summaryrefslogtreecommitdiff
diff options
context:
space:
mode:
Diffstat
-rw-r--r--src/lib/libssl/src/ssl/ssl_algs.c25
-rw-r--r--src/lib/libssl/src/ssl/ssl_asn1.c634
-rw-r--r--src/lib/libssl/src/ssl/ssl_cert.c649
-rw-r--r--src/lib/libssl/src/ssl/ssl_ciph.c1393
-rw-r--r--src/lib/libssl/src/ssl/ssl_err.c1064
-rw-r--r--src/lib/libssl/src/ssl/ssl_err2.c7
-rw-r--r--src/lib/libssl/src/ssl/ssl_lib.c3159
-rw-r--r--src/lib/libssl/src/ssl/ssl_rsa.c882
-rw-r--r--src/lib/libssl/src/ssl/ssl_sess.c1094
-rw-r--r--src/lib/libssl/src/ssl/ssl_stat.c893
-rw-r--r--src/lib/libssl/src/ssl/ssl_task.c287
-rw-r--r--src/lib/libssl/src/ssl/ssl_txt.c211
-rw-r--r--src/lib/libssl/ssl_algs.c25
-rw-r--r--src/lib/libssl/ssl_asn1.c634
-rw-r--r--src/lib/libssl/ssl_cert.c649
-rw-r--r--src/lib/libssl/ssl_ciph.c1393
-rw-r--r--src/lib/libssl/ssl_err.c1064
-rw-r--r--src/lib/libssl/ssl_err2.c7
-rw-r--r--src/lib/libssl/ssl_lib.c3159
-rw-r--r--src/lib/libssl/ssl_rsa.c882
-rw-r--r--src/lib/libssl/ssl_sess.c1094
-rw-r--r--src/lib/libssl/ssl_stat.c893
-rw-r--r--src/lib/libssl/ssl_txt.c211
23 files changed, 10335 insertions, 9974 deletions
diff --git a/src/lib/libssl/src/ssl/ssl_algs.c b/src/lib/libssl/src/ssl/ssl_algs.c
index 9c34d19725..76644bda91 100644
--- a/src/lib/libssl/src/ssl/ssl_algs.c
+++ b/src/lib/libssl/src/ssl/ssl_algs.c
@@ -61,8 +61,9 @@
61#include <openssl/lhash.h> 61#include <openssl/lhash.h>
62#include "ssl_locl.h" 62#include "ssl_locl.h"
63 63
64int SSL_library_init(void) 64int
65 { 65SSL_library_init(void)
66{
66 67
67#ifndef OPENSSL_NO_DES 68#ifndef OPENSSL_NO_DES
68 EVP_add_cipher(EVP_des_cbc()); 69 EVP_add_cipher(EVP_des_cbc());
@@ -104,16 +105,16 @@ int SSL_library_init(void)
104#ifndef OPENSSL_NO_SEED 105#ifndef OPENSSL_NO_SEED
105 EVP_add_cipher(EVP_seed_cbc()); 106 EVP_add_cipher(EVP_seed_cbc());
106#endif 107#endif
107 108
108#ifndef OPENSSL_NO_MD5 109#ifndef OPENSSL_NO_MD5
109 EVP_add_digest(EVP_md5()); 110 EVP_add_digest(EVP_md5());
110 EVP_add_digest_alias(SN_md5,"ssl2-md5"); 111 EVP_add_digest_alias(SN_md5, "ssl2-md5");
111 EVP_add_digest_alias(SN_md5,"ssl3-md5"); 112 EVP_add_digest_alias(SN_md5, "ssl3-md5");
112#endif 113#endif
113#ifndef OPENSSL_NO_SHA 114#ifndef OPENSSL_NO_SHA
114 EVP_add_digest(EVP_sha1()); /* RSA with sha1 */ 115 EVP_add_digest(EVP_sha1()); /* RSA with sha1 */
115 EVP_add_digest_alias(SN_sha1,"ssl3-sha1"); 116 EVP_add_digest_alias(SN_sha1, "ssl3-sha1");
116 EVP_add_digest_alias(SN_sha1WithRSAEncryption,SN_sha1WithRSA); 117 EVP_add_digest_alias(SN_sha1WithRSAEncryption, SN_sha1WithRSA);
117#endif 118#endif
118#ifndef OPENSSL_NO_SHA256 119#ifndef OPENSSL_NO_SHA256
119 EVP_add_digest(EVP_sha224()); 120 EVP_add_digest(EVP_sha224());
@@ -125,9 +126,9 @@ int SSL_library_init(void)
125#endif 126#endif
126#if !defined(OPENSSL_NO_SHA) && !defined(OPENSSL_NO_DSA) 127#if !defined(OPENSSL_NO_SHA) && !defined(OPENSSL_NO_DSA)
127 EVP_add_digest(EVP_dss1()); /* DSA with sha1 */ 128 EVP_add_digest(EVP_dss1()); /* DSA with sha1 */
128 EVP_add_digest_alias(SN_dsaWithSHA1,SN_dsaWithSHA1_2); 129 EVP_add_digest_alias(SN_dsaWithSHA1, SN_dsaWithSHA1_2);
129 EVP_add_digest_alias(SN_dsaWithSHA1,"DSS1"); 130 EVP_add_digest_alias(SN_dsaWithSHA1, "DSS1");
130 EVP_add_digest_alias(SN_dsaWithSHA1,"dss1"); 131 EVP_add_digest_alias(SN_dsaWithSHA1, "dss1");
131#endif 132#endif
132#ifndef OPENSSL_NO_ECDSA 133#ifndef OPENSSL_NO_ECDSA
133 EVP_add_digest(EVP_ecdsa()); 134 EVP_add_digest(EVP_ecdsa());
@@ -145,6 +146,6 @@ int SSL_library_init(void)
145#endif 146#endif
146 /* initialize cipher/digest methods table */ 147 /* initialize cipher/digest methods table */
147 ssl_load_ciphers(); 148 ssl_load_ciphers();
148 return(1); 149 return (1);
149 } 150}
150 151
diff --git a/src/lib/libssl/src/ssl/ssl_asn1.c b/src/lib/libssl/src/ssl/ssl_asn1.c
index 38540be1e5..51668db785 100644
--- a/src/lib/libssl/src/ssl/ssl_asn1.c
+++ b/src/lib/libssl/src/ssl/ssl_asn1.c
@@ -89,8 +89,7 @@
89#include <openssl/objects.h> 89#include <openssl/objects.h>
90#include <openssl/x509.h> 90#include <openssl/x509.h>
91 91
92typedef struct ssl_session_asn1_st 92typedef struct ssl_session_asn1_st {
93 {
94 ASN1_INTEGER version; 93 ASN1_INTEGER version;
95 ASN1_INTEGER ssl_version; 94 ASN1_INTEGER ssl_version;
96 ASN1_OCTET_STRING cipher; 95 ASN1_OCTET_STRING cipher;
@@ -100,7 +99,7 @@ typedef struct ssl_session_asn1_st
100 ASN1_OCTET_STRING session_id_context; 99 ASN1_OCTET_STRING session_id_context;
101 ASN1_OCTET_STRING key_arg; 100 ASN1_OCTET_STRING key_arg;
102#ifndef OPENSSL_NO_KRB5 101#ifndef OPENSSL_NO_KRB5
103 ASN1_OCTET_STRING krb5_princ; 102 ASN1_OCTET_STRING krb5_princ;
104#endif /* OPENSSL_NO_KRB5 */ 103#endif /* OPENSSL_NO_KRB5 */
105 ASN1_INTEGER time; 104 ASN1_INTEGER time;
106 ASN1_INTEGER timeout; 105 ASN1_INTEGER timeout;
@@ -117,169 +116,156 @@ typedef struct ssl_session_asn1_st
117#ifndef OPENSSL_NO_SRP 116#ifndef OPENSSL_NO_SRP
118 ASN1_OCTET_STRING srp_username; 117 ASN1_OCTET_STRING srp_username;
119#endif /* OPENSSL_NO_SRP */ 118#endif /* OPENSSL_NO_SRP */
120 } SSL_SESSION_ASN1; 119} SSL_SESSION_ASN1;
121 120
122int i2d_SSL_SESSION(SSL_SESSION *in, unsigned char **pp) 121int
123 { 122i2d_SSL_SESSION(SSL_SESSION *in, unsigned char **pp)
123{
124#define LSIZE2 (sizeof(long)*2) 124#define LSIZE2 (sizeof(long)*2)
125 int v1=0,v2=0,v3=0,v4=0,v5=0,v7=0,v8=0; 125 int v1 = 0, v2 = 0, v3 = 0, v4 = 0, v5 = 0, v7 = 0, v8 = 0;
126 unsigned char buf[4],ibuf1[LSIZE2],ibuf2[LSIZE2]; 126 unsigned char buf[4], ibuf1[LSIZE2], ibuf2[LSIZE2];
127 unsigned char ibuf3[LSIZE2],ibuf4[LSIZE2],ibuf5[LSIZE2]; 127 unsigned char ibuf3[LSIZE2], ibuf4[LSIZE2], ibuf5[LSIZE2];
128#ifndef OPENSSL_NO_TLSEXT 128#ifndef OPENSSL_NO_TLSEXT
129 int v6=0,v9=0,v10=0; 129 int v6 = 0, v9 = 0, v10 = 0;
130 unsigned char ibuf6[LSIZE2]; 130 unsigned char ibuf6[LSIZE2];
131#endif 131#endif
132#ifndef OPENSSL_NO_COMP 132#ifndef OPENSSL_NO_COMP
133 unsigned char cbuf; 133 unsigned char cbuf;
134 int v11=0; 134 int v11 = 0;
135#endif 135#endif
136#ifndef OPENSSL_NO_SRP 136#ifndef OPENSSL_NO_SRP
137 int v12=0; 137 int v12 = 0;
138#endif 138#endif
139 long l; 139 long l;
140 SSL_SESSION_ASN1 a; 140 SSL_SESSION_ASN1 a;
141 M_ASN1_I2D_vars(in); 141 M_ASN1_I2D_vars(in);
142 142
143 if ((in == NULL) || ((in->cipher == NULL) && (in->cipher_id == 0))) 143 if ((in == NULL) || ((in->cipher == NULL) && (in->cipher_id == 0)))
144 return(0); 144 return (0);
145 145
146 /* Note that I cheat in the following 2 assignments. I know 146 /* Note that I cheat in the following 2 assignments. I know
147 * that if the ASN1_INTEGER passed to ASN1_INTEGER_set 147 * that if the ASN1_INTEGER passed to ASN1_INTEGER_set
148 * is > sizeof(long)+1, the buffer will not be re-OPENSSL_malloc()ed. 148 * is > sizeof(long)+1, the buffer will not be re-OPENSSL_malloc()ed.
149 * This is a bit evil but makes things simple, no dynamic allocation 149 * This is a bit evil but makes things simple, no dynamic allocation
150 * to clean up :-) */ 150 * to clean up :-) */
151 a.version.length=LSIZE2; 151 a.version.length = LSIZE2;
152 a.version.type=V_ASN1_INTEGER; 152 a.version.type = V_ASN1_INTEGER;
153 a.version.data=ibuf1; 153 a.version.data = ibuf1;
154 ASN1_INTEGER_set(&(a.version),SSL_SESSION_ASN1_VERSION); 154 ASN1_INTEGER_set(&(a.version), SSL_SESSION_ASN1_VERSION);
155 155
156 a.ssl_version.length=LSIZE2; 156 a.ssl_version.length = LSIZE2;
157 a.ssl_version.type=V_ASN1_INTEGER; 157 a.ssl_version.type = V_ASN1_INTEGER;
158 a.ssl_version.data=ibuf2; 158 a.ssl_version.data = ibuf2;
159 ASN1_INTEGER_set(&(a.ssl_version),in->ssl_version); 159 ASN1_INTEGER_set(&(a.ssl_version), in->ssl_version);
160 160
161 a.cipher.type=V_ASN1_OCTET_STRING; 161 a.cipher.type = V_ASN1_OCTET_STRING;
162 a.cipher.data=buf; 162 a.cipher.data = buf;
163 163
164 if (in->cipher == NULL) 164 if (in->cipher == NULL)
165 l=in->cipher_id; 165 l = in->cipher_id;
166 else 166 else
167 l=in->cipher->id; 167 l = in->cipher->id;
168 if (in->ssl_version == SSL2_VERSION) 168 if (in->ssl_version == SSL2_VERSION) {
169 { 169 a.cipher.length = 3;
170 a.cipher.length=3; 170 buf[0] = ((unsigned char)(l >> 16L))&0xff;
171 buf[0]=((unsigned char)(l>>16L))&0xff; 171 buf[1] = ((unsigned char)(l >> 8L))&0xff;
172 buf[1]=((unsigned char)(l>> 8L))&0xff; 172 buf[2] = ((unsigned char)(l ))&0xff;
173 buf[2]=((unsigned char)(l ))&0xff; 173 } else {
174 } 174 a.cipher.length = 2;
175 else 175 buf[0] = ((unsigned char)(l >> 8L))&0xff;
176 { 176 buf[1] = ((unsigned char)(l ))&0xff;
177 a.cipher.length=2; 177 }
178 buf[0]=((unsigned char)(l>>8L))&0xff;
179 buf[1]=((unsigned char)(l ))&0xff;
180 }
181 178
182#ifndef OPENSSL_NO_COMP 179#ifndef OPENSSL_NO_COMP
183 if (in->compress_meth) 180 if (in->compress_meth) {
184 {
185 cbuf = (unsigned char)in->compress_meth; 181 cbuf = (unsigned char)in->compress_meth;
186 a.comp_id.length = 1; 182 a.comp_id.length = 1;
187 a.comp_id.type = V_ASN1_OCTET_STRING; 183 a.comp_id.type = V_ASN1_OCTET_STRING;
188 a.comp_id.data = &cbuf; 184 a.comp_id.data = &cbuf;
189 } 185 }
190#endif 186#endif
191 187
192 a.master_key.length=in->master_key_length; 188 a.master_key.length = in->master_key_length;
193 a.master_key.type=V_ASN1_OCTET_STRING; 189 a.master_key.type = V_ASN1_OCTET_STRING;
194 a.master_key.data=in->master_key; 190 a.master_key.data = in->master_key;
195 191
196 a.session_id.length=in->session_id_length; 192 a.session_id.length = in->session_id_length;
197 a.session_id.type=V_ASN1_OCTET_STRING; 193 a.session_id.type = V_ASN1_OCTET_STRING;
198 a.session_id.data=in->session_id; 194 a.session_id.data = in->session_id;
199 195
200 a.session_id_context.length=in->sid_ctx_length; 196 a.session_id_context.length = in->sid_ctx_length;
201 a.session_id_context.type=V_ASN1_OCTET_STRING; 197 a.session_id_context.type = V_ASN1_OCTET_STRING;
202 a.session_id_context.data=in->sid_ctx; 198 a.session_id_context.data = in->sid_ctx;
203 199
204 a.key_arg.length=in->key_arg_length; 200 a.key_arg.length = in->key_arg_length;
205 a.key_arg.type=V_ASN1_OCTET_STRING; 201 a.key_arg.type = V_ASN1_OCTET_STRING;
206 a.key_arg.data=in->key_arg; 202 a.key_arg.data = in->key_arg;
207 203
208#ifndef OPENSSL_NO_KRB5 204#ifndef OPENSSL_NO_KRB5
209 if (in->krb5_client_princ_len) 205 if (in->krb5_client_princ_len) {
210 { 206 a.krb5_princ.length = in->krb5_client_princ_len;
211 a.krb5_princ.length=in->krb5_client_princ_len; 207 a.krb5_princ.type = V_ASN1_OCTET_STRING;
212 a.krb5_princ.type=V_ASN1_OCTET_STRING; 208 a.krb5_princ.data = in->krb5_client_princ;
213 a.krb5_princ.data=in->krb5_client_princ; 209 }
214 }
215#endif /* OPENSSL_NO_KRB5 */ 210#endif /* OPENSSL_NO_KRB5 */
216 211
217 if (in->time != 0L) 212 if (in->time != 0L) {
218 { 213 a.time.length = LSIZE2;
219 a.time.length=LSIZE2; 214 a.time.type = V_ASN1_INTEGER;
220 a.time.type=V_ASN1_INTEGER; 215 a.time.data = ibuf3;
221 a.time.data=ibuf3; 216 ASN1_INTEGER_set(&(a.time), in->time);
222 ASN1_INTEGER_set(&(a.time),in->time); 217 }
223 }
224 218
225 if (in->timeout != 0L) 219 if (in->timeout != 0L) {
226 { 220 a.timeout.length = LSIZE2;
227 a.timeout.length=LSIZE2; 221 a.timeout.type = V_ASN1_INTEGER;
228 a.timeout.type=V_ASN1_INTEGER; 222 a.timeout.data = ibuf4;
229 a.timeout.data=ibuf4; 223 ASN1_INTEGER_set(&(a.timeout), in->timeout);
230 ASN1_INTEGER_set(&(a.timeout),in->timeout); 224 }
231 }
232 225
233 if (in->verify_result != X509_V_OK) 226 if (in->verify_result != X509_V_OK) {
234 { 227 a.verify_result.length = LSIZE2;
235 a.verify_result.length=LSIZE2; 228 a.verify_result.type = V_ASN1_INTEGER;
236 a.verify_result.type=V_ASN1_INTEGER; 229 a.verify_result.data = ibuf5;
237 a.verify_result.data=ibuf5; 230 ASN1_INTEGER_set(&a.verify_result, in->verify_result);
238 ASN1_INTEGER_set(&a.verify_result,in->verify_result); 231 }
239 }
240 232
241#ifndef OPENSSL_NO_TLSEXT 233#ifndef OPENSSL_NO_TLSEXT
242 if (in->tlsext_hostname) 234 if (in->tlsext_hostname) {
243 { 235 a.tlsext_hostname.length = strlen(in->tlsext_hostname);
244 a.tlsext_hostname.length=strlen(in->tlsext_hostname); 236 a.tlsext_hostname.type = V_ASN1_OCTET_STRING;
245 a.tlsext_hostname.type=V_ASN1_OCTET_STRING; 237 a.tlsext_hostname.data = (unsigned char *)in->tlsext_hostname;
246 a.tlsext_hostname.data=(unsigned char *)in->tlsext_hostname; 238 }
247 } 239 if (in->tlsext_tick) {
248 if (in->tlsext_tick) 240 a.tlsext_tick.length = in->tlsext_ticklen;
249 { 241 a.tlsext_tick.type = V_ASN1_OCTET_STRING;
250 a.tlsext_tick.length= in->tlsext_ticklen; 242 a.tlsext_tick.data = (unsigned char *)in->tlsext_tick;
251 a.tlsext_tick.type=V_ASN1_OCTET_STRING; 243 }
252 a.tlsext_tick.data=(unsigned char *)in->tlsext_tick; 244 if (in->tlsext_tick_lifetime_hint > 0) {
253 } 245 a.tlsext_tick_lifetime.length = LSIZE2;
254 if (in->tlsext_tick_lifetime_hint > 0) 246 a.tlsext_tick_lifetime.type = V_ASN1_INTEGER;
255 { 247 a.tlsext_tick_lifetime.data = ibuf6;
256 a.tlsext_tick_lifetime.length=LSIZE2; 248 ASN1_INTEGER_set(&a.tlsext_tick_lifetime, in->tlsext_tick_lifetime_hint);
257 a.tlsext_tick_lifetime.type=V_ASN1_INTEGER; 249 }
258 a.tlsext_tick_lifetime.data=ibuf6;
259 ASN1_INTEGER_set(&a.tlsext_tick_lifetime,in->tlsext_tick_lifetime_hint);
260 }
261#endif /* OPENSSL_NO_TLSEXT */ 250#endif /* OPENSSL_NO_TLSEXT */
262#ifndef OPENSSL_NO_PSK 251#ifndef OPENSSL_NO_PSK
263 if (in->psk_identity_hint) 252 if (in->psk_identity_hint) {
264 { 253 a.psk_identity_hint.length = strlen(in->psk_identity_hint);
265 a.psk_identity_hint.length=strlen(in->psk_identity_hint); 254 a.psk_identity_hint.type = V_ASN1_OCTET_STRING;
266 a.psk_identity_hint.type=V_ASN1_OCTET_STRING; 255 a.psk_identity_hint.data = (unsigned char *)(in->psk_identity_hint);
267 a.psk_identity_hint.data=(unsigned char *)(in->psk_identity_hint); 256 }
268 } 257 if (in->psk_identity) {
269 if (in->psk_identity) 258 a.psk_identity.length = strlen(in->psk_identity);
270 { 259 a.psk_identity.type = V_ASN1_OCTET_STRING;
271 a.psk_identity.length=strlen(in->psk_identity); 260 a.psk_identity.data = (unsigned char *)(in->psk_identity);
272 a.psk_identity.type=V_ASN1_OCTET_STRING; 261 }
273 a.psk_identity.data=(unsigned char *)(in->psk_identity);
274 }
275#endif /* OPENSSL_NO_PSK */ 262#endif /* OPENSSL_NO_PSK */
276#ifndef OPENSSL_NO_SRP 263#ifndef OPENSSL_NO_SRP
277 if (in->srp_username) 264 if (in->srp_username) {
278 { 265 a.srp_username.length = strlen(in->srp_username);
279 a.srp_username.length=strlen(in->srp_username); 266 a.srp_username.type = V_ASN1_OCTET_STRING;
280 a.srp_username.type=V_ASN1_OCTET_STRING; 267 a.srp_username.data = (unsigned char *)(in->srp_username);
281 a.srp_username.data=(unsigned char *)(in->srp_username); 268 }
282 }
283#endif /* OPENSSL_NO_SRP */ 269#endif /* OPENSSL_NO_SRP */
284 270
285 M_ASN1_I2D_len(&(a.version), i2d_ASN1_INTEGER); 271 M_ASN1_I2D_len(&(a.version), i2d_ASN1_INTEGER);
@@ -289,41 +275,41 @@ int i2d_SSL_SESSION(SSL_SESSION *in, unsigned char **pp)
289 M_ASN1_I2D_len(&(a.master_key), i2d_ASN1_OCTET_STRING); 275 M_ASN1_I2D_len(&(a.master_key), i2d_ASN1_OCTET_STRING);
290#ifndef OPENSSL_NO_KRB5 276#ifndef OPENSSL_NO_KRB5
291 if (in->krb5_client_princ_len) 277 if (in->krb5_client_princ_len)
292 M_ASN1_I2D_len(&(a.krb5_princ), i2d_ASN1_OCTET_STRING); 278 M_ASN1_I2D_len(&(a.krb5_princ), i2d_ASN1_OCTET_STRING);
293#endif /* OPENSSL_NO_KRB5 */ 279#endif /* OPENSSL_NO_KRB5 */
294 if (in->key_arg_length > 0) 280 if (in->key_arg_length > 0)
295 M_ASN1_I2D_len_IMP_opt(&(a.key_arg),i2d_ASN1_OCTET_STRING); 281 M_ASN1_I2D_len_IMP_opt(&(a.key_arg), i2d_ASN1_OCTET_STRING);
296 if (in->time != 0L) 282 if (in->time != 0L)
297 M_ASN1_I2D_len_EXP_opt(&(a.time),i2d_ASN1_INTEGER,1,v1); 283 M_ASN1_I2D_len_EXP_opt(&(a.time), i2d_ASN1_INTEGER, 1, v1);
298 if (in->timeout != 0L) 284 if (in->timeout != 0L)
299 M_ASN1_I2D_len_EXP_opt(&(a.timeout),i2d_ASN1_INTEGER,2,v2); 285 M_ASN1_I2D_len_EXP_opt(&(a.timeout), i2d_ASN1_INTEGER, 2, v2);
300 if (in->peer != NULL) 286 if (in->peer != NULL)
301 M_ASN1_I2D_len_EXP_opt(in->peer,i2d_X509,3,v3); 287 M_ASN1_I2D_len_EXP_opt(in->peer, i2d_X509, 3, v3);
302 M_ASN1_I2D_len_EXP_opt(&a.session_id_context,i2d_ASN1_OCTET_STRING,4,v4); 288 M_ASN1_I2D_len_EXP_opt(&a.session_id_context, i2d_ASN1_OCTET_STRING, 4, v4);
303 if (in->verify_result != X509_V_OK) 289 if (in->verify_result != X509_V_OK)
304 M_ASN1_I2D_len_EXP_opt(&(a.verify_result),i2d_ASN1_INTEGER,5,v5); 290 M_ASN1_I2D_len_EXP_opt(&(a.verify_result), i2d_ASN1_INTEGER, 5, v5);
305 291
306#ifndef OPENSSL_NO_TLSEXT 292#ifndef OPENSSL_NO_TLSEXT
307 if (in->tlsext_tick_lifetime_hint > 0) 293 if (in->tlsext_tick_lifetime_hint > 0)
308 M_ASN1_I2D_len_EXP_opt(&a.tlsext_tick_lifetime, i2d_ASN1_INTEGER,9,v9); 294 M_ASN1_I2D_len_EXP_opt(&a.tlsext_tick_lifetime, i2d_ASN1_INTEGER, 9, v9);
309 if (in->tlsext_tick) 295 if (in->tlsext_tick)
310 M_ASN1_I2D_len_EXP_opt(&(a.tlsext_tick), i2d_ASN1_OCTET_STRING,10,v10); 296 M_ASN1_I2D_len_EXP_opt(&(a.tlsext_tick), i2d_ASN1_OCTET_STRING, 10, v10);
311 if (in->tlsext_hostname) 297 if (in->tlsext_hostname)
312 M_ASN1_I2D_len_EXP_opt(&(a.tlsext_hostname), i2d_ASN1_OCTET_STRING,6,v6); 298 M_ASN1_I2D_len_EXP_opt(&(a.tlsext_hostname), i2d_ASN1_OCTET_STRING, 6, v6);
313#ifndef OPENSSL_NO_COMP 299#ifndef OPENSSL_NO_COMP
314 if (in->compress_meth) 300 if (in->compress_meth)
315 M_ASN1_I2D_len_EXP_opt(&(a.comp_id), i2d_ASN1_OCTET_STRING,11,v11); 301 M_ASN1_I2D_len_EXP_opt(&(a.comp_id), i2d_ASN1_OCTET_STRING, 11, v11);
316#endif 302#endif
317#endif /* OPENSSL_NO_TLSEXT */ 303#endif /* OPENSSL_NO_TLSEXT */
318#ifndef OPENSSL_NO_PSK 304#ifndef OPENSSL_NO_PSK
319 if (in->psk_identity_hint) 305 if (in->psk_identity_hint)
320 M_ASN1_I2D_len_EXP_opt(&(a.psk_identity_hint), i2d_ASN1_OCTET_STRING,7,v7); 306 M_ASN1_I2D_len_EXP_opt(&(a.psk_identity_hint), i2d_ASN1_OCTET_STRING, 7, v7);
321 if (in->psk_identity) 307 if (in->psk_identity)
322 M_ASN1_I2D_len_EXP_opt(&(a.psk_identity), i2d_ASN1_OCTET_STRING,8,v8); 308 M_ASN1_I2D_len_EXP_opt(&(a.psk_identity), i2d_ASN1_OCTET_STRING, 8, v8);
323#endif /* OPENSSL_NO_PSK */ 309#endif /* OPENSSL_NO_PSK */
324#ifndef OPENSSL_NO_SRP 310#ifndef OPENSSL_NO_SRP
325 if (in->srp_username) 311 if (in->srp_username)
326 M_ASN1_I2D_len_EXP_opt(&(a.srp_username), i2d_ASN1_OCTET_STRING,12,v12); 312 M_ASN1_I2D_len_EXP_opt(&(a.srp_username), i2d_ASN1_OCTET_STRING, 12, v12);
327#endif /* OPENSSL_NO_SRP */ 313#endif /* OPENSSL_NO_SRP */
328 314
329 M_ASN1_I2D_seq_total(); 315 M_ASN1_I2D_seq_total();
@@ -335,308 +321,296 @@ int i2d_SSL_SESSION(SSL_SESSION *in, unsigned char **pp)
335 M_ASN1_I2D_put(&(a.master_key), i2d_ASN1_OCTET_STRING); 321 M_ASN1_I2D_put(&(a.master_key), i2d_ASN1_OCTET_STRING);
336#ifndef OPENSSL_NO_KRB5 322#ifndef OPENSSL_NO_KRB5
337 if (in->krb5_client_princ_len) 323 if (in->krb5_client_princ_len)
338 M_ASN1_I2D_put(&(a.krb5_princ), i2d_ASN1_OCTET_STRING); 324 M_ASN1_I2D_put(&(a.krb5_princ), i2d_ASN1_OCTET_STRING);
339#endif /* OPENSSL_NO_KRB5 */ 325#endif /* OPENSSL_NO_KRB5 */
340 if (in->key_arg_length > 0) 326 if (in->key_arg_length > 0)
341 M_ASN1_I2D_put_IMP_opt(&(a.key_arg),i2d_ASN1_OCTET_STRING,0); 327 M_ASN1_I2D_put_IMP_opt(&(a.key_arg), i2d_ASN1_OCTET_STRING, 0);
342 if (in->time != 0L) 328 if (in->time != 0L)
343 M_ASN1_I2D_put_EXP_opt(&(a.time),i2d_ASN1_INTEGER,1,v1); 329 M_ASN1_I2D_put_EXP_opt(&(a.time), i2d_ASN1_INTEGER, 1, v1);
344 if (in->timeout != 0L) 330 if (in->timeout != 0L)
345 M_ASN1_I2D_put_EXP_opt(&(a.timeout),i2d_ASN1_INTEGER,2,v2); 331 M_ASN1_I2D_put_EXP_opt(&(a.timeout), i2d_ASN1_INTEGER, 2, v2);
346 if (in->peer != NULL) 332 if (in->peer != NULL)
347 M_ASN1_I2D_put_EXP_opt(in->peer,i2d_X509,3,v3); 333 M_ASN1_I2D_put_EXP_opt(in->peer, i2d_X509, 3, v3);
348 M_ASN1_I2D_put_EXP_opt(&a.session_id_context,i2d_ASN1_OCTET_STRING,4, 334 M_ASN1_I2D_put_EXP_opt(&a.session_id_context, i2d_ASN1_OCTET_STRING, 4,
349 v4); 335 v4);
350 if (in->verify_result != X509_V_OK) 336 if (in->verify_result != X509_V_OK)
351 M_ASN1_I2D_put_EXP_opt(&a.verify_result,i2d_ASN1_INTEGER,5,v5); 337 M_ASN1_I2D_put_EXP_opt(&a.verify_result, i2d_ASN1_INTEGER, 5, v5);
352#ifndef OPENSSL_NO_TLSEXT 338#ifndef OPENSSL_NO_TLSEXT
353 if (in->tlsext_hostname) 339 if (in->tlsext_hostname)
354 M_ASN1_I2D_put_EXP_opt(&(a.tlsext_hostname), i2d_ASN1_OCTET_STRING,6,v6); 340 M_ASN1_I2D_put_EXP_opt(&(a.tlsext_hostname), i2d_ASN1_OCTET_STRING, 6, v6);
355#endif /* OPENSSL_NO_TLSEXT */ 341#endif /* OPENSSL_NO_TLSEXT */
356#ifndef OPENSSL_NO_PSK 342#ifndef OPENSSL_NO_PSK
357 if (in->psk_identity_hint) 343 if (in->psk_identity_hint)
358 M_ASN1_I2D_put_EXP_opt(&(a.psk_identity_hint), i2d_ASN1_OCTET_STRING,7,v7); 344 M_ASN1_I2D_put_EXP_opt(&(a.psk_identity_hint), i2d_ASN1_OCTET_STRING, 7, v7);
359 if (in->psk_identity) 345 if (in->psk_identity)
360 M_ASN1_I2D_put_EXP_opt(&(a.psk_identity), i2d_ASN1_OCTET_STRING,8,v8); 346 M_ASN1_I2D_put_EXP_opt(&(a.psk_identity), i2d_ASN1_OCTET_STRING, 8, v8);
361#endif /* OPENSSL_NO_PSK */ 347#endif /* OPENSSL_NO_PSK */
362#ifndef OPENSSL_NO_TLSEXT 348#ifndef OPENSSL_NO_TLSEXT
363 if (in->tlsext_tick_lifetime_hint > 0) 349 if (in->tlsext_tick_lifetime_hint > 0)
364 M_ASN1_I2D_put_EXP_opt(&a.tlsext_tick_lifetime, i2d_ASN1_INTEGER,9,v9); 350 M_ASN1_I2D_put_EXP_opt(&a.tlsext_tick_lifetime, i2d_ASN1_INTEGER, 9, v9);
365 if (in->tlsext_tick) 351 if (in->tlsext_tick)
366 M_ASN1_I2D_put_EXP_opt(&(a.tlsext_tick), i2d_ASN1_OCTET_STRING,10,v10); 352 M_ASN1_I2D_put_EXP_opt(&(a.tlsext_tick), i2d_ASN1_OCTET_STRING, 10, v10);
367#endif /* OPENSSL_NO_TLSEXT */ 353#endif /* OPENSSL_NO_TLSEXT */
368#ifndef OPENSSL_NO_COMP 354#ifndef OPENSSL_NO_COMP
369 if (in->compress_meth) 355 if (in->compress_meth)
370 M_ASN1_I2D_put_EXP_opt(&(a.comp_id), i2d_ASN1_OCTET_STRING,11,v11); 356 M_ASN1_I2D_put_EXP_opt(&(a.comp_id), i2d_ASN1_OCTET_STRING, 11, v11);
371#endif 357#endif
372#ifndef OPENSSL_NO_SRP 358#ifndef OPENSSL_NO_SRP
373 if (in->srp_username) 359 if (in->srp_username)
374 M_ASN1_I2D_put_EXP_opt(&(a.srp_username), i2d_ASN1_OCTET_STRING,12,v12); 360 M_ASN1_I2D_put_EXP_opt(&(a.srp_username), i2d_ASN1_OCTET_STRING, 12, v12);
375#endif /* OPENSSL_NO_SRP */ 361#endif /* OPENSSL_NO_SRP */
376 M_ASN1_I2D_finish(); 362 M_ASN1_I2D_finish();
377 } 363}
378 364
379SSL_SESSION *d2i_SSL_SESSION(SSL_SESSION **a, const unsigned char **pp, 365SSL_SESSION
380 long length) 366*d2i_SSL_SESSION(SSL_SESSION **a, const unsigned char **pp,
381 { 367long length)
382 int ssl_version=0,i; 368{
369 int ssl_version = 0, i;
383 long id; 370 long id;
384 ASN1_INTEGER ai,*aip; 371 ASN1_INTEGER ai, *aip;
385 ASN1_OCTET_STRING os,*osp; 372 ASN1_OCTET_STRING os, *osp;
386 M_ASN1_D2I_vars(a,SSL_SESSION *,SSL_SESSION_new); 373 M_ASN1_D2I_vars(a, SSL_SESSION *, SSL_SESSION_new);
387 374
388 aip= &ai; 375 aip = &ai;
389 osp= &os; 376 osp = &os;
390 377
391 M_ASN1_D2I_Init(); 378 M_ASN1_D2I_Init();
392 M_ASN1_D2I_start_sequence(); 379 M_ASN1_D2I_start_sequence();
393 380
394 ai.data=NULL; ai.length=0; 381 ai.data = NULL;
395 M_ASN1_D2I_get_x(ASN1_INTEGER,aip,d2i_ASN1_INTEGER); 382 ai.length = 0;
396 if (ai.data != NULL) { OPENSSL_free(ai.data); ai.data=NULL; ai.length=0; } 383 M_ASN1_D2I_get_x(ASN1_INTEGER, aip, d2i_ASN1_INTEGER);
384 if (ai.data != NULL) {
385 OPENSSL_free(ai.data);
386 ai.data = NULL;
387 ai.length = 0;
388 }
397 389
398 /* we don't care about the version right now :-) */ 390 /* we don't care about the version right now :-) */
399 M_ASN1_D2I_get_x(ASN1_INTEGER,aip,d2i_ASN1_INTEGER); 391 M_ASN1_D2I_get_x(ASN1_INTEGER, aip, d2i_ASN1_INTEGER);
400 ssl_version=(int)ASN1_INTEGER_get(aip); 392 ssl_version = (int)ASN1_INTEGER_get(aip);
401 ret->ssl_version=ssl_version; 393 ret->ssl_version = ssl_version;
402 if (ai.data != NULL) { OPENSSL_free(ai.data); ai.data=NULL; ai.length=0; } 394 if (ai.data != NULL) {
403 395 OPENSSL_free(ai.data);
404 os.data=NULL; os.length=0; 396 ai.data = NULL;
405 M_ASN1_D2I_get_x(ASN1_OCTET_STRING,osp,d2i_ASN1_OCTET_STRING); 397 ai.length = 0;
406 if (ssl_version == SSL2_VERSION) 398 }
407 { 399
408 if (os.length != 3) 400 os.data = NULL;
409 { 401 os.length = 0;
410 c.error=SSL_R_CIPHER_CODE_WRONG_LENGTH; 402 M_ASN1_D2I_get_x(ASN1_OCTET_STRING, osp, d2i_ASN1_OCTET_STRING);
403 if (ssl_version == SSL2_VERSION) {
404 if (os.length != 3) {
405 c.error = SSL_R_CIPHER_CODE_WRONG_LENGTH;
411 goto err; 406 goto err;
412 }
413 id=0x02000000L|
414 ((unsigned long)os.data[0]<<16L)|
415 ((unsigned long)os.data[1]<< 8L)|
416 (unsigned long)os.data[2];
417 } 407 }
418 else if ((ssl_version>>8) >= SSL3_VERSION_MAJOR) 408 id = 0x02000000L|
419 { 409 ((unsigned long)os.data[0]<<16L)|
420 if (os.length != 2) 410 ((unsigned long)os.data[1]<< 8L)|
421 { 411 (unsigned long)os.data[2];
422 c.error=SSL_R_CIPHER_CODE_WRONG_LENGTH; 412 } else if ((ssl_version >> 8) >= SSL3_VERSION_MAJOR) {
413 if (os.length != 2) {
414 c.error = SSL_R_CIPHER_CODE_WRONG_LENGTH;
423 goto err; 415 goto err;
424 }
425 id=0x03000000L|
426 ((unsigned long)os.data[0]<<8L)|
427 (unsigned long)os.data[1];
428 } 416 }
429 else 417 id = 0x03000000L|
430 { 418 ((unsigned long)os.data[0]<<8L)|
431 c.error=SSL_R_UNKNOWN_SSL_VERSION; 419 (unsigned long)os.data[1];
420 } else {
421 c.error = SSL_R_UNKNOWN_SSL_VERSION;
432 goto err; 422 goto err;
433 } 423 }
434 424
435 ret->cipher=NULL; 425 ret->cipher = NULL;
436 ret->cipher_id=id; 426 ret->cipher_id = id;
437 427
438 M_ASN1_D2I_get_x(ASN1_OCTET_STRING,osp,d2i_ASN1_OCTET_STRING); 428 M_ASN1_D2I_get_x(ASN1_OCTET_STRING, osp, d2i_ASN1_OCTET_STRING);
439 if ((ssl_version>>8) >= SSL3_VERSION_MAJOR) 429 if ((ssl_version >> 8) >= SSL3_VERSION_MAJOR)
440 i=SSL3_MAX_SSL_SESSION_ID_LENGTH; 430 i = SSL3_MAX_SSL_SESSION_ID_LENGTH;
441 else /* if (ssl_version>>8 == SSL2_VERSION_MAJOR) */ 431 else /* if (ssl_version>>8 == SSL2_VERSION_MAJOR) */
442 i=SSL2_MAX_SSL_SESSION_ID_LENGTH; 432 i = SSL2_MAX_SSL_SESSION_ID_LENGTH;
443 433
444 if (os.length > i) 434 if (os.length > i)
445 os.length = i; 435 os.length = i;
446 if (os.length > (int)sizeof(ret->session_id)) /* can't happen */ 436 if (os.length > (int)sizeof(ret->session_id)) /* can't happen */
447 os.length = sizeof(ret->session_id); 437 os.length = sizeof(ret->session_id);
448 438
449 ret->session_id_length=os.length; 439 ret->session_id_length = os.length;
450 OPENSSL_assert(os.length <= (int)sizeof(ret->session_id)); 440 OPENSSL_assert(os.length <= (int)sizeof(ret->session_id));
451 memcpy(ret->session_id,os.data,os.length); 441 memcpy(ret->session_id, os.data, os.length);
452 442
453 M_ASN1_D2I_get_x(ASN1_OCTET_STRING,osp,d2i_ASN1_OCTET_STRING); 443 M_ASN1_D2I_get_x(ASN1_OCTET_STRING, osp, d2i_ASN1_OCTET_STRING);
454 if (os.length > SSL_MAX_MASTER_KEY_LENGTH) 444 if (os.length > SSL_MAX_MASTER_KEY_LENGTH)
455 ret->master_key_length=SSL_MAX_MASTER_KEY_LENGTH; 445 ret->master_key_length = SSL_MAX_MASTER_KEY_LENGTH;
456 else 446 else
457 ret->master_key_length=os.length; 447 ret->master_key_length = os.length;
458 memcpy(ret->master_key,os.data,ret->master_key_length); 448 memcpy(ret->master_key, os.data, ret->master_key_length);
459 449
460 os.length=0; 450 os.length = 0;
461 451
462#ifndef OPENSSL_NO_KRB5 452#ifndef OPENSSL_NO_KRB5
463 os.length=0; 453 os.length = 0;
464 M_ASN1_D2I_get_opt(osp,d2i_ASN1_OCTET_STRING,V_ASN1_OCTET_STRING); 454 M_ASN1_D2I_get_opt(osp, d2i_ASN1_OCTET_STRING, V_ASN1_OCTET_STRING);
465 if (os.data) 455 if (os.data) {
466 { 456 if (os.length > SSL_MAX_KRB5_PRINCIPAL_LENGTH)
467 if (os.length > SSL_MAX_KRB5_PRINCIPAL_LENGTH) 457 ret->krb5_client_princ_len = 0;
468 ret->krb5_client_princ_len=0;
469 else 458 else
470 ret->krb5_client_princ_len=os.length; 459 ret->krb5_client_princ_len = os.length;
471 memcpy(ret->krb5_client_princ,os.data,ret->krb5_client_princ_len); 460 memcpy(ret->krb5_client_princ, os.data, ret->krb5_client_princ_len);
472 OPENSSL_free(os.data); 461 OPENSSL_free(os.data);
473 os.data = NULL; 462 os.data = NULL;
474 os.length = 0; 463 os.length = 0;
475 } 464 } else
476 else 465 ret->krb5_client_princ_len = 0;
477 ret->krb5_client_princ_len=0;
478#endif /* OPENSSL_NO_KRB5 */ 466#endif /* OPENSSL_NO_KRB5 */
479 467
480 M_ASN1_D2I_get_IMP_opt(osp,d2i_ASN1_OCTET_STRING,0,V_ASN1_OCTET_STRING); 468 M_ASN1_D2I_get_IMP_opt(osp, d2i_ASN1_OCTET_STRING, 0, V_ASN1_OCTET_STRING);
481 if (os.length > SSL_MAX_KEY_ARG_LENGTH) 469 if (os.length > SSL_MAX_KEY_ARG_LENGTH)
482 ret->key_arg_length=SSL_MAX_KEY_ARG_LENGTH; 470 ret->key_arg_length = SSL_MAX_KEY_ARG_LENGTH;
483 else 471 else
484 ret->key_arg_length=os.length; 472 ret->key_arg_length = os.length;
485 memcpy(ret->key_arg,os.data,ret->key_arg_length); 473 memcpy(ret->key_arg, os.data, ret->key_arg_length);
486 if (os.data != NULL) OPENSSL_free(os.data); 474 if (os.data != NULL)
487 475 OPENSSL_free(os.data);
488 ai.length=0;
489 M_ASN1_D2I_get_EXP_opt(aip,d2i_ASN1_INTEGER,1);
490 if (ai.data != NULL)
491 {
492 ret->time=ASN1_INTEGER_get(aip);
493 OPENSSL_free(ai.data); ai.data=NULL; ai.length=0;
494 }
495 else
496 ret->time=(unsigned long)time(NULL);
497
498 ai.length=0;
499 M_ASN1_D2I_get_EXP_opt(aip,d2i_ASN1_INTEGER,2);
500 if (ai.data != NULL)
501 {
502 ret->timeout=ASN1_INTEGER_get(aip);
503 OPENSSL_free(ai.data); ai.data=NULL; ai.length=0;
504 }
505 else
506 ret->timeout=3;
507 476
508 if (ret->peer != NULL) 477 ai.length = 0;
509 { 478 M_ASN1_D2I_get_EXP_opt(aip, d2i_ASN1_INTEGER, 1);
479 if (ai.data != NULL) {
480 ret->time = ASN1_INTEGER_get(aip);
481 OPENSSL_free(ai.data);
482 ai.data = NULL;
483 ai.length = 0;
484 } else
485 ret->time = (unsigned long)time(NULL);
486
487 ai.length = 0;
488 M_ASN1_D2I_get_EXP_opt(aip, d2i_ASN1_INTEGER, 2);
489 if (ai.data != NULL) {
490 ret->timeout = ASN1_INTEGER_get(aip);
491 OPENSSL_free(ai.data);
492 ai.data = NULL;
493 ai.length = 0;
494 } else
495 ret->timeout = 3;
496
497 if (ret->peer != NULL) {
510 X509_free(ret->peer); 498 X509_free(ret->peer);
511 ret->peer=NULL; 499 ret->peer = NULL;
512 } 500 }
513 M_ASN1_D2I_get_EXP_opt(ret->peer,d2i_X509,3); 501 M_ASN1_D2I_get_EXP_opt(ret->peer, d2i_X509, 3);
514 502
515 os.length=0; 503 os.length = 0;
516 os.data=NULL; 504 os.data = NULL;
517 M_ASN1_D2I_get_EXP_opt(osp,d2i_ASN1_OCTET_STRING,4); 505 M_ASN1_D2I_get_EXP_opt(osp, d2i_ASN1_OCTET_STRING, 4);
518 506
519 if(os.data != NULL) 507 if (os.data != NULL) {
520 { 508 if (os.length > SSL_MAX_SID_CTX_LENGTH) {
521 if (os.length > SSL_MAX_SID_CTX_LENGTH) 509 c.error = SSL_R_BAD_LENGTH;
522 { 510 goto err;
523 c.error=SSL_R_BAD_LENGTH; 511 } else {
524 goto err; 512 ret->sid_ctx_length = os.length;
525 } 513 memcpy(ret->sid_ctx, os.data, os.length);
526 else
527 {
528 ret->sid_ctx_length=os.length;
529 memcpy(ret->sid_ctx,os.data,os.length);
530 }
531 OPENSSL_free(os.data); os.data=NULL; os.length=0;
532 }
533 else
534 ret->sid_ctx_length=0;
535
536 ai.length=0;
537 M_ASN1_D2I_get_EXP_opt(aip,d2i_ASN1_INTEGER,5);
538 if (ai.data != NULL)
539 {
540 ret->verify_result=ASN1_INTEGER_get(aip);
541 OPENSSL_free(ai.data); ai.data=NULL; ai.length=0;
542 } 514 }
543 else 515 OPENSSL_free(os.data);
544 ret->verify_result=X509_V_OK; 516 os.data = NULL;
517 os.length = 0;
518 } else
519 ret->sid_ctx_length = 0;
520
521 ai.length = 0;
522 M_ASN1_D2I_get_EXP_opt(aip, d2i_ASN1_INTEGER, 5);
523 if (ai.data != NULL) {
524 ret->verify_result = ASN1_INTEGER_get(aip);
525 OPENSSL_free(ai.data);
526 ai.data = NULL;
527 ai.length = 0;
528 } else
529 ret->verify_result = X509_V_OK;
545 530
546#ifndef OPENSSL_NO_TLSEXT 531#ifndef OPENSSL_NO_TLSEXT
547 os.length=0; 532 os.length = 0;
548 os.data=NULL; 533 os.data = NULL;
549 M_ASN1_D2I_get_EXP_opt(osp,d2i_ASN1_OCTET_STRING,6); 534 M_ASN1_D2I_get_EXP_opt(osp, d2i_ASN1_OCTET_STRING, 6);
550 if (os.data) 535 if (os.data) {
551 {
552 ret->tlsext_hostname = BUF_strndup((char *)os.data, os.length); 536 ret->tlsext_hostname = BUF_strndup((char *)os.data, os.length);
553 OPENSSL_free(os.data); 537 OPENSSL_free(os.data);
554 os.data = NULL; 538 os.data = NULL;
555 os.length = 0; 539 os.length = 0;
556 } 540 } else
557 else 541 ret->tlsext_hostname = NULL;
558 ret->tlsext_hostname=NULL;
559#endif /* OPENSSL_NO_TLSEXT */ 542#endif /* OPENSSL_NO_TLSEXT */
560 543
561#ifndef OPENSSL_NO_PSK 544#ifndef OPENSSL_NO_PSK
562 os.length=0; 545 os.length = 0;
563 os.data=NULL; 546 os.data = NULL;
564 M_ASN1_D2I_get_EXP_opt(osp,d2i_ASN1_OCTET_STRING,7); 547 M_ASN1_D2I_get_EXP_opt(osp, d2i_ASN1_OCTET_STRING, 7);
565 if (os.data) 548 if (os.data) {
566 {
567 ret->psk_identity_hint = BUF_strndup((char *)os.data, os.length); 549 ret->psk_identity_hint = BUF_strndup((char *)os.data, os.length);
568 OPENSSL_free(os.data); 550 OPENSSL_free(os.data);
569 os.data = NULL; 551 os.data = NULL;
570 os.length = 0; 552 os.length = 0;
571 } 553 } else
572 else 554 ret->psk_identity_hint = NULL;
573 ret->psk_identity_hint=NULL;
574 555
575 os.length=0; 556 os.length = 0;
576 os.data=NULL; 557 os.data = NULL;
577 M_ASN1_D2I_get_EXP_opt(osp,d2i_ASN1_OCTET_STRING,8); 558 M_ASN1_D2I_get_EXP_opt(osp, d2i_ASN1_OCTET_STRING, 8);
578 if (os.data) 559 if (os.data) {
579 {
580 ret->psk_identity = BUF_strndup((char *)os.data, os.length); 560 ret->psk_identity = BUF_strndup((char *)os.data, os.length);
581 OPENSSL_free(os.data); 561 OPENSSL_free(os.data);
582 os.data = NULL; 562 os.data = NULL;
583 os.length = 0; 563 os.length = 0;
584 } 564 } else
585 else 565 ret->psk_identity = NULL;
586 ret->psk_identity=NULL;
587#endif /* OPENSSL_NO_PSK */ 566#endif /* OPENSSL_NO_PSK */
588 567
589#ifndef OPENSSL_NO_TLSEXT 568#ifndef OPENSSL_NO_TLSEXT
590 ai.length=0; 569 ai.length = 0;
591 M_ASN1_D2I_get_EXP_opt(aip,d2i_ASN1_INTEGER,9); 570 M_ASN1_D2I_get_EXP_opt(aip, d2i_ASN1_INTEGER, 9);
592 if (ai.data != NULL) 571 if (ai.data != NULL) {
593 { 572 ret->tlsext_tick_lifetime_hint = ASN1_INTEGER_get(aip);
594 ret->tlsext_tick_lifetime_hint=ASN1_INTEGER_get(aip); 573 OPENSSL_free(ai.data);
595 OPENSSL_free(ai.data); ai.data=NULL; ai.length=0; 574 ai.data = NULL;
596 } 575 ai.length = 0;
597 else if (ret->tlsext_ticklen && ret->session_id_length) 576 } else if (ret->tlsext_ticklen && ret->session_id_length)
598 ret->tlsext_tick_lifetime_hint = -1; 577 ret->tlsext_tick_lifetime_hint = -1;
599 else 578 else
600 ret->tlsext_tick_lifetime_hint=0; 579 ret->tlsext_tick_lifetime_hint = 0;
601 os.length=0; 580 os.length = 0;
602 os.data=NULL; 581 os.data = NULL;
603 M_ASN1_D2I_get_EXP_opt(osp,d2i_ASN1_OCTET_STRING,10); 582 M_ASN1_D2I_get_EXP_opt(osp, d2i_ASN1_OCTET_STRING, 10);
604 if (os.data) 583 if (os.data) {
605 {
606 ret->tlsext_tick = os.data; 584 ret->tlsext_tick = os.data;
607 ret->tlsext_ticklen = os.length; 585 ret->tlsext_ticklen = os.length;
608 os.data = NULL; 586 os.data = NULL;
609 os.length = 0; 587 os.length = 0;
610 } 588 } else
611 else 589 ret->tlsext_tick = NULL;
612 ret->tlsext_tick=NULL;
613#endif /* OPENSSL_NO_TLSEXT */ 590#endif /* OPENSSL_NO_TLSEXT */
614#ifndef OPENSSL_NO_COMP 591#ifndef OPENSSL_NO_COMP
615 os.length=0; 592 os.length = 0;
616 os.data=NULL; 593 os.data = NULL;
617 M_ASN1_D2I_get_EXP_opt(osp,d2i_ASN1_OCTET_STRING,11); 594 M_ASN1_D2I_get_EXP_opt(osp, d2i_ASN1_OCTET_STRING, 11);
618 if (os.data) 595 if (os.data) {
619 {
620 ret->compress_meth = os.data[0]; 596 ret->compress_meth = os.data[0];
621 OPENSSL_free(os.data); 597 OPENSSL_free(os.data);
622 os.data = NULL; 598 os.data = NULL;
623 } 599 }
624#endif 600#endif
625 601
626#ifndef OPENSSL_NO_SRP 602#ifndef OPENSSL_NO_SRP
627 os.length=0; 603 os.length = 0;
628 os.data=NULL; 604 os.data = NULL;
629 M_ASN1_D2I_get_EXP_opt(osp,d2i_ASN1_OCTET_STRING,12); 605 M_ASN1_D2I_get_EXP_opt(osp, d2i_ASN1_OCTET_STRING, 12);
630 if (os.data) 606 if (os.data) {
631 {
632 ret->srp_username = BUF_strndup((char *)os.data, os.length); 607 ret->srp_username = BUF_strndup((char *)os.data, os.length);
633 OPENSSL_free(os.data); 608 OPENSSL_free(os.data);
634 os.data = NULL; 609 os.data = NULL;
635 os.length = 0; 610 os.length = 0;
636 } 611 } else
637 else 612 ret->srp_username = NULL;
638 ret->srp_username=NULL;
639#endif /* OPENSSL_NO_SRP */ 613#endif /* OPENSSL_NO_SRP */
640 614
641 M_ASN1_D2I_Finish(a,SSL_SESSION_free,SSL_F_D2I_SSL_SESSION); 615 M_ASN1_D2I_Finish(a, SSL_SESSION_free, SSL_F_D2I_SSL_SESSION);
642 } 616}
diff --git a/src/lib/libssl/src/ssl/ssl_cert.c b/src/lib/libssl/src/ssl/ssl_cert.c
index 1aaddc351f..79eb4ee031 100644
--- a/src/lib/libssl/src/ssl/ssl_cert.c
+++ b/src/lib/libssl/src/ssl/ssl_cert.c
@@ -132,36 +132,36 @@
132#include <openssl/bn.h> 132#include <openssl/bn.h>
133#include "ssl_locl.h" 133#include "ssl_locl.h"
134 134
135int SSL_get_ex_data_X509_STORE_CTX_idx(void) 135int
136 { 136SSL_get_ex_data_X509_STORE_CTX_idx(void)
137 static volatile int ssl_x509_store_ctx_idx= -1; 137{
138 static volatile int ssl_x509_store_ctx_idx = -1;
138 int got_write_lock = 0; 139 int got_write_lock = 0;
139 140
140 CRYPTO_r_lock(CRYPTO_LOCK_SSL_CTX); 141 CRYPTO_r_lock(CRYPTO_LOCK_SSL_CTX);
141 142
142 if (ssl_x509_store_ctx_idx < 0) 143 if (ssl_x509_store_ctx_idx < 0) {
143 {
144 CRYPTO_r_unlock(CRYPTO_LOCK_SSL_CTX); 144 CRYPTO_r_unlock(CRYPTO_LOCK_SSL_CTX);
145 CRYPTO_w_lock(CRYPTO_LOCK_SSL_CTX); 145 CRYPTO_w_lock(CRYPTO_LOCK_SSL_CTX);
146 got_write_lock = 1; 146 got_write_lock = 1;
147 147
148 if (ssl_x509_store_ctx_idx < 0) 148 if (ssl_x509_store_ctx_idx < 0) {
149 { 149 ssl_x509_store_ctx_idx = X509_STORE_CTX_get_ex_new_index(
150 ssl_x509_store_ctx_idx=X509_STORE_CTX_get_ex_new_index( 150 0, "SSL for verify callback", NULL, NULL, NULL);
151 0,"SSL for verify callback",NULL,NULL,NULL);
152 }
153 } 151 }
152 }
154 153
155 if (got_write_lock) 154 if (got_write_lock)
156 CRYPTO_w_unlock(CRYPTO_LOCK_SSL_CTX); 155 CRYPTO_w_unlock(CRYPTO_LOCK_SSL_CTX);
157 else 156 else
158 CRYPTO_r_unlock(CRYPTO_LOCK_SSL_CTX); 157 CRYPTO_r_unlock(CRYPTO_LOCK_SSL_CTX);
159 158
160 return ssl_x509_store_ctx_idx; 159 return ssl_x509_store_ctx_idx;
161 } 160}
162 161
163static void ssl_cert_set_default_md(CERT *cert) 162static void
164 { 163ssl_cert_set_default_md(CERT *cert)
164{
165 /* Set digest values to defaults */ 165 /* Set digest values to defaults */
166#ifndef OPENSSL_NO_DSA 166#ifndef OPENSSL_NO_DSA
167 cert->pkeys[SSL_PKEY_DSA_SIGN].digest = EVP_sha1(); 167 cert->pkeys[SSL_PKEY_DSA_SIGN].digest = EVP_sha1();
@@ -173,37 +173,37 @@ static void ssl_cert_set_default_md(CERT *cert)
173#ifndef OPENSSL_NO_ECDSA 173#ifndef OPENSSL_NO_ECDSA
174 cert->pkeys[SSL_PKEY_ECC].digest = EVP_sha1(); 174 cert->pkeys[SSL_PKEY_ECC].digest = EVP_sha1();
175#endif 175#endif
176 } 176}
177 177
178CERT *ssl_cert_new(void) 178CERT
179 { 179*ssl_cert_new(void)
180{
180 CERT *ret; 181 CERT *ret;
181 182
182 ret=(CERT *)OPENSSL_malloc(sizeof(CERT)); 183 ret = (CERT *)OPENSSL_malloc(sizeof(CERT));
183 if (ret == NULL) 184 if (ret == NULL) {
184 { 185 SSLerr(SSL_F_SSL_CERT_NEW, ERR_R_MALLOC_FAILURE);
185 SSLerr(SSL_F_SSL_CERT_NEW,ERR_R_MALLOC_FAILURE); 186 return (NULL);
186 return(NULL); 187 }
187 } 188 memset(ret, 0, sizeof(CERT));
188 memset(ret,0,sizeof(CERT));
189 189
190 ret->key= &(ret->pkeys[SSL_PKEY_RSA_ENC]); 190 ret->key = &(ret->pkeys[SSL_PKEY_RSA_ENC]);
191 ret->references=1; 191 ret->references = 1;
192 ssl_cert_set_default_md(ret); 192 ssl_cert_set_default_md(ret);
193 return(ret); 193 return (ret);
194 } 194}
195 195
196CERT *ssl_cert_dup(CERT *cert) 196CERT
197 { 197*ssl_cert_dup(CERT *cert)
198{
198 CERT *ret; 199 CERT *ret;
199 int i; 200 int i;
200 201
201 ret = (CERT *)OPENSSL_malloc(sizeof(CERT)); 202 ret = (CERT *)OPENSSL_malloc(sizeof(CERT));
202 if (ret == NULL) 203 if (ret == NULL) {
203 {
204 SSLerr(SSL_F_SSL_CERT_DUP, ERR_R_MALLOC_FAILURE); 204 SSLerr(SSL_F_SSL_CERT_DUP, ERR_R_MALLOC_FAILURE);
205 return(NULL); 205 return (NULL);
206 } 206 }
207 207
208 memset(ret, 0, sizeof(CERT)); 208 memset(ret, 0, sizeof(CERT));
209 209
@@ -218,77 +218,64 @@ CERT *ssl_cert_dup(CERT *cert)
218 ret->export_mask_a = cert->export_mask_a; 218 ret->export_mask_a = cert->export_mask_a;
219 219
220#ifndef OPENSSL_NO_RSA 220#ifndef OPENSSL_NO_RSA
221 if (cert->rsa_tmp != NULL) 221 if (cert->rsa_tmp != NULL) {
222 {
223 RSA_up_ref(cert->rsa_tmp); 222 RSA_up_ref(cert->rsa_tmp);
224 ret->rsa_tmp = cert->rsa_tmp; 223 ret->rsa_tmp = cert->rsa_tmp;
225 } 224 }
226 ret->rsa_tmp_cb = cert->rsa_tmp_cb; 225 ret->rsa_tmp_cb = cert->rsa_tmp_cb;
227#endif 226#endif
228 227
229#ifndef OPENSSL_NO_DH 228#ifndef OPENSSL_NO_DH
230 if (cert->dh_tmp != NULL) 229 if (cert->dh_tmp != NULL) {
231 {
232 ret->dh_tmp = DHparams_dup(cert->dh_tmp); 230 ret->dh_tmp = DHparams_dup(cert->dh_tmp);
233 if (ret->dh_tmp == NULL) 231 if (ret->dh_tmp == NULL) {
234 {
235 SSLerr(SSL_F_SSL_CERT_DUP, ERR_R_DH_LIB); 232 SSLerr(SSL_F_SSL_CERT_DUP, ERR_R_DH_LIB);
236 goto err; 233 goto err;
237 } 234 }
238 if (cert->dh_tmp->priv_key) 235 if (cert->dh_tmp->priv_key) {
239 {
240 BIGNUM *b = BN_dup(cert->dh_tmp->priv_key); 236 BIGNUM *b = BN_dup(cert->dh_tmp->priv_key);
241 if (!b) 237 if (!b) {
242 {
243 SSLerr(SSL_F_SSL_CERT_DUP, ERR_R_BN_LIB); 238 SSLerr(SSL_F_SSL_CERT_DUP, ERR_R_BN_LIB);
244 goto err; 239 goto err;
245 }
246 ret->dh_tmp->priv_key = b;
247 } 240 }
248 if (cert->dh_tmp->pub_key) 241 ret->dh_tmp->priv_key = b;
249 { 242 }
243 if (cert->dh_tmp->pub_key) {
250 BIGNUM *b = BN_dup(cert->dh_tmp->pub_key); 244 BIGNUM *b = BN_dup(cert->dh_tmp->pub_key);
251 if (!b) 245 if (!b) {
252 {
253 SSLerr(SSL_F_SSL_CERT_DUP, ERR_R_BN_LIB); 246 SSLerr(SSL_F_SSL_CERT_DUP, ERR_R_BN_LIB);
254 goto err; 247 goto err;
255 }
256 ret->dh_tmp->pub_key = b;
257 } 248 }
249 ret->dh_tmp->pub_key = b;
258 } 250 }
251 }
259 ret->dh_tmp_cb = cert->dh_tmp_cb; 252 ret->dh_tmp_cb = cert->dh_tmp_cb;
260#endif 253#endif
261 254
262#ifndef OPENSSL_NO_ECDH 255#ifndef OPENSSL_NO_ECDH
263 if (cert->ecdh_tmp) 256 if (cert->ecdh_tmp) {
264 {
265 ret->ecdh_tmp = EC_KEY_dup(cert->ecdh_tmp); 257 ret->ecdh_tmp = EC_KEY_dup(cert->ecdh_tmp);
266 if (ret->ecdh_tmp == NULL) 258 if (ret->ecdh_tmp == NULL) {
267 {
268 SSLerr(SSL_F_SSL_CERT_DUP, ERR_R_EC_LIB); 259 SSLerr(SSL_F_SSL_CERT_DUP, ERR_R_EC_LIB);
269 goto err; 260 goto err;
270 }
271 } 261 }
262 }
272 ret->ecdh_tmp_cb = cert->ecdh_tmp_cb; 263 ret->ecdh_tmp_cb = cert->ecdh_tmp_cb;
273#endif 264#endif
274 265
275 for (i = 0; i < SSL_PKEY_NUM; i++) 266 for (i = 0; i < SSL_PKEY_NUM; i++) {
276 { 267 if (cert->pkeys[i].x509 != NULL) {
277 if (cert->pkeys[i].x509 != NULL)
278 {
279 ret->pkeys[i].x509 = cert->pkeys[i].x509; 268 ret->pkeys[i].x509 = cert->pkeys[i].x509;
280 CRYPTO_add(&ret->pkeys[i].x509->references, 1, 269 CRYPTO_add(&ret->pkeys[i].x509->references, 1,
281 CRYPTO_LOCK_X509); 270 CRYPTO_LOCK_X509);
282 } 271 }
283 272
284 if (cert->pkeys[i].privatekey != NULL) 273 if (cert->pkeys[i].privatekey != NULL) {
285 {
286 ret->pkeys[i].privatekey = cert->pkeys[i].privatekey; 274 ret->pkeys[i].privatekey = cert->pkeys[i].privatekey;
287 CRYPTO_add(&ret->pkeys[i].privatekey->references, 1, 275 CRYPTO_add(&ret->pkeys[i].privatekey->references, 1,
288 CRYPTO_LOCK_EVP_PKEY); 276 CRYPTO_LOCK_EVP_PKEY);
289 277
290 switch(i) 278 switch (i) {
291 {
292 /* If there was anything special to do for 279 /* If there was anything special to do for
293 * certain types of keys, we'd do it here. 280 * certain types of keys, we'd do it here.
