO_REQUIRED_DIGEST);
1118 return 0; 1118 return 0;
1119 } 1119 }
1120 1120
@@ -1345,12 +1345,12 @@ tls1_export_keying_material(SSL *s, unsigned char *out, size_t olen,
1345 1345
1346 goto ret; 1346 goto ret;
1347err1: 1347err1:
1348 SSLerr(SSL_F_TLS1_EXPORT_KEYING_MATERIAL, 1348 SSLerror(
1349 SSL_R_TLS_ILLEGAL_EXPORTER_LABEL); 1349 SSL_R_TLS_ILLEGAL_EXPORTER_LABEL);
1350 rv = 0; 1350 rv = 0;
1351 goto ret; 1351 goto ret;
1352err2: 1352err2:
1353 SSLerr(SSL_F_TLS1_EXPORT_KEYING_MATERIAL, ERR_R_MALLOC_FAILURE); 1353 SSLerror(ERR_R_MALLOC_FAILURE);
1354 rv = 0; 1354 rv = 0;
1355ret: 1355ret:
1356 free(buff); 1356 free(buff);
diff --git a/src/lib/libssl/t1_lib.c b/src/lib/libssl/t1_lib.c
index 3585a3ac55..b3e86c0a31 100644
--- a/src/lib/libssl/t1_lib.c
+++ b/src/lib/libssl/t1_lib.c
@@ -1,4 +1,4 @@
1/* $OpenBSD: t1_lib.c,v 1.112 2017/01/26 06:32:58 jsing Exp $ */ 1/* $OpenBSD: t1_lib.c,v 1.113 2017/01/26 10:40:21 beck Exp $ */
2/* Copyright (C) 1995-1998 Eric Young (eay@cryptsoft.com) 2/* Copyright (C) 1995-1998 Eric Young (eay@cryptsoft.com)
3 * All rights reserved. 3 * All rights reserved.
4 * 4 *
@@ -742,7 +742,7 @@ ssl_add_clienthello_tlsext(SSL *s, unsigned char *p, unsigned char *limit)
742 int el; 742 int el;
743 743
744 if (!ssl_add_clienthello_renegotiate_ext(s, 0, &el, 0)) { 744 if (!ssl_add_clienthello_renegotiate_ext(s, 0, &el, 0)) {
745 SSLerr(SSL_F_SSL_ADD_CLIENTHELLO_TLSEXT, 745 SSLerror(
746 ERR_R_INTERNAL_ERROR); 746 ERR_R_INTERNAL_ERROR);
747 return NULL; 747 return NULL;
748 } 748 }
@@ -754,7 +754,7 @@ ssl_add_clienthello_tlsext(SSL *s, unsigned char *p, unsigned char *limit)
754 s2n(el, ret); 754 s2n(el, ret);
755 755
756 if (!ssl_add_clienthello_renegotiate_ext(s, ret, &el, el)) { 756 if (!ssl_add_clienthello_renegotiate_ext(s, ret, &el, el)) {
757 SSLerr(SSL_F_SSL_ADD_CLIENTHELLO_TLSEXT, 757 SSLerror(
758 ERR_R_INTERNAL_ERROR); 758 ERR_R_INTERNAL_ERROR);
759 return NULL; 759 return NULL;
760 } 760 }
@@ -780,7 +780,7 @@ ssl_add_clienthello_tlsext(SSL *s, unsigned char *p, unsigned char *limit)
780 if (formatslen > lenmax) 780 if (formatslen > lenmax)
781 return NULL; 781 return NULL;
782 if (formatslen > 255) { 782 if (formatslen > 255) {
783 SSLerr(SSL_F_SSL_ADD_CLIENTHELLO_TLSEXT, 783 SSLerror(
784 ERR_R_INTERNAL_ERROR); 784 ERR_R_INTERNAL_ERROR);
785 return NULL; 785 return NULL;
786 } 786 }
@@ -803,7 +803,7 @@ ssl_add_clienthello_tlsext(SSL *s, unsigned char *p, unsigned char *limit)
803 if (curveslen * 2 > lenmax) 803 if (curveslen * 2 > lenmax)