294 * (Nothing at the moment, I think.) */ 281 * (Nothing at the moment, I think.) */
@@ -297,11 +284,11 @@ CERT *ssl_cert_dup(CERT *cert)
297 case SSL_PKEY_RSA_SIGN: 284 case SSL_PKEY_RSA_SIGN:
298 /* We have an RSA key. */ 285 /* We have an RSA key. */
299 break; 286 break;
300 287
301 case SSL_PKEY_DSA_SIGN: 288 case SSL_PKEY_DSA_SIGN:
302 /* We have a DSA key. */ 289 /* We have a DSA key. */
303 break; 290 break;
304 291
305 case SSL_PKEY_DH_RSA: 292 case SSL_PKEY_DH_RSA:
306 case SSL_PKEY_DH_DSA: 293 case SSL_PKEY_DH_DSA:
307 /* We have a DH key. */ 294 /* We have a DH key. */
@@ -314,21 +301,21 @@ CERT *ssl_cert_dup(CERT *cert)
314 default: 301 default:
315 /* Can't happen. */ 302 /* Can't happen. */
316 SSLerr(SSL_F_SSL_CERT_DUP, SSL_R_LIBRARY_BUG); 303 SSLerr(SSL_F_SSL_CERT_DUP, SSL_R_LIBRARY_BUG);
317 }
318 } 304 }
319 } 305 }
320 306 }
307
321 /* ret->extra_certs *should* exist, but currently the own certificate 308 /* ret->extra_certs *should* exist, but currently the own certificate
322 * chain is held inside SSL_CTX */ 309 * chain is held inside SSL_CTX */
323 310
324 ret->references=1; 311 ret->references = 1;
325 /* Set digests to defaults. NB: we don't copy existing values as they 312 /* Set digests to defaults. NB: we don't copy existing values as they
326 * will be set during handshake. 313 * will be set during handshake.
327 */ 314 */
328 ssl_cert_set_default_md(ret); 315 ssl_cert_set_default_md(ret);
329 316
330 return(ret); 317 return (ret);
331 318
332#if !defined(OPENSSL_NO_DH) || !defined(OPENSSL_NO_ECDH) 319#if !defined(OPENSSL_NO_DH) || !defined(OPENSSL_NO_ECDH)
333err: 320err:
334#endif 321#endif
@@ -345,50 +332,52 @@ err:
345 EC_KEY_free(ret->ecdh_tmp); 332 EC_KEY_free(ret->ecdh_tmp);
346#endif 333#endif
347 334
348 for (i = 0; i < SSL_PKEY_NUM; i++) 335 for (i = 0; i < SSL_PKEY_NUM; i++) {
349 {
350 if (ret->pkeys[i].x509 != NULL) 336 if (ret->pkeys[i].x509 != NULL)
351 X509_free(ret->pkeys[i].x509); 337 X509_free(ret->pkeys[i].x509);
352 if (ret->pkeys[i].privatekey != NULL) 338 if (ret->pkeys[i].privatekey != NULL)
353 EVP_PKEY_free(ret->pkeys[i].privatekey); 339 EVP_PKEY_free(ret->pkeys[i].privatekey);
354 } 340 }
355 341
356 return NULL; 342 return NULL;
357 } 343}
358 344
359 345
360void ssl_cert_free(CERT *c) 346void
361 { 347ssl_cert_free(CERT *c)
348{
362 int i; 349 int i;
363 350
364 if(c == NULL) 351 if (c == NULL)
365 return; 352 return;
366 353
367 i=CRYPTO_add(&c->references,-1,CRYPTO_LOCK_SSL_CERT); 354 i = CRYPTO_add(&c->references, -1, CRYPTO_LOCK_SSL_CERT);
368#ifdef REF_PRINT 355#ifdef REF_PRINT
369 REF_PRINT("CERT",c); 356 REF_PRINT("CERT", c);
370#endif 357#endif
371 if (i > 0) return; 358 if (i > 0)
359 return;
372#ifdef REF_CHECK 360#ifdef REF_CHECK
373 if (i < 0) 361 if (i < 0) {
374 { 362 fprintf(stderr, "ssl_cert_free, bad reference count\n");
375 fprintf(stderr,"ssl_cert_free, bad reference count\n");
376 abort(); /* ok */ 363 abort(); /* ok */
377 } 364 }
378#endif 365#endif
379 366
380#ifndef OPENSSL_NO_RSA 367#ifndef OPENSSL_NO_RSA
381 if (c->rsa_tmp) RSA_free(c->rsa_tmp); 368 if (c->rsa_tmp)
369 RSA_free(c->rsa_tmp);
382#endif 370#endif
383#ifndef OPENSSL_NO_DH 371#ifndef OPENSSL_NO_DH
384 if (c->dh_tmp) DH_free(c->dh_tmp); 372 if (c->dh_tmp)
373 DH_free(c->dh_tmp);
385#endif 374#endif
386#ifndef OPENSSL_NO_ECDH 375#ifndef OPENSSL_NO_ECDH
387 if (c->ecdh_tmp) EC_KEY_free(c->ecdh_tmp); 376 if (c->ecdh_tmp)
377 EC_KEY_free(c->ecdh_tmp);
388#endif 378#endif
389 379
390 for (i=0; i<SSL_PKEY_NUM; i++) 380 for (i = 0; i < SSL_PKEY_NUM; i++) {
391 {
392 if (c->pkeys[i].x509 != NULL) 381 if (c->pkeys[i].x509 != NULL)
393 X509_free(c->pkeys[i].x509); 382 X509_free(c->pkeys[i].x509);
394 if (c->pkeys[i].privatekey != NULL) 383 if (c->pkeys[i].privatekey != NULL)
@@ -397,12 +386,13 @@ void ssl_cert_free(CERT *c)
397 if (c->pkeys[i].publickey != NULL) 386 if (c->pkeys[i].publickey != NULL)
398 EVP_PKEY_free(c->pkeys[i].publickey); 387 EVP_PKEY_free(c->pkeys[i].publickey);
399#endif 388#endif
400 }
401 OPENSSL_free(c);
402 } 389 }
390 OPENSSL_free(c);
391}
403 392
404int ssl_cert_inst(CERT **o) 393int
405 { 394ssl_cert_inst(CERT **o)
395{
406 /* Create a CERT if there isn't already one 396 /* Create a CERT if there isn't already one
407 * (which cannot really happen, as it is initially created in 397 * (which cannot really happen, as it is initially created in
408 * SSL_CTX_new; but the earlier code usually allows for that one 398 * SSL_CTX_new; but the earlier code usually allows for that one
@@ -412,44 +402,42 @@ int ssl_cert_inst(CERT **o)
412 * s->cert being NULL, otherwise we could do without the 402 * s->cert being NULL, otherwise we could do without the
413 * initialization in SSL_CTX_new). 403 * initialization in SSL_CTX_new).
414 */ 404 */
415 405
416 if (o == NULL) 406 if (o == NULL) {
417 {
418 SSLerr(SSL_F_SSL_CERT_INST, ERR_R_PASSED_NULL_PARAMETER); 407 SSLerr(SSL_F_SSL_CERT_INST, ERR_R_PASSED_NULL_PARAMETER);
419 return(0); 408 return (0);
420 } 409 }
421 if (*o == NULL) 410 if (*o == NULL) {
422 { 411 if ((*o = ssl_cert_new()) == NULL) {
423 if ((*o = ssl_cert_new()) == NULL)
424 {
425 SSLerr(SSL_F_SSL_CERT_INST, ERR_R_MALLOC_FAILURE); 412 SSLerr(SSL_F_SSL_CERT_INST, ERR_R_MALLOC_FAILURE);
426 return(0); 413 return (0);
427 }
428 } 414 }
429 return(1);
430 } 415 }
416 return (1);
417}
431 418
432 419
433SESS_CERT *ssl_sess_cert_new(void) 420SESS_CERT
434 { 421*ssl_sess_cert_new(void)
422{
435 SESS_CERT *ret; 423 SESS_CERT *ret;
436 424
437 ret = OPENSSL_malloc(sizeof *ret); 425 ret = OPENSSL_malloc(sizeof *ret);
438 if (ret == NULL) 426 if (ret == NULL) {
439 {
440 SSLerr(SSL_F_SSL_SESS_CERT_NEW, ERR_R_MALLOC_FAILURE); 427 SSLerr(SSL_F_SSL_SESS_CERT_NEW, ERR_R_MALLOC_FAILURE);
441 return NULL; 428 return NULL;
442 } 429 }
443 430
444 memset(ret, 0 ,sizeof *ret); 431 memset(ret, 0 , sizeof *ret);
445 ret->peer_key = &(ret->peer_pkeys[SSL_PKEY_RSA_ENC]); 432 ret->peer_key = &(ret->peer_pkeys[SSL_PKEY_RSA_ENC]);
446 ret->references = 1; 433 ret->references = 1;
447 434
448 return ret; 435 return ret;
449 } 436}
450 437
451void ssl_sess_cert_free(SESS_CERT *sc) 438void
452 { 439ssl_sess_cert_free(SESS_CERT *sc)
440{
453 int i; 441 int i;
454 442
455 if (sc == NULL) 443 if (sc == NULL)
@@ -462,27 +450,25 @@ void ssl_sess_cert_free(SESS_CERT *sc)
462 if (i > 0) 450 if (i > 0)
463 return; 451 return;
464#ifdef REF_CHECK 452#ifdef REF_CHECK
465 if (i < 0) 453 if (i < 0) {
466 { 454 fprintf(stderr, "ssl_sess_cert_free, bad reference count\n");
467 fprintf(stderr,"ssl_sess_cert_free, bad reference count\n");
468 abort(); /* ok */ 455 abort(); /* ok */
469 } 456 }
470#endif 457#endif
471 458
472 /* i == 0 */ 459 /* i == 0 */
473 if (sc->cert_chain != NULL) 460 if (sc->cert_chain != NULL)
474 sk_X509_pop_free(sc->cert_chain, X509_free); 461 sk_X509_pop_free(sc->cert_chain, X509_free);
475 for (i = 0; i < SSL_PKEY_NUM; i++) 462 for (i = 0; i < SSL_PKEY_NUM; i++) {
476 {
477 if (sc->peer_pkeys[i].x509 != NULL) 463 if (sc->peer_pkeys[i].x509 != NULL)
478 X509_free(sc->peer_pkeys[i].x509); 464 X509_free(sc->peer_pkeys[i].x509);
479#if 0 /* We don't have the peer's private key. These lines are just 465#if 0 /* We don't have the peer's private key. These lines are just
480 * here as a reminder that we're still using a not-quite-appropriate 466 * here as a reminder that we're still using a not-quite-appropriate
481 * data structure. */ 467 * data structure. */
482 if (sc->peer_pkeys[i].privatekey != NULL) 468 if (sc->peer_pkeys[i].privatekey != NULL)
483 EVP_PKEY_free(sc->peer_pkeys[i].privatekey); 469 EVP_PKEY_free(sc->peer_pkeys[i].privatekey);
484#endif 470#endif
485 } 471 }
486 472
487#ifndef OPENSSL_NO_RSA 473#ifndef OPENSSL_NO_RSA
488 if (sc->peer_rsa_tmp != NULL) 474 if (sc->peer_rsa_tmp != NULL)
@@ -498,34 +484,35 @@ void ssl_sess_cert_free(SESS_CERT *sc)
498#endif 484#endif
499 485
500 OPENSSL_free(sc); 486 OPENSSL_free(sc);
501 } 487}
502 488
503int ssl_set_peer_cert_type(SESS_CERT *sc,int type) 489int
504 { 490ssl_set_peer_cert_type(SESS_CERT *sc, int type)
491{
505 sc->peer_cert_type = type; 492 sc->peer_cert_type = type;
506 return(1); 493 return (1);
507 } 494}
508 495
509int ssl_verify_cert_chain(SSL *s,STACK_OF(X509) *sk) 496int
510 { 497ssl_verify_cert_chain(SSL *s, STACK_OF(X509) *sk)
498{
511 X509 *x; 499 X509 *x;
512 int i; 500 int i;
513 X509_STORE_CTX ctx; 501 X509_STORE_CTX ctx;
514 502
515 if ((sk == NULL) || (sk_X509_num(sk) == 0)) 503 if ((sk == NULL) || (sk_X509_num(sk) == 0))
516 return(0); 504 return (0);
517 505
518 x=sk_X509_value(sk,0); 506 x = sk_X509_value(sk, 0);
519 if(!X509_STORE_CTX_init(&ctx,s->ctx->cert_store,x,sk)) 507 if (!X509_STORE_CTX_init(&ctx, s->ctx->cert_store, x, sk)) {
520 { 508 SSLerr(SSL_F_SSL_VERIFY_CERT_CHAIN, ERR_R_X509_LIB);
521 SSLerr(SSL_F_SSL_VERIFY_CERT_CHAIN,ERR_R_X509_LIB); 509 return (0);
522 return(0); 510 }
523 }
524#if 0 511#if 0
525 if (SSL_get_verify_depth(s) >= 0) 512 if (SSL_get_verify_depth(s) >= 0)
526 X509_STORE_CTX_set_depth(&ctx, SSL_get_verify_depth(s)); 513 X509_STORE_CTX_set_depth(&ctx, SSL_get_verify_depth(s));
527#endif 514#endif
528 X509_STORE_CTX_set_ex_data(&ctx,SSL_get_ex_data_X509_STORE_CTX_idx(),s); 515 X509_STORE_CTX_set_ex_data(&ctx, SSL_get_ex_data_X509_STORE_CTX_idx(), s);
529 516
530 /* We need to inherit the verify parameters. These can be determined by 517 /* We need to inherit the verify parameters. These can be determined by
531 * the context: if its a server it will verify SSL client certificates 518 * the context: if its a server it will verify SSL client certificates
@@ -533,7 +520,7 @@ int ssl_verify_cert_chain(SSL *s,STACK_OF(X509) *sk)
533 */ 520 */
534 521
535 X509_STORE_CTX_set_default(&ctx, 522 X509_STORE_CTX_set_default(&ctx,
536 s->server ? "ssl_client" : "ssl_server"); 523 s->server ? "ssl_client" : "ssl_server");
537 /* Anything non-default in "param" should overwrite anything in the 524 /* Anything non-default in "param" should overwrite anything in the
538 * ctx. 525 * ctx.
539 */ 526 */
@@ -544,121 +531,127 @@ int ssl_verify_cert_chain(SSL *s,STACK_OF(X509) *sk)
544 531
545 if (s->ctx->app_verify_callback != NULL) 532 if (s->ctx->app_verify_callback != NULL)
546#if 1 /* new with OpenSSL 0.9.7 */ 533#if 1 /* new with OpenSSL 0.9.7 */
547 i=s->ctx->app_verify_callback(&ctx, s->ctx->app_verify_arg); 534 i = s->ctx->app_verify_callback(&ctx, s->ctx->app_verify_arg);
535
548#else 536#else
549 i=s->ctx->app_verify_callback(&ctx); /* should pass app_verify_arg */ 537 i=s->ctx->app_verify_callback(&ctx); /* should pass app_verify_arg */
550#endif 538#endif
551 else 539 else {
552 {
553#ifndef OPENSSL_NO_X509_VERIFY 540#ifndef OPENSSL_NO_X509_VERIFY
554 i=X509_verify_cert(&ctx); 541 i = X509_verify_cert(&ctx);
555#else 542#else
556 i=0; 543 i = 0;
557 ctx.error=X509_V_ERR_APPLICATION_VERIFICATION; 544 ctx.error = X509_V_ERR_APPLICATION_VERIFICATION;
558 SSLerr(SSL_F_SSL_VERIFY_CERT_CHAIN,SSL_R_NO_VERIFY_CALLBACK); 545 SSLerr(SSL_F_SSL_VERIFY_CERT_CHAIN, SSL_R_NO_VERIFY_CALLBACK);
559#endif 546#endif
560 } 547 }
561 548
562 s->verify_result=ctx.error; 549 s->verify_result = ctx.error;
563 X509_STORE_CTX_cleanup(&ctx); 550 X509_STORE_CTX_cleanup(&ctx);
564 551
565 return(i); 552 return (i);
566 } 553}
567 554
568static void set_client_CA_list(STACK_OF(X509_NAME) **ca_list,STACK_OF(X509_NAME) *name_list) 555static void
569 { 556set_client_CA_list(STACK_OF(X509_NAME) **ca_list, STACK_OF(X509_NAME) *name_list)
557{
570 if (*ca_list != NULL) 558 if (*ca_list != NULL)
571 sk_X509_NAME_pop_free(*ca_list,X509_NAME_free); 559 sk_X509_NAME_pop_free(*ca_list, X509_NAME_free);
572 560
573 *ca_list=name_list; 561 *ca_list = name_list;
574 } 562}
575 563
576STACK_OF(X509_NAME) *SSL_dup_CA_list(STACK_OF(X509_NAME) *sk) 564STACK_OF(X509_NAME)
577 { 565*SSL_dup_CA_list(STACK_OF(X509_NAME) *sk)
566{
578 int i; 567 int i;
579 STACK_OF(X509_NAME) *ret; 568 STACK_OF(X509_NAME) *ret;
580 X509_NAME *name; 569 X509_NAME *name;
581 570
582 ret=sk_X509_NAME_new_null(); 571 ret = sk_X509_NAME_new_null();
583 for (i=0; i<sk_X509_NAME_num(sk); i++) 572 for (i = 0; i < sk_X509_NAME_num(sk); i++) {
584 { 573 name = X509_NAME_dup(sk_X509_NAME_value(sk, i));
585 name=X509_NAME_dup(sk_X509_NAME_value(sk,i)); 574 if ((name == NULL) || !sk_X509_NAME_push(ret, name)) {
586 if ((name == NULL) || !sk_X509_NAME_push(ret,name)) 575 sk_X509_NAME_pop_free(ret, X509_NAME_free);
587 { 576 return (NULL);
588 sk_X509_NAME_pop_free(ret,X509_NAME_free);
589 return(NULL);
590 }
591 } 577 }
592 return(ret);
593 } 578 }
594 579 return (ret);
595void SSL_set_client_CA_list(SSL *s,STACK_OF(X509_NAME) *name_list) 580}
596 { 581
597 set_client_CA_list(&(s->client_CA),name_list); 582void
598 } 583SSL_set_client_CA_list(SSL *s, STACK_OF(X509_NAME) *name_list)
599 584{
600void SSL_CTX_set_client_CA_list(SSL_CTX *ctx,STACK_OF(X509_NAME) *name_list) 585 set_client_CA_list(&(s->client_CA), name_list);
601 { 586}
602 set_client_CA_list(&(ctx->client_CA),name_list); 587
603 } 588void
604 589SSL_CTX_set_client_CA_list(SSL_CTX *ctx, STACK_OF(X509_NAME) *name_list)
605STACK_OF(X509_NAME) *SSL_CTX_get_client_CA_list(const SSL_CTX *ctx) 590{
606 { 591 set_client_CA_list(&(ctx->client_CA), name_list);
607 return(ctx->client_CA); 592}
608 } 593
609 594STACK_OF(X509_NAME)
610STACK_OF(X509_NAME) *SSL_get_client_CA_list(const SSL *s) 595*SSL_CTX_get_client_CA_list(const SSL_CTX *ctx)
611 { 596{
597 return (ctx->client_CA);
598}
599
600STACK_OF(X509_NAME)
601*SSL_get_client_CA_list(const SSL *s)
602{
612 if (s->type == SSL_ST_CONNECT) 603 if (s->type == SSL_ST_CONNECT)
613 { /* we are in the client */ 604 { /* we are in the client */
614 if (((s->version>>8) == SSL3_VERSION_MAJOR) && 605 if (((s->version >> 8) == SSL3_VERSION_MAJOR) &&
615 (s->s3 != NULL)) 606 (s->s3 != NULL))
616 return(s->s3->tmp.ca_names); 607 return (s->s3->tmp.ca_names);
617 else 608 else
618 return(NULL); 609 return (NULL);
619 } 610 } else {
620 else
621 {
622 if (s->client_CA != NULL) 611 if (s->client_CA != NULL)
623 return(s->client_CA); 612 return (s->client_CA);
624 else 613 else
625 return(s->ctx->client_CA); 614 return (s->ctx->client_CA);
626 }
627 } 615 }
616}
628 617
629static int add_client_CA(STACK_OF(X509_NAME) **sk,X509 *x) 618static int
630 { 619add_client_CA(STACK_OF(X509_NAME) **sk, X509 *x)
620{
631 X509_NAME *name; 621 X509_NAME *name;
632 622
633 if (x == NULL) return(0); 623 if (x == NULL)
634 if ((*sk == NULL) && ((*sk=sk_X509_NAME_new_null()) == NULL)) 624 return (0);
635 return(0); 625 if ((*sk == NULL) && ((*sk = sk_X509_NAME_new_null()) == NULL))
636 626 return (0);
637 if ((name=X509_NAME_dup(X509_get_subject_name(x))) == NULL)
638 return(0);
639
640 if (!sk_X509_NAME_push(*sk,name))
641 {
642 X509_NAME_free(name);
643 return(0);
644 }
645 return(1);
646 }
647 627
648int SSL_add_client_CA(SSL *ssl,X509 *x) 628 if ((name = X509_NAME_dup(X509_get_subject_name(x))) == NULL)
649 { 629 return (0);
650 return(add_client_CA(&(ssl->client_CA),x));
651 }
652 630
653int SSL_CTX_add_client_CA(SSL_CTX *ctx,X509 *x) 631 if (!sk_X509_NAME_push(*sk, name)) {
654 { 632 X509_NAME_free(name);
655 return(add_client_CA(&(ctx->client_CA),x)); 633 return (0);
656 }
657
658static int xname_cmp(const X509_NAME * const *a, const X509_NAME * const *b)
659 {
660 return(X509_NAME_cmp(*a,*b));
661 } 634 }
635 return (1);
636}
637
638int
639SSL_add_client_CA(SSL *ssl, X509 *x)
640{
641 return (add_client_CA(&(ssl->client_CA), x));
642}
643
644int
645SSL_CTX_add_client_CA(SSL_CTX *ctx, X509 *x)
646{
647 return (add_client_CA(&(ctx->client_CA), x));
648}
649
650static int
651xname_cmp(const X509_NAME * const *a, const X509_NAME * const *b)
652{
653 return (X509_NAME_cmp(*a, *b));
654}
662 655
663#ifndef OPENSSL_NO_STDIO 656#ifndef OPENSSL_NO_STDIO
664/*! 657/*!
@@ -669,65 +662,65 @@ static int xname_cmp(const X509_NAME * const *a, const X509_NAME * const *b)
669 * \param file the file containing one or more certs. 662 * \param file the file containing one or more certs.
670 * \return a ::STACK containing the certs. 663 * \return a ::STACK containing the certs.
671 */ 664 */
672STACK_OF(X509_NAME) *SSL_load_client_CA_file(const char *file) 665STACK_OF(X509_NAME)
673 { 666*SSL_load_client_CA_file(const char *file)
667{
674 BIO *in; 668 BIO *in;
675 X509 *x=NULL; 669 X509 *x = NULL;
676 X509_NAME *xn=NULL; 670 X509_NAME *xn = NULL;
677 STACK_OF(X509_NAME) *ret = NULL,*sk; 671 STACK_OF(X509_NAME) *ret = NULL, *sk;
678 672
679 sk=sk_X509_NAME_new(xname_cmp); 673 sk = sk_X509_NAME_new(xname_cmp);
680 674
681 in=BIO_new(BIO_s_file_internal()); 675 in = BIO_new(BIO_s_file_internal());
682 676
683 if ((sk == NULL) || (in == NULL)) 677 if ((sk == NULL) || (in == NULL)) {
684 { 678 SSLerr(SSL_F_SSL_LOAD_CLIENT_CA_FILE, ERR_R_MALLOC_FAILURE);
685 SSLerr(SSL_F_SSL_LOAD_CLIENT_CA_FILE,ERR_R_MALLOC_FAILURE);
686 goto err; 679 goto err;
687 } 680 }
688 681
689 if (!BIO_read_filename(in,file)) 682 if (!BIO_read_filename(in, file))
690 goto err; 683 goto err;
691 684
692 for (;;) 685 for (;;) {
693 { 686 if (PEM_read_bio_X509(in, &x, NULL, NULL) == NULL)
694 if (PEM_read_bio_X509(in,&x,NULL,NULL) == NULL)
695 break; 687 break;
696 if (ret == NULL) 688 if (ret == NULL) {
697 {
698 ret = sk_X509_NAME_new_null(); 689 ret = sk_X509_NAME_new_null();
699 if (ret == NULL) 690 if (ret == NULL) {
700 { 691 SSLerr(SSL_F_SSL_LOAD_CLIENT_CA_FILE, ERR_R_MALLOC_FAILURE);
701 SSLerr(SSL_F_SSL_LOAD_CLIENT_CA_FILE,ERR_R_MALLOC_FAILURE);
702 goto err; 692 goto err;
703 }
704 } 693 }
705 if ((xn=X509_get_subject_name(x)) == NULL) goto err; 694 }
706 /* check for duplicates */ 695 if ((xn = X509_get_subject_name(x)) == NULL) goto err;
707 xn=X509_NAME_dup(xn); 696 /* check for duplicates */
708 if (xn == NULL) goto err; 697 xn = X509_NAME_dup(xn);
709 if (sk_X509_NAME_find(sk,xn) >= 0) 698 if (xn == NULL)
699 goto err;
700 if (sk_X509_NAME_find(sk, xn) >= 0)
710 X509_NAME_free(xn); 701 X509_NAME_free(xn);
711 else 702 else {
712 { 703 sk_X509_NAME_push(sk, xn);
713 sk_X509_NAME_push(sk,xn); 704 sk_X509_NAME_push(ret, xn);
714 sk_X509_NAME_push(ret,xn);
715 }
716 } 705 }
706 }
717 707
718 if (0) 708 if (0) {
719 {
720err: 709err:
721 if (ret != NULL) sk_X509_NAME_pop_free(ret,X509_NAME_free); 710 if (ret != NULL)
722 ret=NULL; 711 sk_X509_NAME_pop_free(ret, X509_NAME_free);
723 } 712 ret = NULL;
724 if (sk != NULL) sk_X509_NAME_free(sk); 713 }
725 if (in != NULL) BIO_free(in); 714 if (sk != NULL)
726 if (x != NULL) X509_free(x); 715 sk_X509_NAME_free(sk);
716 if (in != NULL)
717 BIO_free(in);
718 if (x != NULL)
719 X509_free(x);
727 if (ret != NULL) 720 if (ret != NULL)
728 ERR_clear_error(); 721 ERR_clear_error();
729 return(ret); 722 return (ret);
730 } 723}
731#endif 724#endif
732 725
733/*! 726/*!
@@ -739,57 +732,56 @@ err:
739 * certs may have been added to \c stack. 732 * certs may have been added to \c stack.
740 */ 733 */
741 734
742int SSL_add_file_cert_subjects_to_stack(STACK_OF(X509_NAME) *stack, 735int
743 const char *file) 736SSL_add_file_cert_subjects_to_stack(STACK_OF(X509_NAME) *stack,
744 { 737 const char *file)
738{
745 BIO *in; 739 BIO *in;
746 X509 *x=NULL; 740 X509 *x = NULL;
747 X509_NAME *xn=NULL; 741 X509_NAME *xn = NULL;
748 int ret=1; 742 int ret = 1;
749 int (*oldcmp)(const X509_NAME * const *a, const X509_NAME * const *b); 743 int (*oldcmp)(const X509_NAME * const *a, const X509_NAME * const *b);
750 744
751 oldcmp=sk_X509_NAME_set_cmp_func(stack,xname_cmp); 745 oldcmp = sk_X509_NAME_set_cmp_func(stack, xname_cmp);
752 746
753 in=BIO_new(BIO_s_file_internal()); 747 in = BIO_new(BIO_s_file_internal());
754 748
755 if (in == NULL) 749 if (in == NULL) {
756 { 750 SSLerr(SSL_F_SSL_ADD_FILE_CERT_SUBJECTS_TO_STACK, ERR_R_MALLOC_FAILURE);
757 SSLerr(SSL_F_SSL_ADD_FILE_CERT_SUBJECTS_TO_STACK,ERR_R_MALLOC_FAILURE);
758 goto err; 751 goto err;
759 } 752 }
760 753
761 if (!BIO_read_filename(in,file)) 754 if (!BIO_read_filename(in, file))
762 goto err; 755 goto err;
763 756
764 for (;;) 757 for (;;) {
765 { 758 if (PEM_read_bio_X509(in, &x, NULL, NULL) == NULL)
766 if (PEM_read_bio_X509(in,&x,NULL,NULL) == NULL)
767 break; 759 break;
768 if ((xn=X509_get_subject_name(x)) == NULL) goto err; 760 if ((xn = X509_get_subject_name(x)) == NULL) goto err;
769 xn=X509_NAME_dup(xn); 761 xn = X509_NAME_dup(xn);
770 if (xn == NULL) goto err; 762 if (xn == NULL)
771 if (sk_X509_NAME_find(stack,xn) >= 0) 763 goto err;
764 if (sk_X509_NAME_find(stack, xn) >= 0)
772 X509_NAME_free(xn); 765 X509_NAME_free(xn);
773 else 766 else
774 sk_X509_NAME_push(stack,xn); 767 sk_X509_NAME_push(stack, xn);
775 } 768 }
776 769
777 ERR_clear_error(); 770 ERR_clear_error();
778 771
779 if (0) 772 if (0) {
780 {
781err: 773err:
782 ret=0; 774 ret = 0;
783 } 775 }
784 if(in != NULL) 776 if (in != NULL)
785 BIO_free(in); 777 BIO_free(in);
786 if(x != NULL) 778 if (x != NULL)
787 X509_free(x); 779 X509_free(x);
788 780
789 (void)sk_X509_NAME_set_cmp_func(stack,oldcmp); 781 (void)sk_X509_NAME_set_cmp_func(stack, oldcmp);
790 782
791 return ret; 783 return ret;
792 } 784}
793 785
794/*! 786/*!
795 * Add a directory of certs to a stack. 787 * Add a directory of certs to a stack.
@@ -802,9 +794,10 @@ err:
802 * certs may have been added to \c stack. 794 * certs may have been added to \c stack.
803 */ 795 */
804 796
805int SSL_add_dir_cert_subjects_to_stack(STACK_OF(X509_NAME) *stack, 797int
806 const char *dir) 798SSL_add_dir_cert_subjects_to_stack(STACK_OF(X509_NAME) *stack,
807 { 799 const char *dir)
800{
808 OPENSSL_DIR_CTX *d = NULL; 801 OPENSSL_DIR_CTX *d = NULL;
809 const char *filename; 802 const char *filename;
810 int ret = 0; 803 int ret = 0;
@@ -813,36 +806,34 @@ int SSL_add_dir_cert_subjects_to_stack(STACK_OF(X509_NAME) *stack,
813 806
814 /* Note that a side effect is that the CAs will be sorted by name */ 807 /* Note that a side effect is that the CAs will be sorted by name */
815 808
816 while((filename = OPENSSL_DIR_read(&d, dir))) 809 while ((filename = OPENSSL_DIR_read(&d, dir))) {
817 {
818 char buf[1024]; 810 char buf[1024];
819 int r; 811 int r;
820 812
821 if(strlen(dir)+strlen(filename)+2 > sizeof buf) 813 if (strlen(dir) + strlen(filename) + 2 > sizeof buf) {
822 { 814 SSLerr(SSL_F_SSL_ADD_DIR_CERT_SUBJECTS_TO_STACK, SSL_R_PATH_TOO_LONG);
823 SSLerr(SSL_F_SSL_ADD_DIR_CERT_SUBJECTS_TO_STACK,SSL_R_PATH_TOO_LONG);
824 goto err; 815 goto err;
825 } 816 }
826 r = BIO_snprintf(buf,sizeof buf,"%s/%s",dir,filename); 817 r = BIO_snprintf(buf, sizeof buf, "%s/%s", dir, filename);
827 if (r <= 0 || r >= (int)sizeof(buf)) 818 if (r <= 0 || r >= (int)sizeof(buf))
828 goto err; 819 goto err;
829 if(!SSL_add_file_cert_subjects_to_stack(stack,buf)) 820 if (!SSL_add_file_cert_subjects_to_stack(stack, buf))
830 goto err; 821 goto err;
831 } 822 }
832 823
833 if (errno) 824 if (errno) {
834 {
835 SYSerr(SYS_F_OPENDIR, errno); 825 SYSerr(SYS_F_OPENDIR, errno);
836 ERR_add_error_data(3, "OPENSSL_DIR_read(&ctx, '", dir, "')"); 826 ERR_add_error_data(3, "OPENSSL_DIR_read(&ctx, '", dir, "')");
837 SSLerr(SSL_F_SSL_ADD_DIR_CERT_SUBJECTS_TO_STACK, ERR_R_SYS_LIB); 827 SSLerr(SSL_F_SSL_ADD_DIR_CERT_SUBJECTS_TO_STACK, ERR_R_SYS_LIB);
838 goto err; 828 goto err;
839 } 829 }
840 830
841 ret = 1; 831 ret = 1;
842 832
843err: 833err:
844 if (d) OPENSSL_DIR_end(&d); 834 if (d)
835 OPENSSL_DIR_end(&d);
845 CRYPTO_w_unlock(CRYPTO_LOCK_READDIR); 836 CRYPTO_w_unlock(CRYPTO_LOCK_READDIR);
846 return ret; 837 return ret;
847 } 838}
848 839
diff --git a/src/lib/libssl/src/ssl/ssl_ciph.c b/src/lib/libssl/src/ssl/ssl_ciph.c
index 0aba8e048c..f37c70cf91 100644
--- a/src/lib/libssl/src/ssl/ssl_ciph.c
+++ b/src/lib/libssl/src/ssl/ssl_ciph.c
@@ -167,15 +167,15 @@
167#define SSL_ENC_NUM_IDX 14 167#define SSL_ENC_NUM_IDX 14
168 168
169 169
170static const EVP_CIPHER *ssl_cipher_methods[SSL_ENC_NUM_IDX]={ 170static const EVP_CIPHER *ssl_cipher_methods[SSL_ENC_NUM_IDX] = {
171 NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL 171 NULL, NULL, NULL, NULL, NULL, NULL, NULL, NULL, NULL, NULL, NULL, NULL, NULL, NULL
172 }; 172};
173 173
174#define SSL_COMP_NULL_IDX 0 174#define SSL_COMP_NULL_IDX 0
175#define SSL_COMP_ZLIB_IDX 1 175#define SSL_COMP_ZLIB_IDX 1
176#define SSL_COMP_NUM_IDX 2 176#define SSL_COMP_NUM_IDX 2
177 177
178static STACK_OF(SSL_COMP) *ssl_comp_methods=NULL; 178static STACK_OF(SSL_COMP) *ssl_comp_methods = NULL;
179 179
180#define SSL_MD_MD5_IDX 0 180#define SSL_MD_MD5_IDX 0
181#define SSL_MD_SHA1_IDX 1 181#define SSL_MD_SHA1_IDX 1
@@ -187,27 +187,27 @@ static STACK_OF(SSL_COMP) *ssl_comp_methods=NULL;
187 * defined in the 187 * defined in the
188 * ssl_locl.h */ 188 * ssl_locl.h */
189#define SSL_MD_NUM_IDX SSL_MAX_DIGEST 189#define SSL_MD_NUM_IDX SSL_MAX_DIGEST
190static const EVP_MD *ssl_digest_methods[SSL_MD_NUM_IDX]={ 190static const EVP_MD *ssl_digest_methods[SSL_MD_NUM_IDX] = {
191 NULL,NULL,NULL,NULL,NULL,NULL 191 NULL, NULL, NULL, NULL, NULL, NULL
192 }; 192};
193/* PKEY_TYPE for GOST89MAC is known in advance, but, because 193/* PKEY_TYPE for GOST89MAC is known in advance, but, because
194 * implementation is engine-provided, we'll fill it only if 194 * implementation is engine-provided, we'll fill it only if
195 * corresponding EVP_PKEY_METHOD is found 195 * corresponding EVP_PKEY_METHOD is found
196 */ 196 */
197static int ssl_mac_pkey_id[SSL_MD_NUM_IDX]={ 197static int ssl_mac_pkey_id[SSL_MD_NUM_IDX] = {
198 EVP_PKEY_HMAC,EVP_PKEY_HMAC,EVP_PKEY_HMAC,NID_undef, 198 EVP_PKEY_HMAC, EVP_PKEY_HMAC, EVP_PKEY_HMAC, NID_undef,
199 EVP_PKEY_HMAC,EVP_PKEY_HMAC 199 EVP_PKEY_HMAC, EVP_PKEY_HMAC
200 }; 200};
201 201
202static int ssl_mac_secret_size[SSL_MD_NUM_IDX]={ 202static int ssl_mac_secret_size[SSL_MD_NUM_IDX] = {
203 0,0,0,0,0,0 203 0, 0, 0, 0, 0, 0
204 }; 204};
205 205
206static int ssl_handshake_digest_flag[SSL_MD_NUM_IDX]={ 206static int ssl_handshake_digest_flag[SSL_MD_NUM_IDX] = {
207 SSL_HANDSHAKE_MAC_MD5,SSL_HANDSHAKE_MAC_SHA, 207 SSL_HANDSHAKE_MAC_MD5, SSL_HANDSHAKE_MAC_SHA,
208 SSL_HANDSHAKE_MAC_GOST94, 0, SSL_HANDSHAKE_MAC_SHA256, 208 SSL_HANDSHAKE_MAC_GOST94, 0, SSL_HANDSHAKE_MAC_SHA256,
209 SSL_HANDSHAKE_MAC_SHA384 209 SSL_HANDSHAKE_MAC_SHA384
210 }; 210};
211 211
212#define CIPHER_ADD 1 212#define CIPHER_ADD 1
213#define CIPHER_KILL 2 213#define CIPHER_KILL 2
@@ -215,376 +215,371 @@ static int ssl_handshake_digest_flag[SSL_MD_NUM_IDX]={
215#define CIPHER_ORD 4 215#define CIPHER_ORD 4
216#define CIPHER_SPECIAL 5 216#define CIPHER_SPECIAL 5
217 217
218typedef struct cipher_order_st 218typedef struct cipher_order_st {
219 {
220 const SSL_CIPHER *cipher; 219 const SSL_CIPHER *cipher;
221 int active; 220 int active;
222 int dead; 221 int dead;
223 struct cipher_order_st *next,*prev; 222 struct cipher_order_st *next, *prev;
224 } CIPHER_ORDER; 223} CIPHER_ORDER;
225 224
226static const SSL_CIPHER cipher_aliases[]={ 225static const SSL_CIPHER cipher_aliases[] = {
227 /* "ALL" doesn't include eNULL (must be specifically enabled) */ 226 /* "ALL" doesn't include eNULL (must be specifically enabled) */
228 {0,SSL_TXT_ALL,0, 0,0,~SSL_eNULL,0,0,0,0,0,0}, 227 {0, SSL_TXT_ALL, 0, 0, 0,~SSL_eNULL, 0, 0, 0, 0, 0, 0},
229 /* "COMPLEMENTOFALL" */ 228 /* "COMPLEMENTOFALL" */
230 {0,SSL_TXT_CMPALL,0, 0,0,SSL_eNULL,0,0,0,0,0,0}, 229 {0, SSL_TXT_CMPALL, 0, 0, 0, SSL_eNULL, 0, 0, 0, 0, 0, 0},
231 230
232 /* "COMPLEMENTOFDEFAULT" (does *not* include ciphersuites not found in ALL!) */ 231 /* "COMPLEMENTOFDEFAULT" (does *not* include ciphersuites not found in ALL!) */
233 {0,SSL_TXT_CMPDEF,0, SSL_kEDH|SSL_kEECDH,SSL_aNULL,~SSL_eNULL,0,0,0,0,0,0}, 232 {0, SSL_TXT_CMPDEF, 0, SSL_kEDH|SSL_kEECDH, SSL_aNULL,~SSL_eNULL, 0, 0, 0, 0, 0, 0},
234 233
235 /* key exchange aliases 234 /* key exchange aliases
236 * (some of those using only a single bit here combine 235 * (some of those using only a single bit here combine
237 * multiple key exchange algs according to the RFCs, 236 * multiple key exchange algs according to the RFCs,
238 * e.g. kEDH combines DHE_DSS and DHE_RSA) */ 237 * e.g. kEDH combines DHE_DSS and DHE_RSA) */
239 {0,SSL_TXT_kRSA,0, SSL_kRSA, 0,0,0,0,0,0,0,0}, 238 {0, SSL_TXT_kRSA, 0, SSL_kRSA, 0, 0, 0, 0, 0, 0, 0, 0},
240 239
241 {0,SSL_TXT_kDHr,0, SSL_kDHr, 0,0,0,0,0,0,0,0}, /* no such ciphersuites supported! */ 240 {0,SSL_TXT_kDHr,0, SSL_kDHr, 0,0,0,0,0,0,0,0}, /* no such ciphersuites supported! */
242 {0,SSL_TXT_kDHd,0, SSL_kDHd, 0,0,0,0,0,0,0,0}, /* no such ciphersuites supported! */ 241 {0,SSL_TXT_kDHd,0, SSL_kDHd, 0,0,0,0,0,0,0,0}, /* no such ciphersuites supported! */
243 {0,SSL_TXT_kDH,0, SSL_kDHr|SSL_kDHd,0,0,0,0,0,0,0,0}, /* no such ciphersuites supported! */ 242 {0,SSL_TXT_kDH,0, SSL_kDHr|SSL_kDHd,0,0,0,0,0,0,0,0}, /* no such ciphersuites supported! */
244 {0,SSL_TXT_kEDH,0, SSL_kEDH, 0,0,0,0,0,0,0,0}, 243 {0, SSL_TXT_kEDH, 0, SSL_kEDH, 0, 0, 0, 0, 0, 0, 0, 0},
245 {0,SSL_TXT_DH,0, SSL_kDHr|SSL_kDHd|SSL_kEDH,0,0,0,0,0,0,0,0}, 244 {0, SSL_TXT_DH, 0, SSL_kDHr|SSL_kDHd|SSL_kEDH, 0, 0, 0, 0, 0, 0, 0, 0},
246 245
247 {0,SSL_TXT_kKRB5,0, SSL_kKRB5, 0,0,0,0,0,0,0,0}, 246 {0, SSL_TXT_kKRB5, 0, SSL_kKRB5, 0, 0, 0, 0, 0, 0, 0, 0},
248 247
249 {0,SSL_TXT_kECDHr,0, SSL_kECDHr,0,0,0,0,0,0,0,0}, 248 {0, SSL_TXT_kECDHr, 0, SSL_kECDHr, 0, 0, 0, 0, 0, 0, 0, 0},
250 {0,SSL_TXT_kECDHe,0, SSL_kECDHe,0,0,0,0,0,0,0,0}, 249 {0, SSL_TXT_kECDHe, 0, SSL_kECDHe, 0, 0, 0, 0, 0, 0, 0, 0},
251 {0,SSL_TXT_kECDH,0, SSL_kECDHr|SSL_kECDHe,0,0,0,0,0,0,0,0}, 250 {0, SSL_TXT_kECDH, 0, SSL_kECDHr|SSL_kECDHe, 0, 0, 0, 0, 0, 0, 0, 0},
252 {0,SSL_TXT_kEECDH,0, SSL_kEECDH,0,0,0,0,0,0,0,0}, 251 {0, SSL_TXT_kEECDH, 0, SSL_kEECDH, 0, 0, 0, 0, 0, 0, 0, 0},
253 {0,SSL_TXT_ECDH,0, SSL_kECDHr|SSL_kECDHe|SSL_kEECDH,0,0,0,0,0,0,0,0}, 252 {0, SSL_TXT_ECDH, 0, SSL_kECDHr|SSL_kECDHe|SSL_kEECDH, 0, 0, 0, 0, 0, 0, 0, 0},
254 253
255 {0,SSL_TXT_kPSK,0, SSL_kPSK, 0,0,0,0,0,0,0,0}, 254 {0, SSL_TXT_kPSK, 0, SSL_kPSK, 0, 0, 0, 0, 0, 0, 0, 0},
256 {0,SSL_TXT_kSRP,0, SSL_kSRP, 0,0,0,0,0,0,0,0}, 255 {0, SSL_TXT_kSRP, 0, SSL_kSRP, 0, 0, 0, 0, 0, 0, 0, 0},
257 {0,SSL_TXT_kGOST,0, SSL_kGOST,0,0,0,0,0,0,0,0}, 256 {0, SSL_TXT_kGOST, 0, SSL_kGOST, 0, 0, 0, 0, 0, 0, 0, 0},
258 257
259 /* server authentication aliases */ 258 /* server authentication aliases */
260 {0,SSL_TXT_aRSA,0, 0,SSL_aRSA, 0,0,0,0,0,0,0}, 259 {0, SSL_TXT_aRSA, 0, 0, SSL_aRSA, 0, 0, 0, 0, 0, 0, 0},
261 {0,SSL_TXT_aDSS,0, 0,SSL_aDSS, 0,0,0,0,0,0,0}, 260 {0, SSL_TXT_aDSS, 0, 0, SSL_aDSS, 0, 0, 0, 0, 0, 0, 0},
262 {0,SSL_TXT_DSS,0, 0,SSL_aDSS, 0,0,0,0,0,0,0}, 261 {0, SSL_TXT_DSS, 0, 0, SSL_aDSS, 0, 0, 0, 0, 0, 0, 0},
263 {0,SSL_TXT_aKRB5,0, 0,SSL_aKRB5, 0,0,0,0,0,0,0}, 262 {0, SSL_TXT_aKRB5, 0, 0, SSL_aKRB5, 0, 0, 0, 0, 0, 0, 0},
264 {0,SSL_TXT_aNULL,0, 0,SSL_aNULL, 0,0,0,0,0,0,0}, 263 {0, SSL_TXT_aNULL, 0, 0, SSL_aNULL, 0, 0, 0, 0, 0, 0, 0},
265 {0,SSL_TXT_aDH,0, 0,SSL_aDH, 0,0,0,0,0,0,0}, /* no such ciphersuites supported! */ 264 {0,SSL_TXT_aDH,0, 0,SSL_aDH, 0,0,0,0,0,0,0}, /* no such ciphersuites supported! */
266 {0,SSL_TXT_aECDH,0, 0,SSL_aECDH, 0,0,0,0,0,0,0}, 265 {0, SSL_TXT_aECDH, 0, 0, SSL_aECDH, 0, 0, 0, 0, 0, 0, 0},
267 {0,SSL_TXT_aECDSA,0, 0,SSL_aECDSA,0,0,0,0,0,0,0}, 266 {0, SSL_TXT_aECDSA, 0, 0, SSL_aECDSA, 0, 0, 0, 0, 0, 0, 0},
268 {0,SSL_TXT_ECDSA,0, 0,SSL_aECDSA, 0,0,0,0,0,0,0}, 267 {0, SSL_TXT_ECDSA, 0, 0, SSL_aECDSA, 0, 0, 0, 0, 0, 0, 0},
269 {0,SSL_TXT_aPSK,0, 0,SSL_aPSK, 0,0,0,0,0,0,0}, 268 {0, SSL_TXT_aPSK, 0, 0, SSL_aPSK, 0, 0, 0, 0, 0, 0, 0},
270 {0,SSL_TXT_aGOST94,0,0,SSL_aGOST94,0,0,0,0,0,0,0}, 269 {0, SSL_TXT_aGOST94, 0, 0, SSL_aGOST94, 0, 0, 0, 0, 0, 0, 0},
271 {0,SSL_TXT_aGOST01,0,0,SSL_aGOST01,0,0,0,0,0,0,0}, 270 {0, SSL_TXT_aGOST01, 0, 0, SSL_aGOST01, 0, 0, 0, 0, 0, 0, 0},
272 {0,SSL_TXT_aGOST,0,0,SSL_aGOST94|SSL_aGOST01,0,0,0,0,0,0,0}, 271 {0, SSL_TXT_aGOST, 0, 0, SSL_aGOST94|SSL_aGOST01, 0, 0, 0, 0, 0, 0, 0},
273 272
274 /* aliases combining key exchange and server authentication */ 273 /* aliases combining key exchange and server authentication */
275 {0,SSL_TXT_EDH,0, SSL_kEDH,~SSL_aNULL,0,0,0,0,0,0,0}, 274 {0, SSL_TXT_EDH, 0, SSL_kEDH,~SSL_aNULL, 0, 0, 0, 0, 0, 0, 0},
276 {0,SSL_TXT_EECDH,0, SSL_kEECDH,~SSL_aNULL,0,0,0,0,0,0,0}, 275 {0, SSL_TXT_EECDH, 0, SSL_kEECDH,~SSL_aNULL, 0, 0, 0, 0, 0, 0, 0},
277 {0,SSL_TXT_NULL,0, 0,0,SSL_eNULL, 0,0,0,0,0,0}, 276 {0, SSL_TXT_NULL, 0, 0, 0, SSL_eNULL, 0, 0, 0, 0, 0, 0},
278 {0,SSL_TXT_KRB5,0, SSL_kKRB5,SSL_aKRB5,0,0,0,0,0,0,0}, 277 {0, SSL_TXT_KRB5, 0, SSL_kKRB5, SSL_aKRB5, 0, 0, 0, 0, 0, 0, 0},
279 {0,SSL_TXT_RSA,0, SSL_kRSA,SSL_aRSA,0,0,0,0,0,0,0}, 278 {0, SSL_TXT_RSA, 0, SSL_kRSA, SSL_aRSA, 0, 0, 0, 0, 0, 0, 0},
280 {0,SSL_TXT_ADH,0, SSL_kEDH,SSL_aNULL,0,0,0,0,0,0,0}, 279 {0, SSL_TXT_ADH, 0, SSL_kEDH, SSL_aNULL, 0, 0, 0, 0, 0, 0, 0},
281 {0,SSL_TXT_AECDH,0, SSL_kEECDH,SSL_aNULL,0,0,0,0,0,0,0}, 280 {0, SSL_TXT_AECDH, 0, SSL_kEECDH, SSL_aNULL, 0, 0, 0, 0, 0, 0, 0},
282 {0,SSL_TXT_PSK,0, SSL_kPSK,SSL_aPSK,0,0,0,0,0,0,0}, 281 {0, SSL_TXT_PSK, 0, SSL_kPSK, SSL_aPSK, 0, 0, 0, 0, 0, 0, 0},
283 {0,SSL_TXT_SRP,0, SSL_kSRP,0,0,0,0,0,0,0,0}, 282 {0, SSL_TXT_SRP, 0, SSL_kSRP, 0, 0, 0, 0, 0, 0, 0, 0},
284 283
285 284
286 /* symmetric encryption aliases */ 285 /* symmetric encryption aliases */
287 {0,SSL_TXT_DES,0, 0,0,SSL_DES, 0,0,0,0,0,0}, 286 {0, SSL_TXT_DES, 0, 0, 0, SSL_DES, 0, 0, 0, 0, 0, 0},
288 {0,SSL_TXT_3DES,0, 0,0,SSL_3DES, 0,0,0,0,0,0}, 287 {0, SSL_TXT_3DES, 0, 0, 0, SSL_3DES, 0, 0, 0, 0, 0, 0},
289 {0,SSL_TXT_RC4,0, 0,0,SSL_RC4, 0,0,0,0,0,0}, 288 {0, SSL_TXT_RC4, 0, 0, 0, SSL_RC4, 0, 0, 0, 0, 0, 0},
290 {0,SSL_TXT_RC2,0, 0,0,SSL_RC2, 0,0,0,0,0,0}, 289 {0, SSL_TXT_RC2, 0, 0, 0, SSL_RC2, 0, 0, 0, 0, 0, 0},
291 {0,SSL_TXT_IDEA,0, 0,0,SSL_IDEA, 0,0,0,0,0,0}, 290 {0, SSL_TXT_IDEA, 0, 0, 0, SSL_IDEA, 0, 0, 0, 0, 0, 0},
292 {0,SSL_TXT_SEED,0, 0,0,SSL_SEED, 0,0,0,0,0,0}, 291 {0, SSL_TXT_SEED, 0, 0, 0, SSL_SEED, 0, 0, 0, 0, 0, 0},
293 {0,SSL_TXT_eNULL,0, 0,0,SSL_eNULL, 0,0,0,0,0,0}, 292 {0, SSL_TXT_eNULL, 0, 0, 0, SSL_eNULL, 0, 0, 0, 0, 0, 0},
294 {0,SSL_TXT_AES128,0, 0,0,SSL_AES128|SSL_AES128GCM,0,0,0,0,0,0}, 293 {0, SSL_TXT_AES128, 0, 0, 0, SSL_AES128|SSL_AES128GCM, 0, 0, 0, 0, 0, 0},
295 {0,SSL_TXT_AES256,0, 0,0,SSL_AES256|SSL_AES256GCM,0,0,0,0,0,0}, 294 {0, SSL_TXT_AES256, 0, 0, 0, SSL_AES256|SSL_AES256GCM, 0, 0, 0, 0, 0, 0},
296 {0,SSL_TXT_AES,0, 0,0,SSL_AES,0,0,0,0,0,0}, 295 {0, SSL_TXT_AES, 0, 0, 0, SSL_AES, 0, 0, 0, 0, 0, 0},
297 {0,SSL_TXT_AES_GCM,0, 0,0,SSL_AES128GCM|SSL_AES256GCM,0,0,0,0,0,0}, 296 {0, SSL_TXT_AES_GCM, 0, 0, 0, SSL_AES128GCM|SSL_AES256GCM, 0, 0, 0, 0, 0, 0},
298 {0,SSL_TXT_CAMELLIA128,0,0,0,SSL_CAMELLIA128,0,0,0,0,0,0}, 297 {0, SSL_TXT_CAMELLIA128, 0, 0, 0, SSL_CAMELLIA128, 0, 0, 0, 0, 0, 0},
299 {0,SSL_TXT_CAMELLIA256,0,0,0,SSL_CAMELLIA256,0,0,0,0,0,0}, 298 {0, SSL_TXT_CAMELLIA256, 0, 0, 0, SSL_CAMELLIA256, 0, 0, 0, 0, 0, 0},
300 {0,SSL_TXT_CAMELLIA ,0,0,0,SSL_CAMELLIA128|SSL_CAMELLIA256,0,0,0,0,0,0}, 299 {0, SSL_TXT_CAMELLIA , 0, 0, 0, SSL_CAMELLIA128|SSL_CAMELLIA256, 0, 0, 0, 0, 0, 0},
301 300
302 /* MAC aliases */ 301 /* MAC aliases */
303 {0,SSL_TXT_MD5,0, 0,0,0,SSL_MD5, 0,0,0,0,0}, 302 {0, SSL_TXT_MD5, 0, 0, 0, 0, SSL_MD5, 0, 0, 0, 0, 0},
304 {0,SSL_TXT_SHA1,0, 0,0,0,SSL_SHA1, 0,0,0,0,0}, 303 {0, SSL_TXT_SHA1, 0, 0, 0, 0, SSL_SHA1, 0, 0, 0, 0, 0},
305 {0,SSL_TXT_SHA,0, 0,0,0,SSL_SHA1, 0,0,0,0,0}, 304 {0, SSL_TXT_SHA, 0, 0, 0, 0, SSL_SHA1, 0, 0, 0, 0, 0},
306 {0,SSL_TXT_GOST94,0, 0,0,0,SSL_GOST94, 0,0,0,0,0}, 305 {0, SSL_TXT_GOST94, 0, 0, 0, 0, SSL_GOST94, 0, 0, 0, 0, 0},
307 {0,SSL_TXT_GOST89MAC,0, 0,0,0,SSL_GOST89MAC, 0,0,0,0,0}, 306 {0, SSL_TXT_GOST89MAC, 0, 0, 0, 0, SSL_GOST89MAC, 0, 0, 0, 0, 0},
308 {0,SSL_TXT_SHA256,0, 0,0,0,SSL_SHA256, 0,0,0,0,0}, 307 {0, SSL_TXT_SHA256, 0, 0, 0, 0, SSL_SHA256, 0, 0, 0, 0, 0},
309 {0,SSL_TXT_SHA384,0, 0,0,0,SSL_SHA384, 0,0,0,0,0}, 308 {0, SSL_TXT_SHA384, 0, 0, 0, 0, SSL_SHA384, 0, 0, 0, 0, 0},
310 309
311 /* protocol version aliases */ 310 /* protocol version aliases */
312 {0,SSL_TXT_SSLV2,0, 0,0,0,0,SSL_SSLV2, 0,0,0,0}, 311 {0, SSL_TXT_SSLV2, 0, 0, 0, 0, 0, SSL_SSLV2, 0, 0, 0, 0},
313 {0,SSL_TXT_SSLV3,0, 0,0,0,0,SSL_SSLV3, 0,0,0,0}, 312 {0, SSL_TXT_SSLV3, 0, 0, 0, 0, 0, SSL_SSLV3, 0, 0, 0, 0},
314 {0,SSL_TXT_TLSV1,0, 0,0,0,0,SSL_TLSV1, 0,0,0,0}, 313 {0, SSL_TXT_TLSV1, 0, 0, 0, 0, 0, SSL_TLSV1, 0, 0, 0, 0},
315 {0,SSL_TXT_TLSV1_2,0, 0,0,0,0,SSL_TLSV1_2, 0,0,0,0}, 314 {0, SSL_TXT_TLSV1_2, 0, 0, 0, 0, 0, SSL_TLSV1_2, 0, 0, 0, 0},
316 315
317 /* export flag */ 316 /* export flag */
318 {0,SSL_TXT_EXP,0, 0,0,0,0,0,SSL_EXPORT,0,0,0}, 317 {0, SSL_TXT_EXP, 0, 0, 0, 0, 0, 0, SSL_EXPORT, 0, 0, 0},
319 {0,SSL_TXT_EXPORT,0, 0,0,0,0,0,SSL_EXPORT,0,0,0}, 318 {0, SSL_TXT_EXPORT, 0, 0, 0, 0, 0, 0, SSL_EXPORT, 0, 0, 0},
320 319
321 /* strength classes */ 320 /* strength classes */
322 {0,SSL_TXT_EXP40,0, 0,0,0,0,0,SSL_EXP40, 0,0,0}, 321 {0, SSL_TXT_EXP40, 0, 0, 0, 0, 0, 0, SSL_EXP40, 0, 0, 0},
323 {0,SSL_TXT_EXP56,0, 0,0,0,0,0,SSL_EXP56, 0,0,0}, 322 {0, SSL_TXT_EXP56, 0, 0, 0, 0, 0, 0, SSL_EXP56, 0, 0, 0},
324 {0,SSL_TXT_LOW,0, 0,0,0,0,0,SSL_LOW, 0,0,0}, 323 {0, SSL_TXT_LOW, 0, 0, 0, 0, 0, 0, SSL_LOW, 0, 0, 0},
325 {0,SSL_TXT_MEDIUM,0, 0,0,0,0,0,SSL_MEDIUM,0,0,0}, 324 {0, SSL_TXT_MEDIUM, 0, 0, 0, 0, 0, 0, SSL_MEDIUM, 0, 0, 0},
326 {0,SSL_TXT_HIGH,0, 0,0,0,0,0,SSL_HIGH, 0,0,0}, 325 {0, SSL_TXT_HIGH, 0, 0, 0, 0, 0, 0, SSL_HIGH, 0, 0, 0},
327 /* FIPS 140-2 approved ciphersuite */ 326 /* FIPS 140-2 approved ciphersuite */
328 {0,SSL_TXT_FIPS,0, 0,0,~SSL_eNULL,0,0,SSL_FIPS, 0,0,0}, 327 {0, SSL_TXT_FIPS, 0, 0, 0,~SSL_eNULL, 0, 0, SSL_FIPS, 0, 0, 0},
329 }; 328};
330/* Search for public key algorithm with given name and 329/* Search for public key algorithm with given name and
331 * return its pkey_id if it is available. Otherwise return 0 330 * return its pkey_id if it is available. Otherwise return 0
332 */ 331 */
333#ifdef OPENSSL_NO_ENGINE 332#ifdef OPENSSL_NO_ENGINE
334 333
335static int get_optional_pkey_id(const char *pkey_name) 334static int
336 { 335get_optional_pkey_id(const char *pkey_name)
336{
337 const EVP_PKEY_ASN1_METHOD *ameth; 337 const EVP_PKEY_ASN1_METHOD *ameth;
338 int pkey_id=0; 338 int pkey_id = 0;
339 ameth = EVP_PKEY_asn1_find_str(NULL,pkey_name,-1); 339 ameth = EVP_PKEY_asn1_find_str(NULL, pkey_name, -1);
340 if (ameth) 340 if (ameth) {
341 { 341 EVP_PKEY_asn1_get0_info(&pkey_id, NULL, NULL, NULL, NULL, ameth);
342 EVP_PKEY_asn1_get0_info(&pkey_id, NULL,NULL,NULL,NULL,ameth);
343 }
344 return pkey_id;
345 } 342 }
343 return pkey_id;
344}
346 345
347#else 346#else
348 347
349static int get_optional_pkey_id(const char *pkey_name) 348static int
350 { 349get_optional_pkey_id(const char *pkey_name)
350{
351 const EVP_PKEY_ASN1_METHOD *ameth; 351 const EVP_PKEY_ASN1_METHOD *ameth;
352 ENGINE *tmpeng = NULL; 352 ENGINE *tmpeng = NULL;
353 int pkey_id=0; 353 int pkey_id = 0;
354 ameth = EVP_PKEY_asn1_find_str(&tmpeng,pkey_name,-1); 354 ameth = EVP_PKEY_asn1_find_str(&tmpeng, pkey_name, -1);
355 if (ameth) 355 if (ameth) {
356 { 356 EVP_PKEY_asn1_get0_info(&pkey_id, NULL, NULL, NULL, NULL, ameth);
357 EVP_PKEY_asn1_get0_info(&pkey_id, NULL,NULL,NULL,NULL,ameth);
358 }
359 if (tmpeng) ENGINE_finish(tmpeng);
360 return pkey_id;
361 } 357 }
358 if (tmpeng)
359 ENGINE_finish(tmpeng);
360 return pkey_id;
361}
362 362
363#endif 363#endif
364 364
365void ssl_load_ciphers(void) 365void
366 { 366ssl_load_ciphers(void)
367 ssl_cipher_methods[SSL_ENC_DES_IDX]= 367{
368 EVP_get_cipherbyname(SN_des_cbc); 368 ssl_cipher_methods[SSL_ENC_DES_IDX]=
369 EVP_get_cipherbyname(SN_des_cbc);
369 ssl_cipher_methods[SSL_ENC_3DES_IDX]= 370 ssl_cipher_methods[SSL_ENC_3DES_IDX]=
370 EVP_get_cipherbyname(SN_des_ede3_cbc); 371 EVP_get_cipherbyname(SN_des_ede3_cbc);
371 ssl_cipher_methods[SSL_ENC_RC4_IDX]= 372 ssl_cipher_methods[SSL_ENC_RC4_IDX]=
372 EVP_get_cipherbyname(SN_rc4); 373 EVP_get_cipherbyname(SN_rc4);
373 ssl_cipher_methods[SSL_ENC_RC2_IDX]= 374 ssl_cipher_methods[SSL_ENC_RC2_IDX]=
374 EVP_get_cipherbyname(SN_rc2_cbc); 375 EVP_get_cipherbyname(SN_rc2_cbc);
375#ifndef OPENSSL_NO_IDEA 376#ifndef OPENSSL_NO_IDEA
376 ssl_cipher_methods[SSL_ENC_IDEA_IDX]= 377 ssl_cipher_methods[SSL_ENC_IDEA_IDX]=
377 EVP_get_cipherbyname(SN_idea_cbc); 378 EVP_get_cipherbyname(SN_idea_cbc);
378#else 379#else
379 ssl_cipher_methods[SSL_ENC_IDEA_IDX]= NULL; 380 ssl_cipher_methods[SSL_ENC_IDEA_IDX] = NULL;
380#endif 381#endif
381 ssl_cipher_methods[SSL_ENC_AES128_IDX]= 382 ssl_cipher_methods[SSL_ENC_AES128_IDX]=
382 EVP_get_cipherbyname(SN_aes_128_cbc); 383 EVP_get_cipherbyname(SN_aes_128_cbc);
383 ssl_cipher_methods[SSL_ENC_AES256_IDX]= 384 ssl_cipher_methods[SSL_ENC_AES256_IDX]=
384 EVP_get_cipherbyname(SN_aes_256_cbc); 385 EVP_get_cipherbyname(SN_aes_256_cbc);
385 ssl_cipher_methods[SSL_ENC_CAMELLIA128_IDX]= 386 ssl_cipher_methods[SSL_ENC_CAMELLIA128_IDX]=
386 EVP_get_cipherbyname(SN_camellia_128_cbc); 387 EVP_get_cipherbyname(SN_camellia_128_cbc);
387 ssl_cipher_methods[SSL_ENC_CAMELLIA256_IDX]= 388 ssl_cipher_methods[SSL_ENC_CAMELLIA256_IDX]=
388 EVP_get_cipherbyname(SN_camellia_256_cbc); 389 EVP_get_cipherbyname(SN_camellia_256_cbc);
389 ssl_cipher_methods[SSL_ENC_GOST89_IDX]= 390 ssl_cipher_methods[SSL_ENC_GOST89_IDX]=
390 EVP_get_cipherbyname(SN_gost89_cnt); 391 EVP_get_cipherbyname(SN_gost89_cnt);
391 ssl_cipher_methods[SSL_ENC_SEED_IDX]= 392 ssl_cipher_methods[SSL_ENC_SEED_IDX]=
392 EVP_get_cipherbyname(SN_seed_cbc); 393 EVP_get_cipherbyname(SN_seed_cbc);
393 394
394 ssl_cipher_methods[SSL_ENC_AES128GCM_IDX]= 395 ssl_cipher_methods[SSL_ENC_AES128GCM_IDX]=
395 EVP_get_cipherbyname(SN_aes_128_gcm); 396 EVP_get_cipherbyname(SN_aes_128_gcm);
396 ssl_cipher_methods[SSL_ENC_AES256GCM_IDX]= 397 ssl_cipher_methods[SSL_ENC_AES256GCM_IDX]=
397 EVP_get_cipherbyname(SN_aes_256_gcm); 398 EVP_get_cipherbyname(SN_aes_256_gcm);
398 399
399 ssl_digest_methods[SSL_MD_MD5_IDX]= 400 ssl_digest_methods[SSL_MD_MD5_IDX]=
400 EVP_get_digestbyname(SN_md5); 401 EVP_get_digestbyname(SN_md5);
401 ssl_mac_secret_size[SSL_MD_MD5_IDX]= 402 ssl_mac_secret_size[SSL_MD_MD5_IDX]=
402 EVP_MD_size(ssl_digest_methods[SSL_MD_MD5_IDX]); 403 EVP_MD_size(ssl_digest_methods[SSL_MD_MD5_IDX]);
403 OPENSSL_assert(ssl_mac_secret_size[SSL_MD_MD5_IDX] >= 0); 404 OPENSSL_assert(ssl_mac_secret_size[SSL_MD_MD5_IDX] >= 0);
404 ssl_digest_methods[SSL_MD_SHA1_IDX]= 405 ssl_digest_methods[SSL_MD_SHA1_IDX]=
405 EVP_get_digestbyname(SN_sha1); 406 EVP_get_digestbyname(SN_sha1);
406 ssl_mac_secret_size[SSL_MD_SHA1_IDX]= 407 ssl_mac_secret_size[SSL_MD_SHA1_IDX]=
407 EVP_MD_size(ssl_digest_methods[SSL_MD_SHA1_IDX]); 408 EVP_MD_size(ssl_digest_methods[SSL_MD_SHA1_IDX]);
408 OPENSSL_assert(ssl_mac_secret_size[SSL_MD_SHA1_IDX] >= 0); 409 OPENSSL_assert(ssl_mac_secret_size[SSL_MD_SHA1_IDX] >= 0);
409 ssl_digest_methods[SSL_MD_GOST94_IDX]= 410 ssl_digest_methods[SSL_MD_GOST94_IDX]=
410 EVP_get_digestbyname(SN_id_GostR3411_94); 411 EVP_get_digestbyname(SN_id_GostR3411_94);
411 if (ssl_digest_methods[SSL_MD_GOST94_IDX]) 412 if (ssl_digest_methods[SSL_MD_GOST94_IDX]) {
412 {
413 ssl_mac_secret_size[SSL_MD_GOST94_IDX]= 413 ssl_mac_secret_size[SSL_MD_GOST94_IDX]=
414 EVP_MD_size(ssl_digest_methods[SSL_MD_GOST94_IDX]); 414 EVP_MD_size(ssl_digest_methods[SSL_MD_GOST94_IDX]);
415 OPENSSL_assert(ssl_mac_secret_size[SSL_MD_GOST94_IDX] >= 0); 415 OPENSSL_assert(ssl_mac_secret_size[SSL_MD_GOST94_IDX] >= 0);
416 } 416 }
417 ssl_digest_methods[SSL_MD_GOST89MAC_IDX]= 417 ssl_digest_methods[SSL_MD_GOST89MAC_IDX]=
418 EVP_get_digestbyname(SN_id_Gost28147_89_MAC); 418 EVP_get_digestbyname(SN_id_Gost28147_89_MAC);
419 ssl_mac_pkey_id[SSL_MD_GOST89MAC_IDX] = get_optional_pkey_id("gost-mac"); 419 ssl_mac_pkey_id[SSL_MD_GOST89MAC_IDX] = get_optional_pkey_id("gost-mac");
420 if (ssl_mac_pkey_id[SSL_MD_GOST89MAC_IDX]) { 420 if (ssl_mac_pkey_id[SSL_MD_GOST89MAC_IDX]) {
421 ssl_mac_secret_size[SSL_MD_GOST89MAC_IDX]=32; 421 ssl_mac_secret_size[SSL_MD_GOST89MAC_IDX] = 32;
422 } 422 }
423 423
424 ssl_digest_methods[SSL_MD_SHA256_IDX]= 424 ssl_digest_methods[SSL_MD_SHA256_IDX]=
425 EVP_get_digestbyname(SN_sha256); 425 EVP_get_digestbyname(SN_sha256);
426 ssl_mac_secret_size[SSL_MD_SHA256_IDX]= 426 ssl_mac_secret_size[SSL_MD_SHA256_IDX]=
427 EVP_MD_size(ssl_digest_methods[SSL_MD_SHA256_IDX]); 427 EVP_MD_size(ssl_digest_methods[SSL_MD_SHA256_IDX]);
428 ssl_digest_methods[SSL_MD_SHA384_IDX]= 428 ssl_digest_methods[SSL_MD_SHA384_IDX]=
429 EVP_get_digestbyname(SN_sha384); 429 EVP_get_digestbyname(SN_sha384);
430 ssl_mac_secret_size[SSL_MD_SHA384_IDX]= 430 ssl_mac_secret_size[SSL_MD_SHA384_IDX]=
431 EVP_MD_size(ssl_digest_methods[SSL_MD_SHA384_IDX]); 431 EVP_MD_size(ssl_digest_methods[SSL_MD_SHA384_IDX]);
432 } 432}
433#ifndef OPENSSL_NO_COMP 433#ifndef OPENSSL_NO_COMP
434 434
435static int sk_comp_cmp(const SSL_COMP * const *a, 435static int
436 const SSL_COMP * const *b) 436sk_comp_cmp(const SSL_COMP * const *a,
437 { 437 const SSL_COMP * const *b)
438 return((*a)->id-(*b)->id); 438{
439 } 439 return ((*a)->id - (*b)->id);
440}
440 441
441static void load_builtin_compressions(void) 442static void
442 { 443load_builtin_compressions(void)
444{
443 int got_write_lock = 0; 445 int got_write_lock = 0;
444 446
445 CRYPTO_r_lock(CRYPTO_LOCK_SSL); 447 CRYPTO_r_lock(CRYPTO_LOCK_SSL);
446 if (ssl_comp_methods == NULL) 448 if (ssl_comp_methods == NULL) {
447 {
448 CRYPTO_r_unlock(CRYPTO_LOCK_SSL); 449 CRYPTO_r_unlock(CRYPTO_LOCK_SSL);
449 CRYPTO_w_lock(CRYPTO_LOCK_SSL); 450 CRYPTO_w_lock(CRYPTO_LOCK_SSL);
450 got_write_lock = 1; 451 got_write_lock = 1;
451 452
452 if (ssl_comp_methods == NULL) 453 if (ssl_comp_methods == NULL) {
453 {
454 SSL_COMP *comp = NULL; 454 SSL_COMP *comp = NULL;
455 455
456 MemCheck_off(); 456 MemCheck_off();
457 ssl_comp_methods=sk_SSL_COMP_new(sk_comp_cmp); 457 ssl_comp_methods = sk_SSL_COMP_new(sk_comp_cmp);
458 if (ssl_comp_methods != NULL) 458 if (ssl_comp_methods != NULL) {
459 { 459 comp = (SSL_COMP *)OPENSSL_malloc(sizeof(SSL_COMP));
460 comp=(SSL_COMP *)OPENSSL_malloc(sizeof(SSL_COMP)); 460 if (comp != NULL) {
461 if (comp != NULL) 461 comp->method = COMP_zlib();
462 {
463 comp->method=COMP_zlib();
464 if (comp->method 462 if (comp->method
465 && comp->method->type == NID_undef) 463 && comp->method->type == NID_undef)
466 OPENSSL_free(comp); 464 OPENSSL_free(comp);
467 else 465 else {
468 { 466 comp->id = SSL_COMP_ZLIB_IDX;
469 comp->id=SSL_COMP_ZLIB_IDX; 467 comp->name = comp->method->name;
470 comp->name=comp->method->name; 468 sk_SSL_COMP_push(ssl_comp_methods, comp);
471 sk_SSL_COMP_push(ssl_comp_methods,comp);
472 }
473 } 469 }
474 sk_SSL_COMP_sort(ssl_comp_methods);
475 } 470 }
476 MemCheck_on(); 471 sk_SSL_COMP_sort(ssl_comp_methods);
477 } 472 }
473 MemCheck_on();
478 } 474 }
479 475 }
476
480 if (got_write_lock) 477 if (got_write_lock)
481 CRYPTO_w_unlock(CRYPTO_LOCK_SSL); 478 CRYPTO_w_unlock(CRYPTO_LOCK_SSL);
482 else 479 else
483 CRYPTO_r_unlock(CRYPTO_LOCK_SSL); 480 CRYPTO_r_unlock(CRYPTO_LOCK_SSL);
484 } 481}
485#endif 482#endif
486 483
487int ssl_cipher_get_evp(const SSL_SESSION *s, const EVP_CIPHER **enc, 484int
488 const EVP_MD **md, int *mac_pkey_type, int *mac_secret_size,SSL_COMP **comp) 485ssl_cipher_get_evp(const SSL_SESSION *s, const EVP_CIPHER **enc,
489 { 486 const EVP_MD **md, int *mac_pkey_type, int *mac_secret_size, SSL_COMP **comp)
487{
490 int i; 488 int i;
491 const SSL_CIPHER *c; 489 const SSL_CIPHER *c;
492 490
493 c=s->cipher; 491 c = s->cipher;
494 if (c == NULL) return(0); 492 if (c == NULL)
495 if (comp != NULL) 493 return (0);
496 { 494 if (comp != NULL) {
497 SSL_COMP ctmp; 495 SSL_COMP ctmp;
498#ifndef OPENSSL_NO_COMP 496#ifndef OPENSSL_NO_COMP
499 load_builtin_compressions(); 497 load_builtin_compressions();
500#endif 498#endif
501 499
502 *comp=NULL; 500 *comp = NULL;
503 ctmp.id=s->compress_meth; 501 ctmp.id = s->compress_meth;
504 if (ssl_comp_methods != NULL) 502 if (ssl_comp_methods != NULL) {
505 { 503 i = sk_SSL_COMP_find(ssl_comp_methods, &ctmp);
506 i=sk_SSL_COMP_find(ssl_comp_methods,&ctmp);
507 if (i >= 0) 504 if (i >= 0)
508 *comp=sk_SSL_COMP_value(ssl_comp_methods,i); 505 *comp = sk_SSL_COMP_value(ssl_comp_methods, i);
509 else 506 else
510 *comp=NULL; 507 *comp = NULL;
511 }
512 } 508 }
509 }
513 510
514 if ((enc == NULL) || (md == NULL)) return(0); 511 if ((enc == NULL)
512 || (md == NULL)) return (0);
515 513
516 switch (c->algorithm_enc) 514 switch (c->algorithm_enc) {
517 {
518 case SSL_DES: 515 case SSL_DES:
519 i=SSL_ENC_DES_IDX; 516 i = SSL_ENC_DES_IDX;
520 break; 517 break;
521 case SSL_3DES: 518 case SSL_3DES:
522 i=SSL_ENC_3DES_IDX; 519 i = SSL_ENC_3DES_IDX;
523 break; 520 break;
524 case SSL_RC4: 521 case SSL_RC4:
525 i=SSL_ENC_RC4_IDX; 522 i = SSL_ENC_RC4_IDX;
526 break; 523 break;
527 case SSL_RC2: 524 case SSL_RC2:
528 i=SSL_ENC_RC2_IDX; 525 i = SSL_ENC_RC2_IDX;
529 break; 526 break;
530 case SSL_IDEA: 527 case SSL_IDEA:
531 i=SSL_ENC_IDEA_IDX; 528 i = SSL_ENC_IDEA_IDX;
532 break; 529 break;
533 case SSL_eNULL: 530 case SSL_eNULL:
534 i=SSL_ENC_NULL_IDX; 531 i = SSL_ENC_NULL_IDX;
535 break; 532 break;
536 case SSL_AES128: 533 case SSL_AES128:
537 i=SSL_ENC_AES128_IDX; 534 i = SSL_ENC_AES128_IDX;
538 break; 535 break;
539 case SSL_AES256: 536 case SSL_AES256:
540 i=SSL_ENC_AES256_IDX; 537 i = SSL_ENC_AES256_IDX;
541 break; 538 break;
542 case SSL_CAMELLIA128: 539 case SSL_CAMELLIA128:
543 i=SSL_ENC_CAMELLIA128_IDX; 540 i = SSL_ENC_CAMELLIA128_IDX;
544 break; 541 break;
545 case SSL_CAMELLIA256: 542 case SSL_CAMELLIA256:
546 i=SSL_ENC_CAMELLIA256_IDX; 543 i = SSL_ENC_CAMELLIA256_IDX;
547 break; 544 break;
548 case SSL_eGOST2814789CNT: 545 case SSL_eGOST2814789CNT:
549 i=SSL_ENC_GOST89_IDX; 546 i = SSL_ENC_GOST89_IDX;
550 break; 547 break;
551 case SSL_SEED: 548 case SSL_SEED:
552 i=SSL_ENC_SEED_IDX; 549 i = SSL_ENC_SEED_IDX;
553 break; 550 break;
554 case SSL_AES128GCM: 551 case SSL_AES128GCM:
555 i=SSL_ENC_AES128GCM_IDX; 552 i = SSL_ENC_AES128GCM_IDX;
556 break; 553 break;
557 case SSL_AES256GCM: 554 case SSL_AES256GCM:
558 i=SSL_ENC_AES256GCM_IDX; 555 i = SSL_ENC_AES256GCM_IDX;
559 break; 556 break;
560 default: 557 default:
561 i= -1; 558 i = -1;
562 break; 559 break;
563 } 560 }
564 561
565 if ((i < 0) || (i > SSL_ENC_NUM_IDX)) 562 if ((i < 0) || (i > SSL_ENC_NUM_IDX))
566 *enc=NULL; 563 *enc = NULL;
567 else 564 else {
568 {
569 if (i == SSL_ENC_NULL_IDX) 565 if (i == SSL_ENC_NULL_IDX)
570 *enc=EVP_enc_null(); 566 *enc = EVP_enc_null();
571 else 567 else
572 *enc=ssl_cipher_methods[i]; 568 *enc = ssl_cipher_methods[i];
573 } 569 }
574 570
575 switch (c->algorithm_mac) 571 switch (c->algorithm_mac) {
576 {
577 case SSL_MD5: 572 case SSL_MD5:
578 i=SSL_MD_MD5_IDX; 573 i = SSL_MD_MD5_IDX;
579 break; 574 break;
580 case SSL_SHA1: 575 case SSL_SHA1:
581 i=SSL_MD_SHA1_IDX; 576 i = SSL_MD_SHA1_IDX;
582 break; 577 break;
583 case SSL_SHA256: 578 case SSL_SHA256:
584 i=SSL_MD_SHA256_IDX; 579 i = SSL_MD_SHA256_IDX;
585 break; 580 break;
586 case SSL_SHA384: 581 case SSL_SHA384:
587 i=SSL_MD_SHA384_IDX; 582 i = SSL_MD_SHA384_IDX;
588 break; 583 break;
589 case SSL_GOST94: 584 case SSL_GOST94:
590 i = SSL_MD_GOST94_IDX; 585 i = SSL_MD_GOST94_IDX;
@@ -593,63 +588,63 @@ int ssl_cipher_get_evp(const SSL_SESSION *s, const EVP_CIPHER **enc,
593 i = SSL_MD_GOST89MAC_IDX; 588 i = SSL_MD_GOST89MAC_IDX;
594 break; 589 break;
595 default: 590 default:
596 i= -1; 591 i = -1;
597 break; 592 break;
598 } 593 }
599 if ((i < 0) || (i > SSL_MD_NUM_IDX)) 594 if ((i < 0) || (i > SSL_MD_NUM_IDX)) {
600 { 595 *md = NULL;
601 *md=NULL; 596
602 if (mac_pkey_type!=NULL) *mac_pkey_type = NID_undef; 597 if (mac_pkey_type != NULL)
603 if (mac_secret_size!=NULL) *mac_secret_size = 0; 598 *mac_pkey_type = NID_undef;
599 if (mac_secret_size != NULL)
600 *mac_secret_size = 0;
604 if (c->algorithm_mac == SSL_AEAD) 601 if (c->algorithm_mac == SSL_AEAD)
605 mac_pkey_type = NULL; 602 mac_pkey_type = NULL;
606 } 603 } else {
607 else 604 *md = ssl_digest_methods[i];
608 { 605 if (mac_pkey_type != NULL)
609 *md=ssl_digest_methods[i]; 606 *mac_pkey_type = ssl_mac_pkey_id[i];
610 if (mac_pkey_type!=NULL) *mac_pkey_type = ssl_mac_pkey_id[i]; 607 if (mac_secret_size != NULL)
611 if (mac_secret_size!=NULL) *mac_secret_size = ssl_mac_secret_size[i]; 608 *mac_secret_size = ssl_mac_secret_size[i];
612 } 609 }
613 610
614 if ((*enc != NULL) && 611 if ((*enc != NULL) &&
615 (*md != NULL || (EVP_CIPHER_flags(*enc)&EVP_CIPH_FLAG_AEAD_CIPHER)) && 612 (*md != NULL || (EVP_CIPHER_flags(*enc)&EVP_CIPH_FLAG_AEAD_CIPHER)) &&
616 (!mac_pkey_type||*mac_pkey_type != NID_undef)) 613 (!mac_pkey_type || *mac_pkey_type != NID_undef)) {
617 {
618 const EVP_CIPHER *evp; 614 const EVP_CIPHER *evp;
619 615
620 if (s->ssl_version>>8 != TLS1_VERSION_MAJOR || 616 if (s->ssl_version >> 8 != TLS1_VERSION_MAJOR ||
621 s->ssl_version < TLS1_VERSION) 617 s->ssl_version < TLS1_VERSION)
622 return 1; 618 return 1;
623 619
624#ifdef OPENSSL_FIPS 620#ifdef OPENSSL_FIPS
625 if (FIPS_mode()) 621 if (FIPS_mode())
626 return 1; 622 return 1;
627#endif 623#endif
628 624
629 if (c->algorithm_enc == SSL_RC4 && 625 if (c->algorithm_enc == SSL_RC4 &&
630 c->algorithm_mac == SSL_MD5 && 626 c->algorithm_mac == SSL_MD5 &&
631 (evp=EVP_get_cipherbyname("RC4-HMAC-MD5"))) 627 (evp = EVP_get_cipherbyname("RC4-HMAC-MD5")))
632 *enc = evp, *md = NULL; 628 *enc = evp, *md = NULL;
633 else if (c->algorithm_enc == SSL_AES128 && 629 else if (c->algorithm_enc == SSL_AES128 &&
634 c->algorithm_mac == SSL_SHA1 && 630 c->algorithm_mac == SSL_SHA1 &&
635 (evp=EVP_get_cipherbyname("AES-128-CBC-HMAC-SHA1"))) 631 (evp = EVP_get_cipherbyname("AES-128-CBC-HMAC-SHA1")))
636 *enc = evp, *md = NULL; 632 *enc = evp, *md = NULL;
637 else if (c->algorithm_enc == SSL_AES256 && 633 else if (c->algorithm_enc == SSL_AES256 &&
638 c->algorithm_mac == SSL_SHA1 && 634 c->algorithm_mac == SSL_SHA1 &&
639 (evp=EVP_get_cipherbyname("AES-256-CBC-HMAC-SHA1"))) 635 (evp = EVP_get_cipherbyname("AES-256-CBC-HMAC-SHA1")))
640 *enc = evp, *md = NULL; 636 *enc = evp, *md = NULL;
641 return(1); 637 return (1);
642 } 638 } else
643 else 639 return (0);
644 return(0); 640}
645 }
646 641
647int ssl_get_handshake_digest(int idx, long *mask, const EVP_MD **md) 642int
643ssl_get_handshake_digest(int idx, long *mask, const EVP_MD **md)
648{ 644{
649 if (idx <0||idx>=SSL_MD_NUM_IDX) 645 if (idx < 0 || idx >= SSL_MD_NUM_IDX) {
650 {
651 return 0; 646 return 0;
652 } 647 }
653 *mask = ssl_handshake_digest_flag[idx]; 648 *mask = ssl_handshake_digest_flag[idx];
654 if (*mask) 649 if (*mask)
655 *md = ssl_digest_methods[idx]; 650 *md = ssl_digest_methods[idx];
@@ -661,40 +656,45 @@ int ssl_get_handshake_digest(int idx, long *mask, const EVP_MD **md)
661#define ITEM_SEP(a) \ 656#define ITEM_SEP(a) \
662 (((a) == ':') || ((a) == ' ') || ((a) == ';') || ((a) == ',')) 657 (((a) == ':') || ((a) == ' ') || ((a) == ';') || ((a) == ','))
663 658
664static void ll_append_tail(CIPHER_ORDER **head, CIPHER_ORDER *curr, 659static void
665 CIPHER_ORDER **tail) 660ll_append_tail(CIPHER_ORDER **head, CIPHER_ORDER *curr,
666 { 661 CIPHER_ORDER **tail)
667 if (curr == *tail) return; 662{
663 if (curr == *tail)
664 return;
668 if (curr == *head) 665 if (curr == *head)
669 *head=curr->next; 666 *head = curr->next;
670 if (curr->prev != NULL) 667 if (curr->prev != NULL)
671 curr->prev->next=curr->next; 668 curr->prev->next = curr->next;
672 if (curr->next != NULL) 669 if (curr->next != NULL)
673 curr->next->prev=curr->prev; 670 curr->next->prev = curr->prev;
674 (*tail)->next=curr; 671 (*tail)->next = curr;
675 curr->prev= *tail; 672 curr->prev= *tail;
676 curr->next=NULL; 673 curr->next = NULL;
677 *tail=curr; 674 *tail = curr;
678 } 675}
679 676
680static void ll_append_head(CIPHER_ORDER **head, CIPHER_ORDER *curr, 677static void
681 CIPHER_ORDER **tail) 678ll_append_head(CIPHER_ORDER **head, CIPHER_ORDER *curr,
682 { 679 CIPHER_ORDER **tail)
683 if (curr == *head) return; 680{
681 if (curr == *head)
682 return;
684 if (curr == *tail) 683 if (curr == *tail)
685 *tail=curr->prev; 684 *tail = curr->prev;
686 if (curr->next != NULL) 685 if (curr->next != NULL)
687 curr->next->prev=curr->prev; 686 curr->next->prev = curr->prev;
688 if (curr->prev != NULL) 687 if (curr->prev != NULL)
689 curr->prev->next=curr->next; 688 curr->prev->next = curr->next;
690 (*head)->prev=curr; 689 (*head)->prev = curr;
691 curr->next= *head; 690 curr->next= *head;
692 curr->prev=NULL; 691 curr->prev = NULL;
693 *head=curr; 692 *head = curr;
694 } 693}
695 694
696static void ssl_cipher_get_disabled(unsigned long *mkey, unsigned long *auth, unsigned long *enc, unsigned long *mac, unsigned long *ssl) 695static void
697 { 696ssl_cipher_get_disabled(unsigned long *mkey, unsigned long *auth, unsigned long *enc, unsigned long *mac, unsigned long *ssl)
697{
698 *mkey = 0; 698 *mkey = 0;
699 *auth = 0; 699 *auth = 0;
700 *enc = 0; 700 *enc = 0;
@@ -743,44 +743,45 @@ static void ssl_cipher_get_disabled(unsigned long *mkey, unsigned long *auth, un
743 /* Disable GOST key exchange if no GOST signature algs are available * */ 743 /* Disable GOST key exchange if no GOST signature algs are available * */
744 if ((*auth & (SSL_aGOST94|SSL_aGOST01)) == (SSL_aGOST94|SSL_aGOST01)) { 744 if ((*auth & (SSL_aGOST94|SSL_aGOST01)) == (SSL_aGOST94|SSL_aGOST01)) {
745 *mkey |= SSL_kGOST; 745 *mkey |= SSL_kGOST;
746 } 746 }
747#ifdef SSL_FORBID_ENULL 747#ifdef SSL_FORBID_ENULL
748 *enc |= SSL_eNULL; 748 *enc |= SSL_eNULL;
749#endif 749#endif
750
751
752
753 *enc |= (ssl_cipher_methods[SSL_ENC_DES_IDX ] == NULL) ? SSL_DES :0;
754 *enc |= (ssl_cipher_methods[SSL_ENC_3DES_IDX] == NULL) ? SSL_3DES:0;
755 *enc |= (ssl_cipher_methods[SSL_ENC_RC4_IDX ] == NULL) ? SSL_RC4 :0;
756 *enc |= (ssl_cipher_methods[SSL_ENC_RC2_IDX ] == NULL) ? SSL_RC2 :0;
757 *enc |= (ssl_cipher_methods[SSL_ENC_IDEA_IDX] == NULL) ? SSL_IDEA:0;
758 *enc |= (ssl_cipher_methods[SSL_ENC_AES128_IDX] == NULL) ? SSL_AES128:0;
759 *enc |= (ssl_cipher_methods[SSL_ENC_AES256_IDX] == NULL) ? SSL_AES256:0;
760 *enc |= (ssl_cipher_methods[SSL_ENC_AES128GCM_IDX] == NULL) ? SSL_AES128GCM:0;
761 *enc |= (ssl_cipher_methods[SSL_ENC_AES256GCM_IDX] == NULL) ? SSL_AES256GCM:0;
762 *enc |= (ssl_cipher_methods[SSL_ENC_CAMELLIA128_IDX] == NULL) ? SSL_CAMELLIA128:0;
763 *enc |= (ssl_cipher_methods[SSL_ENC_CAMELLIA256_IDX] == NULL) ? SSL_CAMELLIA256:0;
764 *enc |= (ssl_cipher_methods[SSL_ENC_GOST89_IDX] == NULL) ? SSL_eGOST2814789CNT:0;
765 *enc |= (ssl_cipher_methods[SSL_ENC_SEED_IDX] == NULL) ? SSL_SEED:0;
766
767 *mac |= (ssl_digest_methods[SSL_MD_MD5_IDX ] == NULL) ? SSL_MD5 :0;
768 *mac |= (ssl_digest_methods[SSL_MD_SHA1_IDX] == NULL) ? SSL_SHA1:0;
769 *mac |= (ssl_digest_methods[SSL_MD_SHA256_IDX] == NULL) ? SSL_SHA256:0;
770 *mac |= (ssl_digest_methods[SSL_MD_SHA384_IDX] == NULL) ? SSL_SHA384:0;
771 *mac |= (ssl_digest_methods[SSL_MD_GOST94_IDX] == NULL) ? SSL_GOST94:0;
772 *mac |= (ssl_digest_methods[SSL_MD_GOST89MAC_IDX] == NULL || ssl_mac_pkey_id[SSL_MD_GOST89MAC_IDX]==NID_undef)? SSL_GOST89MAC:0;
773 750
774 }
775 751
776static void ssl_cipher_collect_ciphers(const SSL_METHOD *ssl_method, 752
777 int num_of_ciphers, 753 *enc |= (ssl_cipher_methods[SSL_ENC_DES_IDX ] == NULL) ? SSL_DES : 0;
778 unsigned long disabled_mkey, unsigned long disabled_auth, 754 *enc |= (ssl_cipher_methods[SSL_ENC_3DES_IDX] == NULL) ? SSL_3DES : 0;
779 unsigned long disabled_enc, unsigned long disabled_mac, 755 *enc |= (ssl_cipher_methods[SSL_ENC_RC4_IDX ] == NULL) ? SSL_RC4 : 0;
780 unsigned long disabled_ssl, 756 *enc |= (ssl_cipher_methods[SSL_ENC_RC2_IDX ] == NULL) ? SSL_RC2 : 0;
781 CIPHER_ORDER *co_list, 757 *enc |= (ssl_cipher_methods[SSL_ENC_IDEA_IDX] == NULL) ? SSL_IDEA : 0;
782 CIPHER_ORDER **head_p, CIPHER_ORDER **tail_p) 758 *enc |= (ssl_cipher_methods[SSL_ENC_AES128_IDX] == NULL) ? SSL_AES128 : 0;
783 { 759 *enc |= (ssl_cipher_methods[SSL_ENC_AES256_IDX] == NULL) ? SSL_AES256 : 0;
760 *enc |= (ssl_cipher_methods[SSL_ENC_AES128GCM_IDX] == NULL) ? SSL_AES128GCM : 0;
761 *enc |= (ssl_cipher_methods[SSL_ENC_AES256GCM_IDX] == NULL) ? SSL_AES256GCM : 0;
762 *enc |= (ssl_cipher_methods[SSL_ENC_CAMELLIA128_IDX] == NULL) ? SSL_CAMELLIA128 : 0;
763 *enc |= (ssl_cipher_methods[SSL_ENC_CAMELLIA256_IDX] == NULL) ? SSL_CAMELLIA256 : 0;
764 *enc |= (ssl_cipher_methods[SSL_ENC_GOST89_IDX] == NULL) ? SSL_eGOST2814789CNT : 0;
765 *enc |= (ssl_cipher_methods[SSL_ENC_SEED_IDX] == NULL) ? SSL_SEED : 0;
766
767 *mac |= (ssl_digest_methods[SSL_MD_MD5_IDX ] == NULL) ? SSL_MD5 : 0;
768 *mac |= (ssl_digest_methods[SSL_MD_SHA1_IDX] == NULL) ? SSL_SHA1 : 0;
769 *mac |= (ssl_digest_methods[SSL_MD_SHA256_IDX] == NULL) ? SSL_SHA256 : 0;
770 *mac |= (ssl_digest_methods[SSL_MD_SHA384_IDX] == NULL) ? SSL_SHA384 : 0;
771 *mac |= (ssl_digest_methods[SSL_MD_GOST94_IDX] == NULL) ? SSL_GOST94 : 0;
772 *mac |= (ssl_digest_methods[SSL_MD_GOST89MAC_IDX] == NULL || ssl_mac_pkey_id[SSL_MD_GOST89MAC_IDX]==NID_undef) ? SSL_GOST89MAC : 0;
773
774}
775
776static void
777ssl_cipher_collect_ciphers(const SSL_METHOD *ssl_method,
778 int num_of_ciphers,
779unsigned long disabled_mkey, unsigned long disabled_auth,
780 unsigned long disabled_enc, unsigned long disabled_mac,
781unsigned long disabled_ssl,
782 CIPHER_ORDER *co_list,
783CIPHER_ORDER **head_p, CIPHER_ORDER **tail_p)
784{
784 int i, co_list_num; 785 int i, co_list_num;
785 const SSL_CIPHER *c; 786 const SSL_CIPHER *c;
786 787
@@ -793,68 +794,64 @@ static void ssl_cipher_collect_ciphers(const SSL_METHOD *ssl_method,
793 794
794 /* Get the initial list of ciphers */ 795 /* Get the initial list of ciphers */
795 co_list_num = 0; /* actual count of ciphers */ 796 co_list_num = 0; /* actual count of ciphers */
796 for (i = 0; i < num_of_ciphers; i++) 797 for (i = 0; i < num_of_ciphers; i++) {
797 {
798 c = ssl_method->get_cipher(i); 798 c = ssl_method->get_cipher(i);
799 /* drop those that use any of that is not available */ 799 /* drop those that use any of that is not available */
800 if ((c != NULL) && c->valid && 800 if ((c != NULL) && c->valid &&
801#ifdef OPENSSL_FIPS 801#ifdef OPENSSL_FIPS
802 (!FIPS_mode() || (c->algo_strength & SSL_FIPS)) && 802 (!FIPS_mode() || (c->algo_strength & SSL_FIPS)) &&
803#endif 803#endif
804 !(c->algorithm_mkey & disabled_mkey) && 804 !(c->algorithm_mkey & disabled_mkey) &&
805 !(c->algorithm_auth & disabled_auth) && 805 !(c->algorithm_auth & disabled_auth) &&
806 !(c->algorithm_enc & disabled_enc) && 806 !(c->algorithm_enc & disabled_enc) &&
807 !(c->algorithm_mac & disabled_mac) && 807 !(c->algorithm_mac & disabled_mac) &&
808 !(c->algorithm_ssl & disabled_ssl)) 808 !(c->algorithm_ssl & disabled_ssl)) {
809 {
810 co_list[co_list_num].cipher = c; 809 co_list[co_list_num].cipher = c;
811 co_list[co_list_num].next = NULL; 810 co_list[co_list_num].next = NULL;
812 co_list[co_list_num].prev = NULL; 811 co_list[co_list_num].prev = NULL;
813 co_list[co_list_num].active = 0; 812 co_list[co_list_num].active = 0;
814 co_list_num++; 813 co_list_num++;
815#ifdef KSSL_DEBUG 814#ifdef KSSL_DEBUG
816 printf("\t%d: %s %lx %lx %lx\n",i,c->name,c->id,c->algorithm_mkey,c->algorithm_auth); 815 printf("\t%d: %s %lx %lx %lx\n", i, c->name, c->id, c->algorithm_mkey, c->algorithm_auth);
817#endif /* KSSL_DEBUG */ 816#endif /* KSSL_DEBUG */
818 /* 817 /*
819 if (!sk_push(ca_list,(char *)c)) goto err; 818 if (!sk_push(ca_list,(char *)c)) goto err;
820 */ 819 */
821 }
822 } 820 }
821 }
823 822
824 /* 823 /*
825 * Prepare linked list from list entries 824 * Prepare linked list from list entries
826 */ 825 */
827 if (co_list_num > 0) 826 if (co_list_num > 0) {
828 {
829 co_list[0].prev = NULL; 827 co_list[0].prev = NULL;
830 828
831 if (co_list_num > 1) 829 if (co_list_num > 1) {
832 {
833 co_list[0].next = &co_list[1]; 830 co_list[0].next = &co_list[1];
834 831
835 for (i = 1; i < co_list_num - 1; i++) 832 for (i = 1; i < co_list_num - 1; i++) {
836 {
837 co_list[i].prev = &co_list[i - 1]; 833 co_list[i].prev = &co_list[i - 1];
838 co_list[i].next = &co_list[i + 1]; 834 co_list[i].next = &co_list[i + 1];
839 } 835 }
840 836
841 co_list[co_list_num - 1].prev = &co_list[co_list_num - 2]; 837 co_list[co_list_num - 1].prev = &co_list[co_list_num - 2];
842 } 838 }
843 839
844 co_list[co_list_num - 1].next = NULL; 840 co_list[co_list_num - 1].next = NULL;
845 841
846 *head_p = &co_list[0]; 842 *head_p = &co_list[0];
847 *tail_p = &co_list[co_list_num - 1]; 843 *tail_p = &co_list[co_list_num - 1];
848 }
849 } 844 }
845}
850 846
851static void ssl_cipher_collect_aliases(const SSL_CIPHER **ca_list, 847static void
852 int num_of_group_aliases, 848ssl_cipher_collect_aliases(const SSL_CIPHER **ca_list,
853 unsigned long disabled_mkey, unsigned long disabled_auth, 849 int num_of_group_aliases,
854 unsigned long disabled_enc, unsigned long disabled_mac, 850unsigned long disabled_mkey, unsigned long disabled_auth,
855 unsigned long disabled_ssl, 851 unsigned long disabled_enc, unsigned long disabled_mac,
856 CIPHER_ORDER *head) 852unsigned long disabled_ssl,
857 { 853 CIPHER_ORDER *head)
854{
858 CIPHER_ORDER *ciph_curr; 855 CIPHER_ORDER *ciph_curr;
859 const SSL_CIPHER **ca_curr; 856 const SSL_CIPHER **ca_curr;
860 int i; 857 int i;
@@ -869,12 +866,11 @@ static void ssl_cipher_collect_aliases(const SSL_CIPHER **ca_list,
869 */ 866 */
870 ciph_curr = head; 867 ciph_curr = head;
871 ca_curr = ca_list; 868 ca_curr = ca_list;
872 while (ciph_curr != NULL) 869 while (ciph_curr != NULL) {
873 {
874 *ca_curr = ciph_curr->cipher; 870 *ca_curr = ciph_curr->cipher;
875 ca_curr++; 871 ca_curr++;
876 ciph_curr = ciph_curr->next; 872 ciph_curr = ciph_curr->next;
877 } 873 }
878 874
879 /* 875 /*
880 * Now we add the available ones from the cipher_aliases[] table. 876 * Now we add the available ones from the cipher_aliases[] table.
@@ -882,8 +878,7 @@ static void ssl_cipher_collect_aliases(const SSL_CIPHER **ca_list,
882 * in any affected category must be supported (set in enabled_mask), 878 * in any affected category must be supported (set in enabled_mask),
883 * or represent a cipher strength value (will be added in any case because algorithms=0). 879 * or represent a cipher strength value (will be added in any case because algorithms=0).
884 */ 880 */
885 for (i = 0; i < num_of_group_aliases; i++) 881 for (i = 0; i < num_of_group_aliases; i++) {
886 {
887 unsigned long algorithm_mkey = cipher_aliases[i].algorithm_mkey; 882 unsigned long algorithm_mkey = cipher_aliases[i].algorithm_mkey;
888 unsigned long algorithm_auth = cipher_aliases[i].algorithm_auth; 883 unsigned long algorithm_auth = cipher_aliases[i].algorithm_auth;
889 unsigned long algorithm_enc = cipher_aliases[i].algorithm_enc; 884 unsigned long algorithm_enc = cipher_aliases[i].algorithm_enc;
@@ -893,45 +888,46 @@ static void ssl_cipher_collect_aliases(const SSL_CIPHER **ca_list,
893 if (algorithm_mkey) 888 if (algorithm_mkey)
894 if ((algorithm_mkey & mask_mkey) == 0) 889 if ((algorithm_mkey & mask_mkey) == 0)
895 continue; 890 continue;
896 891
897 if (algorithm_auth) 892 if (algorithm_auth)
898 if ((algorithm_auth & mask_auth) == 0) 893 if ((algorithm_auth & mask_auth) == 0)
899 continue; 894 continue;
900 895
901 if (algorithm_enc) 896 if (algorithm_enc)
902 if ((algorithm_enc & mask_enc) == 0) 897 if ((algorithm_enc & mask_enc) == 0)
903 continue; 898 continue;
904 899
905 if (algorithm_mac) 900 if (algorithm_mac)
906 if ((algorithm_mac & mask_mac) == 0) 901 if ((algorithm_mac & mask_mac) == 0)
907 continue; 902 continue;
908 903
909 if (algorithm_ssl) 904 if (algorithm_ssl)
910 if ((algorithm_ssl & mask_ssl) == 0) 905 if ((algorithm_ssl & mask_ssl) == 0)
911 continue; 906 continue;
912 907
913 *ca_curr = (SSL_CIPHER *)(cipher_aliases + i); 908 *ca_curr = (SSL_CIPHER *)(cipher_aliases + i);
914 ca_curr++; 909 ca_curr++;
915 } 910 }
916 911
917 *ca_curr = NULL; /* end of list */ 912 *ca_curr = NULL; /* end of list */
918 } 913}
919 914
920static void ssl_cipher_apply_rule(unsigned long cipher_id, 915static void
921 unsigned long alg_mkey, unsigned long alg_auth, 916ssl_cipher_apply_rule(unsigned long cipher_id,
922 unsigned long alg_enc, unsigned long alg_mac, 917 unsigned long alg_mkey, unsigned long alg_auth,
923 unsigned long alg_ssl, 918unsigned long alg_enc, unsigned long alg_mac,
924 unsigned long algo_strength, 919 unsigned long alg_ssl,
925 int rule, int strength_bits, 920unsigned long algo_strength,
926 CIPHER_ORDER **head_p, CIPHER_ORDER **tail_p) 921 int rule, int strength_bits,
927 { 922CIPHER_ORDER **head_p, CIPHER_ORDER **tail_p)
923{
928 CIPHER_ORDER *head, *tail, *curr, *curr2, *last; 924 CIPHER_ORDER *head, *tail, *curr, *curr2, *last;
929 const SSL_CIPHER *cp; 925 const SSL_CIPHER *cp;
930 int reverse = 0; 926 int reverse = 0;
931 927
932#ifdef CIPHER_DEBUG 928#ifdef CIPHER_DEBUG
933 printf("Applying rule %d with %08lx/%08lx/%08lx/%08lx/%08lx %08lx (%d)\n", 929 printf("Applying rule %d with %08lx/%08lx/%08lx/%08lx/%08lx %08lx (%d)\n",
934 rule, alg_mkey, alg_auth, alg_enc, alg_mac, alg_ssl, algo_strength, strength_bits); 930 rule, alg_mkey, alg_auth, alg_enc, alg_mac, alg_ssl, algo_strength, strength_bits);
935#endif 931#endif
936 932
937 if (rule == CIPHER_DEL) 933 if (rule == CIPHER_DEL)
@@ -940,21 +936,18 @@ static void ssl_cipher_apply_rule(unsigned long cipher_id,
940 head = *head_p; 936 head = *head_p;
941 tail = *tail_p; 937 tail = *tail_p;
942 938
943 if (reverse) 939 if (reverse) {
944 {
945 curr = tail; 940 curr = tail;
946 last = head; 941 last = head;
947 } 942 } else {
948 else
949 {
950 curr = head; 943 curr = head;
951 last = tail; 944 last = tail;
952 } 945 }
953 946
954 curr2 = curr; 947 curr2 = curr;
955 for (;;) 948 for (;;) {
956 { 949 if ((curr == NULL)
957 if ((curr == NULL) || (curr == last)) break; 950 || (curr == last)) break;
958 curr = curr2; 951 curr = curr2;
959 curr2 = reverse ? curr->prev : curr->next; 952 curr2 = reverse ? curr->prev : curr->next;
960 953
@@ -964,13 +957,10 @@ static void ssl_cipher_apply_rule(unsigned long cipher_id,
964 * Selection criteria is either the value of strength_bits 957 * Selection criteria is either the value of strength_bits
965 * or the algorithms used. 958 * or the algorithms used.
966 */ 959 */
967 if (strength_bits >= 0) 960 if (strength_bits >= 0) {
968 {
969 if (strength_bits != cp->strength_bits) 961 if (strength_bits != cp->strength_bits)
970 continue; 962 continue;
971 } 963 } else {
972 else
973 {
974#ifdef CIPHER_DEBUG 964#ifdef CIPHER_DEBUG
975 printf("\nName: %s:\nAlgo = %08lx/%08lx/%08lx/%08lx/%08lx Algo_strength = %08lx\n", cp->name, cp->algorithm_mkey, cp->algorithm_auth, cp->algorithm_enc, cp->algorithm_mac, cp->algorithm_ssl, cp->algo_strength); 965 printf("\nName: %s:\nAlgo = %08lx/%08lx/%08lx/%08lx/%08lx Algo_strength = %08lx\n", cp->name, cp->algorithm_mkey, cp->algorithm_auth, cp->algorithm_enc, cp->algorithm_mac, cp->algorithm_ssl, cp->algo_strength);
976#endif 966#endif
@@ -989,45 +979,36 @@ static void ssl_cipher_apply_rule(unsigned long cipher_id,
989 continue; 979 continue;
990 if ((algo_strength & SSL_STRONG_MASK) && !(algo_strength & SSL_STRONG_MASK & cp->algo_strength)) 980 if ((algo_strength & SSL_STRONG_MASK) && !(algo_strength & SSL_STRONG_MASK & cp->algo_strength))
991 continue; 981 continue;
992 } 982 }
993 983
994#ifdef CIPHER_DEBUG 984#ifdef CIPHER_DEBUG
995 printf("Action = %d\n", rule); 985 printf("Action = %d\n", rule);
996#endif 986#endif
997 987
998 /* add the cipher if it has not been added yet. */ 988 /* add the cipher if it has not been added yet. */
999 if (rule == CIPHER_ADD) 989 if (rule == CIPHER_ADD) {
1000 {
1001 /* reverse == 0 */ 990 /* reverse == 0 */
1002 if (!curr->active) 991 if (!curr->active) {
1003 {
1004 ll_append_tail(&head, curr, &tail); 992 ll_append_tail(&head, curr, &tail);
1005 curr->active = 1; 993 curr->active = 1;
1006 }
1007 } 994 }
995 }
1008 /* Move the added cipher to this location */ 996 /* Move the added cipher to this location */
1009 else if (rule == CIPHER_ORD) 997 else if (rule == CIPHER_ORD) {
1010 {
1011 /* reverse == 0 */ 998 /* reverse == 0 */
1012 if (curr->active) 999 if (curr->active) {
1013 {
1014 ll_append_tail(&head, curr, &tail); 1000 ll_append_tail(&head, curr, &tail);
1015 }
1016 } 1001 }
1017 else if (rule == CIPHER_DEL) 1002 } else if (rule == CIPHER_DEL) {
1018 {
1019 /* reverse == 1 */ 1003 /* reverse == 1 */
1020 if (curr->active) 1004 if (curr->active) {
1021 {
1022 /* most recently deleted ciphersuites get best positions 1005 /* most recently deleted ciphersuites get best positions
1023 * for any future CIPHER_ADD (note that the CIPHER_DEL loop 1006 * for any future CIPHER_ADD (note that the CIPHER_DEL loop
1024 * works in reverse to maintain the order) */ 1007 * works in reverse to maintain the order) */
1025 ll_append_head(&head, curr, &tail); 1008 ll_append_head(&head, curr, &tail);
1026 curr->active = 0; 1009 curr->active = 0;
1027 }
1028 } 1010 }
1029 else if (rule == CIPHER_KILL) 1011 } else if (rule == CIPHER_KILL) {
1030 {
1031 /* reverse == 0 */ 1012 /* reverse == 0 */
1032 if (head == curr) 1013 if (head == curr)
1033 head = curr->next; 1014 head = curr->next;
@@ -1042,16 +1023,17 @@ static void ssl_cipher_apply_rule(unsigned long cipher_id,
1042 curr->prev->next = curr->next; 1023 curr->prev->next = curr->next;
1043 curr->next = NULL; 1024 curr->next = NULL;
1044 curr->prev = NULL; 1025 curr->prev = NULL;
1045 }
1046 } 1026 }
1027 }
1047 1028
1048 *head_p = head; 1029 *head_p = head;
1049 *tail_p = tail; 1030 *tail_p = tail;
1050 } 1031}
1051 1032
1052static int ssl_cipher_strength_sort(CIPHER_ORDER **head_p, 1033static int
1053 CIPHER_ORDER **tail_p) 1034ssl_cipher_strength_sort(CIPHER_ORDER **head_p,
1054 { 1035 CIPHER_ORDER **tail_p)
1036{
1055 int max_strength_bits, i, *number_uses; 1037 int max_strength_bits, i, *number_uses;
1056 CIPHER_ORDER *curr; 1038 CIPHER_ORDER *curr;
1057 1039
@@ -1062,32 +1044,29 @@ static int ssl_cipher_strength_sort(CIPHER_ORDER **head_p,
1062 */ 1044 */
1063 max_strength_bits = 0; 1045 max_strength_bits = 0;
1064 curr = *head_p; 1046 curr = *head_p;
1065 while (curr != NULL) 1047 while (curr != NULL) {
1066 {
1067 if (curr->active && 1048 if (curr->active &&
1068 (curr->cipher->strength_bits > max_strength_bits)) 1049 (curr->cipher->strength_bits > max_strength_bits))
1069 max_strength_bits = curr->cipher->strength_bits; 1050 max_strength_bits = curr->cipher->strength_bits;
1070 curr = curr->next; 1051 curr = curr->next;
1071 } 1052 }
1072 1053
1073 number_uses = OPENSSL_malloc((max_strength_bits + 1) * sizeof(int)); 1054 number_uses = OPENSSL_malloc((max_strength_bits + 1) * sizeof(int));
1074 if (!number_uses) 1055 if (!number_uses) {
1075 { 1056 SSLerr(SSL_F_SSL_CIPHER_STRENGTH_SORT, ERR_R_MALLOC_FAILURE);
1076 SSLerr(SSL_F_SSL_CIPHER_STRENGTH_SORT,ERR_R_MALLOC_FAILURE); 1057 return (0);
1077 return(0); 1058 }
1078 }
1079 memset(number_uses, 0, (max_strength_bits + 1) * sizeof(int)); 1059 memset(number_uses, 0, (max_strength_bits + 1) * sizeof(int));
1080 1060
1081 /* 1061 /*
1082 * Now find the strength_bits values actually used 1062 * Now find the strength_bits values actually used
1083 */ 1063 */
1084 curr = *head_p; 1064 curr = *head_p;
1085 while (curr != NULL) 1065 while (curr != NULL) {
1086 {
1087 if (curr->active) 1066 if (curr->active)
1088 number_uses[curr->cipher->strength_bits]++; 1067 number_uses[curr->cipher->strength_bits]++;
1089 curr = curr->next; 1068 curr = curr->next;
1090 } 1069 }
1091 /* 1070 /*
1092 * Go through the list of used strength_bits values in descending 1071 * Go through the list of used strength_bits values in descending
1093 * order. 1072 * order.
@@ -1097,13 +1076,14 @@ static int ssl_cipher_strength_sort(CIPHER_ORDER **head_p,
1097 ssl_cipher_apply_rule(0, 0, 0, 0, 0, 0, 0, CIPHER_ORD, i, head_p, tail_p); 1076 ssl_cipher_apply_rule(0, 0, 0, 0, 0, 0, 0, CIPHER_ORD, i, head_p, tail_p);
1098 1077
1099 OPENSSL_free(number_uses); 1078 OPENSSL_free(number_uses);
1100 return(1); 1079 return (1);
1101 } 1080}
1102 1081
1103static int ssl_cipher_process_rulestr(const char *rule_str, 1082static int
1104 CIPHER_ORDER **head_p, CIPHER_ORDER **tail_p, 1083ssl_cipher_process_rulestr(const char *rule_str,
1105 const SSL_CIPHER **ca_list) 1084 CIPHER_ORDER **head_p, CIPHER_ORDER **tail_p,
1106 { 1085const SSL_CIPHER **ca_list)
1086{
1107 unsigned long alg_mkey, alg_auth, alg_enc, alg_mac, alg_ssl, algo_strength; 1087 unsigned long alg_mkey, alg_auth, alg_enc, alg_mac, alg_ssl, algo_strength;
1108 const char *l, *buf; 1088 const char *l, *buf;
1109 int j, multi, found, rule, retval, ok, buflen; 1089 int j, multi, found, rule, retval, ok, buflen;
@@ -1112,28 +1092,32 @@ static int ssl_cipher_process_rulestr(const char *rule_str,
1112 1092
1113 retval = 1; 1093 retval = 1;
1114 l = rule_str; 1094 l = rule_str;
1115 for (;;) 1095 for (;;) {
1116 {
1117 ch = *l; 1096 ch = *l;
1118 1097
1119 if (ch == '\0') 1098 if (ch == '\0')
1120 break; /* done */ 1099 break;
1100 /* done */
1121 if (ch == '-') 1101 if (ch == '-')
1122 { rule = CIPHER_DEL; l++; } 1102 { rule = CIPHER_DEL;
1123 else if (ch == '+') 1103 l++;
1124 { rule = CIPHER_ORD; l++; } 1104 } else if (ch == '+')
1125 else if (ch == '!') 1105 { rule = CIPHER_ORD;
1126 { rule = CIPHER_KILL; l++; } 1106 l++;
1127 else if (ch == '@') 1107 } else if (ch == '!')
1128 { rule = CIPHER_SPECIAL; l++; } 1108 { rule = CIPHER_KILL;
1129 else 1109 l++;
1130 { rule = CIPHER_ADD; } 1110 } else if (ch == '@')
1111 { rule = CIPHER_SPECIAL;
1112 l++;
1113 } else
1114 { rule = CIPHER_ADD;
1115 }
1131 1116
1132 if (ITEM_SEP(ch)) 1117 if (ITEM_SEP(ch)) {
1133 {
1134 l++; 1118 l++;
1135 continue; 1119 continue;
1136 } 1120 }
1137 1121
1138 alg_mkey = 0; 1122 alg_mkey = 0;
1139 alg_auth = 0; 1123 alg_auth = 0;
@@ -1142,52 +1126,47 @@ static int ssl_cipher_process_rulestr(const char *rule_str,
1142 alg_ssl = 0; 1126 alg_ssl = 0;
1143 algo_strength = 0; 1127 algo_strength = 0;
1144 1128
1145 for (;;) 1129 for (;;) {
1146 {
1147 ch = *l; 1130 ch = *l;
1148 buf = l; 1131 buf = l;
1149 buflen = 0; 1132 buflen = 0;
1150#ifndef CHARSET_EBCDIC 1133#ifndef CHARSET_EBCDIC
1151 while ( ((ch >= 'A') && (ch <= 'Z')) || 1134 while (((ch >= 'A') && (ch <= 'Z')) ||
1152 ((ch >= '0') && (ch <= '9')) || 1135 ((ch >= '0') && (ch <= '9')) ||
1153 ((ch >= 'a') && (ch <= 'z')) || 1136 ((ch >= 'a') && (ch <= 'z')) ||
1154 (ch == '-') || (ch == '.')) 1137 (ch == '-') || (ch == '.'))
1155#else 1138#else
1156 while ( isalnum(ch) || (ch == '-') || (ch == '.')) 1139 while (isalnum(ch) || (ch == '-') || (ch == '.'))
1157#endif 1140#endif
1158 { 1141 {
1159 ch = *(++l); 1142 ch = *(++l);
1160 buflen++; 1143 buflen++;
1161 } 1144 }
1162 1145
1163 if (buflen == 0) 1146 if (buflen == 0) {
1164 {
1165 /* 1147 /*
1166 * We hit something we cannot deal with, 1148 * We hit something we cannot deal with,
1167 * it is no command or separator nor 1149 * it is no command or separator nor
1168 * alphanumeric, so we call this an error. 1150 * alphanumeric, so we call this an error.
1169 */ 1151 */
1170 SSLerr(SSL_F_SSL_CIPHER_PROCESS_RULESTR, 1152 SSLerr(SSL_F_SSL_CIPHER_PROCESS_RULESTR,
1171 SSL_R_INVALID_COMMAND); 1153 SSL_R_INVALID_COMMAND);
1172 retval = found = 0; 1154 retval = found = 0;
1173 l++; 1155 l++;
1174 break; 1156 break;
1175 } 1157 }
1176 1158
1177 if (rule == CIPHER_SPECIAL) 1159 if (rule == CIPHER_SPECIAL) {
1178 {
1179 found = 0; /* unused -- avoid compiler warning */ 1160 found = 0; /* unused -- avoid compiler warning */
1180 break; /* special treatment */ 1161 break; /* special treatment */
1181 } 1162 }
1182 1163
1183 /* check for multi-part specification */ 1164 /* check for multi-part specification */
1184 if (ch == '+') 1165 if (ch == '+') {
1185 { 1166 multi = 1;
1186 multi=1;
1187 l++; 1167 l++;
1188 } 1168 } else
1189 else 1169 multi = 0;
1190 multi=0;
1191 1170
1192 /* 1171 /*
1193 * Now search for the cipher alias in the ca_list. Be careful 1172 * Now search for the cipher alias in the ca_list. Be careful
@@ -1202,126 +1181,121 @@ static int ssl_cipher_process_rulestr(const char *rule_str,
1202 */ 1181 */
1203 j = found = 0; 1182 j = found = 0;
1204 cipher_id = 0; 1183 cipher_id = 0;
1205 while (ca_list[j]) 1184 while (ca_list[j]) {
1206 {
1207 if (!strncmp(buf, ca_list[j]->name, buflen) && 1185 if (!strncmp(buf, ca_list[j]->name, buflen) &&
1208 (ca_list[j]->name[buflen] == '\0')) 1186 (ca_list[j]->name[buflen] == '\0')) {
1209 {
1210 found = 1; 1187 found = 1;
1211 break; 1188 break;
1212 } 1189 } else
1213 else
1214 j++; 1190 j++;
1215 } 1191 }
1216 1192
1217 if (!found) 1193 if (!found)
1218 break; /* ignore this entry */ 1194 break; /* ignore this entry */
1219 1195
1220 if (ca_list[j]->algorithm_mkey) 1196 if (ca_list[j]->algorithm_mkey) {
1221 { 1197 if (alg_mkey) {
1222 if (alg_mkey)
1223 {
1224 alg_mkey &= ca_list[j]->algorithm_mkey; 1198 alg_mkey &= ca_list[j]->algorithm_mkey;
1225 if (!alg_mkey) { found = 0; break; } 1199 if (!alg_mkey) {
1200 found = 0;
1201 break;
1226 } 1202 }
1227 else 1203 } else
1228 alg_mkey = ca_list[j]->algorithm_mkey; 1204 alg_mkey = ca_list[j]->algorithm_mkey;
1229 } 1205 }
1230 1206
1231 if (ca_list[j]->algorithm_auth) 1207 if (ca_list[j]->algorithm_auth) {
1232 { 1208 if (alg_auth) {
1233 if (alg_auth)
1234 {
1235 alg_auth &= ca_list[j]->algorithm_auth; 1209 alg_auth &= ca_list[j]->algorithm_auth;
1236 if (!alg_auth) { found = 0; break; } 1210 if (!alg_auth) {
1211 found = 0;
1212 break;
1237 } 1213 }
1238 else 1214 } else
1239 alg_auth = ca_list[j]->algorithm_auth; 1215 alg_auth = ca_list[j]->algorithm_auth;
1240 } 1216 }
1241 1217
1242 if (ca_list[j]->algorithm_enc) 1218 if (ca_list[j]->algorithm_enc) {
1243 { 1219 if (alg_enc) {
1244 if (alg_enc)
1245 {
1246 alg_enc &= ca_list[j]->algorithm_enc; 1220 alg_enc &= ca_list[j]->algorithm_enc;
1247 if (!alg_enc) { found = 0; break; } 1221 if (!alg_enc) {
1222 found = 0;
1223 break;
1248 } 1224 }
1249 else 1225 } else
1250 alg_enc = ca_list[j]->algorithm_enc; 1226 alg_enc = ca_list[j]->algorithm_enc;
1251 } 1227 }
1252 1228
1253 if (ca_list[j]->algorithm_mac) 1229 if (ca_list[j]->algorithm_mac) {
1254 { 1230 if (alg_mac) {
1255 if (alg_mac)
1256 {
1257 alg_mac &= ca_list[j]->algorithm_mac; 1231 alg_mac &= ca_list[j]->algorithm_mac;
1258 if (!alg_mac) { found = 0; break; } 1232 if (!alg_mac) {
1233 found = 0;
1234 break;
1259 } 1235 }
1260 else 1236 } else
1261 alg_mac = ca_list[j]->algorithm_mac; 1237 alg_mac = ca_list[j]->algorithm_mac;
1262 } 1238 }
1263 1239
1264 if (ca_list[j]->algo_strength & SSL_EXP_MASK) 1240 if (ca_list[j]->algo_strength & SSL_EXP_MASK) {
1265 { 1241 if (algo_strength & SSL_EXP_MASK) {
1266 if (algo_strength & SSL_EXP_MASK)
1267 {
1268 algo_strength &= (ca_list[j]->algo_strength & SSL_EXP_MASK) | ~SSL_EXP_MASK; 1242 algo_strength &= (ca_list[j]->algo_strength & SSL_EXP_MASK) | ~SSL_EXP_MASK;
1269 if (!(algo_strength & SSL_EXP_MASK)) { found = 0; break; } 1243 if (!(algo_strength & SSL_EXP_MASK)) {
1244 found = 0;
1245 break;
1270 } 1246 }
1271 else 1247 } else
1272 algo_strength |= ca_list[j]->algo_strength & SSL_EXP_MASK; 1248 algo_strength |= ca_list[j]->algo_strength & SSL_EXP_MASK;
1273 } 1249 }
1274 1250
1275 if (ca_list[j]->algo_strength & SSL_STRONG_MASK) 1251 if (ca_list[j]->algo_strength & SSL_STRONG_MASK) {
1276 { 1252 if (algo_strength & SSL_STRONG_MASK) {
1277 if (algo_strength & SSL_STRONG_MASK)
1278 {
1279 algo_strength &= (ca_list[j]->algo_strength & SSL_STRONG_MASK) | ~SSL_STRONG_MASK; 1253 algo_strength &= (ca_list[j]->algo_strength & SSL_STRONG_MASK) | ~SSL_STRONG_MASK;
1280 if (!(algo_strength & SSL_STRONG_MASK)) { found = 0; break; } 1254 if (!(algo_strength & SSL_STRONG_MASK)) {
1255 found = 0;
1256 break;
1281 } 1257 }
1282 else 1258 } else
1283 algo_strength |= ca_list[j]->algo_strength & SSL_STRONG_MASK; 1259 algo_strength |= ca_list[j]->algo_strength & SSL_STRONG_MASK;
1284 } 1260 }
1285 1261
1286 if (ca_list[j]->valid) 1262 if (ca_list[j]->valid) {
1287 {
1288 /* explicit ciphersuite found; its protocol version 1263 /* explicit ciphersuite found; its protocol version
1289 * does not become part of the search pattern!*/ 1264 * does not become part of the search pattern!*/
1290 1265
1291 cipher_id = ca_list[j]->id; 1266 cipher_id = ca_list[j]->id;
1292 } 1267 } else {
1293 else
1294 {
1295 /* not an explicit ciphersuite; only in this case, the 1268 /* not an explicit ciphersuite; only in this case, the
1296 * protocol version is considered part of the search pattern */ 1269 * protocol version is considered part of the search pattern */
1297 1270
1298 if (ca_list[j]->algorithm_ssl) 1271 if (ca_list[j]->algorithm_ssl) {
1299 { 1272 if (alg_ssl) {
1300 if (alg_ssl)
1301 {
1302 alg_ssl &= ca_list[j]->algorithm_ssl; 1273 alg_ssl &= ca_list[j]->algorithm_ssl;
1303 if (!alg_ssl) { found = 0; break; } 1274 if (!alg_ssl) {
1275 found = 0;
1276 break;
1304 } 1277 }
1305 else 1278 } else
1306 alg_ssl = ca_list[j]->algorithm_ssl; 1279 alg_ssl = ca_list[j]->algorithm_ssl;
1307 }
1308 } 1280 }
1309
1310 if (!multi) break;
1311 } 1281 }
1312 1282
1283 if (!multi)
1284 break;
1285 }
1286
1313 /* 1287 /*
1314 * Ok, we have the rule, now apply it 1288 * Ok, we have the rule, now apply it
1315 */ 1289 */
1316 if (rule == CIPHER_SPECIAL) 1290 if (rule == CIPHER_SPECIAL)
1317 { /* special command */ 1291 { /* special command */
1318 ok = 0; 1292 ok = 0;
1319 if ((buflen == 8) && 1293 if ((buflen == 8) &&
1320 !strncmp(buf, "STRENGTH", 8)) 1294 !strncmp(buf, "STRENGTH", 8))
1321 ok = ssl_cipher_strength_sort(head_p, tail_p); 1295 ok = ssl_cipher_strength_sort(head_p, tail_p);
1322 else 1296 else
1323 SSLerr(SSL_F_SSL_CIPHER_PROCESS_RULESTR, 1297 SSLerr(SSL_F_SSL_CIPHER_PROCESS_RULESTR,
1324 SSL_R_INVALID_COMMAND); 1298 SSL_R_INVALID_COMMAND);
1325 if (ok == 0) 1299 if (ok == 0)
1326 retval = 0; 1300 retval = 0;
1327 /* 1301 /*
@@ -1331,30 +1305,27 @@ static int ssl_cipher_process_rulestr(const char *rule_str,
1331 * end or ':' is found. 1305 * end or ':' is found.