804 return NULL; 804 return NULL;
805 if (curveslen * 2 > 65532) { 805 if (curveslen * 2 > 65532) {
806 SSLerr(SSL_F_SSL_ADD_CLIENTHELLO_TLSEXT, 806 SSLerror(
807 ERR_R_INTERNAL_ERROR); 807 ERR_R_INTERNAL_ERROR);
808 return NULL; 808 return NULL;
809 } 809 }
@@ -946,7 +946,7 @@ skip_ext:
946 s2n(el, ret); 946 s2n(el, ret);
947 947
948 if (ssl_add_clienthello_use_srtp_ext(s, ret, &el, el)) { 948 if (ssl_add_clienthello_use_srtp_ext(s, ret, &el, el)) {
949 SSLerr(SSL_F_SSL_ADD_CLIENTHELLO_TLSEXT, 949 SSLerror(
950 ERR_R_INTERNAL_ERROR); 950 ERR_R_INTERNAL_ERROR);
951 return NULL; 951 return NULL;
952 } 952 }
@@ -1025,7 +1025,7 @@ ssl_add_serverhello_tlsext(SSL *s, unsigned char *p, unsigned char *limit)
1025 int el; 1025 int el;
1026 1026
1027 if (!ssl_add_serverhello_renegotiate_ext(s, 0, &el, 0)) { 1027 if (!ssl_add_serverhello_renegotiate_ext(s, 0, &el, 0)) {
1028 SSLerr(SSL_F_SSL_ADD_SERVERHELLO_TLSEXT, 1028 SSLerror(
1029 ERR_R_INTERNAL_ERROR); 1029 ERR_R_INTERNAL_ERROR);
1030 return NULL; 1030 return NULL;
1031 } 1031 }
@@ -1037,7 +1037,7 @@ ssl_add_serverhello_tlsext(SSL *s, unsigned char *p, unsigned char *limit)
1037 s2n(el, ret); 1037 s2n(el, ret);
1038 1038
1039 if (!ssl_add_serverhello_renegotiate_ext(s, ret, &el, el)) { 1039 if (!ssl_add_serverhello_renegotiate_ext(s, ret, &el, el)) {
1040 SSLerr(SSL_F_SSL_ADD_SERVERHELLO_TLSEXT, 1040 SSLerror(
1041 ERR_R_INTERNAL_ERROR); 1041 ERR_R_INTERNAL_ERROR);
1042 return NULL; 1042 return NULL;
1043 } 1043 }
@@ -1061,7 +1061,7 @@ ssl_add_serverhello_tlsext(SSL *s, unsigned char *p, unsigned char *limit)
1061 if (formatslen > lenmax) 1061 if (formatslen > lenmax)
1062 return NULL; 1062 return NULL;
1063 if (formatslen > 255) { 1063 if (formatslen > 255) {
1064 SSLerr(SSL_F_SSL_ADD_SERVERHELLO_TLSEXT, 1064 SSLerror(
1065 ERR_R_INTERNAL_ERROR); 1065 ERR_R_INTERNAL_ERROR);
1066 return NULL; 1066 return NULL;
1067 } 1067 }
@@ -1108,7 +1108,7 @@ ssl_add_serverhello_tlsext(SSL *s, unsigned char *p, unsigned char *limit)
1108 s2n(el, ret); 1108 s2n(el, ret);
1109 1109
1110 if (ssl_add_serverhello_use_srtp_ext(s, ret, &el, el)) { 1110 if (ssl_add_serverhello_use_srtp_ext(s, ret, &el, el)) {
1111 SSLerr(SSL_F_SSL_ADD_SERVERHELLO_TLSEXT, 1111 SSLerror(
1112 ERR_R_INTERNAL_ERROR); 1112 ERR_R_INTERNAL_ERROR);
1113 return NULL; 1113 return NULL;
1114 } 1114 }
@@ -1627,7 +1627,7 @@ ri_check:
1627 1627
1628 if (!renegotiate_seen && s->internal->renegotiate) { 1628 if (!renegotiate_seen && s->internal->renegotiate) {