1332 */ 1306 */
1333 while ((*l != '\0') && !ITEM_SEP(*l)) 1307 while ((*l != '\0') && !ITEM_SEP(*l))
1334 l++; 1308 l++;
1335 } 1309 } else if (found) {
1336 else if (found)
1337 {
1338 ssl_cipher_apply_rule(cipher_id, 1310 ssl_cipher_apply_rule(cipher_id,
1339 alg_mkey, alg_auth, alg_enc, alg_mac, alg_ssl, algo_strength, 1311 alg_mkey, alg_auth, alg_enc, alg_mac, alg_ssl, algo_strength,
1340 rule, -1, head_p, tail_p); 1312 rule, -1, head_p, tail_p);
1341 } 1313 } else {
1342 else
1343 {
1344 while ((*l != '\0') && !ITEM_SEP(*l)) 1314 while ((*l != '\0') && !ITEM_SEP(*l))
1345 l++; 1315 l++;
1346 } 1316 }
1347 if (*l == '\0') break; /* done */ 1317 if (*l == '\0') break; /* done */
1348 } 1318 }
1349 1319
1350 return(retval); 1320 return (retval);
1351 } 1321}
1352 1322
1353STACK_OF(SSL_CIPHER) *ssl_create_cipher_list(const SSL_METHOD *ssl_method, 1323STACK_OF(SSL_CIPHER)
1354 STACK_OF(SSL_CIPHER) **cipher_list, 1324*ssl_create_cipher_list(const SSL_METHOD *ssl_method,
1355 STACK_OF(SSL_CIPHER) **cipher_list_by_id, 1325STACK_OF(SSL_CIPHER) **cipher_list,
1356 const char *rule_str) 1326 STACK_OF(SSL_CIPHER) **cipher_list_by_id,
1357 { 1327const char *rule_str)
1328{
1358 int ok, num_of_ciphers, num_of_alias_max, num_of_group_aliases; 1329 int ok, num_of_ciphers, num_of_alias_max, num_of_group_aliases;
1359 unsigned long disabled_mkey, disabled_auth, disabled_enc, disabled_mac, disabled_ssl; 1330 unsigned long disabled_mkey, disabled_auth, disabled_enc, disabled_mac, disabled_ssl;
1360 STACK_OF(SSL_CIPHER) *cipherstack, *tmp_cipher_list; 1331 STACK_OF(SSL_CIPHER) *cipherstack, *tmp_cipher_list;
@@ -1384,15 +1355,14 @@ STACK_OF(SSL_CIPHER) *ssl_create_cipher_list(const SSL_METHOD *ssl_method,
1384 printf("ssl_create_cipher_list() for %d ciphers\n", num_of_ciphers); 1355 printf("ssl_create_cipher_list() for %d ciphers\n", num_of_ciphers);
1385#endif /* KSSL_DEBUG */ 1356#endif /* KSSL_DEBUG */
1386 co_list = (CIPHER_ORDER *)OPENSSL_malloc(sizeof(CIPHER_ORDER) * num_of_ciphers); 1357 co_list = (CIPHER_ORDER *)OPENSSL_malloc(sizeof(CIPHER_ORDER) * num_of_ciphers);
1387 if (co_list == NULL) 1358 if (co_list == NULL) {
1388 { 1359 SSLerr(SSL_F_SSL_CREATE_CIPHER_LIST, ERR_R_MALLOC_FAILURE);
1389 SSLerr(SSL_F_SSL_CREATE_CIPHER_LIST,ERR_R_MALLOC_FAILURE);
1390 return(NULL); /* Failure */ 1360 return(NULL); /* Failure */
1391 } 1361 }
1392 1362
1393 ssl_cipher_collect_ciphers(ssl_method, num_of_ciphers, 1363 ssl_cipher_collect_ciphers(ssl_method, num_of_ciphers,
1394 disabled_mkey, disabled_auth, disabled_enc, disabled_mac, disabled_ssl, 1364 disabled_mkey, disabled_auth, disabled_enc, disabled_mac, disabled_ssl,
1395 co_list, &head, &tail); 1365 co_list, &head, &tail);
1396 1366
1397 1367
1398 /* Now arrange all ciphers by preference: */ 1368 /* Now arrange all ciphers by preference: */
@@ -1419,19 +1389,18 @@ STACK_OF(SSL_CIPHER) *ssl_create_cipher_list(const SSL_METHOD *ssl_method,
1419 ssl_cipher_apply_rule(0, 0, SSL_aECDH, 0, 0, 0, 0, CIPHER_ORD, -1, &head, &tail); 1389 ssl_cipher_apply_rule(0, 0, SSL_aECDH, 0, 0, 0, 0, CIPHER_ORD, -1, &head, &tail);
1420 /* ssl_cipher_apply_rule(0, 0, SSL_aDH, 0, 0, 0, 0, CIPHER_ORD, -1, &head, &tail); */ 1390 /* ssl_cipher_apply_rule(0, 0, SSL_aDH, 0, 0, 0, 0, CIPHER_ORD, -1, &head, &tail); */
1421 ssl_cipher_apply_rule(0, SSL_kRSA, 0, 0, 0, 0, 0, CIPHER_ORD, -1, &head, &tail); 1391 ssl_cipher_apply_rule(0, SSL_kRSA, 0, 0, 0, 0, 0, CIPHER_ORD, -1, &head, &tail);
1422 ssl_cipher_apply_rule(0, SSL_kPSK, 0,0, 0, 0, 0, CIPHER_ORD, -1, &head, &tail); 1392 ssl_cipher_apply_rule(0, SSL_kPSK, 0, 0, 0, 0, 0, CIPHER_ORD, -1, &head, &tail);
1423 ssl_cipher_apply_rule(0, SSL_kKRB5, 0,0, 0, 0, 0, CIPHER_ORD, -1, &head, &tail); 1393 ssl_cipher_apply_rule(0, SSL_kKRB5, 0, 0, 0, 0, 0, CIPHER_ORD, -1, &head, &tail);
1424 1394
1425 /* RC4 is sort-of broken -- move the the end */ 1395 /* RC4 is sort-of broken -- move the the end */
1426 ssl_cipher_apply_rule(0, 0, 0, SSL_RC4, 0, 0, 0, CIPHER_ORD, -1, &head, &tail); 1396 ssl_cipher_apply_rule(0, 0, 0, SSL_RC4, 0, 0, 0, CIPHER_ORD, -1, &head, &tail);
1427 1397
1428 /* Now sort by symmetric encryption strength. The above ordering remains 1398 /* Now sort by symmetric encryption strength. The above ordering remains
1429 * in force within each class */ 1399 * in force within each class */
1430 if (!ssl_cipher_strength_sort(&head, &tail)) 1400 if (!ssl_cipher_strength_sort(&head, &tail)) {
1431 {
1432 OPENSSL_free(co_list); 1401 OPENSSL_free(co_list);
1433 return NULL; 1402 return NULL;
1434 } 1403 }
1435 1404
1436 /* Now disable everything (maintaining the ordering!) */ 1405 /* Now disable everything (maintaining the ordering!) */
1437 ssl_cipher_apply_rule(0, 0, 0, 0, 0, 0, 0, CIPHER_DEL, -1, &head, &tail); 1406 ssl_cipher_apply_rule(0, 0, 0, 0, 0, 0, 0, CIPHER_DEL, -1, &head, &tail);
@@ -1448,15 +1417,14 @@ STACK_OF(SSL_CIPHER) *ssl_create_cipher_list(const SSL_METHOD *ssl_method,
1448 num_of_group_aliases = sizeof(cipher_aliases) / sizeof(SSL_CIPHER); 1417 num_of_group_aliases = sizeof(cipher_aliases) / sizeof(SSL_CIPHER);
1449 num_of_alias_max = num_of_ciphers + num_of_group_aliases + 1; 1418 num_of_alias_max = num_of_ciphers + num_of_group_aliases + 1;
1450 ca_list = OPENSSL_malloc(sizeof(SSL_CIPHER *) * num_of_alias_max); 1419 ca_list = OPENSSL_malloc(sizeof(SSL_CIPHER *) * num_of_alias_max);
1451 if (ca_list == NULL) 1420 if (ca_list == NULL) {
1452 {
1453 OPENSSL_free(co_list); 1421 OPENSSL_free(co_list);
1454 SSLerr(SSL_F_SSL_CREATE_CIPHER_LIST,ERR_R_MALLOC_FAILURE); 1422 SSLerr(SSL_F_SSL_CREATE_CIPHER_LIST, ERR_R_MALLOC_FAILURE);
1455 return(NULL); /* Failure */ 1423 return(NULL); /* Failure */
1456 } 1424 }
1457 ssl_cipher_collect_aliases(ca_list, num_of_group_aliases, 1425 ssl_cipher_collect_aliases(ca_list, num_of_group_aliases,
1458 disabled_mkey, disabled_auth, disabled_enc, 1426 disabled_mkey, disabled_auth, disabled_enc,
1459 disabled_mac, disabled_ssl, head); 1427 disabled_mac, disabled_ssl, head);
1460 1428
1461 /* 1429 /*
1462 * If the rule_string begins with DEFAULT, apply the default rule 1430 * If the rule_string begins with DEFAULT, apply the default rule
@@ -1464,14 +1432,13 @@ STACK_OF(SSL_CIPHER) *ssl_create_cipher_list(const SSL_METHOD *ssl_method,
1464 */ 1432 */
1465 ok = 1; 1433 ok = 1;
1466 rule_p = rule_str; 1434 rule_p = rule_str;
1467 if (strncmp(rule_str,"DEFAULT",7) == 0) 1435 if (strncmp(rule_str, "DEFAULT", 7) == 0) {
1468 {
1469 ok = ssl_cipher_process_rulestr(SSL_DEFAULT_CIPHER_LIST, 1436 ok = ssl_cipher_process_rulestr(SSL_DEFAULT_CIPHER_LIST,
1470 &head, &tail, ca_list); 1437 &head, &tail, ca_list);
1471 rule_p += 7; 1438 rule_p += 7;
1472 if (*rule_p == ':') 1439 if (*rule_p == ':')
1473 rule_p++; 1440 rule_p++;
1474 } 1441 }
1475 1442
1476 if (ok && (strlen(rule_p) > 0)) 1443 if (ok && (strlen(rule_p) > 0))
1477 ok = ssl_cipher_process_rulestr(rule_p, &head, &tail, ca_list); 1444 ok = ssl_cipher_process_rulestr(rule_p, &head, &tail, ca_list);
@@ -1479,65 +1446,63 @@ STACK_OF(SSL_CIPHER) *ssl_create_cipher_list(const SSL_METHOD *ssl_method,
1479 OPENSSL_free((void *)ca_list); /* Not needed anymore */ 1446 OPENSSL_free((void *)ca_list); /* Not needed anymore */
1480 1447
1481 if (!ok) 1448 if (!ok)
1482 { /* Rule processing failure */ 1449 { /* Rule processing failure */
1483 OPENSSL_free(co_list); 1450 OPENSSL_free(co_list);
1484 return(NULL); 1451 return (NULL);
1485 } 1452 }
1486 1453
1487 /* 1454 /*
1488 * Allocate new "cipherstack" for the result, return with error 1455 * Allocate new "cipherstack" for the result, return with error
1489 * if we cannot get one. 1456 * if we cannot get one.
1490 */ 1457 */
1491 if ((cipherstack = sk_SSL_CIPHER_new_null()) == NULL) 1458 if ((cipherstack = sk_SSL_CIPHER_new_null()) == NULL) {
1492 {
1493 OPENSSL_free(co_list); 1459 OPENSSL_free(co_list);
1494 return(NULL); 1460 return (NULL);
1495 } 1461 }
1496 1462
1497 /* 1463 /*
1498 * The cipher selection for the list is done. The ciphers are added 1464 * The cipher selection for the list is done. The ciphers are added
1499 * to the resulting precedence to the STACK_OF(SSL_CIPHER). 1465 * to the resulting precedence to the STACK_OF(SSL_CIPHER).
1500 */ 1466 */
1501 for (curr = head; curr != NULL; curr = curr->next) 1467 for (curr = head; curr != NULL; curr = curr->next) {
1502 {
1503#ifdef OPENSSL_FIPS 1468#ifdef OPENSSL_FIPS
1504 if (curr->active && (!FIPS_mode() || curr->cipher->algo_strength & SSL_FIPS)) 1469 if (curr->active && (!FIPS_mode() || curr->cipher->algo_strength & SSL_FIPS))
1505#else 1470#else
1506 if (curr->active) 1471 if (curr->active)
1507#endif 1472#endif
1508 { 1473 {
1509 sk_SSL_CIPHER_push(cipherstack, curr->cipher); 1474 sk_SSL_CIPHER_push(cipherstack, curr->cipher);
1510#ifdef CIPHER_DEBUG 1475#ifdef CIPHER_DEBUG
1511 printf("<%s>\n",curr->cipher->name); 1476 printf("<%s>\n", curr->cipher->name);
1512#endif 1477#endif
1513 }
1514 } 1478 }
1479 }
1515 OPENSSL_free(co_list); /* Not needed any longer */ 1480 OPENSSL_free(co_list); /* Not needed any longer */
1516 1481
1517 tmp_cipher_list = sk_SSL_CIPHER_dup(cipherstack); 1482 tmp_cipher_list = sk_SSL_CIPHER_dup(cipherstack);
1518 if (tmp_cipher_list == NULL) 1483 if (tmp_cipher_list == NULL) {
1519 {
1520 sk_SSL_CIPHER_free(cipherstack); 1484 sk_SSL_CIPHER_free(cipherstack);
1521 return NULL; 1485 return NULL;
1522 } 1486 }
1523 if (*cipher_list != NULL) 1487 if (*cipher_list != NULL)
1524 sk_SSL_CIPHER_free(*cipher_list); 1488 sk_SSL_CIPHER_free(*cipher_list);
1525 *cipher_list = cipherstack; 1489 *cipher_list = cipherstack;
1526 if (*cipher_list_by_id != NULL) 1490 if (*cipher_list_by_id != NULL)
1527 sk_SSL_CIPHER_free(*cipher_list_by_id); 1491 sk_SSL_CIPHER_free(*cipher_list_by_id);
1528 *cipher_list_by_id = tmp_cipher_list; 1492 *cipher_list_by_id = tmp_cipher_list;
1529 (void)sk_SSL_CIPHER_set_cmp_func(*cipher_list_by_id,ssl_cipher_ptr_id_cmp); 1493 (void)sk_SSL_CIPHER_set_cmp_func(*cipher_list_by_id, ssl_cipher_ptr_id_cmp);
1530 1494
1531 sk_SSL_CIPHER_sort(*cipher_list_by_id); 1495 sk_SSL_CIPHER_sort(*cipher_list_by_id);
1532 return(cipherstack); 1496 return (cipherstack);
1533 } 1497}
1534 1498
1535char *SSL_CIPHER_description(const SSL_CIPHER *cipher, char *buf, int len) 1499char
1536 { 1500*SSL_CIPHER_description(const SSL_CIPHER *cipher, char *buf, int len)
1537 int is_export,pkl,kl; 1501{
1538 const char *ver,*exp_str; 1502 int is_export, pkl, kl;
1539 const char *kx,*au,*enc,*mac; 1503 const char *ver, *exp_str;
1540 unsigned long alg_mkey,alg_auth,alg_enc,alg_mac,alg_ssl,alg2; 1504 const char *kx, *au, *enc, *mac;
1505 unsigned long alg_mkey, alg_auth, alg_enc, alg_mac, alg_ssl, alg2;
1541#ifdef KSSL_DEBUG 1506#ifdef KSSL_DEBUG
1542 static const char *format="%-23s %s Kx=%-8s Au=%-4s Enc=%-9s Mac=%-4s%s AL=%lx/%lx/%lx/%lx/%lx\n"; 1507 static const char *format="%-23s %s Kx=%-8s Au=%-4s Enc=%-9s Mac=%-4s%s AL=%lx/%lx/%lx/%lx/%lx\n";
1543#else 1508#else
@@ -1550,13 +1515,13 @@ char *SSL_CIPHER_description(const SSL_CIPHER *cipher, char *buf, int len)
1550 alg_mac = cipher->algorithm_mac; 1515 alg_mac = cipher->algorithm_mac;
1551 alg_ssl = cipher->algorithm_ssl; 1516 alg_ssl = cipher->algorithm_ssl;
1552 1517
1553 alg2=cipher->algorithm2; 1518 alg2 = cipher->algorithm2;
1519
1520 is_export = SSL_C_IS_EXPORT(cipher);
1521 pkl = SSL_C_EXPORT_PKEYLENGTH(cipher);
1522 kl = SSL_C_EXPORT_KEYLENGTH(cipher);
1523 exp_str = is_export?" export":"";
1554 1524
1555 is_export=SSL_C_IS_EXPORT(cipher);
1556 pkl=SSL_C_EXPORT_PKEYLENGTH(cipher);
1557 kl=SSL_C_EXPORT_KEYLENGTH(cipher);
1558 exp_str=is_export?" export":"";
1559
1560 if (alg_ssl & SSL_SSLV2) 1525 if (alg_ssl & SSL_SSLV2)
1561 ver="SSLv2"; 1526 ver="SSLv2";
1562 else if (alg_ssl & SSL_SSLV3) 1527 else if (alg_ssl & SSL_SSLV3)
@@ -1566,10 +1531,9 @@ char *SSL_CIPHER_description(const SSL_CIPHER *cipher, char *buf, int len)
1566 else 1531 else
1567 ver="unknown"; 1532 ver="unknown";
1568 1533
1569 switch (alg_mkey) 1534 switch (alg_mkey) {
1570 {
1571 case SSL_kRSA: 1535 case SSL_kRSA:
1572 kx=is_export?(pkl == 512 ? "RSA(512)" : "RSA(1024)"):"RSA"; 1536 kx = is_export?(pkl == 512 ? "RSA(512)" : "RSA(1024)"):"RSA";
1573 break; 1537 break;
1574 case SSL_kDHr: 1538 case SSL_kDHr:
1575 kx="DH/RSA"; 1539 kx="DH/RSA";
@@ -1577,11 +1541,11 @@ char *SSL_CIPHER_description(const SSL_CIPHER *cipher, char *buf, int len)
1577 case SSL_kDHd: 1541 case SSL_kDHd:
1578 kx="DH/DSS"; 1542 kx="DH/DSS";
1579 break; 1543 break;
1580 case SSL_kKRB5: 1544 case SSL_kKRB5:
1581 kx="KRB5"; 1545 kx="KRB5";
1582 break; 1546 break;
1583 case SSL_kEDH: 1547 case SSL_kEDH:
1584 kx=is_export?(pkl == 512 ? "DH(512)" : "DH(1024)"):"DH"; 1548 kx = is_export?(pkl == 512 ? "DH(512)" : "DH(1024)"):"DH";
1585 break; 1549 break;
1586 case SSL_kECDHr: 1550 case SSL_kECDHr:
1587 kx="ECDH/RSA"; 1551 kx="ECDH/RSA";
@@ -1600,10 +1564,9 @@ char *SSL_CIPHER_description(const SSL_CIPHER *cipher, char *buf, int len)
1600 break; 1564 break;
1601 default: 1565 default:
1602 kx="unknown"; 1566 kx="unknown";
1603 } 1567 }
1604 1568
1605 switch (alg_auth) 1569 switch (alg_auth) {
1606 {
1607 case SSL_aRSA: 1570 case SSL_aRSA:
1608 au="RSA"; 1571 au="RSA";
1609 break; 1572 break;
@@ -1613,10 +1576,10 @@ char *SSL_CIPHER_description(const SSL_CIPHER *cipher, char *buf, int len)
1613 case SSL_aDH: 1576 case SSL_aDH:
1614 au="DH"; 1577 au="DH";
1615 break; 1578 break;
1616 case SSL_aKRB5: 1579 case SSL_aKRB5:
1617 au="KRB5"; 1580 au="KRB5";
1618 break; 1581 break;
1619 case SSL_aECDH: 1582 case SSL_aECDH:
1620 au="ECDH"; 1583 au="ECDH";
1621 break; 1584 break;
1622 case SSL_aNULL: 1585 case SSL_aNULL:
@@ -1631,22 +1594,21 @@ char *SSL_CIPHER_description(const SSL_CIPHER *cipher, char *buf, int len)
1631 default: 1594 default:
1632 au="unknown"; 1595 au="unknown";
1633 break; 1596 break;
1634 } 1597 }
1635 1598
1636 switch (alg_enc) 1599 switch (alg_enc) {
1637 {
1638 case SSL_DES: 1600 case SSL_DES:
1639 enc=(is_export && kl == 5)?"DES(40)":"DES(56)"; 1601 enc = (is_export && kl == 5)?"DES(40)":"DES(56)";
1640 break; 1602 break;
1641 case SSL_3DES: 1603 case SSL_3DES:
1642 enc="3DES(168)"; 1604 enc="3DES(168)";
1643 break; 1605 break;
1644 case SSL_RC4: 1606 case SSL_RC4:
1645 enc=is_export?(kl == 5 ? "RC4(40)" : "RC4(56)") 1607 enc = is_export?(kl == 5 ? "RC4(40)" : "RC4(56)")
1646 :((alg2&SSL2_CF_8_BYTE_ENC)?"RC4(64)":"RC4(128)"); 1608 :((alg2&SSL2_CF_8_BYTE_ENC)?"RC4(64)":"RC4(128)");
1647 break; 1609 break;
1648 case SSL_RC2: 1610 case SSL_RC2:
1649 enc=is_export?(kl == 5 ? "RC2(40)" : "RC2(56)"):"RC2(128)"; 1611 enc = is_export?(kl == 5 ? "RC2(40)" : "RC2(56)"):"RC2(128)";
1650 break; 1612 break;
1651 case SSL_IDEA: 1613 case SSL_IDEA:
1652 enc="IDEA(128)"; 1614 enc="IDEA(128)";
@@ -1678,10 +1640,9 @@ char *SSL_CIPHER_description(const SSL_CIPHER *cipher, char *buf, int len)
1678 default: 1640 default:
1679 enc="unknown"; 1641 enc="unknown";
1680 break; 1642 break;
1681 } 1643 }
1682 1644
1683 switch (alg_mac) 1645 switch (alg_mac) {
1684 {
1685 case SSL_MD5: 1646 case SSL_MD5:
1686 mac="MD5"; 1647 mac="MD5";
1687 break; 1648 break;
@@ -1700,108 +1661,119 @@ char *SSL_CIPHER_description(const SSL_CIPHER *cipher, char *buf, int len)
1700 default: 1661 default:
1701 mac="unknown"; 1662 mac="unknown";
1702 break; 1663 break;
1703 } 1664 }
1704 1665
1705 if (buf == NULL) 1666 if (buf == NULL) {
1706 { 1667 len = 128;
1707 len=128; 1668 buf = OPENSSL_malloc(len);
1708 buf=OPENSSL_malloc(len); 1669 if (buf == NULL)
1709 if (buf == NULL) return("OPENSSL_malloc Error"); 1670 return("OPENSSL_malloc Error");
1710 } 1671 } else if (len < 128)
1711 else if (len < 128) 1672 return("Buffer too small");
1712 return("Buffer too small");
1713 1673
1714#ifdef KSSL_DEBUG 1674#ifdef KSSL_DEBUG
1715 BIO_snprintf(buf,len,format,cipher->name,ver,kx,au,enc,mac,exp_str,alg_mkey,alg_auth,alg_enc,alg_mac,alg_ssl); 1675 BIO_snprintf(buf, len, format, cipher->name, ver, kx, au, enc, mac, exp_str, alg_mkey, alg_auth, alg_enc, alg_mac, alg_ssl);
1716#else 1676#else
1717 BIO_snprintf(buf,len,format,cipher->name,ver,kx,au,enc,mac,exp_str); 1677 BIO_snprintf(buf, len, format, cipher->name, ver, kx, au, enc, mac, exp_str);
1718#endif /* KSSL_DEBUG */ 1678#endif /* KSSL_DEBUG */
1719 return(buf); 1679 return (buf);
1720 } 1680}
1721 1681
1722char *SSL_CIPHER_get_version(const SSL_CIPHER *c) 1682char
1723 { 1683*SSL_CIPHER_get_version(const SSL_CIPHER *c)
1684{
1724 int i; 1685 int i;
1725 1686
1726 if (c == NULL) return("(NONE)"); 1687 if (c == NULL)
1727 i=(int)(c->id>>24L); 1688 return("(NONE)");
1689 i = (int)(c->id >> 24L);
1728 if (i == 3) 1690 if (i == 3)
1729 return("TLSv1/SSLv3"); 1691 return("TLSv1/SSLv3");
1730 else if (i == 2) 1692 else if (i == 2)
1731 return("SSLv2"); 1693 return("SSLv2");
1732 else 1694 else
1733 return("unknown"); 1695 return("unknown");
1734 } 1696}
1735 1697
1736/* return the actual cipher being used */ 1698/* return the actual cipher being used */
1737const char *SSL_CIPHER_get_name(const SSL_CIPHER *c) 1699const char
1738 { 1700*SSL_CIPHER_get_name(const SSL_CIPHER *c)
1701{
1739 if (c != NULL) 1702 if (c != NULL)
1740 return(c->name); 1703 return (c->name);
1741 return("(NONE)"); 1704 return("(NONE)");
1742 } 1705}
1743 1706
1744/* number of bits for symmetric cipher */ 1707/* number of bits for symmetric cipher */
1745int SSL_CIPHER_get_bits(const SSL_CIPHER *c, int *alg_bits) 1708int
1746 { 1709SSL_CIPHER_get_bits(const SSL_CIPHER *c, int *alg_bits)
1747 int ret=0; 1710{
1711 int ret = 0;
1748 1712
1749 if (c != NULL) 1713 if (c != NULL) {
1750 { 1714 if (alg_bits != NULL)
1751 if (alg_bits != NULL) *alg_bits = c->alg_bits; 1715 *alg_bits = c->alg_bits;
1752 ret = c->strength_bits; 1716 ret = c->strength_bits;
1753 }
1754 return(ret);
1755 } 1717 }
1718 return (ret);
1719}
1756 1720
1757unsigned long SSL_CIPHER_get_id(const SSL_CIPHER *c) 1721unsigned long
1758 { 1722SSL_CIPHER_get_id(const SSL_CIPHER *c)
1723{
1759 return c->id; 1724 return c->id;
1760 } 1725}
1761 1726
1762SSL_COMP *ssl3_comp_find(STACK_OF(SSL_COMP) *sk, int n) 1727SSL_COMP
1763 { 1728*ssl3_comp_find(STACK_OF(SSL_COMP) *sk, int n)
1729{
1764 SSL_COMP *ctmp; 1730 SSL_COMP *ctmp;
1765 int i,nn; 1731 int i, nn;
1766 1732
1767 if ((n == 0) || (sk == NULL)) return(NULL); 1733 if ((n == 0)
1768 nn=sk_SSL_COMP_num(sk); 1734 || (sk == NULL)) return (NULL);
1769 for (i=0; i<nn; i++) 1735 nn = sk_SSL_COMP_num(sk);
1770 { 1736 for (i = 0; i < nn; i++) {
1771 ctmp=sk_SSL_COMP_value(sk,i); 1737 ctmp = sk_SSL_COMP_value(sk, i);
1772 if (ctmp->id == n) 1738 if (ctmp->id == n)
1773 return(ctmp); 1739 return (ctmp);
1774 }
1775 return(NULL);
1776 } 1740 }
1741 return (NULL);
1742}
1777 1743
1778#ifdef OPENSSL_NO_COMP 1744#ifdef OPENSSL_NO_COMP
1779void *SSL_COMP_get_compression_methods(void) 1745void
1780 { 1746*SSL_COMP_get_compression_methods(void)
1747{
1781 return NULL; 1748 return NULL;
1782 } 1749}
1783int SSL_COMP_add_compression_method(int id, void *cm) 1750
1784 { 1751int
1752SSL_COMP_add_compression_method(int id, void *cm)
1753{
1785 return 1; 1754 return 1;
1786 } 1755}
1787 1756
1788const char *SSL_COMP_get_name(const void *comp) 1757const char
1789 { 1758*SSL_COMP_get_name(const void *comp)
1759{
1790 return NULL; 1760 return NULL;
1791 } 1761}
1792#else 1762#else
1793STACK_OF(SSL_COMP) *SSL_COMP_get_compression_methods(void) 1763STACK_OF(SSL_COMP)
1794 { 1764*SSL_COMP_get_compression_methods(void)
1765{
1795 load_builtin_compressions(); 1766 load_builtin_compressions();
1796 return(ssl_comp_methods); 1767 return (ssl_comp_methods);
1797 } 1768}
1798 1769
1799int SSL_COMP_add_compression_method(int id, COMP_METHOD *cm) 1770int
1800 { 1771SSL_COMP_add_compression_method(int id, COMP_METHOD *cm)
1772{
1801 SSL_COMP *comp; 1773 SSL_COMP *comp;
1802 1774
1803 if (cm == NULL || cm->type == NID_undef) 1775 if (cm == NULL || cm->type == NID_undef)
1804 return 1; 1776 return 1;
1805 1777
1806 /* According to draft-ietf-tls-compression-04.txt, the 1778 /* According to draft-ietf-tls-compression-04.txt, the
1807 compression number ranges should be the following: 1779 compression number ranges should be the following:
@@ -1809,45 +1781,40 @@ int SSL_COMP_add_compression_method(int id, COMP_METHOD *cm)
1809 0 to 63: methods defined by the IETF 1781 0 to 63: methods defined by the IETF
1810 64 to 192: external party methods assigned by IANA 1782 64 to 192: external party methods assigned by IANA
1811 193 to 255: reserved for private use */ 1783 193 to 255: reserved for private use */
1812 if (id < 193 || id > 255) 1784 if (id < 193 || id > 255) {
1813 { 1785 SSLerr(SSL_F_SSL_COMP_ADD_COMPRESSION_METHOD, SSL_R_COMPRESSION_ID_NOT_WITHIN_PRIVATE_RANGE);
1814 SSLerr(SSL_F_SSL_COMP_ADD_COMPRESSION_METHOD,SSL_R_COMPRESSION_ID_NOT_WITHIN_PRIVATE_RANGE);
1815 return 0; 1786 return 0;
1816 } 1787 }
1817 1788
1818 MemCheck_off(); 1789 MemCheck_off();
1819 comp=(SSL_COMP *)OPENSSL_malloc(sizeof(SSL_COMP)); 1790 comp = (SSL_COMP *)OPENSSL_malloc(sizeof(SSL_COMP));
1820 comp->id=id; 1791 comp->id = id;
1821 comp->method=cm; 1792 comp->method = cm;
1822 load_builtin_compressions(); 1793 load_builtin_compressions();
1823 if (ssl_comp_methods 1794 if (ssl_comp_methods
1824 && sk_SSL_COMP_find(ssl_comp_methods,comp) >= 0) 1795 && sk_SSL_COMP_find(ssl_comp_methods, comp) >= 0) {
1825 {
1826 OPENSSL_free(comp); 1796 OPENSSL_free(comp);
1827 MemCheck_on(); 1797 MemCheck_on();
1828 SSLerr(SSL_F_SSL_COMP_ADD_COMPRESSION_METHOD,SSL_R_DUPLICATE_COMPRESSION_ID); 1798 SSLerr(SSL_F_SSL_COMP_ADD_COMPRESSION_METHOD, SSL_R_DUPLICATE_COMPRESSION_ID);
1829 return(1); 1799 return (1);
1830 } 1800 } else if ((ssl_comp_methods == NULL)
1831 else if ((ssl_comp_methods == NULL) 1801 || !sk_SSL_COMP_push(ssl_comp_methods, comp)) {
1832 || !sk_SSL_COMP_push(ssl_comp_methods,comp))
1833 {
1834 OPENSSL_free(comp); 1802 OPENSSL_free(comp);
1835 MemCheck_on(); 1803 MemCheck_on();
1836 SSLerr(SSL_F_SSL_COMP_ADD_COMPRESSION_METHOD,ERR_R_MALLOC_FAILURE); 1804 SSLerr(SSL_F_SSL_COMP_ADD_COMPRESSION_METHOD, ERR_R_MALLOC_FAILURE);
1837 return(1); 1805 return (1);
1838 } 1806 } else {
1839 else
1840 {
1841 MemCheck_on(); 1807 MemCheck_on();
1842 return(0); 1808 return (0);
1843 }
1844 } 1809 }
1810}
1845 1811
1846const char *SSL_COMP_get_name(const COMP_METHOD *comp) 1812const char
1847 { 1813*SSL_COMP_get_name(const COMP_METHOD *comp)
1814{
1848 if (comp) 1815 if (comp)
1849 return comp->name; 1816 return comp->name;
1850 return NULL; 1817 return NULL;
1851 } 1818}
1852 1819
1853#endif 1820#endif
diff --git a/src/lib/libssl/src/ssl/ssl_err.c b/src/lib/libssl/src/ssl/ssl_err.c
index 370fb57e3b..67ba3c7699 100644
--- a/src/lib/libssl/src/ssl/ssl_err.c
+++ b/src/lib/libssl/src/ssl/ssl_err.c
@@ -68,543 +68,541 @@
68#define ERR_FUNC(func) ERR_PACK(ERR_LIB_SSL,func,0) 68#define ERR_FUNC(func) ERR_PACK(ERR_LIB_SSL,func,0)
69#define ERR_REASON(reason) ERR_PACK(ERR_LIB_SSL,0,reason) 69#define ERR_REASON(reason) ERR_PACK(ERR_LIB_SSL,0,reason)
70 70
71static ERR_STRING_DATA SSL_str_functs[]= 71static ERR_STRING_DATA SSL_str_functs[]= {
72 { 72 {ERR_FUNC(SSL_F_CLIENT_CERTIFICATE), "CLIENT_CERTIFICATE"},
73{ERR_FUNC(SSL_F_CLIENT_CERTIFICATE), "CLIENT_CERTIFICATE"}, 73 {ERR_FUNC(SSL_F_CLIENT_FINISHED), "CLIENT_FINISHED"},
74{ERR_FUNC(SSL_F_CLIENT_FINISHED), "CLIENT_FINISHED"}, 74 {ERR_FUNC(SSL_F_CLIENT_HELLO), "CLIENT_HELLO"},
75{ERR_FUNC(SSL_F_CLIENT_HELLO), "CLIENT_HELLO"}, 75 {ERR_FUNC(SSL_F_CLIENT_MASTER_KEY), "CLIENT_MASTER_KEY"},
76{ERR_FUNC(SSL_F_CLIENT_MASTER_KEY), "CLIENT_MASTER_KEY"}, 76 {ERR_FUNC(SSL_F_D2I_SSL_SESSION), "d2i_SSL_SESSION"},
77{ERR_FUNC(SSL_F_D2I_SSL_SESSION), "d2i_SSL_SESSION"}, 77 {ERR_FUNC(SSL_F_DO_DTLS1_WRITE), "DO_DTLS1_WRITE"},
78{ERR_FUNC(SSL_F_DO_DTLS1_WRITE), "DO_DTLS1_WRITE"}, 78 {ERR_FUNC(SSL_F_DO_SSL3_WRITE), "DO_SSL3_WRITE"},
79{ERR_FUNC(SSL_F_DO_SSL3_WRITE), "DO_SSL3_WRITE"}, 79 {ERR_FUNC(SSL_F_DTLS1_ACCEPT), "DTLS1_ACCEPT"},
80{ERR_FUNC(SSL_F_DTLS1_ACCEPT), "DTLS1_ACCEPT"}, 80 {ERR_FUNC(SSL_F_DTLS1_ADD_CERT_TO_BUF), "DTLS1_ADD_CERT_TO_BUF"},
81{ERR_FUNC(SSL_F_DTLS1_ADD_CERT_TO_BUF), "DTLS1_ADD_CERT_TO_BUF"}, 81 {ERR_FUNC(SSL_F_DTLS1_BUFFER_RECORD), "DTLS1_BUFFER_RECORD"},
82{ERR_FUNC(SSL_F_DTLS1_BUFFER_RECORD), "DTLS1_BUFFER_RECORD"}, 82 {ERR_FUNC(SSL_F_DTLS1_CHECK_TIMEOUT_NUM), "DTLS1_CHECK_TIMEOUT_NUM"},
83{ERR_FUNC(SSL_F_DTLS1_CHECK_TIMEOUT_NUM), "DTLS1_CHECK_TIMEOUT_NUM"}, 83 {ERR_FUNC(SSL_F_DTLS1_CLIENT_HELLO), "DTLS1_CLIENT_HELLO"},
84{ERR_FUNC(SSL_F_DTLS1_CLIENT_HELLO), "DTLS1_CLIENT_HELLO"}, 84 {ERR_FUNC(SSL_F_DTLS1_CONNECT), "DTLS1_CONNECT"},
85{ERR_FUNC(SSL_F_DTLS1_CONNECT), "DTLS1_CONNECT"}, 85 {ERR_FUNC(SSL_F_DTLS1_ENC), "DTLS1_ENC"},
86{ERR_FUNC(SSL_F_DTLS1_ENC), "DTLS1_ENC"}, 86 {ERR_FUNC(SSL_F_DTLS1_GET_HELLO_VERIFY), "DTLS1_GET_HELLO_VERIFY"},
87{ERR_FUNC(SSL_F_DTLS1_GET_HELLO_VERIFY), "DTLS1_GET_HELLO_VERIFY"}, 87 {ERR_FUNC(SSL_F_DTLS1_GET_MESSAGE), "DTLS1_GET_MESSAGE"},
88{ERR_FUNC(SSL_F_DTLS1_GET_MESSAGE), "DTLS1_GET_MESSAGE"}, 88 {ERR_FUNC(SSL_F_DTLS1_GET_MESSAGE_FRAGMENT), "DTLS1_GET_MESSAGE_FRAGMENT"},
89{ERR_FUNC(SSL_F_DTLS1_GET_MESSAGE_FRAGMENT), "DTLS1_GET_MESSAGE_FRAGMENT"}, 89 {ERR_FUNC(SSL_F_DTLS1_GET_RECORD), "DTLS1_GET_RECORD"},
90{ERR_FUNC(SSL_F_DTLS1_GET_RECORD), "DTLS1_GET_RECORD"}, 90 {ERR_FUNC(SSL_F_DTLS1_HANDLE_TIMEOUT), "DTLS1_HANDLE_TIMEOUT"},
91{ERR_FUNC(SSL_F_DTLS1_HANDLE_TIMEOUT), "DTLS1_HANDLE_TIMEOUT"}, 91 {ERR_FUNC(SSL_F_DTLS1_HEARTBEAT), "DTLS1_HEARTBEAT"},
92{ERR_FUNC(SSL_F_DTLS1_HEARTBEAT), "DTLS1_HEARTBEAT"}, 92 {ERR_FUNC(SSL_F_DTLS1_OUTPUT_CERT_CHAIN), "DTLS1_OUTPUT_CERT_CHAIN"},
93{ERR_FUNC(SSL_F_DTLS1_OUTPUT_CERT_CHAIN), "DTLS1_OUTPUT_CERT_CHAIN"}, 93 {ERR_FUNC(SSL_F_DTLS1_PREPROCESS_FRAGMENT), "DTLS1_PREPROCESS_FRAGMENT"},
94{ERR_FUNC(SSL_F_DTLS1_PREPROCESS_FRAGMENT), "DTLS1_PREPROCESS_FRAGMENT"}, 94 {ERR_FUNC(SSL_F_DTLS1_PROCESS_OUT_OF_SEQ_MESSAGE), "DTLS1_PROCESS_OUT_OF_SEQ_MESSAGE"},
95{ERR_FUNC(SSL_F_DTLS1_PROCESS_OUT_OF_SEQ_MESSAGE), "DTLS1_PROCESS_OUT_OF_SEQ_MESSAGE"}, 95 {ERR_FUNC(SSL_F_DTLS1_PROCESS_RECORD), "DTLS1_PROCESS_RECORD"},
96{ERR_FUNC(SSL_F_DTLS1_PROCESS_RECORD), "DTLS1_PROCESS_RECORD"}, 96 {ERR_FUNC(SSL_F_DTLS1_READ_BYTES), "DTLS1_READ_BYTES"},
97{ERR_FUNC(SSL_F_DTLS1_READ_BYTES), "DTLS1_READ_BYTES"}, 97 {ERR_FUNC(SSL_F_DTLS1_READ_FAILED), "DTLS1_READ_FAILED"},
98{ERR_FUNC(SSL_F_DTLS1_READ_FAILED), "DTLS1_READ_FAILED"}, 98 {ERR_FUNC(SSL_F_DTLS1_SEND_CERTIFICATE_REQUEST), "DTLS1_SEND_CERTIFICATE_REQUEST"},
99{ERR_FUNC(SSL_F_DTLS1_SEND_CERTIFICATE_REQUEST), "DTLS1_SEND_CERTIFICATE_REQUEST"}, 99 {ERR_FUNC(SSL_F_DTLS1_SEND_CLIENT_CERTIFICATE), "DTLS1_SEND_CLIENT_CERTIFICATE"},
100{ERR_FUNC(SSL_F_DTLS1_SEND_CLIENT_CERTIFICATE), "DTLS1_SEND_CLIENT_CERTIFICATE"}, 100 {ERR_FUNC(SSL_F_DTLS1_SEND_CLIENT_KEY_EXCHANGE), "DTLS1_SEND_CLIENT_KEY_EXCHANGE"},
101{ERR_FUNC(SSL_F_DTLS1_SEND_CLIENT_KEY_EXCHANGE), "DTLS1_SEND_CLIENT_KEY_EXCHANGE"}, 101 {ERR_FUNC(SSL_F_DTLS1_SEND_CLIENT_VERIFY), "DTLS1_SEND_CLIENT_VERIFY"},
102{ERR_FUNC(SSL_F_DTLS1_SEND_CLIENT_VERIFY), "DTLS1_SEND_CLIENT_VERIFY"}, 102 {ERR_FUNC(SSL_F_DTLS1_SEND_HELLO_VERIFY_REQUEST), "DTLS1_SEND_HELLO_VERIFY_REQUEST"},
103{ERR_FUNC(SSL_F_DTLS1_SEND_HELLO_VERIFY_REQUEST), "DTLS1_SEND_HELLO_VERIFY_REQUEST"}, 103 {ERR_FUNC(SSL_F_DTLS1_SEND_SERVER_CERTIFICATE), "DTLS1_SEND_SERVER_CERTIFICATE"},
104{ERR_FUNC(SSL_F_DTLS1_SEND_SERVER_CERTIFICATE), "DTLS1_SEND_SERVER_CERTIFICATE"}, 104 {ERR_FUNC(SSL_F_DTLS1_SEND_SERVER_HELLO), "DTLS1_SEND_SERVER_HELLO"},
105{ERR_FUNC(SSL_F_DTLS1_SEND_SERVER_HELLO), "DTLS1_SEND_SERVER_HELLO"}, 105 {ERR_FUNC(SSL_F_DTLS1_SEND_SERVER_KEY_EXCHANGE), "DTLS1_SEND_SERVER_KEY_EXCHANGE"},
106{ERR_FUNC(SSL_F_DTLS1_SEND_SERVER_KEY_EXCHANGE), "DTLS1_SEND_SERVER_KEY_EXCHANGE"}, 106 {ERR_FUNC(SSL_F_DTLS1_WRITE_APP_DATA_BYTES), "DTLS1_WRITE_APP_DATA_BYTES"},
107{ERR_FUNC(SSL_F_DTLS1_WRITE_APP_DATA_BYTES), "DTLS1_WRITE_APP_DATA_BYTES"}, 107 {ERR_FUNC(SSL_F_GET_CLIENT_FINISHED), "GET_CLIENT_FINISHED"},
108{ERR_FUNC(SSL_F_GET_CLIENT_FINISHED), "GET_CLIENT_FINISHED"}, 108 {ERR_FUNC(SSL_F_GET_CLIENT_HELLO), "GET_CLIENT_HELLO"},
109{ERR_FUNC(SSL_F_GET_CLIENT_HELLO), "GET_CLIENT_HELLO"}, 109 {ERR_FUNC(SSL_F_GET_CLIENT_MASTER_KEY), "GET_CLIENT_MASTER_KEY"},
110{ERR_FUNC(SSL_F_GET_CLIENT_MASTER_KEY), "GET_CLIENT_MASTER_KEY"}, 110 {ERR_FUNC(SSL_F_GET_SERVER_FINISHED), "GET_SERVER_FINISHED"},
111{ERR_FUNC(SSL_F_GET_SERVER_FINISHED), "GET_SERVER_FINISHED"}, 111 {ERR_FUNC(SSL_F_GET_SERVER_HELLO), "GET_SERVER_HELLO"},
112{ERR_FUNC(SSL_F_GET_SERVER_HELLO), "GET_SERVER_HELLO"}, 112 {ERR_FUNC(SSL_F_GET_SERVER_VERIFY), "GET_SERVER_VERIFY"},
113{ERR_FUNC(SSL_F_GET_SERVER_VERIFY), "GET_SERVER_VERIFY"}, 113 {ERR_FUNC(SSL_F_I2D_SSL_SESSION), "i2d_SSL_SESSION"},
114{ERR_FUNC(SSL_F_I2D_SSL_SESSION), "i2d_SSL_SESSION"}, 114 {ERR_FUNC(SSL_F_READ_N), "READ_N"},
115{ERR_FUNC(SSL_F_READ_N), "READ_N"}, 115 {ERR_FUNC(SSL_F_REQUEST_CERTIFICATE), "REQUEST_CERTIFICATE"},
116{ERR_FUNC(SSL_F_REQUEST_CERTIFICATE), "REQUEST_CERTIFICATE"}, 116 {ERR_FUNC(SSL_F_SERVER_FINISH), "SERVER_FINISH"},
117{ERR_FUNC(SSL_F_SERVER_FINISH), "SERVER_FINISH"}, 117 {ERR_FUNC(SSL_F_SERVER_HELLO), "SERVER_HELLO"},
118{ERR_FUNC(SSL_F_SERVER_HELLO), "SERVER_HELLO"}, 118 {ERR_FUNC(SSL_F_SERVER_VERIFY), "SERVER_VERIFY"},
119{ERR_FUNC(SSL_F_SERVER_VERIFY), "SERVER_VERIFY"}, 119 {ERR_FUNC(SSL_F_SSL23_ACCEPT), "SSL23_ACCEPT"},
120{ERR_FUNC(SSL_F_SSL23_ACCEPT), "SSL23_ACCEPT"}, 120 {ERR_FUNC(SSL_F_SSL23_CLIENT_HELLO), "SSL23_CLIENT_HELLO"},
121{ERR_FUNC(SSL_F_SSL23_CLIENT_HELLO), "SSL23_CLIENT_HELLO"}, 121 {ERR_FUNC(SSL_F_SSL23_CONNECT), "SSL23_CONNECT"},
122{ERR_FUNC(SSL_F_SSL23_CONNECT), "SSL23_CONNECT"}, 122 {ERR_FUNC(SSL_F_SSL23_GET_CLIENT_HELLO), "SSL23_GET_CLIENT_HELLO"},
123{ERR_FUNC(SSL_F_SSL23_GET_CLIENT_HELLO), "SSL23_GET_CLIENT_HELLO"}, 123 {ERR_FUNC(SSL_F_SSL23_GET_SERVER_HELLO), "SSL23_GET_SERVER_HELLO"},
124{ERR_FUNC(SSL_F_SSL23_GET_SERVER_HELLO), "SSL23_GET_SERVER_HELLO"}, 124 {ERR_FUNC(SSL_F_SSL23_PEEK), "SSL23_PEEK"},
125{ERR_FUNC(SSL_F_SSL23_PEEK), "SSL23_PEEK"}, 125 {ERR_FUNC(SSL_F_SSL23_READ), "SSL23_READ"},
126{ERR_FUNC(SSL_F_SSL23_READ), "SSL23_READ"}, 126 {ERR_FUNC(SSL_F_SSL23_WRITE), "SSL23_WRITE"},
127{ERR_FUNC(SSL_F_SSL23_WRITE), "SSL23_WRITE"}, 127 {ERR_FUNC(SSL_F_SSL2_ACCEPT), "SSL2_ACCEPT"},
128{ERR_FUNC(SSL_F_SSL2_ACCEPT), "SSL2_ACCEPT"}, 128 {ERR_FUNC(SSL_F_SSL2_CONNECT), "SSL2_CONNECT"},
129{ERR_FUNC(SSL_F_SSL2_CONNECT), "SSL2_CONNECT"}, 129 {ERR_FUNC(SSL_F_SSL2_ENC_INIT), "SSL2_ENC_INIT"},
130{ERR_FUNC(SSL_F_SSL2_ENC_INIT), "SSL2_ENC_INIT"}, 130 {ERR_FUNC(SSL_F_SSL2_GENERATE_KEY_MATERIAL), "SSL2_GENERATE_KEY_MATERIAL"},
131{ERR_FUNC(SSL_F_SSL2_GENERATE_KEY_MATERIAL), "SSL2_GENERATE_KEY_MATERIAL"}, 131 {ERR_FUNC(SSL_F_SSL2_PEEK), "SSL2_PEEK"},
132{ERR_FUNC(SSL_F_SSL2_PEEK), "SSL2_PEEK"}, 132 {ERR_FUNC(SSL_F_SSL2_READ), "SSL2_READ"},
133{ERR_FUNC(SSL_F_SSL2_READ), "SSL2_READ"}, 133 {ERR_FUNC(SSL_F_SSL2_READ_INTERNAL), "SSL2_READ_INTERNAL"},
134{ERR_FUNC(SSL_F_SSL2_READ_INTERNAL), "SSL2_READ_INTERNAL"}, 134 {ERR_FUNC(SSL_F_SSL2_SET_CERTIFICATE), "SSL2_SET_CERTIFICATE"},
135{ERR_FUNC(SSL_F_SSL2_SET_CERTIFICATE), "SSL2_SET_CERTIFICATE"}, 135 {ERR_FUNC(SSL_F_SSL2_WRITE), "SSL2_WRITE"},
136{ERR_FUNC(SSL_F_SSL2_WRITE), "SSL2_WRITE"}, 136 {ERR_FUNC(SSL_F_SSL3_ACCEPT), "SSL3_ACCEPT"},
137{ERR_FUNC(SSL_F_SSL3_ACCEPT), "SSL3_ACCEPT"}, 137 {ERR_FUNC(SSL_F_SSL3_ADD_CERT_TO_BUF), "SSL3_ADD_CERT_TO_BUF"},
138{ERR_FUNC(SSL_F_SSL3_ADD_CERT_TO_BUF), "SSL3_ADD_CERT_TO_BUF"}, 138 {ERR_FUNC(SSL_F_SSL3_CALLBACK_CTRL), "SSL3_CALLBACK_CTRL"},
139{ERR_FUNC(SSL_F_SSL3_CALLBACK_CTRL), "SSL3_CALLBACK_CTRL"}, 139 {ERR_FUNC(SSL_F_SSL3_CHANGE_CIPHER_STATE), "SSL3_CHANGE_CIPHER_STATE"},
140{ERR_FUNC(SSL_F_SSL3_CHANGE_CIPHER_STATE), "SSL3_CHANGE_CIPHER_STATE"}, 140 {ERR_FUNC(SSL_F_SSL3_CHECK_CERT_AND_ALGORITHM), "SSL3_CHECK_CERT_AND_ALGORITHM"},
141{ERR_FUNC(SSL_F_SSL3_CHECK_CERT_AND_ALGORITHM), "SSL3_CHECK_CERT_AND_ALGORITHM"}, 141 {ERR_FUNC(SSL_F_SSL3_CHECK_CLIENT_HELLO), "SSL3_CHECK_CLIENT_HELLO"},
142{ERR_FUNC(SSL_F_SSL3_CHECK_CLIENT_HELLO), "SSL3_CHECK_CLIENT_HELLO"}, 142 {ERR_FUNC(SSL_F_SSL3_CLIENT_HELLO), "SSL3_CLIENT_HELLO"},
143{ERR_FUNC(SSL_F_SSL3_CLIENT_HELLO), "SSL3_CLIENT_HELLO"}, 143 {ERR_FUNC(SSL_F_SSL3_CONNECT), "SSL3_CONNECT"},
144{ERR_FUNC(SSL_F_SSL3_CONNECT), "SSL3_CONNECT"}, 144 {ERR_FUNC(SSL_F_SSL3_CTRL), "SSL3_CTRL"},
145{ERR_FUNC(SSL_F_SSL3_CTRL), "SSL3_CTRL"}, 145 {ERR_FUNC(SSL_F_SSL3_CTX_CTRL), "SSL3_CTX_CTRL"},
146{ERR_FUNC(SSL_F_SSL3_CTX_CTRL), "SSL3_CTX_CTRL"}, 146 {ERR_FUNC(SSL_F_SSL3_DIGEST_CACHED_RECORDS), "SSL3_DIGEST_CACHED_RECORDS"},
147{ERR_FUNC(SSL_F_SSL3_DIGEST_CACHED_RECORDS), "SSL3_DIGEST_CACHED_RECORDS"}, 147 {ERR_FUNC(SSL_F_SSL3_DO_CHANGE_CIPHER_SPEC), "SSL3_DO_CHANGE_CIPHER_SPEC"},
148{ERR_FUNC(SSL_F_SSL3_DO_CHANGE_CIPHER_SPEC), "SSL3_DO_CHANGE_CIPHER_SPEC"}, 148 {ERR_FUNC(SSL_F_SSL3_ENC), "SSL3_ENC"},
149{ERR_FUNC(SSL_F_SSL3_ENC), "SSL3_ENC"}, 149 {ERR_FUNC(SSL_F_SSL3_GENERATE_KEY_BLOCK), "SSL3_GENERATE_KEY_BLOCK"},
150{ERR_FUNC(SSL_F_SSL3_GENERATE_KEY_BLOCK), "SSL3_GENERATE_KEY_BLOCK"}, 150 {ERR_FUNC(SSL_F_SSL3_GET_CERTIFICATE_REQUEST), "SSL3_GET_CERTIFICATE_REQUEST"},
151{ERR_FUNC(SSL_F_SSL3_GET_CERTIFICATE_REQUEST), "SSL3_GET_CERTIFICATE_REQUEST"}, 151 {ERR_FUNC(SSL_F_SSL3_GET_CERT_STATUS), "SSL3_GET_CERT_STATUS"},
152{ERR_FUNC(SSL_F_SSL3_GET_CERT_STATUS), "SSL3_GET_CERT_STATUS"}, 152 {ERR_FUNC(SSL_F_SSL3_GET_CERT_VERIFY), "SSL3_GET_CERT_VERIFY"},
153{ERR_FUNC(SSL_F_SSL3_GET_CERT_VERIFY), "SSL3_GET_CERT_VERIFY"}, 153 {ERR_FUNC(SSL_F_SSL3_GET_CLIENT_CERTIFICATE), "SSL3_GET_CLIENT_CERTIFICATE"},
154{ERR_FUNC(SSL_F_SSL3_GET_CLIENT_CERTIFICATE), "SSL3_GET_CLIENT_CERTIFICATE"}, 154 {ERR_FUNC(SSL_F_SSL3_GET_CLIENT_HELLO), "SSL3_GET_CLIENT_HELLO"},
155{ERR_FUNC(SSL_F_SSL3_GET_CLIENT_HELLO), "SSL3_GET_CLIENT_HELLO"}, 155 {ERR_FUNC(SSL_F_SSL3_GET_CLIENT_KEY_EXCHANGE), "SSL3_GET_CLIENT_KEY_EXCHANGE"},
156{ERR_FUNC(SSL_F_SSL3_GET_CLIENT_KEY_EXCHANGE), "SSL3_GET_CLIENT_KEY_EXCHANGE"}, 156 {ERR_FUNC(SSL_F_SSL3_GET_FINISHED), "SSL3_GET_FINISHED"},
157{ERR_FUNC(SSL_F_SSL3_GET_FINISHED), "SSL3_GET_FINISHED"}, 157 {ERR_FUNC(SSL_F_SSL3_GET_KEY_EXCHANGE), "SSL3_GET_KEY_EXCHANGE"},
158{ERR_FUNC(SSL_F_SSL3_GET_KEY_EXCHANGE), "SSL3_GET_KEY_EXCHANGE"}, 158 {ERR_FUNC(SSL_F_SSL3_GET_MESSAGE), "SSL3_GET_MESSAGE"},
159{ERR_FUNC(SSL_F_SSL3_GET_MESSAGE), "SSL3_GET_MESSAGE"}, 159 {ERR_FUNC(SSL_F_SSL3_GET_NEW_SESSION_TICKET), "SSL3_GET_NEW_SESSION_TICKET"},
160{ERR_FUNC(SSL_F_SSL3_GET_NEW_SESSION_TICKET), "SSL3_GET_NEW_SESSION_TICKET"}, 160 {ERR_FUNC(SSL_F_SSL3_GET_NEXT_PROTO), "SSL3_GET_NEXT_PROTO"},
161{ERR_FUNC(SSL_F_SSL3_GET_NEXT_PROTO), "SSL3_GET_NEXT_PROTO"}, 161 {ERR_FUNC(SSL_F_SSL3_GET_RECORD), "SSL3_GET_RECORD"},
162{ERR_FUNC(SSL_F_SSL3_GET_RECORD), "SSL3_GET_RECORD"}, 162 {ERR_FUNC(SSL_F_SSL3_GET_SERVER_CERTIFICATE), "SSL3_GET_SERVER_CERTIFICATE"},
163{ERR_FUNC(SSL_F_SSL3_GET_SERVER_CERTIFICATE), "SSL3_GET_SERVER_CERTIFICATE"}, 163 {ERR_FUNC(SSL_F_SSL3_GET_SERVER_DONE), "SSL3_GET_SERVER_DONE"},
164{ERR_FUNC(SSL_F_SSL3_GET_SERVER_DONE), "SSL3_GET_SERVER_DONE"}, 164 {ERR_FUNC(SSL_F_SSL3_GET_SERVER_HELLO), "SSL3_GET_SERVER_HELLO"},
165{ERR_FUNC(SSL_F_SSL3_GET_SERVER_HELLO), "SSL3_GET_SERVER_HELLO"}, 165 {ERR_FUNC(SSL_F_SSL3_HANDSHAKE_MAC), "ssl3_handshake_mac"},
166{ERR_FUNC(SSL_F_SSL3_HANDSHAKE_MAC), "ssl3_handshake_mac"}, 166 {ERR_FUNC(SSL_F_SSL3_NEW_SESSION_TICKET), "SSL3_NEW_SESSION_TICKET"},
167{ERR_FUNC(SSL_F_SSL3_NEW_SESSION_TICKET), "SSL3_NEW_SESSION_TICKET"}, 167 {ERR_FUNC(SSL_F_SSL3_OUTPUT_CERT_CHAIN), "SSL3_OUTPUT_CERT_CHAIN"},
168{ERR_FUNC(SSL_F_SSL3_OUTPUT_CERT_CHAIN), "SSL3_OUTPUT_CERT_CHAIN"}, 168 {ERR_FUNC(SSL_F_SSL3_PEEK), "SSL3_PEEK"},
169{ERR_FUNC(SSL_F_SSL3_PEEK), "SSL3_PEEK"}, 169 {ERR_FUNC(SSL_F_SSL3_READ_BYTES), "SSL3_READ_BYTES"},
170{ERR_FUNC(SSL_F_SSL3_READ_BYTES), "SSL3_READ_BYTES"}, 170 {ERR_FUNC(SSL_F_SSL3_READ_N), "SSL3_READ_N"},
171{ERR_FUNC(SSL_F_SSL3_READ_N), "SSL3_READ_N"}, 171 {ERR_FUNC(SSL_F_SSL3_SEND_CERTIFICATE_REQUEST), "SSL3_SEND_CERTIFICATE_REQUEST"},
172{ERR_FUNC(SSL_F_SSL3_SEND_CERTIFICATE_REQUEST), "SSL3_SEND_CERTIFICATE_REQUEST"}, 172 {ERR_FUNC(SSL_F_SSL3_SEND_CLIENT_CERTIFICATE), "SSL3_SEND_CLIENT_CERTIFICATE"},
173{ERR_FUNC(SSL_F_SSL3_SEND_CLIENT_CERTIFICATE), "SSL3_SEND_CLIENT_CERTIFICATE"}, 173 {ERR_FUNC(SSL_F_SSL3_SEND_CLIENT_KEY_EXCHANGE), "SSL3_SEND_CLIENT_KEY_EXCHANGE"},
174{ERR_FUNC(SSL_F_SSL3_SEND_CLIENT_KEY_EXCHANGE), "SSL3_SEND_CLIENT_KEY_EXCHANGE"}, 174 {ERR_FUNC(SSL_F_SSL3_SEND_CLIENT_VERIFY), "SSL3_SEND_CLIENT_VERIFY"},
175{ERR_FUNC(SSL_F_SSL3_SEND_CLIENT_VERIFY), "SSL3_SEND_CLIENT_VERIFY"}, 175 {ERR_FUNC(SSL_F_SSL3_SEND_SERVER_CERTIFICATE), "SSL3_SEND_SERVER_CERTIFICATE"},
176{ERR_FUNC(SSL_F_SSL3_SEND_SERVER_CERTIFICATE), "SSL3_SEND_SERVER_CERTIFICATE"}, 176 {ERR_FUNC(SSL_F_SSL3_SEND_SERVER_HELLO), "SSL3_SEND_SERVER_HELLO"},
177{ERR_FUNC(SSL_F_SSL3_SEND_SERVER_HELLO), "SSL3_SEND_SERVER_HELLO"}, 177 {ERR_FUNC(SSL_F_SSL3_SEND_SERVER_KEY_EXCHANGE), "SSL3_SEND_SERVER_KEY_EXCHANGE"},
178{ERR_FUNC(SSL_F_SSL3_SEND_SERVER_KEY_EXCHANGE), "SSL3_SEND_SERVER_KEY_EXCHANGE"}, 178 {ERR_FUNC(SSL_F_SSL3_SETUP_KEY_BLOCK), "SSL3_SETUP_KEY_BLOCK"},
179{ERR_FUNC(SSL_F_SSL3_SETUP_KEY_BLOCK), "SSL3_SETUP_KEY_BLOCK"}, 179 {ERR_FUNC(SSL_F_SSL3_SETUP_READ_BUFFER), "SSL3_SETUP_READ_BUFFER"},
180{ERR_FUNC(SSL_F_SSL3_SETUP_READ_BUFFER), "SSL3_SETUP_READ_BUFFER"}, 180 {ERR_FUNC(SSL_F_SSL3_SETUP_WRITE_BUFFER), "SSL3_SETUP_WRITE_BUFFER"},
181{ERR_FUNC(SSL_F_SSL3_SETUP_WRITE_BUFFER), "SSL3_SETUP_WRITE_BUFFER"}, 181 {ERR_FUNC(SSL_F_SSL3_WRITE_BYTES), "SSL3_WRITE_BYTES"},
182{ERR_FUNC(SSL_F_SSL3_WRITE_BYTES), "SSL3_WRITE_BYTES"}, 182 {ERR_FUNC(SSL_F_SSL3_WRITE_PENDING), "SSL3_WRITE_PENDING"},
183{ERR_FUNC(SSL_F_SSL3_WRITE_PENDING), "SSL3_WRITE_PENDING"}, 183 {ERR_FUNC(SSL_F_SSL_ADD_CLIENTHELLO_RENEGOTIATE_EXT), "SSL_ADD_CLIENTHELLO_RENEGOTIATE_EXT"},
184{ERR_FUNC(SSL_F_SSL_ADD_CLIENTHELLO_RENEGOTIATE_EXT), "SSL_ADD_CLIENTHELLO_RENEGOTIATE_EXT"}, 184 {ERR_FUNC(SSL_F_SSL_ADD_CLIENTHELLO_TLSEXT), "SSL_ADD_CLIENTHELLO_TLSEXT"},
185{ERR_FUNC(SSL_F_SSL_ADD_CLIENTHELLO_TLSEXT), "SSL_ADD_CLIENTHELLO_TLSEXT"}, 185 {ERR_FUNC(SSL_F_SSL_ADD_CLIENTHELLO_USE_SRTP_EXT), "SSL_ADD_CLIENTHELLO_USE_SRTP_EXT"},
186{ERR_FUNC(SSL_F_SSL_ADD_CLIENTHELLO_USE_SRTP_EXT), "SSL_ADD_CLIENTHELLO_USE_SRTP_EXT"}, 186 {ERR_FUNC(SSL_F_SSL_ADD_DIR_CERT_SUBJECTS_TO_STACK), "SSL_add_dir_cert_subjects_to_stack"},
187{ERR_FUNC(SSL_F_SSL_ADD_DIR_CERT_SUBJECTS_TO_STACK), "SSL_add_dir_cert_subjects_to_stack"}, 187 {ERR_FUNC(SSL_F_SSL_ADD_FILE_CERT_SUBJECTS_TO_STACK), "SSL_add_file_cert_subjects_to_stack"},
188{ERR_FUNC(SSL_F_SSL_ADD_FILE_CERT_SUBJECTS_TO_STACK), "SSL_add_file_cert_subjects_to_stack"}, 188 {ERR_FUNC(SSL_F_SSL_ADD_SERVERHELLO_RENEGOTIATE_EXT), "SSL_ADD_SERVERHELLO_RENEGOTIATE_EXT"},
189{ERR_FUNC(SSL_F_SSL_ADD_SERVERHELLO_RENEGOTIATE_EXT), "SSL_ADD_SERVERHELLO_RENEGOTIATE_EXT"}, 189 {ERR_FUNC(SSL_F_SSL_ADD_SERVERHELLO_TLSEXT), "SSL_ADD_SERVERHELLO_TLSEXT"},
190{ERR_FUNC(SSL_F_SSL_ADD_SERVERHELLO_TLSEXT), "SSL_ADD_SERVERHELLO_TLSEXT"}, 190 {ERR_FUNC(SSL_F_SSL_ADD_SERVERHELLO_USE_SRTP_EXT), "SSL_ADD_SERVERHELLO_USE_SRTP_EXT"},
191{ERR_FUNC(SSL_F_SSL_ADD_SERVERHELLO_USE_SRTP_EXT), "SSL_ADD_SERVERHELLO_USE_SRTP_EXT"}, 191 {ERR_FUNC(SSL_F_SSL_BAD_METHOD), "SSL_BAD_METHOD"},
192{ERR_FUNC(SSL_F_SSL_BAD_METHOD), "SSL_BAD_METHOD"}, 192 {ERR_FUNC(SSL_F_SSL_BYTES_TO_CIPHER_LIST), "SSL_BYTES_TO_CIPHER_LIST"},
193{ERR_FUNC(SSL_F_SSL_BYTES_TO_CIPHER_LIST), "SSL_BYTES_TO_CIPHER_LIST"}, 193 {ERR_FUNC(SSL_F_SSL_CERT_DUP), "SSL_CERT_DUP"},
194{ERR_FUNC(SSL_F_SSL_CERT_DUP), "SSL_CERT_DUP"}, 194 {ERR_FUNC(SSL_F_SSL_CERT_INST), "SSL_CERT_INST"},
195{ERR_FUNC(SSL_F_SSL_CERT_INST), "SSL_CERT_INST"}, 195 {ERR_FUNC(SSL_F_SSL_CERT_INSTANTIATE), "SSL_CERT_INSTANTIATE"},
196{ERR_FUNC(SSL_F_SSL_CERT_INSTANTIATE), "SSL_CERT_INSTANTIATE"}, 196 {ERR_FUNC(SSL_F_SSL_CERT_NEW), "SSL_CERT_NEW"},
197{ERR_FUNC(SSL_F_SSL_CERT_NEW), "SSL_CERT_NEW"}, 197 {ERR_FUNC(SSL_F_SSL_CHECK_PRIVATE_KEY), "SSL_check_private_key"},
198{ERR_FUNC(SSL_F_SSL_CHECK_PRIVATE_KEY), "SSL_check_private_key"}, 198 {ERR_FUNC(SSL_F_SSL_CHECK_SERVERHELLO_TLSEXT), "SSL_CHECK_SERVERHELLO_TLSEXT"},
199{ERR_FUNC(SSL_F_SSL_CHECK_SERVERHELLO_TLSEXT), "SSL_CHECK_SERVERHELLO_TLSEXT"}, 199 {ERR_FUNC(SSL_F_SSL_CHECK_SRVR_ECC_CERT_AND_ALG), "SSL_CHECK_SRVR_ECC_CERT_AND_ALG"},
200{ERR_FUNC(SSL_F_SSL_CHECK_SRVR_ECC_CERT_AND_ALG), "SSL_CHECK_SRVR_ECC_CERT_AND_ALG"}, 200 {ERR_FUNC(SSL_F_SSL_CIPHER_PROCESS_RULESTR), "SSL_CIPHER_PROCESS_RULESTR"},
201{ERR_FUNC(SSL_F_SSL_CIPHER_PROCESS_RULESTR), "SSL_CIPHER_PROCESS_RULESTR"}, 201 {ERR_FUNC(SSL_F_SSL_CIPHER_STRENGTH_SORT), "SSL_CIPHER_STRENGTH_SORT"},
202{ERR_FUNC(SSL_F_SSL_CIPHER_STRENGTH_SORT), "SSL_CIPHER_STRENGTH_SORT"}, 202 {ERR_FUNC(SSL_F_SSL_CLEAR), "SSL_clear"},
203{ERR_FUNC(SSL_F_SSL_CLEAR), "SSL_clear"}, 203 {ERR_FUNC(SSL_F_SSL_COMP_ADD_COMPRESSION_METHOD), "SSL_COMP_add_compression_method"},
204{ERR_FUNC(SSL_F_SSL_COMP_ADD_COMPRESSION_METHOD), "SSL_COMP_add_compression_method"}, 204 {ERR_FUNC(SSL_F_SSL_CREATE_CIPHER_LIST), "SSL_CREATE_CIPHER_LIST"},
205{ERR_FUNC(SSL_F_SSL_CREATE_CIPHER_LIST), "SSL_CREATE_CIPHER_LIST"}, 205 {ERR_FUNC(SSL_F_SSL_CTRL), "SSL_ctrl"},
206{ERR_FUNC(SSL_F_SSL_CTRL), "SSL_ctrl"}, 206 {ERR_FUNC(SSL_F_SSL_CTX_CHECK_PRIVATE_KEY), "SSL_CTX_check_private_key"},
207{ERR_FUNC(SSL_F_SSL_CTX_CHECK_PRIVATE_KEY), "SSL_CTX_check_private_key"}, 207 {ERR_FUNC(SSL_F_SSL_CTX_MAKE_PROFILES), "SSL_CTX_MAKE_PROFILES"},
208{ERR_FUNC(SSL_F_SSL_CTX_MAKE_PROFILES), "SSL_CTX_MAKE_PROFILES"}, 208 {ERR_FUNC(SSL_F_SSL_CTX_NEW), "SSL_CTX_new"},
209{ERR_FUNC(SSL_F_SSL_CTX_NEW), "SSL_CTX_new"}, 209 {ERR_FUNC(SSL_F_SSL_CTX_SET_CIPHER_LIST), "SSL_CTX_set_cipher_list"},
210{ERR_FUNC(SSL_F_SSL_CTX_SET_CIPHER_LIST), "SSL_CTX_set_cipher_list"}, 210 {ERR_FUNC(SSL_F_SSL_CTX_SET_CLIENT_CERT_ENGINE), "SSL_CTX_set_client_cert_engine"},
211{ERR_FUNC(SSL_F_SSL_CTX_SET_CLIENT_CERT_ENGINE), "SSL_CTX_set_client_cert_engine"}, 211 {ERR_FUNC(SSL_F_SSL_CTX_SET_PURPOSE), "SSL_CTX_set_purpose"},
212{ERR_FUNC(SSL_F_SSL_CTX_SET_PURPOSE), "SSL_CTX_set_purpose"}, 212 {ERR_FUNC(SSL_F_SSL_CTX_SET_SESSION_ID_CONTEXT), "SSL_CTX_set_session_id_context"},
213{ERR_FUNC(SSL_F_SSL_CTX_SET_SESSION_ID_CONTEXT), "SSL_CTX_set_session_id_context"}, 213 {ERR_FUNC(SSL_F_SSL_CTX_SET_SSL_VERSION), "SSL_CTX_set_ssl_version"},
214{ERR_FUNC(SSL_F_SSL_CTX_SET_SSL_VERSION), "SSL_CTX_set_ssl_version"}, 214 {ERR_FUNC(SSL_F_SSL_CTX_SET_TRUST), "SSL_CTX_set_trust"},
215{ERR_FUNC(SSL_F_SSL_CTX_SET_TRUST), "SSL_CTX_set_trust"}, 215 {ERR_FUNC(SSL_F_SSL_CTX_USE_CERTIFICATE), "SSL_CTX_use_certificate"},
216{ERR_FUNC(SSL_F_SSL_CTX_USE_CERTIFICATE), "SSL_CTX_use_certificate"}, 216 {ERR_FUNC(SSL_F_SSL_CTX_USE_CERTIFICATE_ASN1), "SSL_CTX_use_certificate_ASN1"},
217{ERR_FUNC(SSL_F_SSL_CTX_USE_CERTIFICATE_ASN1), "SSL_CTX_use_certificate_ASN1"}, 217 {ERR_FUNC(SSL_F_SSL_CTX_USE_CERTIFICATE_CHAIN_FILE), "SSL_CTX_use_certificate_chain_file"},
218{ERR_FUNC(SSL_F_SSL_CTX_USE_CERTIFICATE_CHAIN_FILE), "SSL_CTX_use_certificate_chain_file"}, 218 {ERR_FUNC(SSL_F_SSL_CTX_USE_CERTIFICATE_FILE), "SSL_CTX_use_certificate_file"},
219{ERR_FUNC(SSL_F_SSL_CTX_USE_CERTIFICATE_FILE), "SSL_CTX_use_certificate_file"}, 219 {ERR_FUNC(SSL_F_SSL_CTX_USE_PRIVATEKEY), "SSL_CTX_use_PrivateKey"},
220{ERR_FUNC(SSL_F_SSL_CTX_USE_PRIVATEKEY), "SSL_CTX_use_PrivateKey"}, 220 {ERR_FUNC(SSL_F_SSL_CTX_USE_PRIVATEKEY_ASN1), "SSL_CTX_use_PrivateKey_ASN1"},
221{ERR_FUNC(SSL_F_SSL_CTX_USE_PRIVATEKEY_ASN1), "SSL_CTX_use_PrivateKey_ASN1"}, 221 {ERR_FUNC(SSL_F_SSL_CTX_USE_PRIVATEKEY_FILE), "SSL_CTX_use_PrivateKey_file"},
222{ERR_FUNC(SSL_F_SSL_CTX_USE_PRIVATEKEY_FILE), "SSL_CTX_use_PrivateKey_file"}, 222 {ERR_FUNC(SSL_F_SSL_CTX_USE_PSK_IDENTITY_HINT), "SSL_CTX_use_psk_identity_hint"},
223{ERR_FUNC(SSL_F_SSL_CTX_USE_PSK_IDENTITY_HINT), "SSL_CTX_use_psk_identity_hint"}, 223 {ERR_FUNC(SSL_F_SSL_CTX_USE_RSAPRIVATEKEY), "SSL_CTX_use_RSAPrivateKey"},
224{ERR_FUNC(SSL_F_SSL_CTX_USE_RSAPRIVATEKEY), "SSL_CTX_use_RSAPrivateKey"}, 224 {ERR_FUNC(SSL_F_SSL_CTX_USE_RSAPRIVATEKEY_ASN1), "SSL_CTX_use_RSAPrivateKey_ASN1"},
225{ERR_FUNC(SSL_F_SSL_CTX_USE_RSAPRIVATEKEY_ASN1), "SSL_CTX_use_RSAPrivateKey_ASN1"}, 225 {ERR_FUNC(SSL_F_SSL_CTX_USE_RSAPRIVATEKEY_FILE), "SSL_CTX_use_RSAPrivateKey_file"},
226{ERR_FUNC(SSL_F_SSL_CTX_USE_RSAPRIVATEKEY_FILE), "SSL_CTX_use_RSAPrivateKey_file"}, 226 {ERR_FUNC(SSL_F_SSL_DO_HANDSHAKE), "SSL_do_handshake"},
227{ERR_FUNC(SSL_F_SSL_DO_HANDSHAKE), "SSL_do_handshake"}, 227 {ERR_FUNC(SSL_F_SSL_GET_NEW_SESSION), "SSL_GET_NEW_SESSION"},
228{ERR_FUNC(SSL_F_SSL_GET_NEW_SESSION), "SSL_GET_NEW_SESSION"}, 228 {ERR_FUNC(SSL_F_SSL_GET_PREV_SESSION), "SSL_GET_PREV_SESSION"},
229{ERR_FUNC(SSL_F_SSL_GET_PREV_SESSION), "SSL_GET_PREV_SESSION"}, 229 {ERR_FUNC(SSL_F_SSL_GET_SERVER_SEND_CERT), "SSL_GET_SERVER_SEND_CERT"},
230{ERR_FUNC(SSL_F_SSL_GET_SERVER_SEND_CERT), "SSL_GET_SERVER_SEND_CERT"}, 230 {ERR_FUNC(SSL_F_SSL_GET_SERVER_SEND_PKEY), "SSL_GET_SERVER_SEND_PKEY"},
231{ERR_FUNC(SSL_F_SSL_GET_SERVER_SEND_PKEY), "SSL_GET_SERVER_SEND_PKEY"}, 231 {ERR_FUNC(SSL_F_SSL_GET_SIGN_PKEY), "SSL_GET_SIGN_PKEY"},
232{ERR_FUNC(SSL_F_SSL_GET_SIGN_PKEY), "SSL_GET_SIGN_PKEY"}, 232 {ERR_FUNC(SSL_F_SSL_INIT_WBIO_BUFFER), "SSL_INIT_WBIO_BUFFER"},
233{ERR_FUNC(SSL_F_SSL_INIT_WBIO_BUFFER), "SSL_INIT_WBIO_BUFFER"}, 233 {ERR_FUNC(SSL_F_SSL_LOAD_CLIENT_CA_FILE), "SSL_load_client_CA_file"},
234{ERR_FUNC(SSL_F_SSL_LOAD_CLIENT_CA_FILE), "SSL_load_client_CA_file"}, 234 {ERR_FUNC(SSL_F_SSL_NEW), "SSL_new"},
235{ERR_FUNC(SSL_F_SSL_NEW), "SSL_new"}, 235 {ERR_FUNC(SSL_F_SSL_PARSE_CLIENTHELLO_RENEGOTIATE_EXT), "SSL_PARSE_CLIENTHELLO_RENEGOTIATE_EXT"},
236{ERR_FUNC(SSL_F_SSL_PARSE_CLIENTHELLO_RENEGOTIATE_EXT), "SSL_PARSE_CLIENTHELLO_RENEGOTIATE_EXT"}, 236 {ERR_FUNC(SSL_F_SSL_PARSE_CLIENTHELLO_TLSEXT), "SSL_PARSE_CLIENTHELLO_TLSEXT"},
237{ERR_FUNC(SSL_F_SSL_PARSE_CLIENTHELLO_TLSEXT), "SSL_PARSE_CLIENTHELLO_TLSEXT"}, 237 {ERR_FUNC(SSL_F_SSL_PARSE_CLIENTHELLO_USE_SRTP_EXT), "SSL_PARSE_CLIENTHELLO_USE_SRTP_EXT"},
238{ERR_FUNC(SSL_F_SSL_PARSE_CLIENTHELLO_USE_SRTP_EXT), "SSL_PARSE_CLIENTHELLO_USE_SRTP_EXT"}, 238 {ERR_FUNC(SSL_F_SSL_PARSE_SERVERHELLO_RENEGOTIATE_EXT), "SSL_PARSE_SERVERHELLO_RENEGOTIATE_EXT"},
239{ERR_FUNC(SSL_F_SSL_PARSE_SERVERHELLO_RENEGOTIATE_EXT), "SSL_PARSE_SERVERHELLO_RENEGOTIATE_EXT"}, 239 {ERR_FUNC(SSL_F_SSL_PARSE_SERVERHELLO_TLSEXT), "SSL_PARSE_SERVERHELLO_TLSEXT"},
240{ERR_FUNC(SSL_F_SSL_PARSE_SERVERHELLO_TLSEXT), "SSL_PARSE_SERVERHELLO_TLSEXT"}, 240 {ERR_FUNC(SSL_F_SSL_PARSE_SERVERHELLO_USE_SRTP_EXT), "SSL_PARSE_SERVERHELLO_USE_SRTP_EXT"},
241{ERR_FUNC(SSL_F_SSL_PARSE_SERVERHELLO_USE_SRTP_EXT), "SSL_PARSE_SERVERHELLO_USE_SRTP_EXT"}, 241 {ERR_FUNC(SSL_F_SSL_PEEK), "SSL_peek"},
242{ERR_FUNC(SSL_F_SSL_PEEK), "SSL_peek"}, 242 {ERR_FUNC(SSL_F_SSL_PREPARE_CLIENTHELLO_TLSEXT), "SSL_PREPARE_CLIENTHELLO_TLSEXT"},
243{ERR_FUNC(SSL_F_SSL_PREPARE_CLIENTHELLO_TLSEXT), "SSL_PREPARE_CLIENTHELLO_TLSEXT"}, 243 {ERR_FUNC(SSL_F_SSL_PREPARE_SERVERHELLO_TLSEXT), "SSL_PREPARE_SERVERHELLO_TLSEXT"},
244{ERR_FUNC(SSL_F_SSL_PREPARE_SERVERHELLO_TLSEXT), "SSL_PREPARE_SERVERHELLO_TLSEXT"}, 244 {ERR_FUNC(SSL_F_SSL_READ), "SSL_read"},
245{ERR_FUNC(SSL_F_SSL_READ), "SSL_read"}, 245 {ERR_FUNC(SSL_F_SSL_RSA_PRIVATE_DECRYPT), "SSL_RSA_PRIVATE_DECRYPT"},
246{ERR_FUNC(SSL_F_SSL_RSA_PRIVATE_DECRYPT), "SSL_RSA_PRIVATE_DECRYPT"}, 246 {ERR_FUNC(SSL_F_SSL_RSA_PUBLIC_ENCRYPT), "SSL_RSA_PUBLIC_ENCRYPT"},
247{ERR_FUNC(SSL_F_SSL_RSA_PUBLIC_ENCRYPT), "SSL_RSA_PUBLIC_ENCRYPT"}, 247 {ERR_FUNC(SSL_F_SSL_SESSION_NEW), "SSL_SESSION_new"},
248{ERR_FUNC(SSL_F_SSL_SESSION_NEW), "SSL_SESSION_new"}, 248 {ERR_FUNC(SSL_F_SSL_SESSION_PRINT_FP), "SSL_SESSION_print_fp"},
249{ERR_FUNC(SSL_F_SSL_SESSION_PRINT_FP), "SSL_SESSION_print_fp"}, 249 {ERR_FUNC(SSL_F_SSL_SESSION_SET1_ID_CONTEXT), "SSL_SESSION_set1_id_context"},
250{ERR_FUNC(SSL_F_SSL_SESSION_SET1_ID_CONTEXT), "SSL_SESSION_set1_id_context"}, 250 {ERR_FUNC(SSL_F_SSL_SESS_CERT_NEW), "SSL_SESS_CERT_NEW"},
251{ERR_FUNC(SSL_F_SSL_SESS_CERT_NEW), "SSL_SESS_CERT_NEW"}, 251 {ERR_FUNC(SSL_F_SSL_SET_CERT), "SSL_SET_CERT"},
252{ERR_FUNC(SSL_F_SSL_SET_CERT), "SSL_SET_CERT"}, 252 {ERR_FUNC(SSL_F_SSL_SET_CIPHER_LIST), "SSL_set_cipher_list"},
253{ERR_FUNC(SSL_F_SSL_SET_CIPHER_LIST), "SSL_set_cipher_list"}, 253 {ERR_FUNC(SSL_F_SSL_SET_FD), "SSL_set_fd"},
254{ERR_FUNC(SSL_F_SSL_SET_FD), "SSL_set_fd"}, 254 {ERR_FUNC(SSL_F_SSL_SET_PKEY), "SSL_SET_PKEY"},
255{ERR_FUNC(SSL_F_SSL_SET_PKEY), "SSL_SET_PKEY"}, 255 {ERR_FUNC(SSL_F_SSL_SET_PURPOSE), "SSL_set_purpose"},
256{ERR_FUNC(SSL_F_SSL_SET_PURPOSE), "SSL_set_purpose"}, 256 {ERR_FUNC(SSL_F_SSL_SET_RFD), "SSL_set_rfd"},
257{ERR_FUNC(SSL_F_SSL_SET_RFD), "SSL_set_rfd"}, 257 {ERR_FUNC(SSL_F_SSL_SET_SESSION), "SSL_set_session"},
258{ERR_FUNC(SSL_F_SSL_SET_SESSION), "SSL_set_session"}, 258 {ERR_FUNC(SSL_F_SSL_SET_SESSION_ID_CONTEXT), "SSL_set_session_id_context"},
259{ERR_FUNC(SSL_F_SSL_SET_SESSION_ID_CONTEXT), "SSL_set_session_id_context"}, 259 {ERR_FUNC(SSL_F_SSL_SET_SESSION_TICKET_EXT), "SSL_set_session_ticket_ext"},
260{ERR_FUNC(SSL_F_SSL_SET_SESSION_TICKET_EXT), "SSL_set_session_ticket_ext"}, 260 {ERR_FUNC(SSL_F_SSL_SET_TRUST), "SSL_set_trust"},
261{ERR_FUNC(SSL_F_SSL_SET_TRUST), "SSL_set_trust"}, 261 {ERR_FUNC(SSL_F_SSL_SET_WFD), "SSL_set_wfd"},
262{ERR_FUNC(SSL_F_SSL_SET_WFD), "SSL_set_wfd"}, 262 {ERR_FUNC(SSL_F_SSL_SHUTDOWN), "SSL_shutdown"},
263{ERR_FUNC(SSL_F_SSL_SHUTDOWN), "SSL_shutdown"}, 263 {ERR_FUNC(SSL_F_SSL_SRP_CTX_INIT), "SSL_SRP_CTX_init"},
264{ERR_FUNC(SSL_F_SSL_SRP_CTX_INIT), "SSL_SRP_CTX_init"}, 264 {ERR_FUNC(SSL_F_SSL_UNDEFINED_CONST_FUNCTION), "SSL_UNDEFINED_CONST_FUNCTION"},
265{ERR_FUNC(SSL_F_SSL_UNDEFINED_CONST_FUNCTION), "SSL_UNDEFINED_CONST_FUNCTION"}, 265 {ERR_FUNC(SSL_F_SSL_UNDEFINED_FUNCTION), "SSL_UNDEFINED_FUNCTION"},
266{ERR_FUNC(SSL_F_SSL_UNDEFINED_FUNCTION), "SSL_UNDEFINED_FUNCTION"}, 266 {ERR_FUNC(SSL_F_SSL_UNDEFINED_VOID_FUNCTION), "SSL_UNDEFINED_VOID_FUNCTION"},
267{ERR_FUNC(SSL_F_SSL_UNDEFINED_VOID_FUNCTION), "SSL_UNDEFINED_VOID_FUNCTION"}, 267 {ERR_FUNC(SSL_F_SSL_USE_CERTIFICATE), "SSL_use_certificate"},
268{ERR_FUNC(SSL_F_SSL_USE_CERTIFICATE), "SSL_use_certificate"}, 268 {ERR_FUNC(SSL_F_SSL_USE_CERTIFICATE_ASN1), "SSL_use_certificate_ASN1"},
269{ERR_FUNC(SSL_F_SSL_USE_CERTIFICATE_ASN1), "SSL_use_certificate_ASN1"}, 269 {ERR_FUNC(SSL_F_SSL_USE_CERTIFICATE_FILE), "SSL_use_certificate_file"},
270{ERR_FUNC(SSL_F_SSL_USE_CERTIFICATE_FILE), "SSL_use_certificate_file"}, 270 {ERR_FUNC(SSL_F_SSL_USE_PRIVATEKEY), "SSL_use_PrivateKey"},
271{ERR_FUNC(SSL_F_SSL_USE_PRIVATEKEY), "SSL_use_PrivateKey"}, 271 {ERR_FUNC(SSL_F_SSL_USE_PRIVATEKEY_ASN1), "SSL_use_PrivateKey_ASN1"},
272{ERR_FUNC(SSL_F_SSL_USE_PRIVATEKEY_ASN1), "SSL_use_PrivateKey_ASN1"}, 272 {ERR_FUNC(SSL_F_SSL_USE_PRIVATEKEY_FILE), "SSL_use_PrivateKey_file"},
273{ERR_FUNC(SSL_F_SSL_USE_PRIVATEKEY_FILE), "SSL_use_PrivateKey_file"}, 273 {ERR_FUNC(SSL_F_SSL_USE_PSK_IDENTITY_HINT), "SSL_use_psk_identity_hint"},
274{ERR_FUNC(SSL_F_SSL_USE_PSK_IDENTITY_HINT), "SSL_use_psk_identity_hint"}, 274 {ERR_FUNC(SSL_F_SSL_USE_RSAPRIVATEKEY), "SSL_use_RSAPrivateKey"},
275{ERR_FUNC(SSL_F_SSL_USE_RSAPRIVATEKEY), "SSL_use_RSAPrivateKey"}, 275 {ERR_FUNC(SSL_F_SSL_USE_RSAPRIVATEKEY_ASN1), "SSL_use_RSAPrivateKey_ASN1"},
276{ERR_FUNC(SSL_F_SSL_USE_RSAPRIVATEKEY_ASN1), "SSL_use_RSAPrivateKey_ASN1"}, 276 {ERR_FUNC(SSL_F_SSL_USE_RSAPRIVATEKEY_FILE), "SSL_use_RSAPrivateKey_file"},
277{ERR_FUNC(SSL_F_SSL_USE_RSAPRIVATEKEY_FILE), "SSL_use_RSAPrivateKey_file"}, 277 {ERR_FUNC(SSL_F_SSL_VERIFY_CERT_CHAIN), "SSL_VERIFY_CERT_CHAIN"},
278{ERR_FUNC(SSL_F_SSL_VERIFY_CERT_CHAIN), "SSL_VERIFY_CERT_CHAIN"}, 278 {ERR_FUNC(SSL_F_SSL_WRITE), "SSL_write"},
279{ERR_FUNC(SSL_F_SSL_WRITE), "SSL_write"}, 279 {ERR_FUNC(SSL_F_TLS1_CERT_VERIFY_MAC), "tls1_cert_verify_mac"},
280{ERR_FUNC(SSL_F_TLS1_CERT_VERIFY_MAC), "tls1_cert_verify_mac"}, 280 {ERR_FUNC(SSL_F_TLS1_CHANGE_CIPHER_STATE), "TLS1_CHANGE_CIPHER_STATE"},
281{ERR_FUNC(SSL_F_TLS1_CHANGE_CIPHER_STATE), "TLS1_CHANGE_CIPHER_STATE"}, 281 {ERR_FUNC(SSL_F_TLS1_CHECK_SERVERHELLO_TLSEXT), "TLS1_CHECK_SERVERHELLO_TLSEXT"},
282{ERR_FUNC(SSL_F_TLS1_CHECK_SERVERHELLO_TLSEXT), "TLS1_CHECK_SERVERHELLO_TLSEXT"}, 282 {ERR_FUNC(SSL_F_TLS1_ENC), "TLS1_ENC"},
283{ERR_FUNC(SSL_F_TLS1_ENC), "TLS1_ENC"}, 283 {ERR_FUNC(SSL_F_TLS1_EXPORT_KEYING_MATERIAL), "TLS1_EXPORT_KEYING_MATERIAL"},
284{ERR_FUNC(SSL_F_TLS1_EXPORT_KEYING_MATERIAL), "TLS1_EXPORT_KEYING_MATERIAL"}, 284 {ERR_FUNC(SSL_F_TLS1_HEARTBEAT), "SSL_F_TLS1_HEARTBEAT"},
285{ERR_FUNC(SSL_F_TLS1_HEARTBEAT), "SSL_F_TLS1_HEARTBEAT"}, 285 {ERR_FUNC(SSL_F_TLS1_PREPARE_CLIENTHELLO_TLSEXT), "TLS1_PREPARE_CLIENTHELLO_TLSEXT"},
286{ERR_FUNC(SSL_F_TLS1_PREPARE_CLIENTHELLO_TLSEXT), "TLS1_PREPARE_CLIENTHELLO_TLSEXT"}, 286 {ERR_FUNC(SSL_F_TLS1_PREPARE_SERVERHELLO_TLSEXT), "TLS1_PREPARE_SERVERHELLO_TLSEXT"},
287{ERR_FUNC(SSL_F_TLS1_PREPARE_SERVERHELLO_TLSEXT), "TLS1_PREPARE_SERVERHELLO_TLSEXT"}, 287 {ERR_FUNC(SSL_F_TLS1_PRF), "tls1_prf"},
288{ERR_FUNC(SSL_F_TLS1_PRF), "tls1_prf"}, 288 {ERR_FUNC(SSL_F_TLS1_SETUP_KEY_BLOCK), "TLS1_SETUP_KEY_BLOCK"},
289{ERR_FUNC(SSL_F_TLS1_SETUP_KEY_BLOCK), "TLS1_SETUP_KEY_BLOCK"}, 289 {ERR_FUNC(SSL_F_WRITE_PENDING), "WRITE_PENDING"},
290{ERR_FUNC(SSL_F_WRITE_PENDING), "WRITE_PENDING"}, 290 {0, NULL}
291{0,NULL} 291};
292 };
293 292
294static ERR_STRING_DATA SSL_str_reasons[]= 293static ERR_STRING_DATA SSL_str_reasons[]= {
295 { 294 {ERR_REASON(SSL_R_APP_DATA_IN_HANDSHAKE) , "app data in handshake"},
296{ERR_REASON(SSL_R_APP_DATA_IN_HANDSHAKE) ,"app data in handshake"}, 295 {ERR_REASON(SSL_R_ATTEMPT_TO_REUSE_SESSION_IN_DIFFERENT_CONTEXT), "attempt to reuse session in different context"},
297{ERR_REASON(SSL_R_ATTEMPT_TO_REUSE_SESSION_IN_DIFFERENT_CONTEXT),"attempt to reuse session in different context"}, 296 {ERR_REASON(SSL_R_BAD_ALERT_RECORD) , "bad alert record"},
298{ERR_REASON(SSL_R_BAD_ALERT_RECORD) ,"bad alert record"}, 297 {ERR_REASON(SSL_R_BAD_AUTHENTICATION_TYPE), "bad authentication type"},
299{ERR_REASON(SSL_R_BAD_AUTHENTICATION_TYPE),"bad authentication type"}, 298 {ERR_REASON(SSL_R_BAD_CHANGE_CIPHER_SPEC), "bad change cipher spec"},
300{ERR_REASON(SSL_R_BAD_CHANGE_CIPHER_SPEC),"bad change cipher spec"}, 299 {ERR_REASON(SSL_R_BAD_CHECKSUM) , "bad checksum"},
301{ERR_REASON(SSL_R_BAD_CHECKSUM) ,"bad checksum"}, 300 {ERR_REASON(SSL_R_BAD_DATA_RETURNED_BY_CALLBACK), "bad data returned by callback"},
302{ERR_REASON(SSL_R_BAD_DATA_RETURNED_BY_CALLBACK),"bad data returned by callback"}, 301 {ERR_REASON(SSL_R_BAD_DECOMPRESSION) , "bad decompression"},
303{ERR_REASON(SSL_R_BAD_DECOMPRESSION) ,"bad decompression"}, 302 {ERR_REASON(SSL_R_BAD_DH_G_LENGTH) , "bad dh g length"},
304{ERR_REASON(SSL_R_BAD_DH_G_LENGTH) ,"bad dh g length"}, 303 {ERR_REASON(SSL_R_BAD_DH_PUB_KEY_LENGTH) , "bad dh pub key length"},
305{ERR_REASON(SSL_R_BAD_DH_PUB_KEY_LENGTH) ,"bad dh pub key length"}, 304 {ERR_REASON(SSL_R_BAD_DH_P_LENGTH) , "bad dh p length"},
306{ERR_REASON(SSL_R_BAD_DH_P_LENGTH) ,"bad dh p length"}, 305 {ERR_REASON(SSL_R_BAD_DIGEST_LENGTH) , "bad digest length"},
307{ERR_REASON(SSL_R_BAD_DIGEST_LENGTH) ,"bad digest length"}, 306 {ERR_REASON(SSL_R_BAD_DSA_SIGNATURE) , "bad dsa signature"},
308{ERR_REASON(SSL_R_BAD_DSA_SIGNATURE) ,"bad dsa signature"}, 307 {ERR_REASON(SSL_R_BAD_ECC_CERT) , "bad ecc cert"},
309{ERR_REASON(SSL_R_BAD_ECC_CERT) ,"bad ecc cert"}, 308 {ERR_REASON(SSL_R_BAD_ECDSA_SIGNATURE) , "bad ecdsa signature"},
310{ERR_REASON(SSL_R_BAD_ECDSA_SIGNATURE) ,"bad ecdsa signature"}, 309 {ERR_REASON(SSL_R_BAD_ECPOINT) , "bad ecpoint"},
311{ERR_REASON(SSL_R_BAD_ECPOINT) ,"bad ecpoint"}, 310 {ERR_REASON(SSL_R_BAD_HANDSHAKE_LENGTH) , "bad handshake length"},
312{ERR_REASON(SSL_R_BAD_HANDSHAKE_LENGTH) ,"bad handshake length"}, 311 {ERR_REASON(SSL_R_BAD_HELLO_REQUEST) , "bad hello request"},
313{ERR_REASON(SSL_R_BAD_HELLO_REQUEST) ,"bad hello request"}, 312 {ERR_REASON(SSL_R_BAD_LENGTH) , "bad length"},
314{ERR_REASON(SSL_R_BAD_LENGTH) ,"bad length"}, 313 {ERR_REASON(SSL_R_BAD_MAC_DECODE) , "bad mac decode"},
315{ERR_REASON(SSL_R_BAD_MAC_DECODE) ,"bad mac decode"}, 314 {ERR_REASON(SSL_R_BAD_MAC_LENGTH) , "bad mac length"},
316{ERR_REASON(SSL_R_BAD_MAC_LENGTH) ,"bad mac length"}, 315 {ERR_REASON(SSL_R_BAD_MESSAGE_TYPE) , "bad message type"},
317{ERR_REASON(SSL_R_BAD_MESSAGE_TYPE) ,"bad message type"}, 316 {ERR_REASON(SSL_R_BAD_PACKET_LENGTH) , "bad packet length"},
318{ERR_REASON(SSL_R_BAD_PACKET_LENGTH) ,"bad packet length"}, 317 {ERR_REASON(SSL_R_BAD_PROTOCOL_VERSION_NUMBER), "bad protocol version number"},
319{ERR_REASON(SSL_R_BAD_PROTOCOL_VERSION_NUMBER),"bad protocol version number"}, 318 {ERR_REASON(SSL_R_BAD_PSK_IDENTITY_HINT_LENGTH), "bad psk identity hint length"},
320{ERR_REASON(SSL_R_BAD_PSK_IDENTITY_HINT_LENGTH),"bad psk identity hint length"}, 319 {ERR_REASON(SSL_R_BAD_RESPONSE_ARGUMENT) , "bad response argument"},
321{ERR_REASON(SSL_R_BAD_RESPONSE_ARGUMENT) ,"bad response argument"}, 320 {ERR_REASON(SSL_R_BAD_RSA_DECRYPT) , "bad rsa decrypt"},
322{ERR_REASON(SSL_R_BAD_RSA_DECRYPT) ,"bad rsa decrypt"}, 321 {ERR_REASON(SSL_R_BAD_RSA_ENCRYPT) , "bad rsa encrypt"},
323{ERR_REASON(SSL_R_BAD_RSA_ENCRYPT) ,"bad rsa encrypt"}, 322 {ERR_REASON(SSL_R_BAD_RSA_E_LENGTH) , "bad rsa e length"},
324{ERR_REASON(SSL_R_BAD_RSA_E_LENGTH) ,"bad rsa e length"}, 323 {ERR_REASON(SSL_R_BAD_RSA_MODULUS_LENGTH), "bad rsa modulus length"},
325{ERR_REASON(SSL_R_BAD_RSA_MODULUS_LENGTH),"bad rsa modulus length"}, 324 {ERR_REASON(SSL_R_BAD_RSA_SIGNATURE) , "bad rsa signature"},
326{ERR_REASON(SSL_R_BAD_RSA_SIGNATURE) ,"bad rsa signature"}, 325 {ERR_REASON(SSL_R_BAD_SIGNATURE) , "bad signature"},
327{ERR_REASON(SSL_R_BAD_SIGNATURE) ,"bad signature"}, 326 {ERR_REASON(SSL_R_BAD_SRP_A_LENGTH) , "bad srp a length"},
328{ERR_REASON(SSL_R_BAD_SRP_A_LENGTH) ,"bad srp a length"}, 327 {ERR_REASON(SSL_R_BAD_SRP_B_LENGTH) , "bad srp b length"},
329{ERR_REASON(SSL_R_BAD_SRP_B_LENGTH) ,"bad srp b length"}, 328 {ERR_REASON(SSL_R_BAD_SRP_G_LENGTH) , "bad srp g length"},
330{ERR_REASON(SSL_R_BAD_SRP_G_LENGTH) ,"bad srp g length"}, 329 {ERR_REASON(SSL_R_BAD_SRP_N_LENGTH) , "bad srp n length"},
331{ERR_REASON(SSL_R_BAD_SRP_N_LENGTH) ,"bad srp n length"}, 330 {ERR_REASON(SSL_R_BAD_SRP_S_LENGTH) , "bad srp s length"},
332{ERR_REASON(SSL_R_BAD_SRP_S_LENGTH) ,"bad srp s length"}, 331 {ERR_REASON(SSL_R_BAD_SRTP_MKI_VALUE) , "bad srtp mki value"},
333{ERR_REASON(SSL_R_BAD_SRTP_MKI_VALUE) ,"bad srtp mki value"}, 332 {ERR_REASON(SSL_R_BAD_SRTP_PROTECTION_PROFILE_LIST), "bad srtp protection profile list"},
334{ERR_REASON(SSL_R_BAD_SRTP_PROTECTION_PROFILE_LIST),"bad srtp protection profile list"}, 333 {ERR_REASON(SSL_R_BAD_SSL_FILETYPE) , "bad ssl filetype"},
335{ERR_REASON(SSL_R_BAD_SSL_FILETYPE) ,"bad ssl filetype"}, 334 {ERR_REASON(SSL_R_BAD_SSL_SESSION_ID_LENGTH), "bad ssl session id length"},
336{ERR_REASON(SSL_R_BAD_SSL_SESSION_ID_LENGTH),"bad ssl session id length"}, 335 {ERR_REASON(SSL_R_BAD_STATE) , "bad state"},
337{ERR_REASON(SSL_R_BAD_STATE) ,"bad state"}, 336 {ERR_REASON(SSL_R_BAD_WRITE_RETRY) , "bad write retry"},
338{ERR_REASON(SSL_R_BAD_WRITE_RETRY) ,"bad write retry"}, 337 {ERR_REASON(SSL_R_BIO_NOT_SET) , "bio not set"},
339{ERR_REASON(SSL_R_BIO_NOT_SET) ,"bio not set"}, 338 {ERR_REASON(SSL_R_BLOCK_CIPHER_PAD_IS_WRONG), "block cipher pad is wrong"},
340{ERR_REASON(SSL_R_BLOCK_CIPHER_PAD_IS_WRONG),"block cipher pad is wrong"}, 339 {ERR_REASON(SSL_R_BN_LIB) , "bn lib"},
341{ERR_REASON(SSL_R_BN_LIB) ,"bn lib"}, 340 {ERR_REASON(SSL_R_CA_DN_LENGTH_MISMATCH) , "ca dn length mismatch"},
342{ERR_REASON(SSL_R_CA_DN_LENGTH_MISMATCH) ,"ca dn length mismatch"}, 341 {ERR_REASON(SSL_R_CA_DN_TOO_LONG) , "ca dn too long"},
343{ERR_REASON(SSL_R_CA_DN_TOO_LONG) ,"ca dn too long"}, 342 {ERR_REASON(SSL_R_CCS_RECEIVED_EARLY) , "ccs received early"},
344{ERR_REASON(SSL_R_CCS_RECEIVED_EARLY) ,"ccs received early"}, 343 {ERR_REASON(SSL_R_CERTIFICATE_VERIFY_FAILED), "certificate verify failed"},
345{ERR_REASON(SSL_R_CERTIFICATE_VERIFY_FAILED),"certificate verify failed"}, 344 {ERR_REASON(SSL_R_CERT_LENGTH_MISMATCH) , "cert length mismatch"},
346{ERR_REASON(SSL_R_CERT_LENGTH_MISMATCH) ,"cert length mismatch"}, 345 {ERR_REASON(SSL_R_CHALLENGE_IS_DIFFERENT), "challenge is different"},
347{ERR_REASON(SSL_R_CHALLENGE_IS_DIFFERENT),"challenge is different"}, 346 {ERR_REASON(SSL_R_CIPHER_CODE_WRONG_LENGTH), "cipher code wrong length"},
348{ERR_REASON(SSL_R_CIPHER_CODE_WRONG_LENGTH),"cipher code wrong length"}, 347 {ERR_REASON(SSL_R_CIPHER_OR_HASH_UNAVAILABLE), "cipher or hash unavailable"},
349{ERR_REASON(SSL_R_CIPHER_OR_HASH_UNAVAILABLE),"cipher or hash unavailable"}, 348 {ERR_REASON(SSL_R_CIPHER_TABLE_SRC_ERROR), "cipher table src error"},
350{ERR_REASON(SSL_R_CIPHER_TABLE_SRC_ERROR),"cipher table src error"}, 349 {ERR_REASON(SSL_R_CLIENTHELLO_TLSEXT) , "clienthello tlsext"},
351{ERR_REASON(SSL_R_CLIENTHELLO_TLSEXT) ,"clienthello tlsext"}, 350 {ERR_REASON(SSL_R_COMPRESSED_LENGTH_TOO_LONG), "compressed length too long"},
352{ERR_REASON(SSL_R_COMPRESSED_LENGTH_TOO_LONG),"compressed length too long"}, 351 {ERR_REASON(SSL_R_COMPRESSION_DISABLED) , "compression disabled"},
353{ERR_REASON(SSL_R_COMPRESSION_DISABLED) ,"compression disabled"}, 352 {ERR_REASON(SSL_R_COMPRESSION_FAILURE) , "compression failure"},
354{ERR_REASON(SSL_R_COMPRESSION_FAILURE) ,"compression failure"}, 353 {ERR_REASON(SSL_R_COMPRESSION_ID_NOT_WITHIN_PRIVATE_RANGE), "compression id not within private range"},
355{ERR_REASON(SSL_R_COMPRESSION_ID_NOT_WITHIN_PRIVATE_RANGE),"compression id not within private range"}, 354 {ERR_REASON(SSL_R_COMPRESSION_LIBRARY_ERROR), "compression library error"},
356{ERR_REASON(SSL_R_COMPRESSION_LIBRARY_ERROR),"compression library error"}, 355 {ERR_REASON(SSL_R_CONNECTION_ID_IS_DIFFERENT), "connection id is different"},
357{ERR_REASON(SSL_R_CONNECTION_ID_IS_DIFFERENT),"connection id is different"}, 356 {ERR_REASON(SSL_R_CONNECTION_TYPE_NOT_SET), "connection type not set"},
358{ERR_REASON(SSL_R_CONNECTION_TYPE_NOT_SET),"connection type not set"}, 357 {ERR_REASON(SSL_R_COOKIE_MISMATCH) , "cookie mismatch"},
359{ERR_REASON(SSL_R_COOKIE_MISMATCH) ,"cookie mismatch"}, 358 {ERR_REASON(SSL_R_DATA_BETWEEN_CCS_AND_FINISHED), "data between ccs and finished"},
360{ERR_REASON(SSL_R_DATA_BETWEEN_CCS_AND_FINISHED),"data between ccs and finished"}, 359 {ERR_REASON(SSL_R_DATA_LENGTH_TOO_LONG) , "data length too long"},
361{ERR_REASON(SSL_R_DATA_LENGTH_TOO_LONG) ,"data length too long"}, 360 {ERR_REASON(SSL_R_DECRYPTION_FAILED) , "decryption failed"},
362{ERR_REASON(SSL_R_DECRYPTION_FAILED) ,"decryption failed"}, 361 {ERR_REASON(SSL_R_DECRYPTION_FAILED_OR_BAD_RECORD_MAC), "decryption failed or bad record mac"},
363{ERR_REASON(SSL_R_DECRYPTION_FAILED_OR_BAD_RECORD_MAC),"decryption failed or bad record mac"}, 362 {ERR_REASON(SSL_R_DH_PUBLIC_VALUE_LENGTH_IS_WRONG), "dh public value length is wrong"},
364{ERR_REASON(SSL_R_DH_PUBLIC_VALUE_LENGTH_IS_WRONG),"dh public value length is wrong"}, 363 {ERR_REASON(SSL_R_DIGEST_CHECK_FAILED) , "digest check failed"},
365{ERR_REASON(SSL_R_DIGEST_CHECK_FAILED) ,"digest check failed"}, 364 {ERR_REASON(SSL_R_DTLS_MESSAGE_TOO_BIG) , "dtls message too big"},
366{ERR_REASON(SSL_R_DTLS_MESSAGE_TOO_BIG) ,"dtls message too big"}, 365 {ERR_REASON(SSL_R_DUPLICATE_COMPRESSION_ID), "duplicate compression id"},
367{ERR_REASON(SSL_R_DUPLICATE_COMPRESSION_ID),"duplicate compression id"}, 366 {ERR_REASON(SSL_R_ECC_CERT_NOT_FOR_KEY_AGREEMENT), "ecc cert not for key agreement"},
368{ERR_REASON(SSL_R_ECC_CERT_NOT_FOR_KEY_AGREEMENT),"ecc cert not for key agreement"}, 367 {ERR_REASON(SSL_R_ECC_CERT_NOT_FOR_SIGNING), "ecc cert not for signing"},
369{ERR_REASON(SSL_R_ECC_CERT_NOT_FOR_SIGNING),"ecc cert not for signing"}, 368 {ERR_REASON(SSL_R_ECC_CERT_SHOULD_HAVE_RSA_SIGNATURE), "ecc cert should have rsa signature"},
370{ERR_REASON(SSL_R_ECC_CERT_SHOULD_HAVE_RSA_SIGNATURE),"ecc cert should have rsa signature"}, 369 {ERR_REASON(SSL_R_ECC_CERT_SHOULD_HAVE_SHA1_SIGNATURE), "ecc cert should have sha1 signature"},
371{ERR_REASON(SSL_R_ECC_CERT_SHOULD_HAVE_SHA1_SIGNATURE),"ecc cert should have sha1 signature"}, 370 {ERR_REASON(SSL_R_ECGROUP_TOO_LARGE_FOR_CIPHER), "ecgroup too large for cipher"},
372{ERR_REASON(SSL_R_ECGROUP_TOO_LARGE_FOR_CIPHER),"ecgroup too large for cipher"}, 371 {ERR_REASON(SSL_R_EMPTY_SRTP_PROTECTION_PROFILE_LIST), "empty srtp protection profile list"},
373{ERR_REASON(SSL_R_EMPTY_SRTP_PROTECTION_PROFILE_LIST),"empty srtp protection profile list"}, 372 {ERR_REASON(SSL_R_ENCRYPTED_LENGTH_TOO_LONG), "encrypted length too long"},
374{ERR_REASON(SSL_R_ENCRYPTED_LENGTH_TOO_LONG),"encrypted length too long"}, 373 {ERR_REASON(SSL_R_ERROR_GENERATING_TMP_RSA_KEY), "error generating tmp rsa key"},
375{ERR_REASON(SSL_R_ERROR_GENERATING_TMP_RSA_KEY),"error generating tmp rsa key"}, 374 {ERR_REASON(SSL_R_ERROR_IN_RECEIVED_CIPHER_LIST), "error in received cipher list"},
376{ERR_REASON(SSL_R_ERROR_IN_RECEIVED_CIPHER_LIST),"error in received cipher list"}, 375 {ERR_REASON(SSL_R_EXCESSIVE_MESSAGE_SIZE), "excessive message size"},
377{ERR_REASON(SSL_R_EXCESSIVE_MESSAGE_SIZE),"excessive message size"}, 376 {ERR_REASON(SSL_R_EXTRA_DATA_IN_MESSAGE) , "extra data in message"},
378{ERR_REASON(SSL_R_EXTRA_DATA_IN_MESSAGE) ,"extra data in message"}, 377 {ERR_REASON(SSL_R_GOT_A_FIN_BEFORE_A_CCS), "got a fin before a ccs"},
379{ERR_REASON(SSL_R_GOT_A_FIN_BEFORE_A_CCS),"got a fin before a ccs"}, 378 {ERR_REASON(SSL_R_GOT_NEXT_PROTO_BEFORE_A_CCS), "got next proto before a ccs"},
380{ERR_REASON(SSL_R_GOT_NEXT_PROTO_BEFORE_A_CCS),"got next proto before a ccs"}, 379 {ERR_REASON(SSL_R_GOT_NEXT_PROTO_WITHOUT_EXTENSION), "got next proto without seeing extension"},
381{ERR_REASON(SSL_R_GOT_NEXT_PROTO_WITHOUT_EXTENSION),"got next proto without seeing extension"}, 380 {ERR_REASON(SSL_R_HTTPS_PROXY_REQUEST) , "https proxy request"},
382{ERR_REASON(SSL_R_HTTPS_PROXY_REQUEST) ,"https proxy request"}, 381 {ERR_REASON(SSL_R_HTTP_REQUEST) , "http request"},
383{ERR_REASON(SSL_R_HTTP_REQUEST) ,"http request"}, 382 {ERR_REASON(SSL_R_ILLEGAL_PADDING) , "illegal padding"},
384{ERR_REASON(SSL_R_ILLEGAL_PADDING) ,"illegal padding"}, 383 {ERR_REASON(SSL_R_INCONSISTENT_COMPRESSION), "inconsistent compression"},
385{ERR_REASON(SSL_R_INCONSISTENT_COMPRESSION),"inconsistent compression"}, 384 {ERR_REASON(SSL_R_INVALID_CHALLENGE_LENGTH), "invalid challenge length"},
386{ERR_REASON(SSL_R_INVALID_CHALLENGE_LENGTH),"invalid challenge length"}, 385 {ERR_REASON(SSL_R_INVALID_COMMAND) , "invalid command"},
387{ERR_REASON(SSL_R_INVALID_COMMAND) ,"invalid command"}, 386 {ERR_REASON(SSL_R_INVALID_COMPRESSION_ALGORITHM), "invalid compression algorithm"},
388{ERR_REASON(SSL_R_INVALID_COMPRESSION_ALGORITHM),"invalid compression algorithm"}, 387 {ERR_REASON(SSL_R_INVALID_PURPOSE) , "invalid purpose"},
389{ERR_REASON(SSL_R_INVALID_PURPOSE) ,"invalid purpose"}, 388 {ERR_REASON(SSL_R_INVALID_SRP_USERNAME) , "invalid srp username"},
390{ERR_REASON(SSL_R_INVALID_SRP_USERNAME) ,"invalid srp username"}, 389 {ERR_REASON(SSL_R_INVALID_STATUS_RESPONSE), "invalid status response"},
391{ERR_REASON(SSL_R_INVALID_STATUS_RESPONSE),"invalid status response"}, 390 {ERR_REASON(SSL_R_INVALID_TICKET_KEYS_LENGTH), "invalid ticket keys length"},
392{ERR_REASON(SSL_R_INVALID_TICKET_KEYS_LENGTH),"invalid ticket keys length"}, 391 {ERR_REASON(SSL_R_INVALID_TRUST) , "invalid trust"},
393{ERR_REASON(SSL_R_INVALID_TRUST) ,"invalid trust"}, 392 {ERR_REASON(SSL_R_KEY_ARG_TOO_LONG) , "key arg too long"},
394{ERR_REASON(SSL_R_KEY_ARG_TOO_LONG) ,"key arg too long"}, 393 {ERR_REASON(SSL_R_KRB5) , "krb5"},
395{ERR_REASON(SSL_R_KRB5) ,"krb5"}, 394 {ERR_REASON(SSL_R_KRB5_C_CC_PRINC) , "krb5 client cc principal (no tkt?)"},
396{ERR_REASON(SSL_R_KRB5_C_CC_PRINC) ,"krb5 client cc principal (no tkt?)"}, 395 {ERR_REASON(SSL_R_KRB5_C_GET_CRED) , "krb5 client get cred"},
397{ERR_REASON(SSL_R_KRB5_C_GET_CRED) ,"krb5 client get cred"}, 396 {ERR_REASON(SSL_R_KRB5_C_INIT) , "krb5 client init"},
398{ERR_REASON(SSL_R_KRB5_C_INIT) ,"krb5 client init"}, 397 {ERR_REASON(SSL_R_KRB5_C_MK_REQ) , "krb5 client mk_req (expired tkt?)"},
399{ERR_REASON(SSL_R_KRB5_C_MK_REQ) ,"krb5 client mk_req (expired tkt?)"}, 398 {ERR_REASON(SSL_R_KRB5_S_BAD_TICKET) , "krb5 server bad ticket"},
400{ERR_REASON(SSL_R_KRB5_S_BAD_TICKET) ,"krb5 server bad ticket"}, 399 {ERR_REASON(SSL_R_KRB5_S_INIT) , "krb5 server init"},
401{ERR_REASON(SSL_R_KRB5_S_INIT) ,"krb5 server init"}, 400 {ERR_REASON(SSL_R_KRB5_S_RD_REQ) , "krb5 server rd_req (keytab perms?)"},
402{ERR_REASON(SSL_R_KRB5_S_RD_REQ) ,"krb5 server rd_req (keytab perms?)"}, 401 {ERR_REASON(SSL_R_KRB5_S_TKT_EXPIRED) , "krb5 server tkt expired"},
403{ERR_REASON(SSL_R_KRB5_S_TKT_EXPIRED) ,"krb5 server tkt expired"}, 402 {ERR_REASON(SSL_R_KRB5_S_TKT_NYV) , "krb5 server tkt not yet valid"},
404{ERR_REASON(SSL_R_KRB5_S_TKT_NYV) ,"krb5 server tkt not yet valid"}, 403 {ERR_REASON(SSL_R_KRB5_S_TKT_SKEW) , "krb5 server tkt skew"},
405{ERR_REASON(SSL_R_KRB5_S_TKT_SKEW) ,"krb5 server tkt skew"}, 404 {ERR_REASON(SSL_R_LENGTH_MISMATCH) , "length mismatch"},
406{ERR_REASON(SSL_R_LENGTH_MISMATCH) ,"length mismatch"}, 405 {ERR_REASON(SSL_R_LENGTH_TOO_SHORT) , "length too short"},
407{ERR_REASON(SSL_R_LENGTH_TOO_SHORT) ,"length too short"}, 406 {ERR_REASON(SSL_R_LIBRARY_BUG) , "library bug"},
408{ERR_REASON(SSL_R_LIBRARY_BUG) ,"library bug"}, 407 {ERR_REASON(SSL_R_LIBRARY_HAS_NO_CIPHERS), "library has no ciphers"},
409{ERR_REASON(SSL_R_LIBRARY_HAS_NO_CIPHERS),"library has no ciphers"}, 408 {ERR_REASON(SSL_R_MESSAGE_TOO_LONG) , "message too long"},
410{ERR_REASON(SSL_R_MESSAGE_TOO_LONG) ,"message too long"}, 409 {ERR_REASON(SSL_R_MISSING_DH_DSA_CERT) , "missing dh dsa cert"},
411{ERR_REASON(SSL_R_MISSING_DH_DSA_CERT) ,"missing dh dsa cert"}, 410 {ERR_REASON(SSL_R_MISSING_DH_KEY) , "missing dh key"},
412{ERR_REASON(SSL_R_MISSING_DH_KEY) ,"missing dh key"}, 411 {ERR_REASON(SSL_R_MISSING_DH_RSA_CERT) , "missing dh rsa cert"},
413{ERR_REASON(SSL_R_MISSING_DH_RSA_CERT) ,"missing dh rsa cert"}, 412 {ERR_REASON(SSL_R_MISSING_DSA_SIGNING_CERT), "missing dsa signing cert"},
414{ERR_REASON(SSL_R_MISSING_DSA_SIGNING_CERT),"missing dsa signing cert"}, 413 {ERR_REASON(SSL_R_MISSING_EXPORT_TMP_DH_KEY), "missing export tmp dh key"},
415{ERR_REASON(SSL_R_MISSING_EXPORT_TMP_DH_KEY),"missing export tmp dh key"}, 414 {ERR_REASON(SSL_R_MISSING_EXPORT_TMP_RSA_KEY), "missing export tmp rsa key"},
416{ERR_REASON(SSL_R_MISSING_EXPORT_TMP_RSA_KEY),"missing export tmp rsa key"}, 415 {ERR_REASON(SSL_R_MISSING_RSA_CERTIFICATE), "missing rsa certificate"},
417{ERR_REASON(SSL_R_MISSING_RSA_CERTIFICATE),"missing rsa certificate"}, 416 {ERR_REASON(SSL_R_MISSING_RSA_ENCRYPTING_CERT), "missing rsa encrypting cert"},
418{ERR_REASON(SSL_R_MISSING_RSA_ENCRYPTING_CERT),"missing rsa encrypting cert"}, 417 {ERR_REASON(SSL_R_MISSING_RSA_SIGNING_CERT), "missing rsa signing cert"},
419{ERR_REASON(SSL_R_MISSING_RSA_SIGNING_CERT),"missing rsa signing cert"}, 418 {ERR_REASON(SSL_R_MISSING_SRP_PARAM) , "can't find SRP server param"},
420{ERR_REASON(SSL_R_MISSING_SRP_PARAM) ,"can't find SRP server param"}, 419 {ERR_REASON(SSL_R_MISSING_TMP_DH_KEY) , "missing tmp dh key"},
421{ERR_REASON(SSL_R_MISSING_TMP_DH_KEY) ,"missing tmp dh key"}, 420 {ERR_REASON(SSL_R_MISSING_TMP_ECDH_KEY) , "missing tmp ecdh key"},
422{ERR_REASON(SSL_R_MISSING_TMP_ECDH_KEY) ,"missing tmp ecdh key"}, 421 {ERR_REASON(SSL_R_MISSING_TMP_RSA_KEY) , "missing tmp rsa key"},
423{ERR_REASON(SSL_R_MISSING_TMP_RSA_KEY) ,"missing tmp rsa key"}, 422 {ERR_REASON(SSL_R_MISSING_TMP_RSA_PKEY) , "missing tmp rsa pkey"},
424{ERR_REASON(SSL_R_MISSING_TMP_RSA_PKEY) ,"missing tmp rsa pkey"}, 423 {ERR_REASON(SSL_R_MISSING_VERIFY_MESSAGE), "missing verify message"},
425{ERR_REASON(SSL_R_MISSING_VERIFY_MESSAGE),"missing verify message"}, 424 {ERR_REASON(SSL_R_MULTIPLE_SGC_RESTARTS) , "multiple sgc restarts"},
426{ERR_REASON(SSL_R_MULTIPLE_SGC_RESTARTS) ,"multiple sgc restarts"}, 425 {ERR_REASON(SSL_R_NON_SSLV2_INITIAL_PACKET), "non sslv2 initial packet"},
427{ERR_REASON(SSL_R_NON_SSLV2_INITIAL_PACKET),"non sslv2 initial packet"}, 426 {ERR_REASON(SSL_R_NO_CERTIFICATES_RETURNED), "no certificates returned"},
428{ERR_REASON(SSL_R_NO_CERTIFICATES_RETURNED),"no certificates returned"}, 427 {ERR_REASON(SSL_R_NO_CERTIFICATE_ASSIGNED), "no certificate assigned"},
429{ERR_REASON(SSL_R_NO_CERTIFICATE_ASSIGNED),"no certificate assigned"}, 428 {ERR_REASON(SSL_R_NO_CERTIFICATE_RETURNED), "no certificate returned"},
430{ERR_REASON(SSL_R_NO_CERTIFICATE_RETURNED),"no certificate returned"}, 429 {ERR_REASON(SSL_R_NO_CERTIFICATE_SET) , "no certificate set"},
431{ERR_REASON(SSL_R_NO_CERTIFICATE_SET) ,"no certificate set"}, 430 {ERR_REASON(SSL_R_NO_CERTIFICATE_SPECIFIED), "no certificate specified"},
432{ERR_REASON(SSL_R_NO_CERTIFICATE_SPECIFIED),"no certificate specified"}, 431 {ERR_REASON(SSL_R_NO_CIPHERS_AVAILABLE) , "no ciphers available"},
433{ERR_REASON(SSL_R_NO_CIPHERS_AVAILABLE) ,"no ciphers available"}, 432 {ERR_REASON(SSL_R_NO_CIPHERS_PASSED) , "no ciphers passed"},
434{ERR_REASON(SSL_R_NO_CIPHERS_PASSED) ,"no ciphers passed"}, 433 {ERR_REASON(SSL_R_NO_CIPHERS_SPECIFIED) , "no ciphers specified"},
435{ERR_REASON(SSL_R_NO_CIPHERS_SPECIFIED) ,"no ciphers specified"}, 434 {ERR_REASON(SSL_R_NO_CIPHER_LIST) , "no cipher list"},
436{ERR_REASON(SSL_R_NO_CIPHER_LIST) ,"no cipher list"}, 435 {ERR_REASON(SSL_R_NO_CIPHER_MATCH) , "no cipher match"},
437{ERR_REASON(SSL_R_NO_CIPHER_MATCH) ,"no cipher match"}, 436 {ERR_REASON(SSL_R_NO_CLIENT_CERT_METHOD) , "no client cert method"},
438{ERR_REASON(SSL_R_NO_CLIENT_CERT_METHOD) ,"no client cert method"}, 437 {ERR_REASON(SSL_R_NO_CLIENT_CERT_RECEIVED), "no client cert received"},
439{ERR_REASON(SSL_R_NO_CLIENT_CERT_RECEIVED),"no client cert received"}, 438 {ERR_REASON(SSL_R_NO_COMPRESSION_SPECIFIED), "no compression specified"},
440{ERR_REASON(SSL_R_NO_COMPRESSION_SPECIFIED),"no compression specified"}, 439 {ERR_REASON(SSL_R_NO_GOST_CERTIFICATE_SENT_BY_PEER), "Peer haven't sent GOST certificate, required for selected ciphersuite"},
441{ERR_REASON(SSL_R_NO_GOST_CERTIFICATE_SENT_BY_PEER),"Peer haven't sent GOST certificate, required for selected ciphersuite"}, 440 {ERR_REASON(SSL_R_NO_METHOD_SPECIFIED) , "no method specified"},
442{ERR_REASON(SSL_R_NO_METHOD_SPECIFIED) ,"no method specified"}, 441 {ERR_REASON(SSL_R_NO_PRIVATEKEY) , "no privatekey"},
443{ERR_REASON(SSL_R_NO_PRIVATEKEY) ,"no privatekey"}, 442 {ERR_REASON(SSL_R_NO_PRIVATE_KEY_ASSIGNED), "no private key assigned"},
444{ERR_REASON(SSL_R_NO_PRIVATE_KEY_ASSIGNED),"no private key assigned"}, 443 {ERR_REASON(SSL_R_NO_PROTOCOLS_AVAILABLE), "no protocols available"},
445{ERR_REASON(SSL_R_NO_PROTOCOLS_AVAILABLE),"no protocols available"}, 444 {ERR_REASON(SSL_R_NO_PUBLICKEY) , "no publickey"},
446{ERR_REASON(SSL_R_NO_PUBLICKEY) ,"no publickey"}, 445 {ERR_REASON(SSL_R_NO_RENEGOTIATION) , "no renegotiation"},
447{ERR_REASON(SSL_R_NO_RENEGOTIATION) ,"no renegotiation"}, 446 {ERR_REASON(SSL_R_NO_REQUIRED_DIGEST) , "digest requred for handshake isn't computed"},
448{ERR_REASON(SSL_R_NO_REQUIRED_DIGEST) ,"digest requred for handshake isn't computed"}, 447 {ERR_REASON(SSL_R_NO_SHARED_CIPHER) , "no shared cipher"},
449{ERR_REASON(SSL_R_NO_SHARED_CIPHER) ,"no shared cipher"}, 448 {ERR_REASON(SSL_R_NO_SRTP_PROFILES) , "no srtp profiles"},
450{ERR_REASON(SSL_R_NO_SRTP_PROFILES) ,"no srtp profiles"}, 449 {ERR_REASON(SSL_R_NO_VERIFY_CALLBACK) , "no verify callback"},
451{ERR_REASON(SSL_R_NO_VERIFY_CALLBACK) ,"no verify callback"}, 450 {ERR_REASON(SSL_R_NULL_SSL_CTX) , "null ssl ctx"},
452{ERR_REASON(SSL_R_NULL_SSL_CTX) ,"null ssl ctx"}, 451 {ERR_REASON(SSL_R_NULL_SSL_METHOD_PASSED), "null ssl method passed"},
453{ERR_REASON(SSL_R_NULL_SSL_METHOD_PASSED),"null ssl method passed"}, 452 {ERR_REASON(SSL_R_OLD_SESSION_CIPHER_NOT_RETURNED), "old session cipher not returned"},
454{ERR_REASON(SSL_R_OLD_SESSION_CIPHER_NOT_RETURNED),"old session cipher not returned"}, 453 {ERR_REASON(SSL_R_OLD_SESSION_COMPRESSION_ALGORITHM_NOT_RETURNED), "old session compression algorithm not returned"},
455{ERR_REASON(SSL_R_OLD_SESSION_COMPRESSION_ALGORITHM_NOT_RETURNED),"old session compression algorithm not returned"}, 454 {ERR_REASON(SSL_R_ONLY_TLS_ALLOWED_IN_FIPS_MODE), "only tls allowed in fips mode"},
456{ERR_REASON(SSL_R_ONLY_TLS_ALLOWED_IN_FIPS_MODE),"only tls allowed in fips mode"}, 455 {ERR_REASON(SSL_R_OPAQUE_PRF_INPUT_TOO_LONG), "opaque PRF input too long"},
457{ERR_REASON(SSL_R_OPAQUE_PRF_INPUT_TOO_LONG),"opaque PRF input too long"}, 456 {ERR_REASON(SSL_R_PACKET_LENGTH_TOO_LONG), "packet length too long"},
458{ERR_REASON(SSL_R_PACKET_LENGTH_TOO_LONG),"packet length too long"}, 457 {ERR_REASON(SSL_R_PARSE_TLSEXT) , "parse tlsext"},
459{ERR_REASON(SSL_R_PARSE_TLSEXT) ,"parse tlsext"}, 458 {ERR_REASON(SSL_R_PATH_TOO_LONG) , "path too long"},
460{ERR_REASON(SSL_R_PATH_TOO_LONG) ,"path too long"}, 459 {ERR_REASON(SSL_R_PEER_DID_NOT_RETURN_A_CERTIFICATE), "peer did not return a certificate"},
461{ERR_REASON(SSL_R_PEER_DID_NOT_RETURN_A_CERTIFICATE),"peer did not return a certificate"}, 460 {ERR_REASON(SSL_R_PEER_ERROR) , "peer error"},
462{ERR_REASON(SSL_R_PEER_ERROR) ,"peer error"}, 461 {ERR_REASON(SSL_R_PEER_ERROR_CERTIFICATE), "peer error certificate"},
463{ERR_REASON(SSL_R_PEER_ERROR_CERTIFICATE),"peer error certificate"}, 462 {ERR_REASON(SSL_R_PEER_ERROR_NO_CERTIFICATE), "peer error no certificate"},
464{ERR_REASON(SSL_R_PEER_ERROR_NO_CERTIFICATE),"peer error no certificate"}, 463 {ERR_REASON(SSL_R_PEER_ERROR_NO_CIPHER) , "peer error no cipher"},
465{ERR_REASON(SSL_R_PEER_ERROR_NO_CIPHER) ,"peer error no cipher"}, 464 {ERR_REASON(SSL_R_PEER_ERROR_UNSUPPORTED_CERTIFICATE_TYPE), "peer error unsupported certificate type"},
466{ERR_REASON(SSL_R_PEER_ERROR_UNSUPPORTED_CERTIFICATE_TYPE),"peer error unsupported certificate type"}, 465 {ERR_REASON(SSL_R_PRE_MAC_LENGTH_TOO_LONG), "pre mac length too long"},
467{ERR_REASON(SSL_R_PRE_MAC_LENGTH_TOO_LONG),"pre mac length too long"}, 466 {ERR_REASON(SSL_R_PROBLEMS_MAPPING_CIPHER_FUNCTIONS), "problems mapping cipher functions"},
468{ERR_REASON(SSL_R_PROBLEMS_MAPPING_CIPHER_FUNCTIONS),"problems mapping cipher functions"}, 467 {ERR_REASON(SSL_R_PROTOCOL_IS_SHUTDOWN) , "protocol is shutdown"},
469{ERR_REASON(SSL_R_PROTOCOL_IS_SHUTDOWN) ,"protocol is shutdown"}, 468 {ERR_REASON(SSL_R_PSK_IDENTITY_NOT_FOUND), "psk identity not found"},
470{ERR_REASON(SSL_R_PSK_IDENTITY_NOT_FOUND),"psk identity not found"}, 469 {ERR_REASON(SSL_R_PSK_NO_CLIENT_CB) , "psk no client cb"},
471{ERR_REASON(SSL_R_PSK_NO_CLIENT_CB) ,"psk no client cb"}, 470 {ERR_REASON(SSL_R_PSK_NO_SERVER_CB) , "psk no server cb"},
472{ERR_REASON(SSL_R_PSK_NO_SERVER_CB) ,"psk no server cb"}, 471 {ERR_REASON(SSL_R_PUBLIC_KEY_ENCRYPT_ERROR), "public key encrypt error"},
473{ERR_REASON(SSL_R_PUBLIC_KEY_ENCRYPT_ERROR),"public key encrypt error"}, 472 {ERR_REASON(SSL_R_PUBLIC_KEY_IS_NOT_RSA) , "public key is not rsa"},
474{ERR_REASON(SSL_R_PUBLIC_KEY_IS_NOT_RSA) ,"public key is not rsa"}, 473 {ERR_REASON(SSL_R_PUBLIC_KEY_NOT_RSA) , "public key not rsa"},
475{ERR_REASON(SSL_R_PUBLIC_KEY_NOT_RSA) ,"public key not rsa"}, 474 {ERR_REASON(SSL_R_READ_BIO_NOT_SET) , "read bio not set"},
476{ERR_REASON(SSL_R_READ_BIO_NOT_SET) ,"read bio not set"}, 475 {ERR_REASON(SSL_R_READ_TIMEOUT_EXPIRED) , "read timeout expired"},
477{ERR_REASON(SSL_R_READ_TIMEOUT_EXPIRED) ,"read timeout expired"}, 476 {ERR_REASON(SSL_R_READ_WRONG_PACKET_TYPE), "read wrong packet type"},
478{ERR_REASON(SSL_R_READ_WRONG_PACKET_TYPE),"read wrong packet type"}, 477 {ERR_REASON(SSL_R_RECORD_LENGTH_MISMATCH), "record length mismatch"},
479{ERR_REASON(SSL_R_RECORD_LENGTH_MISMATCH),"record length mismatch"}, 478 {ERR_REASON(SSL_R_RECORD_TOO_LARGE) , "record too large"},
480{ERR_REASON(SSL_R_RECORD_TOO_LARGE) ,"record too large"}, 479 {ERR_REASON(SSL_R_RECORD_TOO_SMALL) , "record too small"},
481{ERR_REASON(SSL_R_RECORD_TOO_SMALL) ,"record too small"}, 480 {ERR_REASON(SSL_R_RENEGOTIATE_EXT_TOO_LONG), "renegotiate ext too long"},
482{ERR_REASON(SSL_R_RENEGOTIATE_EXT_TOO_LONG),"renegotiate ext too long"}, 481 {ERR_REASON(SSL_R_RENEGOTIATION_ENCODING_ERR), "renegotiation encoding err"},
483{ERR_REASON(SSL_R_RENEGOTIATION_ENCODING_ERR),"renegotiation encoding err"}, 482 {ERR_REASON(SSL_R_RENEGOTIATION_MISMATCH), "renegotiation mismatch"},
484{ERR_REASON(SSL_R_RENEGOTIATION_MISMATCH),"renegotiation mismatch"}, 483 {ERR_REASON(SSL_R_REQUIRED_CIPHER_MISSING), "required cipher missing"},
485{ERR_REASON(SSL_R_REQUIRED_CIPHER_MISSING),"required cipher missing"}, 484 {ERR_REASON(SSL_R_REQUIRED_COMPRESSSION_ALGORITHM_MISSING), "required compresssion algorithm missing"},
486{ERR_REASON(SSL_R_REQUIRED_COMPRESSSION_ALGORITHM_MISSING),"required compresssion algorithm missing"}, 485 {ERR_REASON(SSL_R_REUSE_CERT_LENGTH_NOT_ZERO), "reuse cert length not zero"},
487{ERR_REASON(SSL_R_REUSE_CERT_LENGTH_NOT_ZERO),"reuse cert length not zero"}, 486 {ERR_REASON(SSL_R_REUSE_CERT_TYPE_NOT_ZERO), "reuse cert type not zero"},
488{ERR_REASON(SSL_R_REUSE_CERT_TYPE_NOT_ZERO),"reuse cert type not zero"}, 487 {ERR_REASON(SSL_R_REUSE_CIPHER_LIST_NOT_ZERO), "reuse cipher list not zero"},
489{ERR_REASON(SSL_R_REUSE_CIPHER_LIST_NOT_ZERO),"reuse cipher list not zero"}, 488 {ERR_REASON(SSL_R_SCSV_RECEIVED_WHEN_RENEGOTIATING), "scsv received when renegotiating"},
490{ERR_REASON(SSL_R_SCSV_RECEIVED_WHEN_RENEGOTIATING),"scsv received when renegotiating"}, 489 {ERR_REASON(SSL_R_SERVERHELLO_TLSEXT) , "serverhello tlsext"},
491{ERR_REASON(SSL_R_SERVERHELLO_TLSEXT) ,"serverhello tlsext"}, 490 {ERR_REASON(SSL_R_SESSION_ID_CONTEXT_UNINITIALIZED), "session id context uninitialized"},
492{ERR_REASON(SSL_R_SESSION_ID_CONTEXT_UNINITIALIZED),"session id context uninitialized"}, 491 {ERR_REASON(SSL_R_SHORT_READ) , "short read"},
493{ERR_REASON(SSL_R_SHORT_READ) ,"short read"}, 492 {ERR_REASON(SSL_R_SIGNATURE_ALGORITHMS_ERROR), "signature algorithms error"},
494{ERR_REASON(SSL_R_SIGNATURE_ALGORITHMS_ERROR),"signature algorithms error"}, 493 {ERR_REASON(SSL_R_SIGNATURE_FOR_NON_SIGNING_CERTIFICATE), "signature for non signing certificate"},
495{ERR_REASON(SSL_R_SIGNATURE_FOR_NON_SIGNING_CERTIFICATE),"signature for non signing certificate"}, 494 {ERR_REASON(SSL_R_SRP_A_CALC) , "error with the srp params"},
496{ERR_REASON(SSL_R_SRP_A_CALC) ,"error with the srp params"}, 495 {ERR_REASON(SSL_R_SRTP_COULD_NOT_ALLOCATE_PROFILES), "srtp could not allocate profiles"},
497{ERR_REASON(SSL_R_SRTP_COULD_NOT_ALLOCATE_PROFILES),"srtp could not allocate profiles"}, 496 {ERR_REASON(SSL_R_SRTP_PROTECTION_PROFILE_LIST_TOO_LONG), "srtp protection profile list too long"},
498{ERR_REASON(SSL_R_SRTP_PROTECTION_PROFILE_LIST_TOO_LONG),"srtp protection profile list too long"}, 497 {ERR_REASON(SSL_R_SRTP_UNKNOWN_PROTECTION_PROFILE), "srtp unknown protection profile"},
499{ERR_REASON(SSL_R_SRTP_UNKNOWN_PROTECTION_PROFILE),"srtp unknown protection profile"}, 498 {ERR_REASON(SSL_R_SSL23_DOING_SESSION_ID_REUSE), "ssl23 doing session id reuse"},
500{ERR_REASON(SSL_R_SSL23_DOING_SESSION_ID_REUSE),"ssl23 doing session id reuse"}, 499 {ERR_REASON(SSL_R_SSL2_CONNECTION_ID_TOO_LONG), "ssl2 connection id too long"},
501{ERR_REASON(SSL_R_SSL2_CONNECTION_ID_TOO_LONG),"ssl2 connection id too long"}, 500 {ERR_REASON(SSL_R_SSL3_EXT_INVALID_ECPOINTFORMAT), "ssl3 ext invalid ecpointformat"},
502{ERR_REASON(SSL_R_SSL3_EXT_INVALID_ECPOINTFORMAT),"ssl3 ext invalid ecpointformat"}, 501 {ERR_REASON(SSL_R_SSL3_EXT_INVALID_SERVERNAME), "ssl3 ext invalid servername"},
503{ERR_REASON(SSL_R_SSL3_EXT_INVALID_SERVERNAME),"ssl3 ext invalid servername"}, 502 {ERR_REASON(SSL_R_SSL3_EXT_INVALID_SERVERNAME_TYPE), "ssl3 ext invalid servername type"},
504{ERR_REASON(SSL_R_SSL3_EXT_INVALID_SERVERNAME_TYPE),"ssl3 ext invalid servername type"}, 503 {ERR_REASON(SSL_R_SSL3_SESSION_ID_TOO_LONG), "ssl3 session id too long"},
505{ERR_REASON(SSL_R_SSL3_SESSION_ID_TOO_LONG),"ssl3 session id too long"}, 504 {ERR_REASON(SSL_R_SSL3_SESSION_ID_TOO_SHORT), "ssl3 session id too short"},
506{ERR_REASON(SSL_R_SSL3_SESSION_ID_TOO_SHORT),"ssl3 session id too short"}, 505 {ERR_REASON(SSL_R_SSLV3_ALERT_BAD_CERTIFICATE), "sslv3 alert bad certificate"},
507{ERR_REASON(SSL_R_SSLV3_ALERT_BAD_CERTIFICATE),"sslv3 alert bad certificate"}, 506 {ERR_REASON(SSL_R_SSLV3_ALERT_BAD_RECORD_MAC), "sslv3 alert bad record mac"},
508{ERR_REASON(SSL_R_SSLV3_ALERT_BAD_RECORD_MAC),"sslv3 alert bad record mac"}, 507 {ERR_REASON(SSL_R_SSLV3_ALERT_CERTIFICATE_EXPIRED), "sslv3 alert certificate expired"},
509{ERR_REASON(SSL_R_SSLV3_ALERT_CERTIFICATE_EXPIRED),"sslv3 alert certificate expired"}, 508 {ERR_REASON(SSL_R_SSLV3_ALERT_CERTIFICATE_REVOKED), "sslv3 alert certificate revoked"},
510{ERR_REASON(SSL_R_SSLV3_ALERT_CERTIFICATE_REVOKED),"sslv3 alert certificate revoked"}, 509 {ERR_REASON(SSL_R_SSLV3_ALERT_CERTIFICATE_UNKNOWN), "sslv3 alert certificate unknown"},
511{ERR_REASON(SSL_R_SSLV3_ALERT_CERTIFICATE_UNKNOWN),"sslv3 alert certificate unknown"}, 510 {ERR_REASON(SSL_R_SSLV3_ALERT_DECOMPRESSION_FAILURE), "sslv3 alert decompression failure"},
512{ERR_REASON(SSL_R_SSLV3_ALERT_DECOMPRESSION_FAILURE),"sslv3 alert decompression failure"}, 511 {ERR_REASON(SSL_R_SSLV3_ALERT_HANDSHAKE_FAILURE), "sslv3 alert handshake failure"},
513{ERR_REASON(SSL_R_SSLV3_ALERT_HANDSHAKE_FAILURE),"sslv3 alert handshake failure"}, 512 {ERR_REASON(SSL_R_SSLV3_ALERT_ILLEGAL_PARAMETER), "sslv3 alert illegal parameter"},
514{ERR_REASON(SSL_R_SSLV3_ALERT_ILLEGAL_PARAMETER),"sslv3 alert illegal parameter"}, 513 {ERR_REASON(SSL_R_SSLV3_ALERT_NO_CERTIFICATE), "sslv3 alert no certificate"},
515{ERR_REASON(SSL_R_SSLV3_ALERT_NO_CERTIFICATE),"sslv3 alert no certificate"}, 514 {ERR_REASON(SSL_R_SSLV3_ALERT_UNEXPECTED_MESSAGE), "sslv3 alert unexpected message"},
516{ERR_REASON(SSL_R_SSLV3_ALERT_UNEXPECTED_MESSAGE),"sslv3 alert unexpected message"}, 515 {ERR_REASON(SSL_R_SSLV3_ALERT_UNSUPPORTED_CERTIFICATE), "sslv3 alert unsupported certificate"},
517{ERR_REASON(SSL_R_SSLV3_ALERT_UNSUPPORTED_CERTIFICATE),"sslv3 alert unsupported certificate"}, 516 {ERR_REASON(SSL_R_SSL_CTX_HAS_NO_DEFAULT_SSL_VERSION), "ssl ctx has no default ssl version"},
518{ERR_REASON(SSL_R_SSL_CTX_HAS_NO_DEFAULT_SSL_VERSION),"ssl ctx has no default ssl version"}, 517 {ERR_REASON(SSL_R_SSL_HANDSHAKE_FAILURE) , "ssl handshake failure"},
519{ERR_REASON(SSL_R_SSL_HANDSHAKE_FAILURE) ,"ssl handshake failure"}, 518 {ERR_REASON(SSL_R_SSL_LIBRARY_HAS_NO_CIPHERS), "ssl library has no ciphers"},
520{ERR_REASON(SSL_R_SSL_LIBRARY_HAS_NO_CIPHERS),"ssl library has no ciphers"}, 519 {ERR_REASON(SSL_R_SSL_SESSION_ID_CALLBACK_FAILED), "ssl session id callback failed"},
521{ERR_REASON(SSL_R_SSL_SESSION_ID_CALLBACK_FAILED),"ssl session id callback failed"}, 520 {ERR_REASON(SSL_R_SSL_SESSION_ID_CONFLICT), "ssl session id conflict"},
522{ERR_REASON(SSL_R_SSL_SESSION_ID_CONFLICT),"ssl session id conflict"}, 521 {ERR_REASON(SSL_R_SSL_SESSION_ID_CONTEXT_TOO_LONG), "ssl session id context too long"},
523{ERR_REASON(SSL_R_SSL_SESSION_ID_CONTEXT_TOO_LONG),"ssl session id context too long"}, 522 {ERR_REASON(SSL_R_SSL_SESSION_ID_HAS_BAD_LENGTH), "ssl session id has bad length"},
524{ERR_REASON(SSL_R_SSL_SESSION_ID_HAS_BAD_LENGTH),"ssl session id has bad length"}, 523 {ERR_REASON(SSL_R_SSL_SESSION_ID_IS_DIFFERENT), "ssl session id is different"},
525{ERR_REASON(SSL_R_SSL_SESSION_ID_IS_DIFFERENT),"ssl session id is different"}, 524 {ERR_REASON(SSL_R_TLSV1_ALERT_ACCESS_DENIED), "tlsv1 alert access denied"},
526{ERR_REASON(SSL_R_TLSV1_ALERT_ACCESS_DENIED),"tlsv1 alert access denied"}, 525 {ERR_REASON(SSL_R_TLSV1_ALERT_DECODE_ERROR), "tlsv1 alert decode error"},
527{ERR_REASON(SSL_R_TLSV1_ALERT_DECODE_ERROR),"tlsv1 alert decode error"}, 526 {ERR_REASON(SSL_R_TLSV1_ALERT_DECRYPTION_FAILED), "tlsv1 alert decryption failed"},
528{ERR_REASON(SSL_R_TLSV1_ALERT_DECRYPTION_FAILED),"tlsv1 alert decryption failed"}, 527 {ERR_REASON(SSL_R_TLSV1_ALERT_DECRYPT_ERROR), "tlsv1 alert decrypt error"},
529{ERR_REASON(SSL_R_TLSV1_ALERT_DECRYPT_ERROR),"tlsv1 alert decrypt error"}, 528 {ERR_REASON(SSL_R_TLSV1_ALERT_EXPORT_RESTRICTION), "tlsv1 alert export restriction"},
530{ERR_REASON(SSL_R_TLSV1_ALERT_EXPORT_RESTRICTION),"tlsv1 alert export restriction"}, 529 {ERR_REASON(SSL_R_TLSV1_ALERT_INSUFFICIENT_SECURITY), "tlsv1 alert insufficient security"},