1629 *al = SSL_AD_HANDSHAKE_FAILURE; 1629 *al = SSL_AD_HANDSHAKE_FAILURE;
1630 SSLerr(SSL_F_SSL_PARSE_CLIENTHELLO_TLSEXT, 1630 SSLerror(
1631 SSL_R_UNSAFE_LEGACY_RENEGOTIATION_DISABLED); 1631 SSL_R_UNSAFE_LEGACY_RENEGOTIATION_DISABLED);
1632 return 0; 1632 return 0;
1633 } 1633 }
@@ -1880,7 +1880,7 @@ ri_check:
1880 if (!renegotiate_seen && 1880 if (!renegotiate_seen &&
1881 !(s->internal->options & SSL_OP_LEGACY_SERVER_CONNECT)) { 1881 !(s->internal->options & SSL_OP_LEGACY_SERVER_CONNECT)) {
1882 *al = SSL_AD_HANDSHAKE_FAILURE; 1882 *al = SSL_AD_HANDSHAKE_FAILURE;
1883 SSLerr(SSL_F_SSL_PARSE_SERVERHELLO_TLSEXT, 1883 SSLerror(
1884 SSL_R_UNSAFE_LEGACY_RENEGOTIATION_DISABLED); 1884 SSL_R_UNSAFE_LEGACY_RENEGOTIATION_DISABLED);
1885 return 0; 1885 return 0;
1886 } 1886 }
@@ -2016,7 +2016,7 @@ ssl_check_serverhello_tlsext(SSL *s)
2016 } 2016 }
2017 } 2017 }
2018 if (!found_uncompressed) { 2018 if (!found_uncompressed) {
2019 SSLerr(SSL_F_SSL_CHECK_SERVERHELLO_TLSEXT, SSL_R_TLS_INVALID_ECPOINTFORMAT_LIST); 2019 SSLerror(SSL_R_TLS_INVALID_ECPOINTFORMAT_LIST);
2020 return -1; 2020 return -1;
2021 } 2021 }
2022 } 2022 }
diff --git a/src/lib/libssl/t1_reneg.c b/src/lib/libssl/t1_reneg.c
index 52f17b7d2b..ea432554b0 100644
--- a/src/lib/libssl/t1_reneg.c
+++ b/src/lib/libssl/t1_reneg.c
@@ -1,4 +1,4 @@
1/* $OpenBSD: t1_reneg.c,v 1.12 2017/01/22 09:02:07 jsing Exp $ */ 1/* $OpenBSD: t1_reneg.c,v 1.13 2017/01/26 10:40:21 beck Exp $ */
2/* Copyright (C) 1995-1998 Eric Young (eay@cryptsoft.com) 2/* Copyright (C) 1995-1998 Eric Young (eay@cryptsoft.com)
3 * All rights reserved. 3 * All rights reserved.
4 * 4 *
@@ -123,7 +123,7 @@ ssl_add_clienthello_renegotiate_ext(SSL *s, unsigned char *p, int *len,
123{ 123{
124 if (p) { 124 if (p) {
125 if ((S3I(s)->previous_client_finished_len + 1) > maxlen) { 125 if ((S3I(s)->previous_client_finished_len + 1) > maxlen) {
126 SSLerr(SSL_F_SSL_ADD_CLIENTHELLO_RENEGOTIATE_EXT, 126 SSLerror(
127 SSL_R_RENEGOTIATE_EXT_TOO_LONG); 127 SSL_R_RENEGOTIATE_EXT_TOO_LONG);
128 return 0; 128 return 0;
129 } 129 }
@@ -151,7 +151,7 @@ ssl_parse_clienthello_renegotiate_ext(SSL *s, const unsigned char *d, int len,
151 CBS cbs, reneg; 151 CBS cbs, reneg;
152 152
153 if (len < 0) { 153 if (len < 0) {
154 SSLerr(SSL_F_SSL_PARSE_CLIENTHELLO_RENEGOTIATE_EXT, 154 SSLerror(
155 SSL_R_RENEGOTIATION_ENCODING_ERR); 155 SSL_R_RENEGOTIATION_ENCODING_ERR);
156 *al = SSL_AD_ILLEGAL_PARAMETER; 156 *al = SSL_AD_ILLEGAL_PARAMETER;
157 return 0; 157 return 0;