531{ERR_REASON(SSL_R_TLSV1_ALERT_INSUFFICIENT_SECURITY),"tlsv1 alert insufficient security"}, 530 {ERR_REASON(SSL_R_TLSV1_ALERT_INTERNAL_ERROR), "tlsv1 alert internal error"},
532{ERR_REASON(SSL_R_TLSV1_ALERT_INTERNAL_ERROR),"tlsv1 alert internal error"}, 531 {ERR_REASON(SSL_R_TLSV1_ALERT_NO_RENEGOTIATION), "tlsv1 alert no renegotiation"},
533{ERR_REASON(SSL_R_TLSV1_ALERT_NO_RENEGOTIATION),"tlsv1 alert no renegotiation"}, 532 {ERR_REASON(SSL_R_TLSV1_ALERT_PROTOCOL_VERSION), "tlsv1 alert protocol version"},
534{ERR_REASON(SSL_R_TLSV1_ALERT_PROTOCOL_VERSION),"tlsv1 alert protocol version"}, 533 {ERR_REASON(SSL_R_TLSV1_ALERT_RECORD_OVERFLOW), "tlsv1 alert record overflow"},
535{ERR_REASON(SSL_R_TLSV1_ALERT_RECORD_OVERFLOW),"tlsv1 alert record overflow"}, 534 {ERR_REASON(SSL_R_TLSV1_ALERT_UNKNOWN_CA), "tlsv1 alert unknown ca"},
536{ERR_REASON(SSL_R_TLSV1_ALERT_UNKNOWN_CA),"tlsv1 alert unknown ca"}, 535 {ERR_REASON(SSL_R_TLSV1_ALERT_USER_CANCELLED), "tlsv1 alert user cancelled"},
537{ERR_REASON(SSL_R_TLSV1_ALERT_USER_CANCELLED),"tlsv1 alert user cancelled"}, 536 {ERR_REASON(SSL_R_TLSV1_BAD_CERTIFICATE_HASH_VALUE), "tlsv1 bad certificate hash value"},
538{ERR_REASON(SSL_R_TLSV1_BAD_CERTIFICATE_HASH_VALUE),"tlsv1 bad certificate hash value"}, 537 {ERR_REASON(SSL_R_TLSV1_BAD_CERTIFICATE_STATUS_RESPONSE), "tlsv1 bad certificate status response"},
539{ERR_REASON(SSL_R_TLSV1_BAD_CERTIFICATE_STATUS_RESPONSE),"tlsv1 bad certificate status response"}, 538 {ERR_REASON(SSL_R_TLSV1_CERTIFICATE_UNOBTAINABLE), "tlsv1 certificate unobtainable"},
540{ERR_REASON(SSL_R_TLSV1_CERTIFICATE_UNOBTAINABLE),"tlsv1 certificate unobtainable"}, 539 {ERR_REASON(SSL_R_TLSV1_UNRECOGNIZED_NAME), "tlsv1 unrecognized name"},
541{ERR_REASON(SSL_R_TLSV1_UNRECOGNIZED_NAME),"tlsv1 unrecognized name"}, 540 {ERR_REASON(SSL_R_TLSV1_UNSUPPORTED_EXTENSION), "tlsv1 unsupported extension"},
542{ERR_REASON(SSL_R_TLSV1_UNSUPPORTED_EXTENSION),"tlsv1 unsupported extension"}, 541 {ERR_REASON(SSL_R_TLS_CLIENT_CERT_REQ_WITH_ANON_CIPHER), "tls client cert req with anon cipher"},
543{ERR_REASON(SSL_R_TLS_CLIENT_CERT_REQ_WITH_ANON_CIPHER),"tls client cert req with anon cipher"}, 542 {ERR_REASON(SSL_R_TLS_HEARTBEAT_PEER_DOESNT_ACCEPT), "peer does not accept heartbearts"},
544{ERR_REASON(SSL_R_TLS_HEARTBEAT_PEER_DOESNT_ACCEPT),"peer does not accept heartbearts"}, 543 {ERR_REASON(SSL_R_TLS_HEARTBEAT_PENDING) , "heartbeat request already pending"},
545{ERR_REASON(SSL_R_TLS_HEARTBEAT_PENDING) ,"heartbeat request already pending"}, 544 {ERR_REASON(SSL_R_TLS_ILLEGAL_EXPORTER_LABEL), "tls illegal exporter label"},
546{ERR_REASON(SSL_R_TLS_ILLEGAL_EXPORTER_LABEL),"tls illegal exporter label"}, 545 {ERR_REASON(SSL_R_TLS_INVALID_ECPOINTFORMAT_LIST), "tls invalid ecpointformat list"},
547{ERR_REASON(SSL_R_TLS_INVALID_ECPOINTFORMAT_LIST),"tls invalid ecpointformat list"}, 546 {ERR_REASON(SSL_R_TLS_PEER_DID_NOT_RESPOND_WITH_CERTIFICATE_LIST), "tls peer did not respond with certificate list"},
548{ERR_REASON(SSL_R_TLS_PEER_DID_NOT_RESPOND_WITH_CERTIFICATE_LIST),"tls peer did not respond with certificate list"}, 547 {ERR_REASON(SSL_R_TLS_RSA_ENCRYPTED_VALUE_LENGTH_IS_WRONG), "tls rsa encrypted value length is wrong"},
549{ERR_REASON(SSL_R_TLS_RSA_ENCRYPTED_VALUE_LENGTH_IS_WRONG),"tls rsa encrypted value length is wrong"}, 548 {ERR_REASON(SSL_R_TRIED_TO_USE_UNSUPPORTED_CIPHER), "tried to use unsupported cipher"},
550{ERR_REASON(SSL_R_TRIED_TO_USE_UNSUPPORTED_CIPHER),"tried to use unsupported cipher"}, 549 {ERR_REASON(SSL_R_UNABLE_TO_DECODE_DH_CERTS), "unable to decode dh certs"},
551{ERR_REASON(SSL_R_UNABLE_TO_DECODE_DH_CERTS),"unable to decode dh certs"}, 550 {ERR_REASON(SSL_R_UNABLE_TO_DECODE_ECDH_CERTS), "unable to decode ecdh certs"},
552{ERR_REASON(SSL_R_UNABLE_TO_DECODE_ECDH_CERTS),"unable to decode ecdh certs"}, 551 {ERR_REASON(SSL_R_UNABLE_TO_EXTRACT_PUBLIC_KEY), "unable to extract public key"},
553{ERR_REASON(SSL_R_UNABLE_TO_EXTRACT_PUBLIC_KEY),"unable to extract public key"}, 552 {ERR_REASON(SSL_R_UNABLE_TO_FIND_DH_PARAMETERS), "unable to find dh parameters"},
554{ERR_REASON(SSL_R_UNABLE_TO_FIND_DH_PARAMETERS),"unable to find dh parameters"}, 553 {ERR_REASON(SSL_R_UNABLE_TO_FIND_ECDH_PARAMETERS), "unable to find ecdh parameters"},
555{ERR_REASON(SSL_R_UNABLE_TO_FIND_ECDH_PARAMETERS),"unable to find ecdh parameters"}, 554 {ERR_REASON(SSL_R_UNABLE_TO_FIND_PUBLIC_KEY_PARAMETERS), "unable to find public key parameters"},
556{ERR_REASON(SSL_R_UNABLE_TO_FIND_PUBLIC_KEY_PARAMETERS),"unable to find public key parameters"}, 555 {ERR_REASON(SSL_R_UNABLE_TO_FIND_SSL_METHOD), "unable to find ssl method"},
557{ERR_REASON(SSL_R_UNABLE_TO_FIND_SSL_METHOD),"unable to find ssl method"}, 556 {ERR_REASON(SSL_R_UNABLE_TO_LOAD_SSL2_MD5_ROUTINES), "unable to load ssl2 md5 routines"},
558{ERR_REASON(SSL_R_UNABLE_TO_LOAD_SSL2_MD5_ROUTINES),"unable to load ssl2 md5 routines"}, 557 {ERR_REASON(SSL_R_UNABLE_TO_LOAD_SSL3_MD5_ROUTINES), "unable to load ssl3 md5 routines"},
559{ERR_REASON(SSL_R_UNABLE_TO_LOAD_SSL3_MD5_ROUTINES),"unable to load ssl3 md5 routines"}, 558 {ERR_REASON(SSL_R_UNABLE_TO_LOAD_SSL3_SHA1_ROUTINES), "unable to load ssl3 sha1 routines"},
560{ERR_REASON(SSL_R_UNABLE_TO_LOAD_SSL3_SHA1_ROUTINES),"unable to load ssl3 sha1 routines"}, 559 {ERR_REASON(SSL_R_UNEXPECTED_MESSAGE) , "unexpected message"},
561{ERR_REASON(SSL_R_UNEXPECTED_MESSAGE) ,"unexpected message"}, 560 {ERR_REASON(SSL_R_UNEXPECTED_RECORD) , "unexpected record"},
562{ERR_REASON(SSL_R_UNEXPECTED_RECORD) ,"unexpected record"}, 561 {ERR_REASON(SSL_R_UNINITIALIZED) , "uninitialized"},
563{ERR_REASON(SSL_R_UNINITIALIZED) ,"uninitialized"}, 562 {ERR_REASON(SSL_R_UNKNOWN_ALERT_TYPE) , "unknown alert type"},
564{ERR_REASON(SSL_R_UNKNOWN_ALERT_TYPE) ,"unknown alert type"}, 563 {ERR_REASON(SSL_R_UNKNOWN_CERTIFICATE_TYPE), "unknown certificate type"},
565{ERR_REASON(SSL_R_UNKNOWN_CERTIFICATE_TYPE),"unknown certificate type"}, 564 {ERR_REASON(SSL_R_UNKNOWN_CIPHER_RETURNED), "unknown cipher returned"},
566{ERR_REASON(SSL_R_UNKNOWN_CIPHER_RETURNED),"unknown cipher returned"}, 565 {ERR_REASON(SSL_R_UNKNOWN_CIPHER_TYPE) , "unknown cipher type"},
567{ERR_REASON(SSL_R_UNKNOWN_CIPHER_TYPE) ,"unknown cipher type"}, 566 {ERR_REASON(SSL_R_UNKNOWN_DIGEST) , "unknown digest"},
568{ERR_REASON(SSL_R_UNKNOWN_DIGEST) ,"unknown digest"}, 567 {ERR_REASON(SSL_R_UNKNOWN_KEY_EXCHANGE_TYPE), "unknown key exchange type"},
569{ERR_REASON(SSL_R_UNKNOWN_KEY_EXCHANGE_TYPE),"unknown key exchange type"}, 568 {ERR_REASON(SSL_R_UNKNOWN_PKEY_TYPE) , "unknown pkey type"},
570{ERR_REASON(SSL_R_UNKNOWN_PKEY_TYPE) ,"unknown pkey type"}, 569 {ERR_REASON(SSL_R_UNKNOWN_PROTOCOL) , "unknown protocol"},
571{ERR_REASON(SSL_R_UNKNOWN_PROTOCOL) ,"unknown protocol"}, 570 {ERR_REASON(SSL_R_UNKNOWN_REMOTE_ERROR_TYPE), "unknown remote error type"},
572{ERR_REASON(SSL_R_UNKNOWN_REMOTE_ERROR_TYPE),"unknown remote error type"}, 571 {ERR_REASON(SSL_R_UNKNOWN_SSL_VERSION) , "unknown ssl version"},
573{ERR_REASON(SSL_R_UNKNOWN_SSL_VERSION) ,"unknown ssl version"}, 572 {ERR_REASON(SSL_R_UNKNOWN_STATE) , "unknown state"},
574{ERR_REASON(SSL_R_UNKNOWN_STATE) ,"unknown state"}, 573 {ERR_REASON(SSL_R_UNSAFE_LEGACY_RENEGOTIATION_DISABLED), "unsafe legacy renegotiation disabled"},
575{ERR_REASON(SSL_R_UNSAFE_LEGACY_RENEGOTIATION_DISABLED),"unsafe legacy renegotiation disabled"}, 574 {ERR_REASON(SSL_R_UNSUPPORTED_CIPHER) , "unsupported cipher"},
576{ERR_REASON(SSL_R_UNSUPPORTED_CIPHER) ,"unsupported cipher"}, 575 {ERR_REASON(SSL_R_UNSUPPORTED_COMPRESSION_ALGORITHM), "unsupported compression algorithm"},
577{ERR_REASON(SSL_R_UNSUPPORTED_COMPRESSION_ALGORITHM),"unsupported compression algorithm"}, 576 {ERR_REASON(SSL_R_UNSUPPORTED_DIGEST_TYPE), "unsupported digest type"},
578{ERR_REASON(SSL_R_UNSUPPORTED_DIGEST_TYPE),"unsupported digest type"}, 577 {ERR_REASON(SSL_R_UNSUPPORTED_ELLIPTIC_CURVE), "unsupported elliptic curve"},
579{ERR_REASON(SSL_R_UNSUPPORTED_ELLIPTIC_CURVE),"unsupported elliptic curve"}, 578 {ERR_REASON(SSL_R_UNSUPPORTED_PROTOCOL) , "unsupported protocol"},
580{ERR_REASON(SSL_R_UNSUPPORTED_PROTOCOL) ,"unsupported protocol"}, 579 {ERR_REASON(SSL_R_UNSUPPORTED_SSL_VERSION), "unsupported ssl version"},
581{ERR_REASON(SSL_R_UNSUPPORTED_SSL_VERSION),"unsupported ssl version"}, 580 {ERR_REASON(SSL_R_UNSUPPORTED_STATUS_TYPE), "unsupported status type"},
582{ERR_REASON(SSL_R_UNSUPPORTED_STATUS_TYPE),"unsupported status type"}, 581 {ERR_REASON(SSL_R_USE_SRTP_NOT_NEGOTIATED), "use srtp not negotiated"},
583{ERR_REASON(SSL_R_USE_SRTP_NOT_NEGOTIATED),"use srtp not negotiated"}, 582 {ERR_REASON(SSL_R_WRITE_BIO_NOT_SET) , "write bio not set"},
584{ERR_REASON(SSL_R_WRITE_BIO_NOT_SET) ,"write bio not set"}, 583 {ERR_REASON(SSL_R_WRONG_CIPHER_RETURNED) , "wrong cipher returned"},
585{ERR_REASON(SSL_R_WRONG_CIPHER_RETURNED) ,"wrong cipher returned"}, 584 {ERR_REASON(SSL_R_WRONG_MESSAGE_TYPE) , "wrong message type"},
586{ERR_REASON(SSL_R_WRONG_MESSAGE_TYPE) ,"wrong message type"}, 585 {ERR_REASON(SSL_R_WRONG_NUMBER_OF_KEY_BITS), "wrong number of key bits"},
587{ERR_REASON(SSL_R_WRONG_NUMBER_OF_KEY_BITS),"wrong number of key bits"}, 586 {ERR_REASON(SSL_R_WRONG_SIGNATURE_LENGTH), "wrong signature length"},
588{ERR_REASON(SSL_R_WRONG_SIGNATURE_LENGTH),"wrong signature length"}, 587 {ERR_REASON(SSL_R_WRONG_SIGNATURE_SIZE) , "wrong signature size"},
589{ERR_REASON(SSL_R_WRONG_SIGNATURE_SIZE) ,"wrong signature size"}, 588 {ERR_REASON(SSL_R_WRONG_SIGNATURE_TYPE) , "wrong signature type"},
590{ERR_REASON(SSL_R_WRONG_SIGNATURE_TYPE) ,"wrong signature type"}, 589 {ERR_REASON(SSL_R_WRONG_SSL_VERSION) , "wrong ssl version"},
591{ERR_REASON(SSL_R_WRONG_SSL_VERSION) ,"wrong ssl version"}, 590 {ERR_REASON(SSL_R_WRONG_VERSION_NUMBER) , "wrong version number"},
592{ERR_REASON(SSL_R_WRONG_VERSION_NUMBER) ,"wrong version number"}, 591 {ERR_REASON(SSL_R_X509_LIB) , "x509 lib"},
593{ERR_REASON(SSL_R_X509_LIB) ,"x509 lib"}, 592 {ERR_REASON(SSL_R_X509_VERIFICATION_SETUP_PROBLEMS), "x509 verification setup problems"},
594{ERR_REASON(SSL_R_X509_VERIFICATION_SETUP_PROBLEMS),"x509 verification setup problems"}, 593 {0, NULL}
595{0,NULL} 594};
596 };
597 595
598#endif 596#endif
599 597
600void ERR_load_SSL_strings(void) 598void
601 { 599ERR_load_SSL_strings(void)
600{
602#ifndef OPENSSL_NO_ERR 601#ifndef OPENSSL_NO_ERR
603 602
604 if (ERR_func_error_string(SSL_str_functs[0].error) == NULL) 603 if (ERR_func_error_string(SSL_str_functs[0].error) == NULL) {
605 { 604 ERR_load_strings(0, SSL_str_functs);
606 ERR_load_strings(0,SSL_str_functs); 605 ERR_load_strings(0, SSL_str_reasons);
607 ERR_load_strings(0,SSL_str_reasons);
608 }
609#endif
610 } 606 }
607#endif
608}
diff --git a/src/lib/libssl/src/ssl/ssl_err2.c b/src/lib/libssl/src/ssl/ssl_err2.c
index ea95a5f983..cd781d38aa 100644
--- a/src/lib/libssl/src/ssl/ssl_err2.c
+++ b/src/lib/libssl/src/ssl/ssl_err2.c
@@ -60,11 +60,12 @@
60#include <openssl/err.h> 60#include <openssl/err.h>
61#include <openssl/ssl.h> 61#include <openssl/ssl.h>
62 62
63void SSL_load_error_strings(void) 63void
64 { 64SSL_load_error_strings(void)
65{
65#ifndef OPENSSL_NO_ERR 66#ifndef OPENSSL_NO_ERR
66 ERR_load_crypto_strings(); 67 ERR_load_crypto_strings();
67 ERR_load_SSL_strings(); 68 ERR_load_SSL_strings();
68#endif 69#endif
69 } 70}
70 71
diff --git a/src/lib/libssl/src/ssl/ssl_lib.c b/src/lib/libssl/src/ssl/ssl_lib.c
index d9a728493e..98764b82aa 100644
--- a/src/lib/libssl/src/ssl/ssl_lib.c
+++ b/src/lib/libssl/src/ssl/ssl_lib.c
@@ -160,11 +160,11 @@
160#include <openssl/engine.h> 160#include <openssl/engine.h>
161#endif 161#endif
162 162
163const char *SSL_version_str=OPENSSL_VERSION_TEXT; 163const char *SSL_version_str = OPENSSL_VERSION_TEXT;
164 164
165SSL3_ENC_METHOD ssl3_undef_enc_method={ 165SSL3_ENC_METHOD ssl3_undef_enc_method = {
166 /* evil casts, but these functions are only called if there's a library bug */ 166 /* evil casts, but these functions are only called if there's a library bug */
167 (int (*)(SSL *,int))ssl_undefined_function, 167 (int (*)(SSL *, int))ssl_undefined_function,
168 (int (*)(SSL *, unsigned char *, int))ssl_undefined_function, 168 (int (*)(SSL *, unsigned char *, int))ssl_undefined_function,
169 ssl_undefined_function, 169 ssl_undefined_function,
170 (int (*)(SSL *, unsigned char *, unsigned char *, int))ssl_undefined_function, 170 (int (*)(SSL *, unsigned char *, unsigned char *, int))ssl_undefined_function,
@@ -178,129 +178,124 @@ SSL3_ENC_METHOD ssl3_undef_enc_method={
178 0, /* server_finished_label_len */ 178 0, /* server_finished_label_len */
179 (int (*)(int))ssl_undefined_function, 179 (int (*)(int))ssl_undefined_function,
180 (int (*)(SSL *, unsigned char *, size_t, const char *, 180 (int (*)(SSL *, unsigned char *, size_t, const char *,
181 size_t, const unsigned char *, size_t, 181 size_t, const unsigned char *, size_t,
182 int use_context)) ssl_undefined_function, 182 int use_context)) ssl_undefined_function,
183 }; 183};
184 184
185int SSL_clear(SSL *s) 185int
186 { 186SSL_clear(SSL *s)
187{
187 188
188 if (s->method == NULL) 189 if (s->method == NULL) {
189 { 190 SSLerr(SSL_F_SSL_CLEAR, SSL_R_NO_METHOD_SPECIFIED);
190 SSLerr(SSL_F_SSL_CLEAR,SSL_R_NO_METHOD_SPECIFIED); 191 return (0);
191 return(0); 192 }
192 }
193 193
194 if (ssl_clear_bad_session(s)) 194 if (ssl_clear_bad_session(s)) {
195 {
196 SSL_SESSION_free(s->session); 195 SSL_SESSION_free(s->session);
197 s->session=NULL; 196 s->session = NULL;
198 } 197 }
199 198
200 s->error=0; 199 s->error = 0;
201 s->hit=0; 200 s->hit = 0;
202 s->shutdown=0; 201 s->shutdown = 0;
203 202
204#if 0 /* Disabled since version 1.10 of this file (early return not 203#if 0 /* Disabled since version 1.10 of this file (early return not
205 * needed because SSL_clear is not called when doing renegotiation) */ 204 * needed because SSL_clear is not called when doing renegotiation) */
206 /* This is set if we are doing dynamic renegotiation so keep 205 /* This is set if we are doing dynamic renegotiation so keep
207 * the old cipher. It is sort of a SSL_clear_lite :-) */ 206 * the old cipher. It is sort of a SSL_clear_lite :-) */
208 if (s->renegotiate) return(1);
209#else
210 if (s->renegotiate) 207 if (s->renegotiate)
211 { 208 return (1);
212 SSLerr(SSL_F_SSL_CLEAR,ERR_R_INTERNAL_ERROR); 209#else
210 if (s->renegotiate) {
211 SSLerr(SSL_F_SSL_CLEAR, ERR_R_INTERNAL_ERROR);
213 return 0; 212 return 0;
214 } 213 }
215#endif 214#endif
216 215
217 s->type=0; 216 s->type = 0;
218 217
219 s->state=SSL_ST_BEFORE|((s->server)?SSL_ST_ACCEPT:SSL_ST_CONNECT); 218 s->state = SSL_ST_BEFORE|((s->server) ? SSL_ST_ACCEPT : SSL_ST_CONNECT);
220 219
221 s->version=s->method->version; 220 s->version = s->method->version;
222 s->client_version=s->version; 221 s->client_version = s->version;
223 s->rwstate=SSL_NOTHING; 222 s->rwstate = SSL_NOTHING;
224 s->rstate=SSL_ST_READ_HEADER; 223 s->rstate = SSL_ST_READ_HEADER;
225#if 0 224#if 0
226 s->read_ahead=s->ctx->read_ahead; 225 s->read_ahead = s->ctx->read_ahead;
227#endif 226#endif
228 227
229 if (s->init_buf != NULL) 228 if (s->init_buf != NULL) {
230 {
231 BUF_MEM_free(s->init_buf); 229 BUF_MEM_free(s->init_buf);
232 s->init_buf=NULL; 230 s->init_buf = NULL;
233 } 231 }
234 232
235 ssl_clear_cipher_ctx(s); 233 ssl_clear_cipher_ctx(s);
236 ssl_clear_hash_ctx(&s->read_hash); 234 ssl_clear_hash_ctx(&s->read_hash);
237 ssl_clear_hash_ctx(&s->write_hash); 235 ssl_clear_hash_ctx(&s->write_hash);
238 236
239 s->first_packet=0; 237 s->first_packet = 0;
240 238
241#if 1 239#if 1
242 /* Check to see if we were changed into a different method, if 240 /* Check to see if we were changed into a different method, if
243 * so, revert back if we are not doing session-id reuse. */ 241 * so, revert back if we are not doing session-id reuse. */
244 if (!s->in_handshake && (s->session == NULL) && (s->method != s->ctx->method)) 242 if (!s->in_handshake && (s->session == NULL) && (s->method != s->ctx->method)) {
245 {
246 s->method->ssl_free(s); 243 s->method->ssl_free(s);
247 s->method=s->ctx->method; 244 s->method = s->ctx->method;
248 if (!s->method->ssl_new(s)) 245 if (!s->method->ssl_new(s))
249 return(0); 246 return (0);
250 } 247 } else
251 else
252#endif 248#endif
253 s->method->ssl_clear(s); 249 s->method->ssl_clear(s);
254 return(1); 250 return (1);
255 } 251}
256 252
257/** Used to change an SSL_CTXs default SSL method type */ 253/** Used to change an SSL_CTXs default SSL method type */
258int SSL_CTX_set_ssl_version(SSL_CTX *ctx,const SSL_METHOD *meth) 254int
259 { 255SSL_CTX_set_ssl_version(SSL_CTX *ctx, const SSL_METHOD *meth)
256{
260 STACK_OF(SSL_CIPHER) *sk; 257 STACK_OF(SSL_CIPHER) *sk;
261 258
262 ctx->method=meth; 259 ctx->method = meth;
263 260
264 sk=ssl_create_cipher_list(ctx->method,&(ctx->cipher_list), 261 sk = ssl_create_cipher_list(ctx->method, &(ctx->cipher_list),
265 &(ctx->cipher_list_by_id), 262 &(ctx->cipher_list_by_id),
266 meth->version == SSL2_VERSION ? "SSLv2" : SSL_DEFAULT_CIPHER_LIST); 263 meth->version == SSL2_VERSION ? "SSLv2" : SSL_DEFAULT_CIPHER_LIST);
267 if ((sk == NULL) || (sk_SSL_CIPHER_num(sk) <= 0)) 264 if ((sk == NULL) || (sk_SSL_CIPHER_num(sk) <= 0)) {
268 { 265 SSLerr(SSL_F_SSL_CTX_SET_SSL_VERSION, SSL_R_SSL_LIBRARY_HAS_NO_CIPHERS);
269 SSLerr(SSL_F_SSL_CTX_SET_SSL_VERSION,SSL_R_SSL_LIBRARY_HAS_NO_CIPHERS); 266 return (0);
270 return(0);
271 }
272 return(1);
273 } 267 }
268 return (1);
269}
274 270
275SSL *SSL_new(SSL_CTX *ctx) 271SSL
276 { 272*SSL_new(SSL_CTX *ctx)
273{
277 SSL *s; 274 SSL *s;
278 275
279 if (ctx == NULL) 276 if (ctx == NULL) {
280 { 277 SSLerr(SSL_F_SSL_NEW, SSL_R_NULL_SSL_CTX);
281 SSLerr(SSL_F_SSL_NEW,SSL_R_NULL_SSL_CTX); 278 return (NULL);
282 return(NULL); 279 }
283 } 280 if (ctx->method == NULL) {
284 if (ctx->method == NULL) 281 SSLerr(SSL_F_SSL_NEW, SSL_R_SSL_CTX_HAS_NO_DEFAULT_SSL_VERSION);
285 { 282 return (NULL);
286 SSLerr(SSL_F_SSL_NEW,SSL_R_SSL_CTX_HAS_NO_DEFAULT_SSL_VERSION); 283 }
287 return(NULL);
288 }
289 284
290 s=(SSL *)OPENSSL_malloc(sizeof(SSL)); 285 s = (SSL *)OPENSSL_malloc(sizeof(SSL));
291 if (s == NULL) goto err; 286 if (s == NULL)
292 memset(s,0,sizeof(SSL)); 287 goto err;
288 memset(s, 0, sizeof(SSL));
293 289
294#ifndef OPENSSL_NO_KRB5 290#ifndef OPENSSL_NO_KRB5
295 s->kssl_ctx = kssl_ctx_new(); 291 s->kssl_ctx = kssl_ctx_new();
296#endif /* OPENSSL_NO_KRB5 */ 292#endif /* OPENSSL_NO_KRB5 */
297 293
298 s->options=ctx->options; 294 s->options = ctx->options;
299 s->mode=ctx->mode; 295 s->mode = ctx->mode;
300 s->max_cert_list=ctx->max_cert_list; 296 s->max_cert_list = ctx->max_cert_list;
301 297
302 if (ctx->cert != NULL) 298 if (ctx->cert != NULL) {
303 {
304 /* Earlier library versions used to copy the pointer to 299 /* Earlier library versions used to copy the pointer to
305 * the CERT, not its contents; only when setting new 300 * the CERT, not its contents; only when setting new
306 * parameters for the per-SSL copy, ssl_cert_new would be 301 * parameters for the per-SSL copy, ssl_cert_new would be
@@ -314,22 +309,21 @@ SSL *SSL_new(SSL_CTX *ctx)
314 s->cert = ssl_cert_dup(ctx->cert); 309 s->cert = ssl_cert_dup(ctx->cert);
315 if (s->cert == NULL) 310 if (s->cert == NULL)
316 goto err; 311 goto err;
317 } 312 } else
318 else
319 s->cert=NULL; /* Cannot really happen (see SSL_CTX_new) */ 313 s->cert=NULL; /* Cannot really happen (see SSL_CTX_new) */
320 314
321 s->read_ahead=ctx->read_ahead; 315 s->read_ahead = ctx->read_ahead;
322 s->msg_callback=ctx->msg_callback; 316 s->msg_callback = ctx->msg_callback;
323 s->msg_callback_arg=ctx->msg_callback_arg; 317 s->msg_callback_arg = ctx->msg_callback_arg;
324 s->verify_mode=ctx->verify_mode; 318 s->verify_mode = ctx->verify_mode;
325#if 0 319#if 0
326 s->verify_depth=ctx->verify_depth; 320 s->verify_depth = ctx->verify_depth;
327#endif 321#endif
328 s->sid_ctx_length=ctx->sid_ctx_length; 322 s->sid_ctx_length = ctx->sid_ctx_length;
329 OPENSSL_assert(s->sid_ctx_length <= sizeof s->sid_ctx); 323 OPENSSL_assert(s->sid_ctx_length <= sizeof s->sid_ctx);
330 memcpy(&s->sid_ctx,&ctx->sid_ctx,sizeof(s->sid_ctx)); 324 memcpy(&s->sid_ctx, &ctx->sid_ctx, sizeof(s->sid_ctx));
331 s->verify_callback=ctx->default_verify_callback; 325 s->verify_callback = ctx->default_verify_callback;
332 s->generate_session_id=ctx->generate_session_id; 326 s->generate_session_id = ctx->generate_session_id;
333 327
334 s->param = X509_VERIFY_PARAM_new(); 328 s->param = X509_VERIFY_PARAM_new();
335 if (!s->param) 329 if (!s->param)
@@ -339,11 +333,11 @@ SSL *SSL_new(SSL_CTX *ctx)
339 s->purpose = ctx->purpose; 333 s->purpose = ctx->purpose;
340 s->trust = ctx->trust; 334 s->trust = ctx->trust;
341#endif 335#endif
342 s->quiet_shutdown=ctx->quiet_shutdown; 336 s->quiet_shutdown = ctx->quiet_shutdown;
343 s->max_send_fragment = ctx->max_send_fragment; 337 s->max_send_fragment = ctx->max_send_fragment;
344 338
345 CRYPTO_add(&ctx->references,1,CRYPTO_LOCK_SSL_CTX); 339 CRYPTO_add(&ctx->references, 1, CRYPTO_LOCK_SSL_CTX);
346 s->ctx=ctx; 340 s->ctx = ctx;
347#ifndef OPENSSL_NO_TLSEXT 341#ifndef OPENSSL_NO_TLSEXT
348 s->tlsext_debug_cb = 0; 342 s->tlsext_debug_cb = 0;
349 s->tlsext_debug_arg = NULL; 343 s->tlsext_debug_arg = NULL;
@@ -354,93 +348,95 @@ SSL *SSL_new(SSL_CTX *ctx)
354 s->tlsext_ocsp_exts = NULL; 348 s->tlsext_ocsp_exts = NULL;
355 s->tlsext_ocsp_resp = NULL; 349 s->tlsext_ocsp_resp = NULL;
356 s->tlsext_ocsp_resplen = -1; 350 s->tlsext_ocsp_resplen = -1;
357 CRYPTO_add(&ctx->references,1,CRYPTO_LOCK_SSL_CTX); 351 CRYPTO_add(&ctx->references, 1, CRYPTO_LOCK_SSL_CTX);
358 s->initial_ctx=ctx; 352 s->initial_ctx = ctx;
359# ifndef OPENSSL_NO_NEXTPROTONEG 353# ifndef OPENSSL_NO_NEXTPROTONEG
360 s->next_proto_negotiated = NULL; 354 s->next_proto_negotiated = NULL;
361# endif 355# endif
362#endif 356#endif
363 357
364 s->verify_result=X509_V_OK; 358 s->verify_result = X509_V_OK;
365 359
366 s->method=ctx->method; 360 s->method = ctx->method;
367 361
368 if (!s->method->ssl_new(s)) 362 if (!s->method->ssl_new(s))
369 goto err; 363 goto err;
370 364
371 s->references=1; 365 s->references = 1;
372 s->server=(ctx->method->ssl_accept == ssl_undefined_function)?0:1; 366 s->server = (ctx->method->ssl_accept == ssl_undefined_function) ? 0 : 1;
373 367
374 SSL_clear(s); 368 SSL_clear(s);
375 369
376 CRYPTO_new_ex_data(CRYPTO_EX_INDEX_SSL, s, &s->ex_data); 370 CRYPTO_new_ex_data(CRYPTO_EX_INDEX_SSL, s, &s->ex_data);
377 371
378#ifndef OPENSSL_NO_PSK 372#ifndef OPENSSL_NO_PSK
379 s->psk_client_callback=ctx->psk_client_callback; 373 s->psk_client_callback = ctx->psk_client_callback;
380 s->psk_server_callback=ctx->psk_server_callback; 374 s->psk_server_callback = ctx->psk_server_callback;
381#endif 375#endif
382 376
383 return(s); 377 return (s);
384err: 378err:
385 if (s != NULL) 379 if (s != NULL) {
386 {
387 if (s->cert != NULL) 380 if (s->cert != NULL)
388 ssl_cert_free(s->cert); 381 ssl_cert_free(s->cert);
389 if (s->ctx != NULL) 382 if (s->ctx != NULL)
390 SSL_CTX_free(s->ctx); /* decrement reference count */ 383 SSL_CTX_free(s->ctx); /* decrement reference count */
391 OPENSSL_free(s); 384 OPENSSL_free(s);
392 }
393 SSLerr(SSL_F_SSL_NEW,ERR_R_MALLOC_FAILURE);
394 return(NULL);
395 } 385 }
386 SSLerr(SSL_F_SSL_NEW, ERR_R_MALLOC_FAILURE);
387 return (NULL);
388}
396 389
397int SSL_CTX_set_session_id_context(SSL_CTX *ctx,const unsigned char *sid_ctx, 390int
398 unsigned int sid_ctx_len) 391SSL_CTX_set_session_id_context(SSL_CTX *ctx, const unsigned char *sid_ctx,
399 { 392 unsigned int sid_ctx_len)
400 if(sid_ctx_len > sizeof ctx->sid_ctx) 393{
401 { 394 if (sid_ctx_len > sizeof ctx->sid_ctx) {
402 SSLerr(SSL_F_SSL_CTX_SET_SESSION_ID_CONTEXT,SSL_R_SSL_SESSION_ID_CONTEXT_TOO_LONG); 395 SSLerr(SSL_F_SSL_CTX_SET_SESSION_ID_CONTEXT, SSL_R_SSL_SESSION_ID_CONTEXT_TOO_LONG);
403 return 0; 396 return 0;
404 } 397 }
405 ctx->sid_ctx_length=sid_ctx_len; 398 ctx->sid_ctx_length = sid_ctx_len;
406 memcpy(ctx->sid_ctx,sid_ctx,sid_ctx_len); 399 memcpy(ctx->sid_ctx, sid_ctx, sid_ctx_len);
407 400
408 return 1; 401 return 1;
409 } 402}
410 403
411int SSL_set_session_id_context(SSL *ssl,const unsigned char *sid_ctx, 404int
412 unsigned int sid_ctx_len) 405SSL_set_session_id_context(SSL *ssl, const unsigned char *sid_ctx,
413 { 406 unsigned int sid_ctx_len)
414 if(sid_ctx_len > SSL_MAX_SID_CTX_LENGTH) 407{
415 { 408 if (sid_ctx_len > SSL_MAX_SID_CTX_LENGTH) {
416 SSLerr(SSL_F_SSL_SET_SESSION_ID_CONTEXT,SSL_R_SSL_SESSION_ID_CONTEXT_TOO_LONG); 409 SSLerr(SSL_F_SSL_SET_SESSION_ID_CONTEXT, SSL_R_SSL_SESSION_ID_CONTEXT_TOO_LONG);
417 return 0; 410 return 0;
418 } 411 }
419 ssl->sid_ctx_length=sid_ctx_len; 412 ssl->sid_ctx_length = sid_ctx_len;
420 memcpy(ssl->sid_ctx,sid_ctx,sid_ctx_len); 413 memcpy(ssl->sid_ctx, sid_ctx, sid_ctx_len);
421 414
422 return 1; 415 return 1;
423 } 416}
424 417
425int SSL_CTX_set_generate_session_id(SSL_CTX *ctx, GEN_SESSION_CB cb) 418int
426 { 419SSL_CTX_set_generate_session_id(SSL_CTX *ctx, GEN_SESSION_CB cb)
420{
427 CRYPTO_w_lock(CRYPTO_LOCK_SSL_CTX); 421 CRYPTO_w_lock(CRYPTO_LOCK_SSL_CTX);
428 ctx->generate_session_id = cb; 422 ctx->generate_session_id = cb;
429 CRYPTO_w_unlock(CRYPTO_LOCK_SSL_CTX); 423 CRYPTO_w_unlock(CRYPTO_LOCK_SSL_CTX);
430 return 1; 424 return 1;
431 } 425}
432 426
433int SSL_set_generate_session_id(SSL *ssl, GEN_SESSION_CB cb) 427int
434 { 428SSL_set_generate_session_id(SSL *ssl, GEN_SESSION_CB cb)
429{
435 CRYPTO_w_lock(CRYPTO_LOCK_SSL); 430 CRYPTO_w_lock(CRYPTO_LOCK_SSL);
436 ssl->generate_session_id = cb; 431 ssl->generate_session_id = cb;
437 CRYPTO_w_unlock(CRYPTO_LOCK_SSL); 432 CRYPTO_w_unlock(CRYPTO_LOCK_SSL);
438 return 1; 433 return 1;
439 } 434}
440 435
441int SSL_has_matching_session_id(const SSL *ssl, const unsigned char *id, 436int
442 unsigned int id_len) 437SSL_has_matching_session_id(const SSL *ssl, const unsigned char *id,
443 { 438 unsigned int id_len)
439{
444 /* A quick examination of SSL_SESSION_hash and SSL_SESSION_cmp shows how 440 /* A quick examination of SSL_SESSION_hash and SSL_SESSION_cmp shows how
445 * we can "construct" a session to give us the desired check - ie. to 441 * we can "construct" a session to give us the desired check - ie. to
446 * find if there's a session in the hash table that would conflict with 442 * find if there's a session in the hash table that would conflict with
@@ -448,7 +444,7 @@ int SSL_has_matching_session_id(const SSL *ssl, const unsigned char *id,
448 * use by this SSL. */ 444 * use by this SSL. */
449 SSL_SESSION r, *p; 445 SSL_SESSION r, *p;
450 446
451 if(id_len > sizeof r.session_id) 447 if (id_len > sizeof r.session_id)
452 return 0; 448 return 0;
453 449
454 r.ssl_version = ssl->version; 450 r.ssl_version = ssl->version;
@@ -458,68 +454,74 @@ int SSL_has_matching_session_id(const SSL *ssl, const unsigned char *id,
458 * callback is calling us to check the uniqueness of a shorter ID, it 454 * callback is calling us to check the uniqueness of a shorter ID, it
459 * must be compared as a padded-out ID because that is what it will be 455 * must be compared as a padded-out ID because that is what it will be
460 * converted to when the callback has finished choosing it. */ 456 * converted to when the callback has finished choosing it. */
461 if((r.ssl_version == SSL2_VERSION) && 457 if ((r.ssl_version == SSL2_VERSION) &&
462 (id_len < SSL2_SSL_SESSION_ID_LENGTH)) 458 (id_len < SSL2_SSL_SESSION_ID_LENGTH)) {
463 {
464 memset(r.session_id + id_len, 0, 459 memset(r.session_id + id_len, 0,
465 SSL2_SSL_SESSION_ID_LENGTH - id_len); 460 SSL2_SSL_SESSION_ID_LENGTH - id_len);
466 r.session_id_length = SSL2_SSL_SESSION_ID_LENGTH; 461 r.session_id_length = SSL2_SSL_SESSION_ID_LENGTH;
467 } 462 }
468 463
469 CRYPTO_r_lock(CRYPTO_LOCK_SSL_CTX); 464 CRYPTO_r_lock(CRYPTO_LOCK_SSL_CTX);
470 p = lh_SSL_SESSION_retrieve(ssl->ctx->sessions, &r); 465 p = lh_SSL_SESSION_retrieve(ssl->ctx->sessions, &r);
471 CRYPTO_r_unlock(CRYPTO_LOCK_SSL_CTX); 466 CRYPTO_r_unlock(CRYPTO_LOCK_SSL_CTX);
472 return (p != NULL); 467 return (p != NULL);
473 } 468}
474 469
475int SSL_CTX_set_purpose(SSL_CTX *s, int purpose) 470int
476 { 471SSL_CTX_set_purpose(SSL_CTX *s, int purpose)
472{
477 return X509_VERIFY_PARAM_set_purpose(s->param, purpose); 473 return X509_VERIFY_PARAM_set_purpose(s->param, purpose);
478 } 474}
479 475
480int SSL_set_purpose(SSL *s, int purpose) 476int
481 { 477SSL_set_purpose(SSL *s, int purpose)
478{
482 return X509_VERIFY_PARAM_set_purpose(s->param, purpose); 479 return X509_VERIFY_PARAM_set_purpose(s->param, purpose);
483 } 480}
484 481
485int SSL_CTX_set_trust(SSL_CTX *s, int trust) 482int
486 { 483SSL_CTX_set_trust(SSL_CTX *s, int trust)
484{
487 return X509_VERIFY_PARAM_set_trust(s->param, trust); 485 return X509_VERIFY_PARAM_set_trust(s->param, trust);
488 } 486}
489 487
490int SSL_set_trust(SSL *s, int trust) 488int
491 { 489SSL_set_trust(SSL *s, int trust)
490{
492 return X509_VERIFY_PARAM_set_trust(s->param, trust); 491 return X509_VERIFY_PARAM_set_trust(s->param, trust);
493 } 492}
494 493
495int SSL_CTX_set1_param(SSL_CTX *ctx, X509_VERIFY_PARAM *vpm) 494int
496 { 495SSL_CTX_set1_param(SSL_CTX *ctx, X509_VERIFY_PARAM *vpm)
496{
497 return X509_VERIFY_PARAM_set1(ctx->param, vpm); 497 return X509_VERIFY_PARAM_set1(ctx->param, vpm);
498 } 498}
499 499
500int SSL_set1_param(SSL *ssl, X509_VERIFY_PARAM *vpm) 500int
501 { 501SSL_set1_param(SSL *ssl, X509_VERIFY_PARAM *vpm)
502{
502 return X509_VERIFY_PARAM_set1(ssl->param, vpm); 503 return X509_VERIFY_PARAM_set1(ssl->param, vpm);
503 } 504}
504 505
505void SSL_free(SSL *s) 506void
506 { 507SSL_free(SSL *s)
508{
507 int i; 509 int i;
508 510
509 if(s == NULL) 511 if (s == NULL)
510 return; 512 return;
511 513
512 i=CRYPTO_add(&s->references,-1,CRYPTO_LOCK_SSL); 514 i = CRYPTO_add(&s->references, -1, CRYPTO_LOCK_SSL);
513#ifdef REF_PRINT 515#ifdef REF_PRINT
514 REF_PRINT("SSL",s); 516 REF_PRINT("SSL", s);
515#endif 517#endif
516 if (i > 0) return; 518 if (i > 0)
519 return;
517#ifdef REF_CHECK 520#ifdef REF_CHECK
518 if (i < 0) 521 if (i < 0) {
519 { 522 fprintf(stderr, "SSL_free, bad reference count\n");
520 fprintf(stderr,"SSL_free, bad reference count\n");
521 abort(); /* ok */ 523 abort(); /* ok */
522 } 524 }
523#endif 525#endif
524 526
525 if (s->param) 527 if (s->param)
@@ -527,53 +529,58 @@ void SSL_free(SSL *s)
527 529
528 CRYPTO_free_ex_data(CRYPTO_EX_INDEX_SSL, s, &s->ex_data); 530 CRYPTO_free_ex_data(CRYPTO_EX_INDEX_SSL, s, &s->ex_data);
529 531
530 if (s->bbio != NULL) 532 if (s->bbio != NULL) {
531 {
532 /* If the buffering BIO is in place, pop it off */ 533 /* If the buffering BIO is in place, pop it off */
533 if (s->bbio == s->wbio) 534 if (s->bbio == s->wbio) {
534 { 535 s->wbio = BIO_pop(s->wbio);
535 s->wbio=BIO_pop(s->wbio);
536 }
537 BIO_free(s->bbio);
538 s->bbio=NULL;
539 } 536 }
537 BIO_free(s->bbio);
538 s->bbio = NULL;
539 }
540 if (s->rbio != NULL) 540 if (s->rbio != NULL)
541 BIO_free_all(s->rbio); 541 BIO_free_all(s->rbio);
542 if ((s->wbio != NULL) && (s->wbio != s->rbio)) 542 if ((s->wbio != NULL) && (s->wbio != s->rbio))
543 BIO_free_all(s->wbio); 543 BIO_free_all(s->wbio);
544 544
545 if (s->init_buf != NULL) BUF_MEM_free(s->init_buf); 545 if (s->init_buf != NULL)
546 BUF_MEM_free(s->init_buf);
546 547
547 /* add extra stuff */ 548 /* add extra stuff */
548 if (s->cipher_list != NULL) sk_SSL_CIPHER_free(s->cipher_list); 549 if (s->cipher_list != NULL)
549 if (s->cipher_list_by_id != NULL) sk_SSL_CIPHER_free(s->cipher_list_by_id); 550 sk_SSL_CIPHER_free(s->cipher_list);
551 if (s->cipher_list_by_id != NULL)
552 sk_SSL_CIPHER_free(s->cipher_list_by_id);
550 553
551 /* Make the next call work :-) */ 554 /* Make the next call work :-) */
552 if (s->session != NULL) 555 if (s->session != NULL) {
553 {
554 ssl_clear_bad_session(s); 556 ssl_clear_bad_session(s);
555 SSL_SESSION_free(s->session); 557 SSL_SESSION_free(s->session);
556 } 558 }
557 559
558 ssl_clear_cipher_ctx(s); 560 ssl_clear_cipher_ctx(s);
559 ssl_clear_hash_ctx(&s->read_hash); 561 ssl_clear_hash_ctx(&s->read_hash);
560 ssl_clear_hash_ctx(&s->write_hash); 562 ssl_clear_hash_ctx(&s->write_hash);
561 563
562 if (s->cert != NULL) ssl_cert_free(s->cert); 564 if (s->cert != NULL)
565 ssl_cert_free(s->cert);
563 /* Free up if allocated */ 566 /* Free up if allocated */
564 567
565#ifndef OPENSSL_NO_TLSEXT 568#ifndef OPENSSL_NO_TLSEXT
566 if (s->tlsext_hostname) 569 if (s->tlsext_hostname)
567 OPENSSL_free(s->tlsext_hostname); 570 OPENSSL_free(s->tlsext_hostname);
568 if (s->initial_ctx) SSL_CTX_free(s->initial_ctx); 571 if (s->initial_ctx)
572 SSL_CTX_free(s->initial_ctx);
569#ifndef OPENSSL_NO_EC 573#ifndef OPENSSL_NO_EC
570 if (s->tlsext_ecpointformatlist) OPENSSL_free(s->tlsext_ecpointformatlist); 574 if (s->tlsext_ecpointformatlist)
571 if (s->tlsext_ellipticcurvelist) OPENSSL_free(s->tlsext_ellipticcurvelist); 575 OPENSSL_free(s->tlsext_ecpointformatlist);
576 if (s->tlsext_ellipticcurvelist)
577 OPENSSL_free(s->tlsext_ellipticcurvelist);
572#endif /* OPENSSL_NO_EC */ 578#endif /* OPENSSL_NO_EC */
573 if (s->tlsext_opaque_prf_input) OPENSSL_free(s->tlsext_opaque_prf_input); 579 if (s->tlsext_opaque_prf_input)
580 OPENSSL_free(s->tlsext_opaque_prf_input);
574 if (s->tlsext_ocsp_exts) 581 if (s->tlsext_ocsp_exts)
575 sk_X509_EXTENSION_pop_free(s->tlsext_ocsp_exts, 582 sk_X509_EXTENSION_pop_free(s->tlsext_ocsp_exts,
576 X509_EXTENSION_free); 583 X509_EXTENSION_free);
577 if (s->tlsext_ocsp_ids) 584 if (s->tlsext_ocsp_ids)
578 sk_OCSP_RESPID_pop_free(s->tlsext_ocsp_ids, OCSP_RESPID_free); 585 sk_OCSP_RESPID_pop_free(s->tlsext_ocsp_ids, OCSP_RESPID_free);
579 if (s->tlsext_ocsp_resp) 586 if (s->tlsext_ocsp_resp)
@@ -581,11 +588,13 @@ void SSL_free(SSL *s)
581#endif 588#endif
582 589
583 if (s->client_CA != NULL) 590 if (s->client_CA != NULL)
584 sk_X509_NAME_pop_free(s->client_CA,X509_NAME_free); 591 sk_X509_NAME_pop_free(s->client_CA, X509_NAME_free);
585 592
586 if (s->method != NULL) s->method->ssl_free(s); 593 if (s->method != NULL)
594 s->method->ssl_free(s);
587 595
588 if (s->ctx) SSL_CTX_free(s->ctx); 596 if (s->ctx)
597 SSL_CTX_free(s->ctx);
589 598
590#ifndef OPENSSL_NO_KRB5 599#ifndef OPENSSL_NO_KRB5
591 if (s->kssl_ctx != NULL) 600 if (s->kssl_ctx != NULL)
@@ -598,223 +607,237 @@ void SSL_free(SSL *s)
598#endif 607#endif
599 608
600#ifndef OPENSSL_NO_SRTP 609#ifndef OPENSSL_NO_SRTP
601 if (s->srtp_profiles) 610 if (s->srtp_profiles)
602 sk_SRTP_PROTECTION_PROFILE_free(s->srtp_profiles); 611 sk_SRTP_PROTECTION_PROFILE_free(s->srtp_profiles);
603#endif 612#endif
604 613
605 OPENSSL_free(s); 614 OPENSSL_free(s);
606 } 615}
607 616
608void SSL_set_bio(SSL *s,BIO *rbio,BIO *wbio) 617void
609 { 618SSL_set_bio(SSL *s, BIO *rbio, BIO *wbio)
619{
610 /* If the output buffering BIO is still in place, remove it 620 /* If the output buffering BIO is still in place, remove it
611 */ 621 */
612 if (s->bbio != NULL) 622 if (s->bbio != NULL) {
613 { 623 if (s->wbio == s->bbio) {
614 if (s->wbio == s->bbio) 624 s->wbio = s->wbio->next_bio;
615 { 625 s->bbio->next_bio = NULL;
616 s->wbio=s->wbio->next_bio;
617 s->bbio->next_bio=NULL;
618 }
619 } 626 }
627 }
620 if ((s->rbio != NULL) && (s->rbio != rbio)) 628 if ((s->rbio != NULL) && (s->rbio != rbio))
621 BIO_free_all(s->rbio); 629 BIO_free_all(s->rbio);
622 if ((s->wbio != NULL) && (s->wbio != wbio) && (s->rbio != s->wbio)) 630 if ((s->wbio != NULL) && (s->wbio != wbio) && (s->rbio != s->wbio))
623 BIO_free_all(s->wbio); 631 BIO_free_all(s->wbio);
624 s->rbio=rbio; 632 s->rbio = rbio;
625 s->wbio=wbio; 633 s->wbio = wbio;
626 } 634}
627 635
628BIO *SSL_get_rbio(const SSL *s) 636BIO
629 { return(s->rbio); } 637*SSL_get_rbio(const SSL *s)
638 { return (s->rbio);
639}
630 640
631BIO *SSL_get_wbio(const SSL *s) 641BIO
632 { return(s->wbio); } 642*SSL_get_wbio(const SSL *s)
643 { return (s->wbio);
644}
633 645
634int SSL_get_fd(const SSL *s) 646int
635 { 647SSL_get_fd(const SSL *s)
636 return(SSL_get_rfd(s)); 648{
637 } 649 return (SSL_get_rfd(s));
650}
638 651
639int SSL_get_rfd(const SSL *s) 652int
640 { 653SSL_get_rfd(const SSL *s)
641 int ret= -1; 654{
642 BIO *b,*r; 655 int ret = -1;
656 BIO *b, *r;
643 657
644 b=SSL_get_rbio(s); 658 b = SSL_get_rbio(s);
645 r=BIO_find_type(b,BIO_TYPE_DESCRIPTOR); 659 r = BIO_find_type(b, BIO_TYPE_DESCRIPTOR);
646 if (r != NULL) 660 if (r != NULL)
647 BIO_get_fd(r,&ret); 661 BIO_get_fd(r, &ret);
648 return(ret); 662 return (ret);
649 } 663}
650 664
651int SSL_get_wfd(const SSL *s) 665int
652 { 666SSL_get_wfd(const SSL *s)
653 int ret= -1; 667{
654 BIO *b,*r; 668 int ret = -1;
669 BIO *b, *r;
655 670
656 b=SSL_get_wbio(s); 671 b = SSL_get_wbio(s);
657 r=BIO_find_type(b,BIO_TYPE_DESCRIPTOR); 672 r = BIO_find_type(b, BIO_TYPE_DESCRIPTOR);
658 if (r != NULL) 673 if (r != NULL)
659 BIO_get_fd(r,&ret); 674 BIO_get_fd(r, &ret);
660 return(ret); 675 return (ret);
661 } 676}
662 677
663#ifndef OPENSSL_NO_SOCK 678#ifndef OPENSSL_NO_SOCK
664int SSL_set_fd(SSL *s,int fd) 679int
665 { 680SSL_set_fd(SSL *s, int fd)
666 int ret=0; 681{
667 BIO *bio=NULL; 682 int ret = 0;
683 BIO *bio = NULL;
668 684
669 bio=BIO_new(BIO_s_socket()); 685 bio = BIO_new(BIO_s_socket());
670 686
671 if (bio == NULL) 687 if (bio == NULL) {
672 { 688 SSLerr(SSL_F_SSL_SET_FD, ERR_R_BUF_LIB);
673 SSLerr(SSL_F_SSL_SET_FD,ERR_R_BUF_LIB);
674 goto err; 689 goto err;
675 }
676 BIO_set_fd(bio,fd,BIO_NOCLOSE);
677 SSL_set_bio(s,bio,bio);
678 ret=1;
679err:
680 return(ret);
681 } 690 }
691 BIO_set_fd(bio, fd, BIO_NOCLOSE);
692 SSL_set_bio(s, bio, bio);
693 ret = 1;
694err:
695 return (ret);
696}
682 697
683int SSL_set_wfd(SSL *s,int fd) 698int
684 { 699SSL_set_wfd(SSL *s, int fd)
685 int ret=0; 700{
686 BIO *bio=NULL; 701 int ret = 0;
702 BIO *bio = NULL;
687 703
688 if ((s->rbio == NULL) || (BIO_method_type(s->rbio) != BIO_TYPE_SOCKET) 704 if ((s->rbio == NULL) || (BIO_method_type(s->rbio) != BIO_TYPE_SOCKET)
689 || ((int)BIO_get_fd(s->rbio,NULL) != fd)) 705 || ((int)BIO_get_fd(s->rbio, NULL) != fd)) {
690 { 706 bio = BIO_new(BIO_s_socket());
691 bio=BIO_new(BIO_s_socket());
692 707
693 if (bio == NULL) 708 if (bio == NULL)
694 { SSLerr(SSL_F_SSL_SET_WFD,ERR_R_BUF_LIB); goto err; } 709 { SSLerr(SSL_F_SSL_SET_WFD, ERR_R_BUF_LIB);
695 BIO_set_fd(bio,fd,BIO_NOCLOSE); 710 goto err;
696 SSL_set_bio(s,SSL_get_rbio(s),bio);
697 } 711 }
698 else 712 BIO_set_fd(bio, fd, BIO_NOCLOSE);
699 SSL_set_bio(s,SSL_get_rbio(s),SSL_get_rbio(s)); 713 SSL_set_bio(s, SSL_get_rbio(s), bio);
700 ret=1; 714 } else
715 SSL_set_bio(s, SSL_get_rbio(s), SSL_get_rbio(s));
716 ret = 1;
701err: 717err:
702 return(ret); 718 return (ret);
703 } 719}
704 720
705int SSL_set_rfd(SSL *s,int fd) 721int
706 { 722SSL_set_rfd(SSL *s, int fd)
707 int ret=0; 723{
708 BIO *bio=NULL; 724 int ret = 0;
725 BIO *bio = NULL;
709 726
710 if ((s->wbio == NULL) || (BIO_method_type(s->wbio) != BIO_TYPE_SOCKET) 727 if ((s->wbio == NULL) || (BIO_method_type(s->wbio) != BIO_TYPE_SOCKET)
711 || ((int)BIO_get_fd(s->wbio,NULL) != fd)) 728 || ((int)BIO_get_fd(s->wbio, NULL) != fd)) {
712 { 729 bio = BIO_new(BIO_s_socket());
713 bio=BIO_new(BIO_s_socket());
714 730
715 if (bio == NULL) 731 if (bio == NULL) {
716 { 732 SSLerr(SSL_F_SSL_SET_RFD, ERR_R_BUF_LIB);
717 SSLerr(SSL_F_SSL_SET_RFD,ERR_R_BUF_LIB);
718 goto err; 733 goto err;
719 }
720 BIO_set_fd(bio,fd,BIO_NOCLOSE);
721 SSL_set_bio(s,bio,SSL_get_wbio(s));
722 } 734 }
723 else 735 BIO_set_fd(bio, fd, BIO_NOCLOSE);
724 SSL_set_bio(s,SSL_get_wbio(s),SSL_get_wbio(s)); 736 SSL_set_bio(s, bio, SSL_get_wbio(s));
725 ret=1; 737 } else
738 SSL_set_bio(s, SSL_get_wbio(s), SSL_get_wbio(s));
739 ret = 1;
726err: 740err:
727 return(ret); 741 return (ret);
728 } 742}
729#endif 743#endif
730 744
731 745
732/* return length of latest Finished message we sent, copy to 'buf' */ 746/* return length of latest Finished message we sent, copy to 'buf' */
733size_t SSL_get_finished(const SSL *s, void *buf, size_t count) 747size_t
734 { 748SSL_get_finished(const SSL *s, void *buf, size_t count)
749{
735 size_t ret = 0; 750 size_t ret = 0;
736 751
737 if (s->s3 != NULL) 752 if (s->s3 != NULL) {
738 {
739 ret = s->s3->tmp.finish_md_len; 753 ret = s->s3->tmp.finish_md_len;
740 if (count > ret) 754 if (count > ret)
741 count = ret; 755 count = ret;
742 memcpy(buf, s->s3->tmp.finish_md, count); 756 memcpy(buf, s->s3->tmp.finish_md, count);
743 }
744 return ret;
745 } 757 }
758 return ret;
759}
746 760
747/* return length of latest Finished message we expected, copy to 'buf' */ 761/* return length of latest Finished message we expected, copy to 'buf' */
748size_t SSL_get_peer_finished(const SSL *s, void *buf, size_t count) 762size_t
749 { 763SSL_get_peer_finished(const SSL *s, void *buf, size_t count)
764{
750 size_t ret = 0; 765 size_t ret = 0;
751 766
752 if (s->s3 != NULL) 767 if (s->s3 != NULL) {
753 {
754 ret = s->s3->tmp.peer_finish_md_len; 768 ret = s->s3->tmp.peer_finish_md_len;
755 if (count > ret) 769 if (count > ret)
756 count = ret; 770 count = ret;
757 memcpy(buf, s->s3->tmp.peer_finish_md, count); 771 memcpy(buf, s->s3->tmp.peer_finish_md, count);
758 }
759 return ret;
760 } 772 }
773 return ret;
774}
761 775
762 776
763int SSL_get_verify_mode(const SSL *s) 777int
764 { 778SSL_get_verify_mode(const SSL *s)
765 return(s->verify_mode); 779{
766 } 780 return (s->verify_mode);
781}
767 782
768int SSL_get_verify_depth(const SSL *s) 783int
769 { 784SSL_get_verify_depth(const SSL *s)
785{
770 return X509_VERIFY_PARAM_get_depth(s->param); 786 return X509_VERIFY_PARAM_get_depth(s->param);
771 } 787}
772 788
773int (*SSL_get_verify_callback(const SSL *s))(int,X509_STORE_CTX *) 789int (*SSL_get_verify_callback(const SSL *s))(int, X509_STORE_CTX *)
774 { 790{
775 return(s->verify_callback); 791 return (s->verify_callback);
776 } 792}
777 793
778int SSL_CTX_get_verify_mode(const SSL_CTX *ctx) 794int
779 { 795SSL_CTX_get_verify_mode(const SSL_CTX *ctx)
780 return(ctx->verify_mode); 796{
781 } 797 return (ctx->verify_mode);
798}
782 799
783int SSL_CTX_get_verify_depth(const SSL_CTX *ctx) 800int
784 { 801SSL_CTX_get_verify_depth(const SSL_CTX *ctx)
802{
785 return X509_VERIFY_PARAM_get_depth(ctx->param); 803 return X509_VERIFY_PARAM_get_depth(ctx->param);
786 } 804}
787 805
788int (*SSL_CTX_get_verify_callback(const SSL_CTX *ctx))(int,X509_STORE_CTX *) 806int (*SSL_CTX_get_verify_callback(const SSL_CTX *ctx))(int, X509_STORE_CTX *)
789 { 807{
790 return(ctx->default_verify_callback); 808 return (ctx->default_verify_callback);
791 } 809}
792 810
793void SSL_set_verify(SSL *s,int mode, 811void
794 int (*callback)(int ok,X509_STORE_CTX *ctx)) 812SSL_set_verify(SSL *s, int mode,
795 { 813 int (*callback)(int ok, X509_STORE_CTX *ctx))
796 s->verify_mode=mode; 814{
815 s->verify_mode = mode;
797 if (callback != NULL) 816 if (callback != NULL)
798 s->verify_callback=callback; 817 s->verify_callback = callback;
799 } 818}
800 819
801void SSL_set_verify_depth(SSL *s,int depth) 820void
802 { 821SSL_set_verify_depth(SSL *s, int depth)
822{
803 X509_VERIFY_PARAM_set_depth(s->param, depth); 823 X509_VERIFY_PARAM_set_depth(s->param, depth);
804 } 824}
805 825
806void SSL_set_read_ahead(SSL *s,int yes) 826void
807 { 827SSL_set_read_ahead(SSL *s, int yes)
808 s->read_ahead=yes; 828{
809 } 829 s->read_ahead = yes;
830}
810 831
811int SSL_get_read_ahead(const SSL *s) 832int
812 { 833SSL_get_read_ahead(const SSL *s)
813 return(s->read_ahead); 834{
814 } 835 return (s->read_ahead);
836}
815 837
816int SSL_pending(const SSL *s) 838int
817 { 839SSL_pending(const SSL *s)
840{
818 /* SSL_pending cannot work properly if read-ahead is enabled 841 /* SSL_pending cannot work properly if read-ahead is enabled
819 * (SSL_[CTX_]ctrl(..., SSL_CTRL_SET_READ_AHEAD, 1, NULL)), 842 * (SSL_[CTX_]ctrl(..., SSL_CTRL_SET_READ_AHEAD, 1, NULL)),
820 * and it is impossible to fix since SSL_pending cannot report 843 * and it is impossible to fix since SSL_pending cannot report
@@ -822,264 +845,266 @@ int SSL_pending(const SSL *s)
822 * (Note that SSL_pending() is often used as a boolean value, 845 * (Note that SSL_pending() is often used as a boolean value,
823 * so we'd better not return -1.) 846 * so we'd better not return -1.)
824 */ 847 */
825 return(s->method->ssl_pending(s)); 848 return (s->method->ssl_pending(s));
826 } 849}
827 850
828X509 *SSL_get_peer_certificate(const SSL *s) 851X509
829 { 852*SSL_get_peer_certificate(const SSL *s)
853{
830 X509 *r; 854 X509 *r;
831 855
832 if ((s == NULL) || (s->session == NULL)) 856 if ((s == NULL) || (s->session == NULL))
833 r=NULL; 857 r = NULL;
834 else 858 else
835 r=s->session->peer; 859 r = s->session->peer;
836 860
837 if (r == NULL) return(r); 861 if (r == NULL)
862 return (r);
838 863
839 CRYPTO_add(&r->references,1,CRYPTO_LOCK_X509); 864 CRYPTO_add(&r->references, 1, CRYPTO_LOCK_X509);
840 865
841 return(r); 866 return (r);
842 } 867}
843 868
844STACK_OF(X509) *SSL_get_peer_cert_chain(const SSL *s) 869STACK_OF(X509)
845 { 870*SSL_get_peer_cert_chain(const SSL *s)
871{
846 STACK_OF(X509) *r; 872 STACK_OF(X509) *r;
847 873
848 if ((s == NULL) || (s->session == NULL) || (s->session->sess_cert == NULL)) 874 if ((s == NULL) || (s->session == NULL) || (s->session->sess_cert == NULL))
849 r=NULL; 875 r = NULL;
850 else 876 else
851 r=s->session->sess_cert->cert_chain; 877 r = s->session->sess_cert->cert_chain;
852 878
853 /* If we are a client, cert_chain includes the peer's own 879 /* If we are a client, cert_chain includes the peer's own
854 * certificate; if we are a server, it does not. */ 880 * certificate;
855 881if we are a server, it does not. */
856 return(r); 882
857 } 883 return (r);
884}
858 885
859/* Now in theory, since the calling process own 't' it should be safe to 886/* Now in theory, since the calling process own 't' it should be safe to
860 * modify. We need to be able to read f without being hassled */ 887 * modify. We need to be able to read f without being hassled */
861void SSL_copy_session_id(SSL *t,const SSL *f) 888void
862 { 889SSL_copy_session_id(SSL *t, const SSL *f)
890{
863 CERT *tmp; 891 CERT *tmp;
864 892
865 /* Do we need to to SSL locking? */ 893 /* Do we need to to SSL locking? */
866 SSL_set_session(t,SSL_get_session(f)); 894 SSL_set_session(t, SSL_get_session(f));
867 895
868 /* what if we are setup as SSLv2 but want to talk SSLv3 or 896 /* what if we are setup as SSLv2 but want to talk SSLv3 or
869 * vice-versa */ 897 * vice-versa */
870 if (t->method != f->method) 898 if (t->method != f->method) {
871 {
872 t->method->ssl_free(t); /* cleanup current */ 899 t->method->ssl_free(t); /* cleanup current */
873 t->method=f->method; /* change method */ 900 t->method=f->method; /* change method */
874 t->method->ssl_new(t); /* setup new */ 901 t->method->ssl_new(t); /* setup new */
875 }
876
877 tmp=t->cert;
878 if (f->cert != NULL)
879 {
880 CRYPTO_add(&f->cert->references,1,CRYPTO_LOCK_SSL_CERT);
881 t->cert=f->cert;
882 }
883 else
884 t->cert=NULL;
885 if (tmp != NULL) ssl_cert_free(tmp);
886 SSL_set_session_id_context(t,f->sid_ctx,f->sid_ctx_length);
887 } 902 }
888 903
904 tmp = t->cert;
905 if (f->cert != NULL) {
906 CRYPTO_add(&f->cert->references, 1, CRYPTO_LOCK_SSL_CERT);
907 t->cert = f->cert;
908 } else
909 t->cert = NULL;
910 if (tmp != NULL)
911 ssl_cert_free(tmp);
912 SSL_set_session_id_context(t, f->sid_ctx, f->sid_ctx_length);
913}
914
889/* Fix this so it checks all the valid key/cert options */ 915/* Fix this so it checks all the valid key/cert options */
890int SSL_CTX_check_private_key(const SSL_CTX *ctx) 916int
891 { 917SSL_CTX_check_private_key(const SSL_CTX *ctx)
892 if ( (ctx == NULL) || 918{
919 if ((ctx == NULL) ||
893 (ctx->cert == NULL) || 920 (ctx->cert == NULL) ||
894 (ctx->cert->key->x509 == NULL)) 921 (ctx->cert->key->x509 == NULL)) {
895 { 922 SSLerr(SSL_F_SSL_CTX_CHECK_PRIVATE_KEY, SSL_R_NO_CERTIFICATE_ASSIGNED);
896 SSLerr(SSL_F_SSL_CTX_CHECK_PRIVATE_KEY,SSL_R_NO_CERTIFICATE_ASSIGNED); 923 return (0);
897 return(0); 924 }
898 } 925 if (ctx->cert->key->privatekey == NULL) {
899 if (ctx->cert->key->privatekey == NULL) 926 SSLerr(SSL_F_SSL_CTX_CHECK_PRIVATE_KEY, SSL_R_NO_PRIVATE_KEY_ASSIGNED);
900 { 927 return (0);
901 SSLerr(SSL_F_SSL_CTX_CHECK_PRIVATE_KEY,SSL_R_NO_PRIVATE_KEY_ASSIGNED);
902 return(0);
903 }
904 return(X509_check_private_key(ctx->cert->key->x509, ctx->cert->key->privatekey));
905 } 928 }
929 return (X509_check_private_key(ctx->cert->key->x509, ctx->cert->key->privatekey));
930}
906 931
907/* Fix this function so that it takes an optional type parameter */ 932/* Fix this function so that it takes an optional type parameter */
908int SSL_check_private_key(const SSL *ssl) 933int
909 { 934SSL_check_private_key(const SSL *ssl)
910 if (ssl == NULL) 935{
911 { 936 if (ssl == NULL) {
912 SSLerr(SSL_F_SSL_CHECK_PRIVATE_KEY,ERR_R_PASSED_NULL_PARAMETER); 937 SSLerr(SSL_F_SSL_CHECK_PRIVATE_KEY, ERR_R_PASSED_NULL_PARAMETER);
913 return(0); 938 return (0);
914 } 939 }
915 if (ssl->cert == NULL) 940 if (ssl->cert == NULL) {
916 { 941 SSLerr(SSL_F_SSL_CHECK_PRIVATE_KEY, SSL_R_NO_CERTIFICATE_ASSIGNED);
917 SSLerr(SSL_F_SSL_CHECK_PRIVATE_KEY,SSL_R_NO_CERTIFICATE_ASSIGNED);
918 return 0; 942 return 0;
919 }
920 if (ssl->cert->key->x509 == NULL)
921 {
922 SSLerr(SSL_F_SSL_CHECK_PRIVATE_KEY,SSL_R_NO_CERTIFICATE_ASSIGNED);
923 return(0);
924 }
925 if (ssl->cert->key->privatekey == NULL)
926 {
927 SSLerr(SSL_F_SSL_CHECK_PRIVATE_KEY,SSL_R_NO_PRIVATE_KEY_ASSIGNED);
928 return(0);
929 }
930 return(X509_check_private_key(ssl->cert->key->x509,
931 ssl->cert->key->privatekey));
932 } 943 }
944 if (ssl->cert->key->x509 == NULL) {
945 SSLerr(SSL_F_SSL_CHECK_PRIVATE_KEY, SSL_R_NO_CERTIFICATE_ASSIGNED);
946 return (0);
947 }
948 if (ssl->cert->key->privatekey == NULL) {
949 SSLerr(SSL_F_SSL_CHECK_PRIVATE_KEY, SSL_R_NO_PRIVATE_KEY_ASSIGNED);
950 return (0);
951 }
952 return(X509_check_private_key(ssl->cert->key->x509,
953 ssl->cert->key->privatekey));
954}
933 955
934int SSL_accept(SSL *s) 956int
935 { 957SSL_accept(SSL *s)
958{
936 if (s->handshake_func == 0) 959 if (s->handshake_func == 0)
937 /* Not properly initialized yet */ 960 /* Not properly initialized yet */
938 SSL_set_accept_state(s); 961 SSL_set_accept_state(s);
939 962
940 return(s->method->ssl_accept(s)); 963 return (s->method->ssl_accept(s));
941 } 964}
942 965
943int SSL_connect(SSL *s) 966int
944 { 967SSL_connect(SSL *s)
968{
945 if (s->handshake_func == 0) 969 if (s->handshake_func == 0)
946 /* Not properly initialized yet */ 970 /* Not properly initialized yet */
947 SSL_set_connect_state(s); 971 SSL_set_connect_state(s);
948 972
949 return(s->method->ssl_connect(s)); 973 return (s->method->ssl_connect(s));
950 } 974}
951 975
952long SSL_get_default_timeout(const SSL *s) 976long
953 { 977SSL_get_default_timeout(const SSL *s)
954 return(s->method->get_timeout()); 978{
955 } 979 return (s->method->get_timeout());
980}
956 981
957int SSL_read(SSL *s,void *buf,int num) 982int
958 { 983SSL_read(SSL *s, void *buf, int num)
959 if (s->handshake_func == 0) 984{
960 { 985 if (s->handshake_func == 0) {
961 SSLerr(SSL_F_SSL_READ, SSL_R_UNINITIALIZED); 986 SSLerr(SSL_F_SSL_READ, SSL_R_UNINITIALIZED);
962 return -1; 987 return -1;
963 } 988 }
964 989
965 if (s->shutdown & SSL_RECEIVED_SHUTDOWN) 990 if (s->shutdown & SSL_RECEIVED_SHUTDOWN) {
966 { 991 s->rwstate = SSL_NOTHING;
967 s->rwstate=SSL_NOTHING; 992 return (0);
968 return(0);
969 }
970 return(s->method->ssl_read(s,buf,num));
971 } 993 }
994 return (s->method->ssl_read(s, buf, num));
995}
972 996
973int SSL_peek(SSL *s,void *buf,int num) 997int
974 { 998SSL_peek(SSL *s, void *buf, int num)
975 if (s->handshake_func == 0) 999{
976 { 1000 if (s->handshake_func == 0) {
977 SSLerr(SSL_F_SSL_PEEK, SSL_R_UNINITIALIZED); 1001 SSLerr(SSL_F_SSL_PEEK, SSL_R_UNINITIALIZED);
978 return -1; 1002 return -1;
979 } 1003 }
980 1004
981 if (s->shutdown & SSL_RECEIVED_SHUTDOWN) 1005 if (s->shutdown & SSL_RECEIVED_SHUTDOWN) {
982 { 1006 return (0);
983 return(0);
984 }
985 return(s->method->ssl_peek(s,buf,num));
986 } 1007 }
1008 return (s->method->ssl_peek(s, buf, num));
1009}
987 1010
988int SSL_write(SSL *s,const void *buf,int num) 1011int
989 { 1012SSL_write(SSL *s, const void *buf, int num)
990 if (s->handshake_func == 0) 1013{
991 { 1014 if (s->handshake_func == 0) {
992 SSLerr(SSL_F_SSL_WRITE, SSL_R_UNINITIALIZED); 1015 SSLerr(SSL_F_SSL_WRITE, SSL_R_UNINITIALIZED);
993 return -1; 1016 return -1;
994 } 1017 }
995 1018
996 if (s->shutdown & SSL_SENT_SHUTDOWN) 1019 if (s->shutdown & SSL_SENT_SHUTDOWN) {
997 { 1020 s->rwstate = SSL_NOTHING;
998 s->rwstate=SSL_NOTHING; 1021 SSLerr(SSL_F_SSL_WRITE, SSL_R_PROTOCOL_IS_SHUTDOWN);
999 SSLerr(SSL_F_SSL_WRITE,SSL_R_PROTOCOL_IS_SHUTDOWN); 1022 return (-1);
1000 return(-1);
1001 }
1002 return(s->method->ssl_write(s,buf,num));
1003 } 1023 }
1024 return (s->method->ssl_write(s, buf, num));
1025}
1004 1026
1005int SSL_shutdown(SSL *s) 1027int
1006 { 1028SSL_shutdown(SSL *s)
1029{
1007 /* Note that this function behaves differently from what one might 1030 /* Note that this function behaves differently from what one might
1008 * expect. Return values are 0 for no success (yet), 1031 * expect. Return values are 0 for no success (yet),
1009 * 1 for success; but calling it once is usually not enough, 1032 * 1 for success; but calling it once is usually not enough,
1010 * even if blocking I/O is used (see ssl3_shutdown). 1033 * even if blocking I/O is used (see ssl3_shutdown).
1011 */ 1034 */
1012 1035
1013 if (s->handshake_func == 0) 1036 if (s->handshake_func == 0) {
1014 {
1015 SSLerr(SSL_F_SSL_SHUTDOWN, SSL_R_UNINITIALIZED); 1037 SSLerr(SSL_F_SSL_SHUTDOWN, SSL_R_UNINITIALIZED);
1016 return -1; 1038 return -1;
1017 } 1039 }
1018 1040
1019 if ((s != NULL) && !SSL_in_init(s)) 1041 if ((s != NULL) && !SSL_in_init(s))
1020 return(s->method->ssl_shutdown(s)); 1042 return (s->method->ssl_shutdown(s));
1021 else 1043 else
1022 return(1); 1044 return (1);
1023 } 1045}
1024 1046
1025int SSL_renegotiate(SSL *s) 1047int
1026 { 1048SSL_renegotiate(SSL *s)
1049{
1027 if (s->renegotiate == 0) 1050 if (s->renegotiate == 0)
1028 s->renegotiate=1; 1051 s->renegotiate = 1;
1029 1052
1030 s->new_session=1; 1053 s->new_session = 1;
1031 1054
1032 return(s->method->ssl_renegotiate(s)); 1055 return (s->method->ssl_renegotiate(s));
1033 } 1056}
1034 1057
1035int SSL_renegotiate_abbreviated(SSL *s) 1058int
1036 { 1059SSL_renegotiate_abbreviated(SSL *s)
1060{
1037 if (s->renegotiate == 0) 1061 if (s->renegotiate == 0)
1038 s->renegotiate=1; 1062 s->renegotiate = 1;
1039 1063
1040 s->new_session=0; 1064 s->new_session = 0;
1041 1065
1042 return(s->method->ssl_renegotiate(s)); 1066 return (s->method->ssl_renegotiate(s));
1043 } 1067}
1044 1068
1045int SSL_renegotiate_pending(SSL *s) 1069int
1046 { 1070SSL_renegotiate_pending(SSL *s)
1071{
1047 /* becomes true when negotiation is requested; 1072 /* becomes true when negotiation is requested;
1048 * false again once a handshake has finished */ 1073 * false again once a handshake has finished */
1049 return (s->renegotiate != 0); 1074 return (s->renegotiate != 0);
1050 } 1075}
1051 1076
1052long SSL_ctrl(SSL *s,int cmd,long larg,void *parg) 1077long
1053 { 1078SSL_ctrl(SSL *s, int cmd, long larg, void *parg)
1079{
1054 long l; 1080 long l;
1055 1081
1056 switch (cmd) 1082 switch (cmd) {
1057 {
1058 case SSL_CTRL_GET_READ_AHEAD: 1083 case SSL_CTRL_GET_READ_AHEAD:
1059 return(s->read_ahead); 1084 return (s->read_ahead);
1060 case SSL_CTRL_SET_READ_AHEAD: 1085 case SSL_CTRL_SET_READ_AHEAD:
1061 l=s->read_ahead; 1086 l = s->read_ahead;
1062 s->read_ahead=larg; 1087 s->read_ahead = larg;
1063 return(l); 1088 return (l);
1064 1089
1065 case SSL_CTRL_SET_MSG_CALLBACK_ARG: 1090 case SSL_CTRL_SET_MSG_CALLBACK_ARG:
1066 s->msg_callback_arg = parg; 1091 s->msg_callback_arg = parg;
1067 return 1; 1092 return 1;
1068 1093
1069 case SSL_CTRL_OPTIONS: 1094 case SSL_CTRL_OPTIONS:
1070 return(s->options|=larg); 1095 return (s->options|=larg);
1071 case SSL_CTRL_CLEAR_OPTIONS: 1096 case SSL_CTRL_CLEAR_OPTIONS:
1072 return(s->options&=~larg); 1097 return (s->options&=~larg);
1073 case SSL_CTRL_MODE: 1098 case SSL_CTRL_MODE:
1074 return(s->mode|=larg); 1099 return (s->mode|=larg);
1075 case SSL_CTRL_CLEAR_MODE: 1100 case SSL_CTRL_CLEAR_MODE:
1076 return(s->mode &=~larg); 1101 return (s->mode &=~larg);
1077 case SSL_CTRL_GET_MAX_CERT_LIST: 1102 case SSL_CTRL_GET_MAX_CERT_LIST:
1078 return(s->max_cert_list); 1103 return (s->max_cert_list);
1079 case SSL_CTRL_SET_MAX_CERT_LIST: 1104 case SSL_CTRL_SET_MAX_CERT_LIST:
1080 l=s->max_cert_list; 1105 l = s->max_cert_list;
1081 s->max_cert_list=larg; 1106 s->max_cert_list = larg;
1082 return(l); 1107 return (l);
1083 case SSL_CTRL_SET_MTU: 1108 case SSL_CTRL_SET_MTU:
1084#ifndef OPENSSL_NO_DTLS1 1109#ifndef OPENSSL_NO_DTLS1
1085 if (larg < (long)dtls1_min_mtu()) 1110 if (larg < (long)dtls1_min_mtu())
@@ -1087,11 +1112,10 @@ long SSL_ctrl(SSL *s,int cmd,long larg,void *parg)
1087#endif 1112#endif
1088 1113
1089 if (SSL_version(s) == DTLS1_VERSION || 1114 if (SSL_version(s) == DTLS1_VERSION ||
1090 SSL_version(s) == DTLS1_BAD_VER) 1115 SSL_version(s) == DTLS1_BAD_VER) {
1091 {
1092 s->d1->mtu = larg; 1116 s->d1->mtu = larg;
1093 return larg; 1117 return larg;
1094 } 1118 }
1095 return 0; 1119 return 0;
1096 case SSL_CTRL_SET_MAX_SEND_FRAGMENT: 1120 case SSL_CTRL_SET_MAX_SEND_FRAGMENT:
1097 if (larg < 512 || larg > SSL3_RT_MAX_PLAIN_LENGTH) 1121 if (larg < 512 || larg > SSL3_RT_MAX_PLAIN_LENGTH)
@@ -1103,203 +1127,204 @@ long SSL_ctrl(SSL *s,int cmd,long larg,void *parg)
1103 return s->s3->send_connection_binding; 1127 return s->s3->send_connection_binding;
1104 else return 0; 1128 else return 0;
1105 default: 1129 default:
1106 return(s->method->ssl_ctrl(s,cmd,larg,parg)); 1130 return (s->method->ssl_ctrl(s, cmd, larg, parg));
1107 }
1108 } 1131 }
1132}
1109 1133
1110long SSL_callback_ctrl(SSL *s, int cmd, void (*fp)(void)) 1134long
1111 { 1135SSL_callback_ctrl(SSL *s, int cmd, void (*fp)(void))
1112 switch(cmd) 1136{
1113 { 1137 switch (cmd) {
1114 case SSL_CTRL_SET_MSG_CALLBACK: 1138 case SSL_CTRL_SET_MSG_CALLBACK:
1115 s->msg_callback = (void (*)(int write_p, int version, int content_type, const void *buf, size_t len, SSL *ssl, void *arg))(fp); 1139 s->msg_callback = (void (*)(int write_p, int version, int content_type, const void *buf, size_t len, SSL *ssl, void *arg))(fp);
1116 return 1; 1140 return 1;
1117 1141
1118 default: 1142 default:
1119 return(s->method->ssl_callback_ctrl(s,cmd,fp)); 1143 return (s->method->ssl_callback_ctrl(s, cmd, fp));
1120 }
1121 } 1144 }
1145}
1122 1146
1123LHASH_OF(SSL_SESSION) *SSL_CTX_sessions(SSL_CTX *ctx) 1147LHASH_OF(SSL_SESSION)
1124 { 1148*SSL_CTX_sessions(SSL_CTX *ctx)
1149{
1125 return ctx->sessions; 1150 return ctx->sessions;
1126 } 1151}
1127 1152
1128long SSL_CTX_ctrl(SSL_CTX *ctx,int cmd,long larg,void *parg) 1153long
1129 { 1154SSL_CTX_ctrl(SSL_CTX *ctx, int cmd, long larg, void *parg)
1155{
1130 long l; 1156 long l;
1131 1157
1132 switch (cmd) 1158 switch (cmd) {
1133 {
1134 case SSL_CTRL_GET_READ_AHEAD: 1159 case SSL_CTRL_GET_READ_AHEAD:
1135 return(ctx->read_ahead); 1160 return (ctx->read_ahead);
1136 case SSL_CTRL_SET_READ_AHEAD: 1161 case SSL_CTRL_SET_READ_AHEAD:
1137 l=ctx->read_ahead; 1162 l = ctx->read_ahead;
1138 ctx->read_ahead=larg; 1163 ctx->read_ahead = larg;
1139 return(l); 1164 return (l);
1140 1165
1141 case SSL_CTRL_SET_MSG_CALLBACK_ARG: 1166 case SSL_CTRL_SET_MSG_CALLBACK_ARG:
1142 ctx->msg_callback_arg = parg; 1167 ctx->msg_callback_arg = parg;
1143 return 1; 1168 return 1;
1144 1169
1145 case SSL_CTRL_GET_MAX_CERT_LIST: 1170 case SSL_CTRL_GET_MAX_CERT_LIST:
1146 return(ctx->max_cert_list); 1171 return (ctx->max_cert_list);
1147 case SSL_CTRL_SET_MAX_CERT_LIST: 1172 case SSL_CTRL_SET_MAX_CERT_LIST:
1148 l=ctx->max_cert_list; 1173 l = ctx->max_cert_list;
1149 ctx->max_cert_list=larg; 1174 ctx->max_cert_list = larg;
1150 return(l); 1175 return (l);
1151 1176
1152 case SSL_CTRL_SET_SESS_CACHE_SIZE: 1177 case SSL_CTRL_SET_SESS_CACHE_SIZE:
1153 l=ctx->session_cache_size; 1178 l = ctx->session_cache_size;
1154 ctx->session_cache_size=larg; 1179 ctx->session_cache_size = larg;
1155 return(l); 1180 return (l);
1156 case SSL_CTRL_GET_SESS_CACHE_SIZE: 1181 case SSL_CTRL_GET_SESS_CACHE_SIZE:
1157 return(ctx->session_cache_size); 1182 return (ctx->session_cache_size);
1158 case SSL_CTRL_SET_SESS_CACHE_MODE: 1183 case SSL_CTRL_SET_SESS_CACHE_MODE:
1159 l=ctx->session_cache_mode; 1184 l = ctx->session_cache_mode;
1160 ctx->session_cache_mode=larg; 1185 ctx->session_cache_mode = larg;
1161 return(l); 1186 return (l);
1162 case SSL_CTRL_GET_SESS_CACHE_MODE: 1187 case SSL_CTRL_GET_SESS_CACHE_MODE:
1163 return(ctx->session_cache_mode); 1188 return (ctx->session_cache_mode);
1164 1189
1165 case SSL_CTRL_SESS_NUMBER: 1190 case SSL_CTRL_SESS_NUMBER:
1166 return(lh_SSL_SESSION_num_items(ctx->sessions)); 1191 return (lh_SSL_SESSION_num_items(ctx->sessions));
1167 case SSL_CTRL_SESS_CONNECT: 1192 case SSL_CTRL_SESS_CONNECT:
1168 return(ctx->stats.sess_connect); 1193 return (ctx->stats.sess_connect);
1169 case SSL_CTRL_SESS_CONNECT_GOOD: 1194 case SSL_CTRL_SESS_CONNECT_GOOD:
1170 return(ctx->stats.sess_connect_good); 1195 return (ctx->stats.sess_connect_good);
1171 case SSL_CTRL_SESS_CONNECT_RENEGOTIATE: 1196 case SSL_CTRL_SESS_CONNECT_RENEGOTIATE:
1172 return(ctx->stats.sess_connect_renegotiate); 1197 return (ctx->stats.sess_connect_renegotiate);
1173 case SSL_CTRL_SESS_ACCEPT: 1198 case SSL_CTRL_SESS_ACCEPT:
1174 return(ctx->stats.sess_accept); 1199 return (ctx->stats.sess_accept);
1175 case SSL_CTRL_SESS_ACCEPT_GOOD: 1200 case SSL_CTRL_SESS_ACCEPT_GOOD:
1176 return(ctx->stats.sess_accept_good); 1201 return (ctx->stats.sess_accept_good);
1177 case SSL_CTRL_SESS_ACCEPT_RENEGOTIATE: 1202 case SSL_CTRL_SESS_ACCEPT_RENEGOTIATE:
1178 return(ctx->stats.sess_accept_renegotiate); 1203 return (ctx->stats.sess_accept_renegotiate);
1179 case SSL_CTRL_SESS_HIT: 1204 case SSL_CTRL_SESS_HIT:
1180 return(ctx->stats.sess_hit); 1205 return (ctx->stats.sess_hit);
1181 case SSL_CTRL_SESS_CB_HIT: 1206 case SSL_CTRL_SESS_CB_HIT:
1182 return(ctx->stats.sess_cb_hit); 1207 return (ctx->stats.sess_cb_hit);
1183 case SSL_CTRL_SESS_MISSES: 1208 case SSL_CTRL_SESS_MISSES:
1184 return(ctx->stats.sess_miss); 1209 return (ctx->stats.sess_miss);
1185 case SSL_CTRL_SESS_TIMEOUTS: 1210 case SSL_CTRL_SESS_TIMEOUTS:
1186 return(ctx->stats.sess_timeout); 1211 return (ctx->stats.sess_timeout);
1187 case SSL_CTRL_SESS_CACHE_FULL: 1212 case SSL_CTRL_SESS_CACHE_FULL:
1188 return(ctx->stats.sess_cache_full); 1213 return (ctx->stats.sess_cache_full);
1189 case SSL_CTRL_OPTIONS: 1214 case SSL_CTRL_OPTIONS:
1190 return(ctx->options|=larg); 1215 return (ctx->options|=larg);
1191 case SSL_CTRL_CLEAR_OPTIONS: 1216 case SSL_CTRL_CLEAR_OPTIONS:
1192 return(ctx->options&=~larg); 1217 return (ctx->options&=~larg);
1193 case SSL_CTRL_MODE: 1218 case SSL_CTRL_MODE:
1194 return(ctx->mode|=larg); 1219 return (ctx->mode|=larg);
1195 case SSL_CTRL_CLEAR_MODE: 1220 case SSL_CTRL_CLEAR_MODE:
1196 return(ctx->mode&=~larg); 1221 return (ctx->mode&=~larg);
1197 case SSL_CTRL_SET_MAX_SEND_FRAGMENT: 1222 case SSL_CTRL_SET_MAX_SEND_FRAGMENT:
1198 if (larg < 512 || larg > SSL3_RT_MAX_PLAIN_LENGTH) 1223 if (larg < 512 || larg > SSL3_RT_MAX_PLAIN_LENGTH)
1199 return 0; 1224 return 0;
1200 ctx->max_send_fragment = larg; 1225 ctx->max_send_fragment = larg;
1201 return 1; 1226 return 1;
1202 default: 1227 default:
1203 return(ctx->method->ssl_ctx_ctrl(ctx,cmd,larg,parg)); 1228 return (ctx->method->ssl_ctx_ctrl(ctx, cmd, larg, parg));
1204 }
1205 } 1229 }
1230}
1206 1231
1207long SSL_CTX_callback_ctrl(SSL_CTX *ctx, int cmd, void (*fp)(void)) 1232long
1208 { 1233SSL_CTX_callback_ctrl(SSL_CTX *ctx, int cmd, void (*fp)(void))
1209 switch(cmd) 1234{
1210 { 1235 switch (cmd) {
1211 case SSL_CTRL_SET_MSG_CALLBACK: 1236 case SSL_CTRL_SET_MSG_CALLBACK:
1212 ctx->msg_callback = (void (*)(int write_p, int version, int content_type, const void *buf, size_t len, SSL *ssl, void *arg))(fp); 1237 ctx->msg_callback = (void (*)(int write_p, int version, int content_type, const void *buf, size_t len, SSL *ssl, void *arg))(fp);
1213 return 1; 1238 return 1;
1214 1239
1215 default: 1240 default:
1216 return(ctx->method->ssl_ctx_callback_ctrl(ctx,cmd,fp)); 1241 return (ctx->method->ssl_ctx_callback_ctrl(ctx, cmd, fp));
1217 }
1218 } 1242 }
1243}
1219 1244
1220int ssl_cipher_id_cmp(const SSL_CIPHER *a, const SSL_CIPHER *b) 1245int
1221 { 1246ssl_cipher_id_cmp(const SSL_CIPHER *a, const SSL_CIPHER *b)
1247{
1222 long l; 1248 long l;
1223 1249
1224 l=a->id-b->id; 1250 l = a->id - b->id;
1225 if (l == 0L) 1251 if (l == 0L)
1226 return(0); 1252 return (0);
1227 else 1253 else
1228 return((l > 0)?1:-1); 1254 return ((l > 0) ? 1:-1);
1229 } 1255}
1230 1256
1231int ssl_cipher_ptr_id_cmp(const SSL_CIPHER * const *ap, 1257int
1232 const SSL_CIPHER * const *bp) 1258ssl_cipher_ptr_id_cmp(const SSL_CIPHER * const *ap,
1233 { 1259 const SSL_CIPHER * const *bp)
1260{
1234 long l; 1261 long l;
1235 1262
1236 l=(*ap)->id-(*bp)->id; 1263 l = (*ap)->id - (*bp)->id;
1237 if (l == 0L) 1264 if (l == 0L)
1238 return(0); 1265 return (0);
1239 else 1266 else
1240 return((l > 0)?1:-1); 1267 return ((l > 0) ? 1:-1);
1241 } 1268}
1242 1269
1243/** return a STACK of the ciphers available for the SSL and in order of 1270/** return a STACK of the ciphers available for the SSL and in order of
1244 * preference */ 1271 * preference */
1245STACK_OF(SSL_CIPHER) *SSL_get_ciphers(const SSL *s) 1272STACK_OF(SSL_CIPHER)
1246 { 1273*SSL_get_ciphers(const SSL *s)
1247 if (s != NULL) 1274{
1248 { 1275 if (s != NULL) {
1249 if (s->cipher_list != NULL) 1276 if (s->cipher_list != NULL) {
1250 { 1277 return (s->cipher_list);
1251 return(s->cipher_list); 1278 } else if ((s->ctx != NULL) &&
1252 } 1279 (s->ctx->cipher_list != NULL)) {
1253 else if ((s->ctx != NULL) && 1280 return (s->ctx->cipher_list);
1254 (s->ctx->cipher_list != NULL))
1255 {
1256 return(s->ctx->cipher_list);
1257 }
1258 } 1281 }
1259 return(NULL);
1260 } 1282 }
1283 return (NULL);
1284}
1261 1285
1262/** return a STACK of the ciphers available for the SSL and in order of 1286/** return a STACK of the ciphers available for the SSL and in order of
1263 * algorithm id */ 1287 * algorithm id */
1264STACK_OF(SSL_CIPHER) *ssl_get_ciphers_by_id(SSL *s) 1288STACK_OF(SSL_CIPHER)
1265 { 1289*ssl_get_ciphers_by_id(SSL *s)
1266 if (s != NULL) 1290{
1267 { 1291 if (s != NULL) {
1268 if (s->cipher_list_by_id != NULL) 1292 if (s->cipher_list_by_id != NULL) {
1269 { 1293 return (s->cipher_list_by_id);
1270 return(s->cipher_list_by_id); 1294 } else if ((s->ctx != NULL) &&
1271 } 1295 (s->ctx->cipher_list_by_id != NULL)) {
1272 else if ((s->ctx != NULL) && 1296 return (s->ctx->cipher_list_by_id);
1273 (s->ctx->cipher_list_by_id != NULL))
1274 {
1275 return(s->ctx->cipher_list_by_id);
1276 }
1277 } 1297 }
1278 return(NULL);
1279 } 1298 }
1299 return (NULL);
1300}
1280 1301
1281/** The old interface to get the same thing as SSL_get_ciphers() */ 1302/** The old interface to get the same thing as SSL_get_ciphers() */
1282const char *SSL_get_cipher_list(const SSL *s,int n) 1303const char
1283 { 1304*SSL_get_cipher_list(const SSL *s, int n)
1305{
1284 SSL_CIPHER *c; 1306 SSL_CIPHER *c;
1285 STACK_OF(SSL_CIPHER) *sk; 1307 STACK_OF(SSL_CIPHER) *sk;
1286 1308
1287 if (s == NULL) return(NULL); 1309 if (s == NULL)
1288 sk=SSL_get_ciphers(s); 1310 return (NULL);
1311 sk = SSL_get_ciphers(s);
1289 if ((sk == NULL) || (sk_SSL_CIPHER_num(sk) <= n)) 1312 if ((sk == NULL) || (sk_SSL_CIPHER_num(sk) <= n))
1290 return(NULL); 1313 return (NULL);
1291 c=sk_SSL_CIPHER_value(sk,n); 1314 c = sk_SSL_CIPHER_value(sk, n);
1292 if (c == NULL) return(NULL); 1315 if (c == NULL)
1293 return(c->name); 1316 return (NULL);
1294 } 1317 return (c->name);
1318}
1295 1319
1296/** specify the ciphers to be used by default by the SSL_CTX */ 1320/** specify the ciphers to be used by default by the SSL_CTX */
1297int SSL_CTX_set_cipher_list(SSL_CTX *ctx, const char *str) 1321int
1298 { 1322SSL_CTX_set_cipher_list(SSL_CTX *ctx, const char *str)
1323{
1299 STACK_OF(SSL_CIPHER) *sk; 1324 STACK_OF(SSL_CIPHER) *sk;
1300 1325
1301 sk=ssl_create_cipher_list(ctx->method,&ctx->cipher_list, 1326 sk = ssl_create_cipher_list(ctx->method, &ctx->cipher_list,
1302 &ctx->cipher_list_by_id,str); 1327 &ctx->cipher_list_by_id, str);
1303 /* ssl_create_cipher_list may return an empty stack if it 1328 /* ssl_create_cipher_list may return an empty stack if it
1304 * was unable to find a cipher matching the given rule string 1329 * was unable to find a cipher matching the given rule string
1305 * (for example if the rule string specifies a cipher which 1330 * (for example if the rule string specifies a cipher which
@@ -1309,35 +1334,35 @@ int SSL_CTX_set_cipher_list(SSL_CTX *ctx, const char *str)
1309 * updated. */ 1334 * updated. */
1310 if (sk == NULL) 1335 if (sk == NULL)
1311 return 0; 1336 return 0;
1312 else if (sk_SSL_CIPHER_num(sk) == 0) 1337 else if (sk_SSL_CIPHER_num(sk) == 0) {
1313 {
1314 SSLerr(SSL_F_SSL_CTX_SET_CIPHER_LIST, SSL_R_NO_CIPHER_MATCH); 1338 SSLerr(SSL_F_SSL_CTX_SET_CIPHER_LIST, SSL_R_NO_CIPHER_MATCH);
1315 return 0; 1339 return 0;
1316 }
1317 return 1;
1318 } 1340 }
1341 return 1;
1342}
1319 1343
1320/** specify the ciphers to be used by the SSL */ 1344/** specify the ciphers to be used by the SSL */
1321int SSL_set_cipher_list(SSL *s,const char *str) 1345int
1322 { 1346SSL_set_cipher_list(SSL *s, const char *str)
1347{
1323 STACK_OF(SSL_CIPHER) *sk; 1348 STACK_OF(SSL_CIPHER) *sk;
1324 1349
1325 sk=ssl_create_cipher_list(s->ctx->method,&s->cipher_list, 1350 sk = ssl_create_cipher_list(s->ctx->method, &s->cipher_list,
1326 &s->cipher_list_by_id,str); 1351 &s->cipher_list_by_id, str);
1327 /* see comment in SSL_CTX_set_cipher_list */ 1352 /* see comment in SSL_CTX_set_cipher_list */
1328 if (sk == NULL) 1353 if (sk == NULL)
1329 return 0; 1354 return 0;
1330 else if (sk_SSL_CIPHER_num(sk) == 0) 1355 else if (sk_SSL_CIPHER_num(sk) == 0) {
1331 {
1332 SSLerr(SSL_F_SSL_SET_CIPHER_LIST, SSL_R_NO_CIPHER_MATCH); 1356 SSLerr(SSL_F_SSL_SET_CIPHER_LIST, SSL_R_NO_CIPHER_MATCH);
1333 return 0; 1357 return 0;
1334 }
1335 return 1;
1336 } 1358 }
1359 return 1;
1360}
1337 1361
1338/* works well for SSLv2, not so good for SSLv3 */ 1362/* works well for SSLv2, not so good for SSLv3 */
1339char *SSL_get_shared_ciphers(const SSL *s,char *buf,int len) 1363char
1340 { 1364*SSL_get_shared_ciphers(const SSL *s, char *buf, int len)
1365{
1341 char *end; 1366 char *end;
1342 STACK_OF(SSL_CIPHER) *sk; 1367 STACK_OF(SSL_CIPHER) *sk;
1343 SSL_CIPHER *c; 1368 SSL_CIPHER *c;
@@ -1346,146 +1371,138 @@ char *SSL_get_shared_ciphers(const SSL *s,char *buf,int len)
1346 1371
1347 if ((s->session == NULL) || (s->session->ciphers == NULL) || 1372 if ((s->session == NULL) || (s->session->ciphers == NULL) ||
1348 (len < 2)) 1373 (len < 2))
1349 return(NULL); 1374 return (NULL);
1350 1375
1351 sk=s->session->ciphers; 1376 sk = s->session->ciphers;
1352 buf[0] = '\0'; 1377 buf[0] = '\0';
1353 for (i=0; i<sk_SSL_CIPHER_num(sk); i++) 1378 for (i = 0; i < sk_SSL_CIPHER_num(sk); i++) {
1354 { 1379 c = sk_SSL_CIPHER_value(sk, i);
1355 c=sk_SSL_CIPHER_value(sk,i);
1356 end = buf + curlen; 1380 end = buf + curlen;
1357 if (strlcat(buf, c->name, len) >= len || 1381 if (strlcat(buf, c->name, len) >= len ||
1358 (curlen = strlcat(buf, ":", len)) >= len) 1382 (curlen = strlcat(buf, ":", len)) >= len) {
1359 {
1360 /* remove truncated cipher from list */ 1383 /* remove truncated cipher from list */
1361 *end = '\0'; 1384 *end = '\0';
1362 break; 1385 break;
1363 }
1364 } 1386 }
1387 }
1365 /* remove trailing colon */ 1388 /* remove trailing colon */
1366 if ((end = strrchr(buf, ':')) != NULL) 1389 if ((end = strrchr(buf, ':')) != NULL)
1367 *end = '\0'; 1390 *end = '\0';
1368 return(buf); 1391 return (buf);
1369 } 1392}
1370 1393
1371int ssl_cipher_list_to_bytes(SSL *s,STACK_OF(SSL_CIPHER) *sk,unsigned char *p, 1394int
1372 int (*put_cb)(const SSL_CIPHER *, unsigned char *)) 1395ssl_cipher_list_to_bytes(SSL *s, STACK_OF(SSL_CIPHER) *sk, unsigned char *p,
1373 { 1396 int (*put_cb)(const SSL_CIPHER *, unsigned char *))
1374 int i,j=0; 1397{
1398 int i, j = 0;
1375 SSL_CIPHER *c; 1399 SSL_CIPHER *c;
1376 unsigned char *q; 1400 unsigned char *q;
1377#ifndef OPENSSL_NO_KRB5 1401#ifndef OPENSSL_NO_KRB5
1378 int nokrb5 = !kssl_tgt_is_available(s->kssl_ctx); 1402 int nokrb5 = !kssl_tgt_is_available(s->kssl_ctx);
1379#endif /* OPENSSL_NO_KRB5 */ 1403#endif /* OPENSSL_NO_KRB5 */
1380 1404
1381 if (sk == NULL) return(0); 1405 if (sk == NULL)
1382 q=p; 1406 return (0);
1407 q = p;
1383 1408
1384 for (i=0; i<sk_SSL_CIPHER_num(sk); i++) 1409 for (i = 0; i < sk_SSL_CIPHER_num(sk); i++) {
1385 { 1410 c = sk_SSL_CIPHER_value(sk, i);
1386 c=sk_SSL_CIPHER_value(sk,i);
1387 /* Skip TLS v1.2 only ciphersuites if lower than v1.2 */ 1411 /* Skip TLS v1.2 only ciphersuites if lower than v1.2 */
1388 if ((c->algorithm_ssl & SSL_TLSV1_2) && 1412 if ((c->algorithm_ssl & SSL_TLSV1_2) &&
1389 (TLS1_get_client_version(s) < TLS1_2_VERSION)) 1413 (TLS1_get_client_version(s) < TLS1_2_VERSION))
1390 continue; 1414 continue;
1391#ifndef OPENSSL_NO_KRB5 1415#ifndef OPENSSL_NO_KRB5
1392 if (((c->algorithm_mkey & SSL_kKRB5) || (c->algorithm_auth & SSL_aKRB5)) && 1416 if (((c->algorithm_mkey & SSL_kKRB5) || (c->algorithm_auth & SSL_aKRB5)) &&
1393 nokrb5) 1417 nokrb5)
1394 continue; 1418 continue;
1395#endif /* OPENSSL_NO_KRB5 */ 1419#endif /* OPENSSL_NO_KRB5 */
1396#ifndef OPENSSL_NO_PSK 1420#ifndef OPENSSL_NO_PSK
1397 /* with PSK there must be client callback set */ 1421 /* with PSK there must be client callback set */
1398 if (((c->algorithm_mkey & SSL_kPSK) || (c->algorithm_auth & SSL_aPSK)) && 1422 if (((c->algorithm_mkey & SSL_kPSK) || (c->algorithm_auth & SSL_aPSK)) &&
1399 s->psk_client_callback == NULL) 1423 s->psk_client_callback == NULL)
1400 continue; 1424 continue;
1401#endif /* OPENSSL_NO_PSK */ 1425#endif /* OPENSSL_NO_PSK */
1402 j = put_cb ? put_cb(c,p) : ssl_put_cipher_by_char(s,c,p); 1426 j = put_cb ? put_cb(c, p) : ssl_put_cipher_by_char(s, c, p);
1403 p+=j; 1427 p += j;
1404 } 1428 }
1405 /* If p == q, no ciphers and caller indicates an error. Otherwise 1429 /* If p == q, no ciphers and caller indicates an error. Otherwise
1406 * add SCSV if not renegotiating. 1430 * add SCSV if not renegotiating.
1407 */ 1431 */
1408 if (p != q && !s->renegotiate) 1432 if (p != q && !s->renegotiate) {
1409 { 1433 static SSL_CIPHER scsv = {
1410 static SSL_CIPHER scsv =
1411 {
1412 0, NULL, SSL3_CK_SCSV, 0, 0, 0, 0, 0, 0, 0, 0, 0 1434 0, NULL, SSL3_CK_SCSV, 0, 0, 0, 0, 0, 0, 0, 0, 0
1413 }; 1435 };
1414 j = put_cb ? put_cb(&scsv,p) : ssl_put_cipher_by_char(s,&scsv,p); 1436 j = put_cb ? put_cb(&scsv, p) : ssl_put_cipher_by_char(s, &scsv, p);
1415 p+=j; 1437 p += j;
1416#ifdef OPENSSL_RI_DEBUG 1438#ifdef OPENSSL_RI_DEBUG
1417 fprintf(stderr, "SCSV sent by client\n"); 1439 fprintf(stderr, "SCSV sent by client\n");
1418#endif 1440#endif
1419 }
1420
1421 return(p-q);
1422 } 1441 }
1423 1442
1424STACK_OF(SSL_CIPHER) *ssl_bytes_to_cipher_list(SSL *s,unsigned char *p,int num, 1443 return (p - q);
1425 STACK_OF(SSL_CIPHER) **skp) 1444}
1426 { 1445
1446STACK_OF(SSL_CIPHER)
1447*ssl_bytes_to_cipher_list(SSL *s, unsigned char *p, int num,
1448STACK_OF(SSL_CIPHER) **skp)
1449{
1427 const SSL_CIPHER *c; 1450 const SSL_CIPHER *c;
1428 STACK_OF(SSL_CIPHER) *sk; 1451 STACK_OF(SSL_CIPHER) *sk;
1429 int i,n; 1452 int i, n;
1430 if (s->s3) 1453 if (s->s3)
1431 s->s3->send_connection_binding = 0; 1454 s->s3->send_connection_binding = 0;
1432 1455
1433 n=ssl_put_cipher_by_char(s,NULL,NULL); 1456 n = ssl_put_cipher_by_char(s, NULL, NULL);
1434 if ((num%n) != 0) 1457 if ((num % n) != 0) {
1435 { 1458 SSLerr(SSL_F_SSL_BYTES_TO_CIPHER_LIST, SSL_R_ERROR_IN_RECEIVED_CIPHER_LIST);
1436 SSLerr(SSL_F_SSL_BYTES_TO_CIPHER_LIST,SSL_R_ERROR_IN_RECEIVED_CIPHER_LIST); 1459 return (NULL);
1437 return(NULL); 1460 }
1438 }
1439 if ((skp == NULL) || (*skp == NULL)) 1461 if ((skp == NULL) || (*skp == NULL))
1440 sk=sk_SSL_CIPHER_new_null(); /* change perhaps later */ 1462 sk=sk_SSL_CIPHER_new_null(); /* change perhaps later */
1441 else 1463 else {
1442 {
1443 sk= *skp; 1464 sk= *skp;
1444 sk_SSL_CIPHER_zero(sk); 1465 sk_SSL_CIPHER_zero(sk);
1445 } 1466 }
1446 1467
1447 for (i=0; i<num; i+=n) 1468 for (i = 0; i < num; i += n) {
1448 {
1449 /* Check for SCSV */ 1469 /* Check for SCSV */
1450 if (s->s3 && (n != 3 || !p[0]) && 1470 if (s->s3 && (n != 3 || !p[0]) &&
1451 (p[n-2] == ((SSL3_CK_SCSV >> 8) & 0xff)) && 1471 (p[n - 2] == ((SSL3_CK_SCSV >> 8) & 0xff)) &&
1452 (p[n-1] == (SSL3_CK_SCSV & 0xff))) 1472 (p[n - 1] == (SSL3_CK_SCSV & 0xff))) {
1453 {
1454 /* SCSV fatal if renegotiating */ 1473 /* SCSV fatal if renegotiating */
1455 if (s->renegotiate) 1474 if (s->renegotiate) {
1456 { 1475 SSLerr(SSL_F_SSL_BYTES_TO_CIPHER_LIST, SSL_R_SCSV_RECEIVED_WHEN_RENEGOTIATING);
1457 SSLerr(SSL_F_SSL_BYTES_TO_CIPHER_LIST,SSL_R_SCSV_RECEIVED_WHEN_RENEGOTIATING); 1476 ssl3_send_alert(s, SSL3_AL_FATAL, SSL_AD_HANDSHAKE_FAILURE);
1458 ssl3_send_alert(s,SSL3_AL_FATAL,SSL_AD_HANDSHAKE_FAILURE); 1477
1459 goto err; 1478 goto err;
1460 } 1479 }
1461 s->s3->send_connection_binding = 1; 1480 s->s3->send_connection_binding = 1;
1462 p += n; 1481 p += n;
1463#ifdef OPENSSL_RI_DEBUG 1482#ifdef OPENSSL_RI_DEBUG
1464 fprintf(stderr, "SCSV received by server\n"); 1483 fprintf(stderr, "SCSV received by server\n");
1465#endif 1484#endif
1466 continue; 1485 continue;
1467 } 1486 }
1468 1487
1469 c=ssl_get_cipher_by_char(s,p); 1488 c = ssl_get_cipher_by_char(s, p);
1470 p+=n; 1489 p += n;
1471 if (c != NULL) 1490 if (c != NULL) {
1472 { 1491 if (!sk_SSL_CIPHER_push(sk, c)) {
1473 if (!sk_SSL_CIPHER_push(sk,c)) 1492 SSLerr(SSL_F_SSL_BYTES_TO_CIPHER_LIST, ERR_R_MALLOC_FAILURE);
1474 {
1475 SSLerr(SSL_F_SSL_BYTES_TO_CIPHER_LIST,ERR_R_MALLOC_FAILURE);
1476 goto err; 1493 goto err;
1477 }
1478 } 1494 }
1479 } 1495 }
1496 }
1480 1497
1481 if (skp != NULL) 1498 if (skp != NULL)
1482 *skp=sk; 1499 *skp = sk;
1483 return(sk); 1500 return (sk);
1484err: 1501err:
1485 if ((skp == NULL) || (*skp == NULL)) 1502 if ((skp == NULL) || (*skp == NULL))
1486 sk_SSL_CIPHER_free(sk); 1503 sk_SSL_CIPHER_free(sk);
1487 return(NULL); 1504 return (NULL);
1488 } 1505}
1489 1506
1490 1507
1491#ifndef OPENSSL_NO_TLSEXT 1508#ifndef OPENSSL_NO_TLSEXT
@@ -1493,22 +1510,24 @@ err:
1493 * So far, only host_name types are defined (RFC 3546). 1510 * So far, only host_name types are defined (RFC 3546).
1494 */ 1511 */
1495 1512
1496const char *SSL_get_servername(const SSL *s, const int type) 1513const char
1497 { 1514*SSL_get_servername(const SSL *s, const int type)
1515{
1498 if (type != TLSEXT_NAMETYPE_host_name) 1516 if (type != TLSEXT_NAMETYPE_host_name)
1499 return NULL; 1517 return NULL;
1500 1518
1501 return s->session && !s->tlsext_hostname ? 1519 return s->session && !s->tlsext_hostname ?
1502 s->session->tlsext_hostname : 1520 s->session->tlsext_hostname :
1503 s->tlsext_hostname; 1521 s->tlsext_hostname;
1504 } 1522}
1505 1523
1506int SSL_get_servername_type(const SSL *s) 1524int
1507 { 1525SSL_get_servername_type(const SSL *s)
1526{
1508 if (s->session && (!s->tlsext_hostname ? s->session->tlsext_hostname : s->tlsext_hostname)) 1527 if (s->session && (!s->tlsext_hostname ? s->session->tlsext_hostname : s->tlsext_hostname))
1509 return TLSEXT_NAMETYPE_host_name; 1528 return TLSEXT_NAMETYPE_host_name;
1510 return -1; 1529 return -1;
1511 } 1530}
1512 1531
1513# ifndef OPENSSL_NO_NEXTPROTONEG 1532# ifndef OPENSSL_NO_NEXTPROTONEG
1514/* SSL_select_next_proto implements the standard protocol selection. It is 1533/* SSL_select_next_proto implements the standard protocol selection. It is
@@ -1541,31 +1560,29 @@ int SSL_get_servername_type(const SSL *s)
1541 * OPENSSL_NPN_NEGOTIATED if a common protocol was found, or 1560 * OPENSSL_NPN_NEGOTIATED if a common protocol was found, or
1542 * OPENSSL_NPN_NO_OVERLAP if the fallback case was reached. 1561 * OPENSSL_NPN_NO_OVERLAP if the fallback case was reached.
1543 */ 1562 */
1544int SSL_select_next_proto(unsigned char **out, unsigned char *outlen, const unsigned char *server, unsigned int server_len, const unsigned char *client, unsigned int client_len) 1563int
1545 { 1564SSL_select_next_proto(unsigned char **out, unsigned char *outlen, const unsigned char *server, unsigned int server_len, const unsigned char *client, unsigned int client_len)
1565{
1546 unsigned int i, j; 1566 unsigned int i, j;
1547 const unsigned char *result; 1567 const unsigned char *result;
1548 int status = OPENSSL_NPN_UNSUPPORTED; 1568 int status = OPENSSL_NPN_UNSUPPORTED;
1549 1569
1550 /* For each protocol in server preference order, see if we support it. */ 1570 /* For each protocol in server preference order, see if we support it. */
1551 for (i = 0; i < server_len; ) 1571 for (i = 0; i < server_len; ) {
1552 { 1572 for (j = 0; j < client_len; ) {
1553 for (j = 0; j < client_len; )
1554 {
1555 if (server[i] == client[j] && 1573 if (server[i] == client[j] &&
1556 memcmp(&server[i+1], &client[j+1], server[i]) == 0) 1574 memcmp(&server[i + 1], &client[j + 1], server[i]) == 0) {
1557 {
1558 /* We found a match */ 1575 /* We found a match */
1559 result = &server[i]; 1576 result = &server[i];
1560 status = OPENSSL_NPN_NEGOTIATED; 1577 status = OPENSSL_NPN_NEGOTIATED;
1561 goto found; 1578 goto found;
1562 } 1579 }
1563 j += client[j]; 1580 j += client[j];
1564 j++; 1581 j++;
1565 } 1582 }
1566 i += server[i]; 1583 i += server[i];
1567 i++; 1584 i++;
1568 } 1585 }
1569 1586
1570 /* There's no overlap between our protocols and the server's list. */ 1587 /* There's no overlap between our protocols and the server's list. */
1571 result = client; 1588 result = client;
@@ -1575,7 +1592,7 @@ int SSL_select_next_proto(unsigned char **out, unsigned char *outlen, const unsi
1575 *out = (unsigned char *) result + 1; 1592 *out = (unsigned char *) result + 1;
1576 *outlen = result[0]; 1593 *outlen = result[0];
1577 return status; 1594 return status;
1578 } 1595}
1579 1596
1580/* SSL_get0_next_proto_negotiated sets *data and *len to point to the client's 1597/* SSL_get0_next_proto_negotiated sets *data and *len to point to the client's
1581 * requested protocol for this connection and returns 0. If the client didn't 1598 * requested protocol for this connection and returns 0. If the client didn't
@@ -1585,8 +1602,9 @@ int SSL_select_next_proto(unsigned char **out, unsigned char *outlen, const unsi
1585 * from this function need not be a member of the list of supported protocols 1602 * from this function need not be a member of the list of supported protocols
1586 * provided by the callback. 1603 * provided by the callback.