@@ -161,7 +161,7 @@ ssl_parse_clienthello_renegotiate_ext(SSL *s, const unsigned char *d, int len,
161 if (!CBS_get_u8_length_prefixed(&cbs, &reneg) || 161 if (!CBS_get_u8_length_prefixed(&cbs, &reneg) ||
162 /* Consistency check */ 162 /* Consistency check */
163 CBS_len(&cbs) != 0) { 163 CBS_len(&cbs) != 0) {
164 SSLerr(SSL_F_SSL_PARSE_CLIENTHELLO_RENEGOTIATE_EXT, 164 SSLerror(
165 SSL_R_RENEGOTIATION_ENCODING_ERR); 165 SSL_R_RENEGOTIATION_ENCODING_ERR);
166 *al = SSL_AD_ILLEGAL_PARAMETER; 166 *al = SSL_AD_ILLEGAL_PARAMETER;
167 return 0; 167 return 0;
@@ -169,7 +169,7 @@ ssl_parse_clienthello_renegotiate_ext(SSL *s, const unsigned char *d, int len,
169 169
170 /* Check that the extension matches */ 170 /* Check that the extension matches */
171 if (CBS_len(&reneg) != S3I(s)->previous_client_finished_len) { 171 if (CBS_len(&reneg) != S3I(s)->previous_client_finished_len) {
172 SSLerr(SSL_F_SSL_PARSE_CLIENTHELLO_RENEGOTIATE_EXT, 172 SSLerror(
173 SSL_R_RENEGOTIATION_MISMATCH); 173 SSL_R_RENEGOTIATION_MISMATCH);
174 *al = SSL_AD_HANDSHAKE_FAILURE; 174 *al = SSL_AD_HANDSHAKE_FAILURE;
175 return 0; 175 return 0;
@@ -177,7 +177,7 @@ ssl_parse_clienthello_renegotiate_ext(SSL *s, const unsigned char *d, int len,
177 177
178 if (!CBS_mem_equal(&reneg, S3I(s)->previous_client_finished, 178 if (!CBS_mem_equal(&reneg, S3I(s)->previous_client_finished,
179 S3I(s)->previous_client_finished_len)) { 179 S3I(s)->previous_client_finished_len)) {
180 SSLerr(SSL_F_SSL_PARSE_CLIENTHELLO_RENEGOTIATE_EXT, 180 SSLerror(
181 SSL_R_RENEGOTIATION_MISMATCH); 181 SSL_R_RENEGOTIATION_MISMATCH);
182 *al = SSL_AD_HANDSHAKE_FAILURE; 182 *al = SSL_AD_HANDSHAKE_FAILURE;
183 return 0; 183 return 0;
@@ -196,7 +196,7 @@ ssl_add_serverhello_renegotiate_ext(SSL *s, unsigned char *p, int *len,
196 if (p) { 196 if (p) {
197 if ((S3I(s)->previous_client_finished_len + 197 if ((S3I(s)->previous_client_finished_len +
198 S3I(s)->previous_server_finished_len + 1) > maxlen) { 198 S3I(s)->previous_server_finished_len + 1) > maxlen) {
199 SSLerr(SSL_F_SSL_ADD_SERVERHELLO_RENEGOTIATE_EXT, 199 SSLerror(
200 SSL_R_RENEGOTIATE_EXT_TOO_LONG); 200 SSL_R_RENEGOTIATE_EXT_TOO_LONG);
201 return 0; 201 return 0;
202 } 202 }
@@ -235,7 +235,7 @@ ssl_parse_serverhello_renegotiate_ext(SSL *s, const unsigned char *d, int len, i
235 OPENSSL_assert(!expected_len || S3I(s)->previous_server_finished_len); 235 OPENSSL_assert(!expected_len || S3I(s)->previous_server_finished_len);
236 236
237 if (len < 0) { 237 if (len < 0) {
238 SSLerr(SSL_F_SSL_PARSE_SERVERHELLO_RENEGOTIATE_EXT, 238 SSLerror(
239 SSL_R_RENEGOTIATION_ENCODING_ERR); 239 SSL_R_RENEGOTIATION_ENCODING_ERR);
240 *al = SSL_AD_ILLEGAL_PARAMETER; 240 *al = SSL_AD_ILLEGAL_PARAMETER;
241 return 0; 241 return 0;
@@ -246,7 +246,7 @@ ssl_parse_serverhello_renegotiate_ext(SSL *s, const unsigned char *d, int len, i
246 if (!CBS_get_u8_length_prefixed(&cbs, &reneg) || 246 if (!CBS_get_u8_length_prefixed(&cbs, &reneg) ||
247 /* Consistency check */ 247 /* Consistency check */
248 CBS_len(&cbs) != 0) { 248 CBS_len(&cbs) != 0) {
249 SSLerr(SSL_F_SSL_PARSE_SERVERHELLO_RENEGOTIATE_EXT, 249 SSLerror(
250 SSL_R_RENEGOTIATION_ENCODING_ERR); 250 SSL_R_RENEGOTIATION_ENCODING_ERR);
251 *al = SSL_AD_ILLEGAL_PARAMETER; 251 *al = SSL_AD_ILLEGAL_PARAMETER;
252 return 0; 252 return 0;
@@ -259,7 +259,7 @@ ssl_parse_serverhello_renegotiate_ext(SSL *s, const unsigned char *d, int len, i
259 !CBS_get_bytes(&reneg, &previous_server, 259 !CBS_get_bytes(&reneg, &previous_server,
260 S3I(s)->previous_server_finished_len) || 260 S3I(s)->previous_server_finished_len) ||
261 CBS_len(&reneg) != 0) { 261 CBS_len(&reneg) != 0) {
262 SSLerr(SSL_F_SSL_PARSE_SERVERHELLO_RENEGOTIATE_EXT, 262 SSLerror(
263 SSL_R_RENEGOTIATION_MISMATCH); 263 SSL_R_RENEGOTIATION_MISMATCH);
264 *al = SSL_AD_HANDSHAKE_FAILURE; 264 *al = SSL_AD_HANDSHAKE_FAILURE;
265 return 0; 265 return 0;
@@ -267,14 +267,14 @@ ssl_parse_serverhello_renegotiate_ext(SSL *s, const unsigned char *d, int len, i
267 267
268 if (!CBS_mem_equal(&previous_client, S3I(s)->previous_client_finished, 268 if (!CBS_mem_equal(&previous_client, S3I(s)->previous_client_finished,
269 CBS_len(&previous_client))) { 269 CBS_len(&previous_client))) {
270 SSLerr(SSL_F_SSL_PARSE_SERVERHELLO_RENEGOTIATE_EXT, 270 SSLerror(
271 SSL_R_RENEGOTIATION_MISMATCH); 271 SSL_R_RENEGOTIATION_MISMATCH);
272 *al = SSL_AD_HANDSHAKE_FAILURE; 272 *al = SSL_AD_HANDSHAKE_FAILURE;
273 return 0; 273 return 0;
274 } 274 }
275 if (!CBS_mem_equal(&previous_server, S3I(s)->previous_server_finished, 275 if (!CBS_mem_equal(&previous_server, S3I(s)->previous_server_finished,
276 CBS_len(&previous_server))) { 276 CBS_len(&previous_server))) {
277 SSLerr(SSL_F_SSL_PARSE_SERVERHELLO_RENEGOTIATE_EXT, 277 SSLerror(
278 SSL_R_RENEGOTIATION_MISMATCH); 278 SSL_R_RENEGOTIATION_MISMATCH);
279 *al = SSL_AD_ILLEGAL_PARAMETER; 279 *al = SSL_AD_ILLEGAL_PARAMETER;
280 return 0; 280 return 0;
generated by cgit v1.2.3-55-g6feb (git 2.39.1) at 2025-11-02 15:38:35 +0000