1587 */ 1604 */
1588void SSL_get0_next_proto_negotiated(const SSL *s, const unsigned char **data, unsigned *len) 1605void
1589 { 1606SSL_get0_next_proto_negotiated(const SSL *s, const unsigned char **data, unsigned *len)
1607{
1590 *data = s->next_proto_negotiated; 1608 *data = s->next_proto_negotiated;
1591 if (!*data) { 1609 if (!*data) {
1592 *len = 0; 1610 *len = 0;
@@ -1604,11 +1622,12 @@ void SSL_get0_next_proto_negotiated(const SSL *s, const unsigned char **data, un
1604 * 1622 *
1605 * The callback should return SSL_TLSEXT_ERR_OK if it wishes to advertise. Otherwise, no 1623 * The callback should return SSL_TLSEXT_ERR_OK if it wishes to advertise. Otherwise, no
1606 * such extension will be included in the ServerHello. */ 1624 * such extension will be included in the ServerHello. */
1607void SSL_CTX_set_next_protos_advertised_cb(SSL_CTX *ctx, int (*cb) (SSL *ssl, const unsigned char **out, unsigned int *outlen, void *arg), void *arg) 1625void
1608 { 1626SSL_CTX_set_next_protos_advertised_cb(SSL_CTX *ctx, int (*cb) (SSL *ssl, const unsigned char **out, unsigned int *outlen, void *arg), void *arg)
1627{
1609 ctx->next_protos_advertised_cb = cb; 1628 ctx->next_protos_advertised_cb = cb;
1610 ctx->next_protos_advertised_cb_arg = arg; 1629 ctx->next_protos_advertised_cb_arg = arg;
1611 } 1630}
1612 1631
1613/* SSL_CTX_set_next_proto_select_cb sets a callback that is called when a 1632/* SSL_CTX_set_next_proto_select_cb sets a callback that is called when a
1614 * client needs to select a protocol from the server's provided list. |out| 1633 * client needs to select a protocol from the server's provided list. |out|
@@ -1620,183 +1639,186 @@ void SSL_CTX_set_next_protos_advertised_cb(SSL_CTX *ctx, int (*cb) (SSL *ssl, co
1620 * The client must select a protocol. It is fatal to the connection if this 1639 * The client must select a protocol. It is fatal to the connection if this
1621 * callback returns a value other than SSL_TLSEXT_ERR_OK. 1640 * callback returns a value other than SSL_TLSEXT_ERR_OK.
1622 */ 1641 */
1623void SSL_CTX_set_next_proto_select_cb(SSL_CTX *ctx, int (*cb) (SSL *s, unsigned char **out, unsigned char *outlen, const unsigned char *in, unsigned int inlen, void *arg), void *arg) 1642void
1624 { 1643SSL_CTX_set_next_proto_select_cb(SSL_CTX *ctx, int (*cb) (SSL *s, unsigned char **out, unsigned char *outlen, const unsigned char *in, unsigned int inlen, void *arg), void *arg)
1644{
1625 ctx->next_proto_select_cb = cb; 1645 ctx->next_proto_select_cb = cb;
1626 ctx->next_proto_select_cb_arg = arg; 1646 ctx->next_proto_select_cb_arg = arg;
1627 } 1647}
1628# endif 1648# endif
1629#endif 1649#endif
1630 1650
1631int SSL_export_keying_material(SSL *s, unsigned char *out, size_t olen, 1651int
1632 const char *label, size_t llen, const unsigned char *p, size_t plen, 1652SSL_export_keying_material(SSL *s, unsigned char *out, size_t olen,
1633 int use_context) 1653 const char *label, size_t llen, const unsigned char *p, size_t plen,
1634 { 1654int use_context)
1655{
1635 if (s->version < TLS1_VERSION) 1656 if (s->version < TLS1_VERSION)
1636 return -1; 1657 return -1;
1637 1658
1638 return s->method->ssl3_enc->export_keying_material(s, out, olen, label, 1659 return s->method->ssl3_enc->export_keying_material(s, out, olen, label,
1639 llen, p, plen, 1660 llen, p, plen,
1640 use_context); 1661 use_context);
1641 } 1662}
1642 1663
1643static unsigned long ssl_session_hash(const SSL_SESSION *a) 1664static unsigned long
1644 { 1665ssl_session_hash(const SSL_SESSION *a)
1666{
1645 unsigned long l; 1667 unsigned long l;
1646 1668
1647 l=(unsigned long) 1669 l = (unsigned long)
1648 ((unsigned int) a->session_id[0] )| 1670 ((unsigned int) a->session_id[0] )|
1649 ((unsigned int) a->session_id[1]<< 8L)| 1671 ((unsigned int) a->session_id[1]<< 8L)|
1650 ((unsigned long)a->session_id[2]<<16L)| 1672 ((unsigned long)a->session_id[2]<<16L)|
1651 ((unsigned long)a->session_id[3]<<24L); 1673 ((unsigned long)a->session_id[3]<<24L);
1652 return(l); 1674 return (l);
1653 } 1675}
1654 1676
1655/* NB: If this function (or indeed the hash function which uses a sort of 1677/* NB: If this function (or indeed the hash function which uses a sort of
1656 * coarser function than this one) is changed, ensure 1678 * coarser function than this one) is changed, ensure
1657 * SSL_CTX_has_matching_session_id() is checked accordingly. It relies on being 1679 * SSL_CTX_has_matching_session_id() is checked accordingly. It relies on being
1658 * able to construct an SSL_SESSION that will collide with any existing session 1680 * able to construct an SSL_SESSION that will collide with any existing session
1659 * with a matching session ID. */ 1681 * with a matching session ID. */
1660static int ssl_session_cmp(const SSL_SESSION *a,const SSL_SESSION *b) 1682static int
1661 { 1683ssl_session_cmp(const SSL_SESSION *a, const SSL_SESSION *b)
1684{
1662 if (a->ssl_version != b->ssl_version) 1685 if (a->ssl_version != b->ssl_version)
1663 return(1); 1686 return (1);
1664 if (a->session_id_length != b->session_id_length) 1687 if (a->session_id_length != b->session_id_length)
1665 return(1); 1688 return (1);
1666 return(memcmp(a->session_id,b->session_id,a->session_id_length)); 1689 return (memcmp(a->session_id, b->session_id, a->session_id_length));
1667 } 1690}
1668 1691
1669/* These wrapper functions should remain rather than redeclaring 1692/* These wrapper functions should remain rather than redeclaring
1670 * SSL_SESSION_hash and SSL_SESSION_cmp for void* types and casting each 1693 * SSL_SESSION_hash and SSL_SESSION_cmp for void* types and casting each
1671 * variable. The reason is that the functions aren't static, they're exposed via 1694 * variable. The reason is that the functions aren't static, they're exposed via
1672 * ssl.h. */ 1695 * ssl.h. */
1673static IMPLEMENT_LHASH_HASH_FN(ssl_session, SSL_SESSION) 1696static
1674static IMPLEMENT_LHASH_COMP_FN(ssl_session, SSL_SESSION) 1697IMPLEMENT_LHASH_HASH_FN(ssl_session, SSL_SESSION)
1698static
1699IMPLEMENT_LHASH_COMP_FN(ssl_session, SSL_SESSION)
1675 1700
1676SSL_CTX *SSL_CTX_new(const SSL_METHOD *meth) 1701SSL_CTX
1677 { 1702*SSL_CTX_new(const SSL_METHOD *meth)
1678 SSL_CTX *ret=NULL; 1703{
1704 SSL_CTX *ret = NULL;
1679 1705
1680 if (meth == NULL) 1706 if (meth == NULL) {
1681 { 1707 SSLerr(SSL_F_SSL_CTX_NEW, SSL_R_NULL_SSL_METHOD_PASSED);
1682 SSLerr(SSL_F_SSL_CTX_NEW,SSL_R_NULL_SSL_METHOD_PASSED); 1708 return (NULL);
1683 return(NULL); 1709 }
1684 }
1685 1710
1686#ifdef OPENSSL_FIPS 1711#ifdef OPENSSL_FIPS
1687 if (FIPS_mode() && (meth->version < TLS1_VERSION)) 1712 if (FIPS_mode() && (meth->version < TLS1_VERSION)) {
1688 {
1689 SSLerr(SSL_F_SSL_CTX_NEW, SSL_R_ONLY_TLS_ALLOWED_IN_FIPS_MODE); 1713 SSLerr(SSL_F_SSL_CTX_NEW, SSL_R_ONLY_TLS_ALLOWED_IN_FIPS_MODE);
1690 return NULL; 1714 return NULL;
1691 } 1715 }
1692#endif 1716#endif
1693 1717
1694 if (SSL_get_ex_data_X509_STORE_CTX_idx() < 0) 1718 if (SSL_get_ex_data_X509_STORE_CTX_idx() < 0) {
1695 { 1719 SSLerr(SSL_F_SSL_CTX_NEW, SSL_R_X509_VERIFICATION_SETUP_PROBLEMS);
1696 SSLerr(SSL_F_SSL_CTX_NEW,SSL_R_X509_VERIFICATION_SETUP_PROBLEMS);
1697 goto err; 1720 goto err;
1698 } 1721 }
1699 ret=(SSL_CTX *)OPENSSL_malloc(sizeof(SSL_CTX)); 1722 ret = (SSL_CTX *)OPENSSL_malloc(sizeof(SSL_CTX));
1700 if (ret == NULL) 1723 if (ret == NULL)
1701 goto err; 1724 goto err;
1702 1725
1703 memset(ret,0,sizeof(SSL_CTX)); 1726 memset(ret, 0, sizeof(SSL_CTX));
1704 1727
1705 ret->method=meth; 1728 ret->method = meth;
1706 1729
1707 ret->cert_store=NULL; 1730 ret->cert_store = NULL;
1708 ret->session_cache_mode=SSL_SESS_CACHE_SERVER; 1731 ret->session_cache_mode = SSL_SESS_CACHE_SERVER;
1709 ret->session_cache_size=SSL_SESSION_CACHE_MAX_SIZE_DEFAULT; 1732 ret->session_cache_size = SSL_SESSION_CACHE_MAX_SIZE_DEFAULT;
1710 ret->session_cache_head=NULL; 1733 ret->session_cache_head = NULL;
1711 ret->session_cache_tail=NULL; 1734 ret->session_cache_tail = NULL;
1712 1735
1713 /* We take the system default */ 1736 /* We take the system default */
1714 ret->session_timeout=meth->get_timeout(); 1737 ret->session_timeout = meth->get_timeout();
1715 1738
1716 ret->new_session_cb=0; 1739 ret->new_session_cb = 0;
1717 ret->remove_session_cb=0; 1740 ret->remove_session_cb = 0;
1718 ret->get_session_cb=0; 1741 ret->get_session_cb = 0;
1719 ret->generate_session_id=0; 1742 ret->generate_session_id = 0;
1720 1743
1721 memset((char *)&ret->stats,0,sizeof(ret->stats)); 1744 memset((char *)&ret->stats, 0, sizeof(ret->stats));
1722 1745
1723 ret->references=1; 1746 ret->references = 1;
1724 ret->quiet_shutdown=0; 1747 ret->quiet_shutdown = 0;
1725 1748
1726/* ret->cipher=NULL;*/ 1749/* ret->cipher=NULL;*/
1727/* ret->s2->challenge=NULL; 1750/* ret->s2->challenge=NULL;
1728 ret->master_key=NULL; 1751 ret->master_key=NULL;
1729 ret->key_arg=NULL; 1752 ret->key_arg=NULL;
1730 ret->s2->conn_id=NULL; */ 1753 ret->s2->conn_id=NULL;
1754*/
1731 1755
1732 ret->info_callback=NULL; 1756 ret->info_callback = NULL;
1733 1757
1734 ret->app_verify_callback=0; 1758 ret->app_verify_callback = 0;
1735 ret->app_verify_arg=NULL; 1759 ret->app_verify_arg = NULL;
1736 1760
1737 ret->max_cert_list=SSL_MAX_CERT_LIST_DEFAULT; 1761 ret->max_cert_list = SSL_MAX_CERT_LIST_DEFAULT;
1738 ret->read_ahead=0; 1762 ret->read_ahead = 0;
1739 ret->msg_callback=0; 1763 ret->msg_callback = 0;
1740 ret->msg_callback_arg=NULL; 1764 ret->msg_callback_arg = NULL;
1741 ret->verify_mode=SSL_VERIFY_NONE; 1765 ret->verify_mode = SSL_VERIFY_NONE;
1742#if 0 1766#if 0
1743 ret->verify_depth=-1; /* Don't impose a limit (but x509_lu.c does) */ 1767 ret->verify_depth=-1; /* Don't impose a limit (but x509_lu.c does) */
1744#endif 1768#endif
1745 ret->sid_ctx_length=0; 1769 ret->sid_ctx_length = 0;
1746 ret->default_verify_callback=NULL; 1770 ret->default_verify_callback = NULL;
1747 if ((ret->cert=ssl_cert_new()) == NULL) 1771 if ((ret->cert = ssl_cert_new()) == NULL)
1748 goto err; 1772 goto err;
1749 1773
1750 ret->default_passwd_callback=0; 1774 ret->default_passwd_callback = 0;
1751 ret->default_passwd_callback_userdata=NULL; 1775 ret->default_passwd_callback_userdata = NULL;
1752 ret->client_cert_cb=0; 1776 ret->client_cert_cb = 0;
1753 ret->app_gen_cookie_cb=0; 1777 ret->app_gen_cookie_cb = 0;
1754 ret->app_verify_cookie_cb=0; 1778 ret->app_verify_cookie_cb = 0;
1755 1779
1756 ret->sessions=lh_SSL_SESSION_new(); 1780 ret->sessions = lh_SSL_SESSION_new();
1757 if (ret->sessions == NULL) goto err; 1781 if (ret->sessions == NULL)
1758 ret->cert_store=X509_STORE_new(); 1782 goto err;
1759 if (ret->cert_store == NULL) goto err; 1783 ret->cert_store = X509_STORE_new();
1784 if (ret->cert_store == NULL)
1785 goto err;
1760 1786
1761 ssl_create_cipher_list(ret->method, 1787 ssl_create_cipher_list(ret->method,
1762 &ret->cipher_list,&ret->cipher_list_by_id, 1788 &ret->cipher_list, &ret->cipher_list_by_id,
1763 meth->version == SSL2_VERSION ? "SSLv2" : SSL_DEFAULT_CIPHER_LIST); 1789 meth->version == SSL2_VERSION ? "SSLv2" : SSL_DEFAULT_CIPHER_LIST);
1764 if (ret->cipher_list == NULL 1790 if (ret->cipher_list == NULL
1765 || sk_SSL_CIPHER_num(ret->cipher_list) <= 0) 1791 || sk_SSL_CIPHER_num(ret->cipher_list) <= 0) {
1766 { 1792 SSLerr(SSL_F_SSL_CTX_NEW, SSL_R_LIBRARY_HAS_NO_CIPHERS);
1767 SSLerr(SSL_F_SSL_CTX_NEW,SSL_R_LIBRARY_HAS_NO_CIPHERS);
1768 goto err2; 1793 goto err2;
1769 } 1794 }
1770 1795
1771 ret->param = X509_VERIFY_PARAM_new(); 1796 ret->param = X509_VERIFY_PARAM_new();
1772 if (!ret->param) 1797 if (!ret->param)
1773 goto err; 1798 goto err;
1774 1799
1775 if ((ret->rsa_md5=EVP_get_digestbyname("ssl2-md5")) == NULL) 1800 if ((ret->rsa_md5 = EVP_get_digestbyname("ssl2-md5")) == NULL) {
1776 { 1801 SSLerr(SSL_F_SSL_CTX_NEW, SSL_R_UNABLE_TO_LOAD_SSL2_MD5_ROUTINES);
1777 SSLerr(SSL_F_SSL_CTX_NEW,SSL_R_UNABLE_TO_LOAD_SSL2_MD5_ROUTINES);
1778 goto err2; 1802 goto err2;
1779 } 1803 }
1780 if ((ret->md5=EVP_get_digestbyname("ssl3-md5")) == NULL) 1804 if ((ret->md5 = EVP_get_digestbyname("ssl3-md5")) == NULL) {
1781 { 1805 SSLerr(SSL_F_SSL_CTX_NEW, SSL_R_UNABLE_TO_LOAD_SSL3_MD5_ROUTINES);
1782 SSLerr(SSL_F_SSL_CTX_NEW,SSL_R_UNABLE_TO_LOAD_SSL3_MD5_ROUTINES);
1783 goto err2; 1806 goto err2;
1784 } 1807 }
1785 if ((ret->sha1=EVP_get_digestbyname("ssl3-sha1")) == NULL) 1808 if ((ret->sha1 = EVP_get_digestbyname("ssl3-sha1")) == NULL) {
1786 { 1809 SSLerr(SSL_F_SSL_CTX_NEW, SSL_R_UNABLE_TO_LOAD_SSL3_SHA1_ROUTINES);
1787 SSLerr(SSL_F_SSL_CTX_NEW,SSL_R_UNABLE_TO_LOAD_SSL3_SHA1_ROUTINES);
1788 goto err2; 1810 goto err2;
1789 } 1811 }
1790 1812
1791 if ((ret->client_CA=sk_X509_NAME_new_null()) == NULL) 1813 if ((ret->client_CA = sk_X509_NAME_new_null()) == NULL)
1792 goto err; 1814 goto err;
1793 1815
1794 CRYPTO_new_ex_data(CRYPTO_EX_INDEX_SSL_CTX, ret, &ret->ex_data); 1816 CRYPTO_new_ex_data(CRYPTO_EX_INDEX_SSL_CTX, ret, &ret->ex_data);
1795 1817
1796 ret->extra_certs=NULL; 1818 ret->extra_certs = NULL;
1797 /* No compression for DTLS */ 1819 /* No compression for DTLS */
1798 if (meth->version != DTLS1_VERSION) 1820 if (meth->version != DTLS1_VERSION)
1799 ret->comp_methods=SSL_COMP_get_compression_methods(); 1821 ret->comp_methods = SSL_COMP_get_compression_methods();
1800 1822
1801 ret->max_send_fragment = SSL3_RT_MAX_PLAIN_LENGTH; 1823 ret->max_send_fragment = SSL3_RT_MAX_PLAIN_LENGTH;
1802 1824
@@ -1806,8 +1828,8 @@ SSL_CTX *SSL_CTX_new(const SSL_METHOD *meth)
1806 /* Setup RFC4507 ticket keys */ 1828 /* Setup RFC4507 ticket keys */
1807 if ((RAND_pseudo_bytes(ret->tlsext_tick_key_name, 16) <= 0) 1829 if ((RAND_pseudo_bytes(ret->tlsext_tick_key_name, 16) <= 0)
1808 || (RAND_bytes(ret->tlsext_tick_hmac_key, 16) <= 0) 1830 || (RAND_bytes(ret->tlsext_tick_hmac_key, 16) <= 0)
1809 || (RAND_bytes(ret->tlsext_tick_aes_key, 16) <= 0)) 1831 || (RAND_bytes(ret->tlsext_tick_aes_key, 16) <= 0))
1810 ret->options |= SSL_OP_NO_TICKET; 1832 ret->options |= SSL_OP_NO_TICKET;
1811 1833
1812 ret->tlsext_status_cb = 0; 1834 ret->tlsext_status_cb = 0;
1813 ret->tlsext_status_arg = NULL; 1835 ret->tlsext_status_arg = NULL;
@@ -1818,9 +1840,9 @@ SSL_CTX *SSL_CTX_new(const SSL_METHOD *meth)
1818# endif 1840# endif
1819#endif 1841#endif
1820#ifndef OPENSSL_NO_PSK 1842#ifndef OPENSSL_NO_PSK
1821 ret->psk_identity_hint=NULL; 1843 ret->psk_identity_hint = NULL;
1822 ret->psk_client_callback=NULL; 1844 ret->psk_client_callback = NULL;
1823 ret->psk_server_callback=NULL; 1845 ret->psk_server_callback = NULL;
1824#endif 1846#endif
1825#ifndef OPENSSL_NO_SRP 1847#ifndef OPENSSL_NO_SRP
1826 SSL_CTX_SRP_CTX_init(ret); 1848 SSL_CTX_SRP_CTX_init(ret);
@@ -1834,11 +1856,10 @@ SSL_CTX *SSL_CTX_new(const SSL_METHOD *meth)
1834 ret->rbuf_freelist->len = 0; 1856 ret->rbuf_freelist->len = 0;
1835 ret->rbuf_freelist->head = NULL; 1857 ret->rbuf_freelist->head = NULL;
1836 ret->wbuf_freelist = OPENSSL_malloc(sizeof(SSL3_BUF_FREELIST)); 1858 ret->wbuf_freelist = OPENSSL_malloc(sizeof(SSL3_BUF_FREELIST));
1837 if (!ret->wbuf_freelist) 1859 if (!ret->wbuf_freelist) {
1838 {
1839 OPENSSL_free(ret->rbuf_freelist); 1860 OPENSSL_free(ret->rbuf_freelist);
1840 goto err; 1861 goto err;
1841 } 1862 }
1842 ret->wbuf_freelist->chunklen = 0; 1863 ret->wbuf_freelist->chunklen = 0;
1843 ret->wbuf_freelist->len = 0; 1864 ret->wbuf_freelist->len = 0;
1844 ret->wbuf_freelist->head = NULL; 1865 ret->wbuf_freelist->head = NULL;
@@ -1850,16 +1871,15 @@ SSL_CTX *SSL_CTX_new(const SSL_METHOD *meth)
1850#define eng_str(x) eng_strx(x) 1871#define eng_str(x) eng_strx(x)
1851 /* Use specific client engine automatically... ignore errors */ 1872 /* Use specific client engine automatically... ignore errors */
1852 { 1873 {
1853 ENGINE *eng; 1874 ENGINE *eng;
1854 eng = ENGINE_by_id(eng_str(OPENSSL_SSL_CLIENT_ENGINE_AUTO));
1855 if (!eng)
1856 {
1857 ERR_clear_error();
1858 ENGINE_load_builtin_engines();
1859 eng = ENGINE_by_id(eng_str(OPENSSL_SSL_CLIENT_ENGINE_AUTO)); 1875 eng = ENGINE_by_id(eng_str(OPENSSL_SSL_CLIENT_ENGINE_AUTO));
1876 if (!eng) {
1877 ERR_clear_error();
1878 ENGINE_load_builtin_engines();
1879 eng = ENGINE_by_id(eng_str(OPENSSL_SSL_CLIENT_ENGINE_AUTO));
1860 } 1880 }
1861 if (!eng || !SSL_CTX_set_client_cert_engine(ret, eng)) 1881 if (!eng || !SSL_CTX_set_client_cert_engine(ret, eng))
1862 ERR_clear_error(); 1882 ERR_clear_error();
1863 } 1883 }
1864#endif 1884#endif
1865#endif 1885#endif
@@ -1868,50 +1888,54 @@ SSL_CTX *SSL_CTX_new(const SSL_METHOD *meth)
1868 */ 1888 */
1869 ret->options |= SSL_OP_LEGACY_SERVER_CONNECT; 1889 ret->options |= SSL_OP_LEGACY_SERVER_CONNECT;
1870 1890
1871 return(ret); 1891 return (ret);
1872err: 1892err:
1873 SSLerr(SSL_F_SSL_CTX_NEW,ERR_R_MALLOC_FAILURE); 1893 SSLerr(SSL_F_SSL_CTX_NEW, ERR_R_MALLOC_FAILURE);
1874err2: 1894err2:
1875 if (ret != NULL) SSL_CTX_free(ret); 1895 if (ret != NULL)
1876 return(NULL); 1896 SSL_CTX_free(ret);
1877 } 1897 return (NULL);
1898}
1878 1899
1879#if 0 1900#if 0
1880static void SSL_COMP_free(SSL_COMP *comp) 1901static void
1881 { OPENSSL_free(comp); } 1902SSL_COMP_free(SSL_COMP *comp)
1903 { OPENSSL_free(comp);
1904}
1882#endif 1905#endif
1883 1906
1884#ifndef OPENSSL_NO_BUF_FREELISTS 1907#ifndef OPENSSL_NO_BUF_FREELISTS
1885static void 1908static void
1886ssl_buf_freelist_free(SSL3_BUF_FREELIST *list) 1909ssl_buf_freelist_free(SSL3_BUF_FREELIST *list)
1887 { 1910{
1888 SSL3_BUF_FREELIST_ENTRY *ent, *next; 1911 SSL3_BUF_FREELIST_ENTRY *ent, *next;
1889 for (ent = list->head; ent; ent = next) 1912 for (ent = list->head; ent; ent = next) {
1890 {
1891 next = ent->next; 1913 next = ent->next;
1892 OPENSSL_free(ent); 1914 OPENSSL_free(ent);
1893 }
1894 OPENSSL_free(list);
1895 } 1915 }
1916 OPENSSL_free(list);
1917}
1896#endif 1918#endif
1897 1919
1898void SSL_CTX_free(SSL_CTX *a) 1920void
1899 { 1921SSL_CTX_free(SSL_CTX *a)
1922{
1900 int i; 1923 int i;
1901 1924
1902 if (a == NULL) return; 1925 if (a == NULL)
1926 return;
1903 1927
1904 i=CRYPTO_add(&a->references,-1,CRYPTO_LOCK_SSL_CTX); 1928 i = CRYPTO_add(&a->references, -1, CRYPTO_LOCK_SSL_CTX);
1905#ifdef REF_PRINT 1929#ifdef REF_PRINT
1906 REF_PRINT("SSL_CTX",a); 1930 REF_PRINT("SSL_CTX", a);
1907#endif 1931#endif
1908 if (i > 0) return; 1932 if (i > 0)
1933 return;
1909#ifdef REF_CHECK 1934#ifdef REF_CHECK
1910 if (i < 0) 1935 if (i < 0) {
1911 { 1936 fprintf(stderr, "SSL_CTX_free, bad reference count\n");
1912 fprintf(stderr,"SSL_CTX_free, bad reference count\n");
1913 abort(); /* ok */ 1937 abort(); /* ok */
1914 } 1938 }
1915#endif 1939#endif
1916 1940
1917 if (a->param) 1941 if (a->param)
@@ -1927,7 +1951,7 @@ void SSL_CTX_free(SSL_CTX *a)
1927 * (See ticket [openssl.org #212].) 1951 * (See ticket [openssl.org #212].)
1928 */ 1952 */
1929 if (a->sessions != NULL) 1953 if (a->sessions != NULL)
1930 SSL_CTX_flush_sessions(a,0); 1954 SSL_CTX_flush_sessions(a, 0);
1931 1955
1932 CRYPTO_free_ex_data(CRYPTO_EX_INDEX_SSL_CTX, a, &a->ex_data); 1956 CRYPTO_free_ex_data(CRYPTO_EX_INDEX_SSL_CTX, a, &a->ex_data);
1933 1957
@@ -1943,19 +1967,19 @@ void SSL_CTX_free(SSL_CTX *a)
1943 if (a->cert != NULL) 1967 if (a->cert != NULL)
1944 ssl_cert_free(a->cert); 1968 ssl_cert_free(a->cert);
1945 if (a->client_CA != NULL) 1969 if (a->client_CA != NULL)
1946 sk_X509_NAME_pop_free(a->client_CA,X509_NAME_free); 1970 sk_X509_NAME_pop_free(a->client_CA, X509_NAME_free);
1947 if (a->extra_certs != NULL) 1971 if (a->extra_certs != NULL)
1948 sk_X509_pop_free(a->extra_certs,X509_free); 1972 sk_X509_pop_free(a->extra_certs, X509_free);
1949#if 0 /* This should never be done, since it removes a global database */ 1973#if 0 /* This should never be done, since it removes a global database */
1950 if (a->comp_methods != NULL) 1974 if (a->comp_methods != NULL)
1951 sk_SSL_COMP_pop_free(a->comp_methods,SSL_COMP_free); 1975 sk_SSL_COMP_pop_free(a->comp_methods, SSL_COMP_free);
1952#else 1976#else
1953 a->comp_methods = NULL; 1977 a->comp_methods = NULL;
1954#endif 1978#endif
1955 1979
1956#ifndef OPENSSL_NO_SRTP 1980#ifndef OPENSSL_NO_SRTP
1957 if (a->srtp_profiles) 1981 if (a->srtp_profiles)
1958 sk_SRTP_PROTECTION_PROFILE_free(a->srtp_profiles); 1982 sk_SRTP_PROTECTION_PROFILE_free(a->srtp_profiles);
1959#endif 1983#endif
1960 1984
1961#ifndef OPENSSL_NO_PSK 1985#ifndef OPENSSL_NO_PSK
@@ -1978,42 +2002,48 @@ void SSL_CTX_free(SSL_CTX *a)
1978#endif 2002#endif
1979 2003
1980 OPENSSL_free(a); 2004 OPENSSL_free(a);
1981 } 2005}
1982 2006
1983void SSL_CTX_set_default_passwd_cb(SSL_CTX *ctx, pem_password_cb *cb) 2007void
1984 { 2008SSL_CTX_set_default_passwd_cb(SSL_CTX *ctx, pem_password_cb *cb)
1985 ctx->default_passwd_callback=cb; 2009{
1986 } 2010 ctx->default_passwd_callback = cb;
2011}
1987 2012
1988void SSL_CTX_set_default_passwd_cb_userdata(SSL_CTX *ctx,void *u) 2013void
1989 { 2014SSL_CTX_set_default_passwd_cb_userdata(SSL_CTX *ctx, void *u)
1990 ctx->default_passwd_callback_userdata=u; 2015{
1991 } 2016 ctx->default_passwd_callback_userdata = u;
2017}
1992 2018
1993void SSL_CTX_set_cert_verify_callback(SSL_CTX *ctx, int (*cb)(X509_STORE_CTX *,void *), void *arg) 2019void
1994 { 2020SSL_CTX_set_cert_verify_callback(SSL_CTX *ctx, int (*cb)(X509_STORE_CTX *, void *), void *arg)
1995 ctx->app_verify_callback=cb; 2021{
1996 ctx->app_verify_arg=arg; 2022 ctx->app_verify_callback = cb;
1997 } 2023 ctx->app_verify_arg = arg;
2024}
1998 2025
1999void SSL_CTX_set_verify(SSL_CTX *ctx,int mode,int (*cb)(int, X509_STORE_CTX *)) 2026void
2000 { 2027SSL_CTX_set_verify(SSL_CTX *ctx, int mode, int (*cb)(int, X509_STORE_CTX *))
2001 ctx->verify_mode=mode; 2028{
2002 ctx->default_verify_callback=cb; 2029 ctx->verify_mode = mode;
2003 } 2030 ctx->default_verify_callback = cb;
2031}
2004 2032
2005void SSL_CTX_set_verify_depth(SSL_CTX *ctx,int depth) 2033void
2006 { 2034SSL_CTX_set_verify_depth(SSL_CTX *ctx, int depth)
2035{
2007 X509_VERIFY_PARAM_set_depth(ctx->param, depth); 2036 X509_VERIFY_PARAM_set_depth(ctx->param, depth);
2008 } 2037}
2009 2038
2010void ssl_set_cert_masks(CERT *c, const SSL_CIPHER *cipher) 2039void
2011 { 2040ssl_set_cert_masks(CERT *c, const SSL_CIPHER *cipher)
2041{
2012 CERT_PKEY *cpk; 2042 CERT_PKEY *cpk;
2013 int rsa_enc,rsa_tmp,rsa_sign,dh_tmp,dh_rsa,dh_dsa,dsa_sign; 2043 int rsa_enc, rsa_tmp, rsa_sign, dh_tmp, dh_rsa, dh_dsa, dsa_sign;
2014 int rsa_enc_export,dh_rsa_export,dh_dsa_export; 2044 int rsa_enc_export, dh_rsa_export, dh_dsa_export;
2015 int rsa_tmp_export,dh_tmp_export,kl; 2045 int rsa_tmp_export, dh_tmp_export, kl;
2016 unsigned long mask_k,mask_a,emask_k,emask_a; 2046 unsigned long mask_k, mask_a, emask_k, emask_a;
2017 int have_ecc_cert, ecdh_ok, ecdsa_ok, ecc_pkey_size; 2047 int have_ecc_cert, ecdh_ok, ecdsa_ok, ecc_pkey_size;
2018#ifndef OPENSSL_NO_ECDH 2048#ifndef OPENSSL_NO_ECDH
2019 int have_ecdh_tmp; 2049 int have_ecdh_tmp;
@@ -2022,57 +2052,58 @@ void ssl_set_cert_masks(CERT *c, const SSL_CIPHER *cipher)
2022 EVP_PKEY *ecc_pkey = NULL; 2052 EVP_PKEY *ecc_pkey = NULL;
2023 int signature_nid = 0, pk_nid = 0, md_nid = 0; 2053 int signature_nid = 0, pk_nid = 0, md_nid = 0;
2024 2054
2025 if (c == NULL) return; 2055 if (c == NULL)
2056 return;
2026 2057
2027 kl=SSL_C_EXPORT_PKEYLENGTH(cipher); 2058 kl = SSL_C_EXPORT_PKEYLENGTH(cipher);
2028 2059
2029#ifndef OPENSSL_NO_RSA 2060#ifndef OPENSSL_NO_RSA
2030 rsa_tmp=(c->rsa_tmp != NULL || c->rsa_tmp_cb != NULL); 2061 rsa_tmp = (c->rsa_tmp != NULL || c->rsa_tmp_cb != NULL);
2031 rsa_tmp_export=(c->rsa_tmp_cb != NULL || 2062 rsa_tmp_export = (c->rsa_tmp_cb != NULL ||
2032 (rsa_tmp && RSA_size(c->rsa_tmp)*8 <= kl)); 2063 (rsa_tmp && RSA_size(c->rsa_tmp)*8 <= kl));
2033#else 2064#else
2034 rsa_tmp=rsa_tmp_export=0; 2065 rsa_tmp = rsa_tmp_export = 0;
2035#endif 2066#endif
2036#ifndef OPENSSL_NO_DH 2067#ifndef OPENSSL_NO_DH
2037 dh_tmp=(c->dh_tmp != NULL || c->dh_tmp_cb != NULL); 2068 dh_tmp = (c->dh_tmp != NULL || c->dh_tmp_cb != NULL);
2038 dh_tmp_export=(c->dh_tmp_cb != NULL || 2069 dh_tmp_export = (c->dh_tmp_cb != NULL ||
2039 (dh_tmp && DH_size(c->dh_tmp)*8 <= kl)); 2070 (dh_tmp && DH_size(c->dh_tmp)*8 <= kl));
2040#else 2071#else
2041 dh_tmp=dh_tmp_export=0; 2072 dh_tmp = dh_tmp_export = 0;
2042#endif 2073#endif
2043 2074
2044#ifndef OPENSSL_NO_ECDH 2075#ifndef OPENSSL_NO_ECDH
2045 have_ecdh_tmp=(c->ecdh_tmp != NULL || c->ecdh_tmp_cb != NULL); 2076 have_ecdh_tmp = (c->ecdh_tmp != NULL || c->ecdh_tmp_cb != NULL);
2046#endif 2077#endif
2047 cpk= &(c->pkeys[SSL_PKEY_RSA_ENC]); 2078 cpk = &(c->pkeys[SSL_PKEY_RSA_ENC]);
2048 rsa_enc= (cpk->x509 != NULL && cpk->privatekey != NULL); 2079 rsa_enc = (cpk->x509 != NULL && cpk->privatekey != NULL);
2049 rsa_enc_export=(rsa_enc && EVP_PKEY_size(cpk->privatekey)*8 <= kl); 2080 rsa_enc_export = (rsa_enc && EVP_PKEY_size(cpk->privatekey)*8 <= kl);
2050 cpk= &(c->pkeys[SSL_PKEY_RSA_SIGN]); 2081 cpk = &(c->pkeys[SSL_PKEY_RSA_SIGN]);
2051 rsa_sign=(cpk->x509 != NULL && cpk->privatekey != NULL); 2082 rsa_sign = (cpk->x509 != NULL && cpk->privatekey != NULL);
2052 cpk= &(c->pkeys[SSL_PKEY_DSA_SIGN]); 2083 cpk = &(c->pkeys[SSL_PKEY_DSA_SIGN]);
2053 dsa_sign=(cpk->x509 != NULL && cpk->privatekey != NULL); 2084 dsa_sign = (cpk->x509 != NULL && cpk->privatekey != NULL);
2054 cpk= &(c->pkeys[SSL_PKEY_DH_RSA]); 2085 cpk = &(c->pkeys[SSL_PKEY_DH_RSA]);
2055 dh_rsa= (cpk->x509 != NULL && cpk->privatekey != NULL); 2086 dh_rsa = (cpk->x509 != NULL && cpk->privatekey != NULL);
2056 dh_rsa_export=(dh_rsa && EVP_PKEY_size(cpk->privatekey)*8 <= kl); 2087 dh_rsa_export = (dh_rsa && EVP_PKEY_size(cpk->privatekey)*8 <= kl);
2057 cpk= &(c->pkeys[SSL_PKEY_DH_DSA]); 2088 cpk = &(c->pkeys[SSL_PKEY_DH_DSA]);
2058/* FIX THIS EAY EAY EAY */ 2089/* FIX THIS EAY EAY EAY */
2059 dh_dsa= (cpk->x509 != NULL && cpk->privatekey != NULL); 2090 dh_dsa = (cpk->x509 != NULL && cpk->privatekey != NULL);
2060 dh_dsa_export=(dh_dsa && EVP_PKEY_size(cpk->privatekey)*8 <= kl); 2091 dh_dsa_export = (dh_dsa && EVP_PKEY_size(cpk->privatekey)*8 <= kl);
2061 cpk= &(c->pkeys[SSL_PKEY_ECC]); 2092 cpk = &(c->pkeys[SSL_PKEY_ECC]);
2062 have_ecc_cert= (cpk->x509 != NULL && cpk->privatekey != NULL); 2093 have_ecc_cert = (cpk->x509 != NULL && cpk->privatekey != NULL);
2063 mask_k=0; 2094 mask_k = 0;
2064 mask_a=0; 2095 mask_a = 0;
2065 emask_k=0; 2096 emask_k = 0;
2066 emask_a=0; 2097 emask_a = 0;
2098
2067 2099
2068
2069 2100
2070#ifdef CIPHER_DEBUG 2101#ifdef CIPHER_DEBUG
2071 printf("rt=%d rte=%d dht=%d ecdht=%d re=%d ree=%d rs=%d ds=%d dhr=%d dhd=%d\n", 2102 printf("rt=%d rte=%d dht=%d ecdht=%d re=%d ree=%d rs=%d ds=%d dhr=%d dhd=%d\n",
2072 rsa_tmp,rsa_tmp_export,dh_tmp,have_ecdh_tmp, 2103 rsa_tmp, rsa_tmp_export, dh_tmp, have_ecdh_tmp,
2073 rsa_enc,rsa_enc_export,rsa_sign,dsa_sign,dh_rsa,dh_dsa); 2104 rsa_enc, rsa_enc_export, rsa_sign, dsa_sign, dh_rsa, dh_dsa);
2074#endif 2105#endif
2075 2106
2076 cpk = &(c->pkeys[SSL_PKEY_GOST01]); 2107 cpk = &(c->pkeys[SSL_PKEY_GOST01]);
2077 if (cpk->x509 != NULL && cpk->privatekey !=NULL) { 2108 if (cpk->x509 != NULL && cpk->privatekey !=NULL) {
2078 mask_k |= SSL_kGOST; 2109 mask_k |= SSL_kGOST;
@@ -2091,12 +2122,12 @@ void ssl_set_cert_masks(CERT *c, const SSL_CIPHER *cipher)
2091 2122
2092#if 0 2123#if 0
2093 /* The match needs to be both kEDH and aRSA or aDSA, so don't worry */ 2124 /* The match needs to be both kEDH and aRSA or aDSA, so don't worry */
2094 if ( (dh_tmp || dh_rsa || dh_dsa) && 2125 if ((dh_tmp || dh_rsa || dh_dsa) &&
2095 (rsa_enc || rsa_sign || dsa_sign)) 2126 (rsa_enc || rsa_sign || dsa_sign))
2096 mask_k|=SSL_kEDH; 2127 mask_k|=SSL_kEDH;
2097 if ((dh_tmp_export || dh_rsa_export || dh_dsa_export) && 2128 if ((dh_tmp_export || dh_rsa_export || dh_dsa_export) &&
2098 (rsa_enc || rsa_sign || dsa_sign)) 2129 (rsa_enc || rsa_sign || dsa_sign))
2099 emask_k|=SSL_kEDH; 2130 emask_k|=SSL_kEDH;
2100#endif 2131#endif
2101 2132
2102 if (dh_tmp_export) 2133 if (dh_tmp_export)
@@ -2105,23 +2136,25 @@ void ssl_set_cert_masks(CERT *c, const SSL_CIPHER *cipher)
2105 if (dh_tmp) 2136 if (dh_tmp)
2106 mask_k|=SSL_kEDH; 2137 mask_k|=SSL_kEDH;
2107 2138
2108 if (dh_rsa) mask_k|=SSL_kDHr; 2139 if (dh_rsa)
2109 if (dh_rsa_export) emask_k|=SSL_kDHr; 2140 mask_k|=SSL_kDHr;
2141 if (dh_rsa_export)
2142 emask_k|=SSL_kDHr;
2110 2143
2111 if (dh_dsa) mask_k|=SSL_kDHd; 2144 if (dh_dsa)
2112 if (dh_dsa_export) emask_k|=SSL_kDHd; 2145 mask_k|=SSL_kDHd;
2146 if (dh_dsa_export)
2147 emask_k|=SSL_kDHd;
2113 2148
2114 if (rsa_enc || rsa_sign) 2149 if (rsa_enc || rsa_sign) {
2115 {
2116 mask_a|=SSL_aRSA; 2150 mask_a|=SSL_aRSA;
2117 emask_a|=SSL_aRSA; 2151 emask_a|=SSL_aRSA;
2118 } 2152 }
2119 2153
2120 if (dsa_sign) 2154 if (dsa_sign) {
2121 {
2122 mask_a|=SSL_aDSS; 2155 mask_a|=SSL_aDSS;
2123 emask_a|=SSL_aDSS; 2156 emask_a|=SSL_aDSS;
2124 } 2157 }
2125 2158
2126 mask_a|=SSL_aNULL; 2159 mask_a|=SSL_aNULL;
2127 emask_a|=SSL_aNULL; 2160 emask_a|=SSL_aNULL;
@@ -2136,66 +2169,57 @@ void ssl_set_cert_masks(CERT *c, const SSL_CIPHER *cipher)
2136 /* An ECC certificate may be usable for ECDH and/or 2169 /* An ECC certificate may be usable for ECDH and/or
2137 * ECDSA cipher suites depending on the key usage extension. 2170 * ECDSA cipher suites depending on the key usage extension.
2138 */ 2171 */
2139 if (have_ecc_cert) 2172 if (have_ecc_cert) {
2140 {
2141 /* This call populates extension flags (ex_flags) */ 2173 /* This call populates extension flags (ex_flags) */
2142 x = (c->pkeys[SSL_PKEY_ECC]).x509; 2174 x = (c->pkeys[SSL_PKEY_ECC]).x509;
2143 X509_check_purpose(x, -1, 0); 2175 X509_check_purpose(x, -1, 0);
2144 ecdh_ok = (x->ex_flags & EXFLAG_KUSAGE) ? 2176 ecdh_ok = (x->ex_flags & EXFLAG_KUSAGE) ?
2145 (x->ex_kusage & X509v3_KU_KEY_AGREEMENT) : 1; 2177 (x->ex_kusage & X509v3_KU_KEY_AGREEMENT) : 1;
2146 ecdsa_ok = (x->ex_flags & EXFLAG_KUSAGE) ? 2178 ecdsa_ok = (x->ex_flags & EXFLAG_KUSAGE) ?
2147 (x->ex_kusage & X509v3_KU_DIGITAL_SIGNATURE) : 1; 2179 (x->ex_kusage & X509v3_KU_DIGITAL_SIGNATURE) : 1;
2148 ecc_pkey = X509_get_pubkey(x); 2180 ecc_pkey = X509_get_pubkey(x);
2149 ecc_pkey_size = (ecc_pkey != NULL) ? 2181 ecc_pkey_size = (ecc_pkey != NULL) ?
2150 EVP_PKEY_bits(ecc_pkey) : 0; 2182 EVP_PKEY_bits(ecc_pkey) : 0;
2151 EVP_PKEY_free(ecc_pkey); 2183 EVP_PKEY_free(ecc_pkey);
2152 if ((x->sig_alg) && (x->sig_alg->algorithm)) 2184 if ((x->sig_alg) && (x->sig_alg->algorithm)) {
2153 {
2154 signature_nid = OBJ_obj2nid(x->sig_alg->algorithm); 2185 signature_nid = OBJ_obj2nid(x->sig_alg->algorithm);
2155 OBJ_find_sigid_algs(signature_nid, &md_nid, &pk_nid); 2186 OBJ_find_sigid_algs(signature_nid, &md_nid, &pk_nid);
2156 } 2187 }
2157#ifndef OPENSSL_NO_ECDH 2188#ifndef OPENSSL_NO_ECDH
2158 if (ecdh_ok) 2189 if (ecdh_ok) {
2159 {
2160 2190
2161 if (pk_nid == NID_rsaEncryption || pk_nid == NID_rsa) 2191 if (pk_nid == NID_rsaEncryption || pk_nid == NID_rsa) {
2162 {
2163 mask_k|=SSL_kECDHr; 2192 mask_k|=SSL_kECDHr;
2164 mask_a|=SSL_aECDH; 2193 mask_a|=SSL_aECDH;
2165 if (ecc_pkey_size <= 163) 2194 if (ecc_pkey_size <= 163) {
2166 {
2167 emask_k|=SSL_kECDHr; 2195 emask_k|=SSL_kECDHr;
2168 emask_a|=SSL_aECDH; 2196 emask_a|=SSL_aECDH;
2169 }
2170 } 2197 }
2198 }
2171 2199
2172 if (pk_nid == NID_X9_62_id_ecPublicKey) 2200 if (pk_nid == NID_X9_62_id_ecPublicKey) {
2173 {
2174 mask_k|=SSL_kECDHe; 2201 mask_k|=SSL_kECDHe;
2175 mask_a|=SSL_aECDH; 2202 mask_a|=SSL_aECDH;
2176 if (ecc_pkey_size <= 163) 2203 if (ecc_pkey_size <= 163) {
2177 {
2178 emask_k|=SSL_kECDHe; 2204 emask_k|=SSL_kECDHe;
2179 emask_a|=SSL_aECDH; 2205 emask_a|=SSL_aECDH;
2180 }
2181 } 2206 }
2182 } 2207 }
2208 }
2183#endif 2209#endif
2184#ifndef OPENSSL_NO_ECDSA 2210#ifndef OPENSSL_NO_ECDSA
2185 if (ecdsa_ok) 2211 if (ecdsa_ok) {
2186 {
2187 mask_a|=SSL_aECDSA; 2212 mask_a|=SSL_aECDSA;
2188 emask_a|=SSL_aECDSA; 2213 emask_a|=SSL_aECDSA;
2189 }
2190#endif
2191 } 2214 }
2215#endif
2216 }
2192 2217
2193#ifndef OPENSSL_NO_ECDH 2218#ifndef OPENSSL_NO_ECDH
2194 if (have_ecdh_tmp) 2219 if (have_ecdh_tmp) {
2195 {
2196 mask_k|=SSL_kEECDH; 2220 mask_k|=SSL_kEECDH;
2197 emask_k|=SSL_kEECDH; 2221 emask_k|=SSL_kEECDH;
2198 } 2222 }
2199#endif 2223#endif
2200 2224
2201#ifndef OPENSSL_NO_PSK 2225#ifndef OPENSSL_NO_PSK
@@ -2205,12 +2229,12 @@ void ssl_set_cert_masks(CERT *c, const SSL_CIPHER *cipher)
2205 emask_a |= SSL_aPSK; 2229 emask_a |= SSL_aPSK;
2206#endif 2230#endif
2207 2231
2208 c->mask_k=mask_k; 2232 c->mask_k = mask_k;
2209 c->mask_a=mask_a; 2233 c->mask_a = mask_a;
2210 c->export_mask_k=emask_k; 2234 c->export_mask_k = emask_k;
2211 c->export_mask_a=emask_a; 2235 c->export_mask_a = emask_a;
2212 c->valid=1; 2236 c->valid = 1;
2213 } 2237}
2214 2238
2215/* This handy macro borrowed from crypto/x509v3/v3_purp.c */ 2239/* This handy macro borrowed from crypto/x509v3/v3_purp.c */
2216#define ku_reject(x, usage) \ 2240#define ku_reject(x, usage) \
@@ -2218,8 +2242,9 @@ void ssl_set_cert_masks(CERT *c, const SSL_CIPHER *cipher)
2218 2242
2219#ifndef OPENSSL_NO_EC 2243#ifndef OPENSSL_NO_EC
2220 2244
2221int ssl_check_srvr_ecc_cert_and_alg(X509 *x, SSL *s) 2245int
2222 { 2246ssl_check_srvr_ecc_cert_and_alg(X509 *x, SSL *s)
2247{
2223 unsigned long alg_k, alg_a; 2248 unsigned long alg_k, alg_a;
2224 EVP_PKEY *pkey = NULL; 2249 EVP_PKEY *pkey = NULL;
2225 int keysize = 0; 2250 int keysize = 0;
@@ -2229,81 +2254,74 @@ int ssl_check_srvr_ecc_cert_and_alg(X509 *x, SSL *s)
2229 alg_k = cs->algorithm_mkey; 2254 alg_k = cs->algorithm_mkey;
2230 alg_a = cs->algorithm_auth; 2255 alg_a = cs->algorithm_auth;
2231 2256
2232 if (SSL_C_IS_EXPORT(cs)) 2257 if (SSL_C_IS_EXPORT(cs)) {
2233 {
2234 /* ECDH key length in export ciphers must be <= 163 bits */ 2258 /* ECDH key length in export ciphers must be <= 163 bits */
2235 pkey = X509_get_pubkey(x); 2259 pkey = X509_get_pubkey(x);
2236 if (pkey == NULL) return 0; 2260 if (pkey == NULL)
2261 return 0;
2237 keysize = EVP_PKEY_bits(pkey); 2262 keysize = EVP_PKEY_bits(pkey);
2238 EVP_PKEY_free(pkey); 2263 EVP_PKEY_free(pkey);
2239 if (keysize > 163) return 0; 2264 if (keysize > 163)
2240 } 2265 return 0;
2266 }
2241 2267
2242 /* This call populates the ex_flags field correctly */ 2268 /* This call populates the ex_flags field correctly */
2243 X509_check_purpose(x, -1, 0); 2269 X509_check_purpose(x, -1, 0);
2244 if ((x->sig_alg) && (x->sig_alg->algorithm)) 2270 if ((x->sig_alg) && (x->sig_alg->algorithm)) {
2245 {
2246 signature_nid = OBJ_obj2nid(x->sig_alg->algorithm); 2271 signature_nid = OBJ_obj2nid(x->sig_alg->algorithm);
2247 OBJ_find_sigid_algs(signature_nid, &md_nid, &pk_nid); 2272 OBJ_find_sigid_algs(signature_nid, &md_nid, &pk_nid);
2248 } 2273 }
2249 if (alg_k & SSL_kECDHe || alg_k & SSL_kECDHr) 2274 if (alg_k & SSL_kECDHe || alg_k & SSL_kECDHr) {
2250 {
2251 /* key usage, if present, must allow key agreement */ 2275 /* key usage, if present, must allow key agreement */
2252 if (ku_reject(x, X509v3_KU_KEY_AGREEMENT)) 2276 if (ku_reject(x, X509v3_KU_KEY_AGREEMENT)) {
2253 {
2254 SSLerr(SSL_F_SSL_CHECK_SRVR_ECC_CERT_AND_ALG, SSL_R_ECC_CERT_NOT_FOR_KEY_AGREEMENT); 2277 SSLerr(SSL_F_SSL_CHECK_SRVR_ECC_CERT_AND_ALG, SSL_R_ECC_CERT_NOT_FOR_KEY_AGREEMENT);
2255 return 0; 2278 return 0;
2256 } 2279 }
2257 if ((alg_k & SSL_kECDHe) && TLS1_get_version(s) < TLS1_2_VERSION) 2280 if ((alg_k & SSL_kECDHe) && TLS1_get_version(s) < TLS1_2_VERSION) {
2258 {
2259 /* signature alg must be ECDSA */ 2281 /* signature alg must be ECDSA */
2260 if (pk_nid != NID_X9_62_id_ecPublicKey) 2282 if (pk_nid != NID_X9_62_id_ecPublicKey) {
2261 {
2262 SSLerr(SSL_F_SSL_CHECK_SRVR_ECC_CERT_AND_ALG, SSL_R_ECC_CERT_SHOULD_HAVE_SHA1_SIGNATURE); 2283 SSLerr(SSL_F_SSL_CHECK_SRVR_ECC_CERT_AND_ALG, SSL_R_ECC_CERT_SHOULD_HAVE_SHA1_SIGNATURE);
2263 return 0; 2284 return 0;
2264 }
2265 } 2285 }
2266 if ((alg_k & SSL_kECDHr) && TLS1_get_version(s) < TLS1_2_VERSION) 2286 }
2267 { 2287 if ((alg_k & SSL_kECDHr) && TLS1_get_version(s) < TLS1_2_VERSION) {
2268 /* signature alg must be RSA */ 2288 /* signature alg must be RSA */
2269 2289
2270 if (pk_nid != NID_rsaEncryption && pk_nid != NID_rsa) 2290 if (pk_nid != NID_rsaEncryption && pk_nid != NID_rsa) {
2271 {
2272 SSLerr(SSL_F_SSL_CHECK_SRVR_ECC_CERT_AND_ALG, SSL_R_ECC_CERT_SHOULD_HAVE_RSA_SIGNATURE); 2291 SSLerr(SSL_F_SSL_CHECK_SRVR_ECC_CERT_AND_ALG, SSL_R_ECC_CERT_SHOULD_HAVE_RSA_SIGNATURE);
2273 return 0; 2292 return 0;
2274 }
2275 } 2293 }
2276 } 2294 }
2277 if (alg_a & SSL_aECDSA) 2295 }
2278 { 2296 if (alg_a & SSL_aECDSA) {
2279 /* key usage, if present, must allow signing */ 2297 /* key usage, if present, must allow signing */
2280 if (ku_reject(x, X509v3_KU_DIGITAL_SIGNATURE)) 2298 if (ku_reject(x, X509v3_KU_DIGITAL_SIGNATURE)) {
2281 {
2282 SSLerr(SSL_F_SSL_CHECK_SRVR_ECC_CERT_AND_ALG, SSL_R_ECC_CERT_NOT_FOR_SIGNING); 2299 SSLerr(SSL_F_SSL_CHECK_SRVR_ECC_CERT_AND_ALG, SSL_R_ECC_CERT_NOT_FOR_SIGNING);
2283 return 0; 2300 return 0;
2284 }
2285 } 2301 }
2286
2287 return 1; /* all checks are ok */
2288 } 2302 }
2289 2303
2304 return 1;
2305 /* all checks are ok */
2306}
2307
2290#endif 2308#endif
2291 2309
2292/* THIS NEEDS CLEANING UP */ 2310/* THIS NEEDS CLEANING UP */
2293CERT_PKEY *ssl_get_server_send_pkey(const SSL *s) 2311CERT_PKEY
2294 { 2312*ssl_get_server_send_pkey(const SSL *s)
2295 unsigned long alg_k,alg_a; 2313{
2314 unsigned long alg_k, alg_a;
2296 CERT *c; 2315 CERT *c;
2297 int i; 2316 int i;
2298 2317
2299 c=s->cert; 2318 c = s->cert;
2300 ssl_set_cert_masks(c, s->s3->tmp.new_cipher); 2319 ssl_set_cert_masks(c, s->s3->tmp.new_cipher);
2301 2320
2302 alg_k = s->s3->tmp.new_cipher->algorithm_mkey; 2321 alg_k = s->s3->tmp.new_cipher->algorithm_mkey;
2303 alg_a = s->s3->tmp.new_cipher->algorithm_auth; 2322 alg_a = s->s3->tmp.new_cipher->algorithm_auth;
2304 2323
2305 if (alg_k & (SSL_kECDHr|SSL_kECDHe)) 2324 if (alg_k & (SSL_kECDHr|SSL_kECDHe)) {
2306 {
2307 /* we don't need to look at SSL_kEECDH 2325 /* we don't need to look at SSL_kEECDH
2308 * since no certificate is needed for 2326 * since no certificate is needed for
2309 * anon ECDH and for authenticated 2327 * anon ECDH and for authenticated
@@ -2315,171 +2333,162 @@ CERT_PKEY *ssl_get_server_send_pkey(const SSL *s)
2315 * checks for SSL_kECDH before RSA 2333 * checks for SSL_kECDH before RSA
2316 * checks ensures the correct cert is chosen. 2334 * checks ensures the correct cert is chosen.
2317 */ 2335 */
2318 i=SSL_PKEY_ECC; 2336 i = SSL_PKEY_ECC;
2319 } 2337 } else if (alg_a & SSL_aECDSA) {
2320 else if (alg_a & SSL_aECDSA) 2338 i = SSL_PKEY_ECC;
2321 { 2339 } else if (alg_k & SSL_kDHr)
2322 i=SSL_PKEY_ECC; 2340 i = SSL_PKEY_DH_RSA;
2323 }
2324 else if (alg_k & SSL_kDHr)
2325 i=SSL_PKEY_DH_RSA;
2326 else if (alg_k & SSL_kDHd) 2341 else if (alg_k & SSL_kDHd)
2327 i=SSL_PKEY_DH_DSA; 2342 i = SSL_PKEY_DH_DSA;
2328 else if (alg_a & SSL_aDSS) 2343 else if (alg_a & SSL_aDSS)
2329 i=SSL_PKEY_DSA_SIGN; 2344 i = SSL_PKEY_DSA_SIGN;
2330 else if (alg_a & SSL_aRSA) 2345 else if (alg_a & SSL_aRSA) {
2331 {
2332 if (c->pkeys[SSL_PKEY_RSA_ENC].x509 == NULL) 2346 if (c->pkeys[SSL_PKEY_RSA_ENC].x509 == NULL)
2333 i=SSL_PKEY_RSA_SIGN; 2347 i = SSL_PKEY_RSA_SIGN;
2334 else 2348 else
2335 i=SSL_PKEY_RSA_ENC; 2349 i = SSL_PKEY_RSA_ENC;
2336 } 2350 } else if (alg_a & SSL_aKRB5) {
2337 else if (alg_a & SSL_aKRB5)
2338 {
2339 /* VRS something else here? */ 2351 /* VRS something else here? */
2340 return(NULL); 2352 return (NULL);
2341 } 2353 } else if (alg_a & SSL_aGOST94)
2342 else if (alg_a & SSL_aGOST94) 2354 i = SSL_PKEY_GOST94;
2343 i=SSL_PKEY_GOST94;
2344 else if (alg_a & SSL_aGOST01) 2355 else if (alg_a & SSL_aGOST01)
2345 i=SSL_PKEY_GOST01; 2356 i = SSL_PKEY_GOST01;
2346 else /* if (alg_a & SSL_aNULL) */ 2357 else /* if (alg_a & SSL_aNULL) */
2347 { 2358 {
2348 SSLerr(SSL_F_SSL_GET_SERVER_SEND_PKEY,ERR_R_INTERNAL_ERROR); 2359 SSLerr(SSL_F_SSL_GET_SERVER_SEND_PKEY, ERR_R_INTERNAL_ERROR);
2349 return(NULL); 2360 return (NULL);
2350 } 2361 }
2351 2362
2352 return c->pkeys + i; 2363 return c->pkeys + i;
2353 } 2364}
2354 2365
2355X509 *ssl_get_server_send_cert(const SSL *s) 2366X509
2356 { 2367*ssl_get_server_send_cert(const SSL *s)
2368{
2357 CERT_PKEY *cpk; 2369 CERT_PKEY *cpk;
2358 cpk = ssl_get_server_send_pkey(s); 2370 cpk = ssl_get_server_send_pkey(s);
2359 if (!cpk) 2371 if (!cpk)
2360 return NULL; 2372 return NULL;
2361 return cpk->x509; 2373 return cpk->x509;
2362 } 2374}
2363 2375
2364EVP_PKEY *ssl_get_sign_pkey(SSL *s,const SSL_CIPHER *cipher, const EVP_MD **pmd) 2376EVP_PKEY
2365 { 2377*ssl_get_sign_pkey(SSL *s, const SSL_CIPHER *cipher, const EVP_MD **pmd)
2378{
2366 unsigned long alg_a; 2379 unsigned long alg_a;
2367 CERT *c; 2380 CERT *c;
2368 int idx = -1; 2381 int idx = -1;
2369 2382
2370 alg_a = cipher->algorithm_auth; 2383 alg_a = cipher->algorithm_auth;
2371 c=s->cert; 2384 c = s->cert;
2372 2385
2373 if ((alg_a & SSL_aDSS) && 2386 if ((alg_a & SSL_aDSS) &&
2374 (c->pkeys[SSL_PKEY_DSA_SIGN].privatekey != NULL)) 2387 (c->pkeys[SSL_PKEY_DSA_SIGN].privatekey != NULL))
2375 idx = SSL_PKEY_DSA_SIGN; 2388 idx = SSL_PKEY_DSA_SIGN;
2376 else if (alg_a & SSL_aRSA) 2389 else if (alg_a & SSL_aRSA) {
2377 {
2378 if (c->pkeys[SSL_PKEY_RSA_SIGN].privatekey != NULL) 2390 if (c->pkeys[SSL_PKEY_RSA_SIGN].privatekey != NULL)
2379 idx = SSL_PKEY_RSA_SIGN; 2391 idx = SSL_PKEY_RSA_SIGN;
2380 else if (c->pkeys[SSL_PKEY_RSA_ENC].privatekey != NULL) 2392 else if (c->pkeys[SSL_PKEY_RSA_ENC].privatekey != NULL)
2381 idx = SSL_PKEY_RSA_ENC; 2393 idx = SSL_PKEY_RSA_ENC;
2382 } 2394 } else if ((alg_a & SSL_aECDSA) &&
2383 else if ((alg_a & SSL_aECDSA) && 2395 (c->pkeys[SSL_PKEY_ECC].privatekey != NULL))
2384 (c->pkeys[SSL_PKEY_ECC].privatekey != NULL)) 2396 idx = SSL_PKEY_ECC;
2385 idx = SSL_PKEY_ECC; 2397 if (idx == -1) {
2386 if (idx == -1) 2398 SSLerr(SSL_F_SSL_GET_SIGN_PKEY, ERR_R_INTERNAL_ERROR);
2387 { 2399 return (NULL);
2388 SSLerr(SSL_F_SSL_GET_SIGN_PKEY,ERR_R_INTERNAL_ERROR); 2400 }
2389 return(NULL);
2390 }
2391 if (pmd) 2401 if (pmd)
2392 *pmd = c->pkeys[idx].digest; 2402 *pmd = c->pkeys[idx].digest;
2393 return c->pkeys[idx].privatekey; 2403 return c->pkeys[idx].privatekey;
2394 } 2404}
2395 2405
2396void ssl_update_cache(SSL *s,int mode) 2406void
2397 { 2407ssl_update_cache(SSL *s, int mode)
2408{
2398 int i; 2409 int i;
2399 2410
2400 /* If the session_id_length is 0, we are not supposed to cache it, 2411 /* If the session_id_length is 0, we are not supposed to cache it,
2401 * and it would be rather hard to do anyway :-) */ 2412 * and it would be rather hard to do anyway :-) */
2402 if (s->session->session_id_length == 0) return; 2413 if (s->session->session_id_length == 0)
2414 return;
2403 2415
2404 i=s->session_ctx->session_cache_mode; 2416 i = s->session_ctx->session_cache_mode;
2405 if ((i & mode) && (!s->hit) 2417 if ((i & mode) && (!s->hit)
2406 && ((i & SSL_SESS_CACHE_NO_INTERNAL_STORE) 2418 && ((i & SSL_SESS_CACHE_NO_INTERNAL_STORE)
2407 || SSL_CTX_add_session(s->session_ctx,s->session)) 2419 || SSL_CTX_add_session(s->session_ctx, s->session))
2408 && (s->session_ctx->new_session_cb != NULL)) 2420 && (s->session_ctx->new_session_cb != NULL)) {
2409 { 2421 CRYPTO_add(&s->session->references, 1, CRYPTO_LOCK_SSL_SESSION);
2410 CRYPTO_add(&s->session->references,1,CRYPTO_LOCK_SSL_SESSION); 2422 if (!s->session_ctx->new_session_cb(s, s->session))
2411 if (!s->session_ctx->new_session_cb(s,s->session))
2412 SSL_SESSION_free(s->session); 2423 SSL_SESSION_free(s->session);
2413 } 2424 }
2414 2425
2415 /* auto flush every 255 connections */ 2426 /* auto flush every 255 connections */
2416 if ((!(i & SSL_SESS_CACHE_NO_AUTO_CLEAR)) && 2427 if ((!(i & SSL_SESS_CACHE_NO_AUTO_CLEAR)) &&
2417 ((i & mode) == mode)) 2428 ((i & mode) == mode)) {
2418 { 2429 if ((((mode & SSL_SESS_CACHE_CLIENT)
2419 if ( (((mode & SSL_SESS_CACHE_CLIENT)
2420 ?s->session_ctx->stats.sess_connect_good 2430 ?s->session_ctx->stats.sess_connect_good
2421 :s->session_ctx->stats.sess_accept_good) & 0xff) == 0xff) 2431 :s->session_ctx->stats.sess_accept_good) & 0xff) == 0xff) {
2422 {
2423 SSL_CTX_flush_sessions(s->session_ctx,(unsigned long)time(NULL)); 2432 SSL_CTX_flush_sessions(s->session_ctx,(unsigned long)time(NULL));
2424 }
2425 } 2433 }
2426 } 2434 }
2435}
2427 2436
2428const SSL_METHOD *SSL_get_ssl_method(SSL *s) 2437const SSL_METHOD
2429 { 2438*SSL_get_ssl_method(SSL *s)
2430 return(s->method); 2439{
2431 } 2440 return (s->method);
2441}
2432 2442
2433int SSL_set_ssl_method(SSL *s, const SSL_METHOD *meth) 2443int
2434 { 2444SSL_set_ssl_method(SSL *s, const SSL_METHOD *meth)
2435 int conn= -1; 2445{
2436 int ret=1; 2446 int conn = -1;
2447 int ret = 1;
2437 2448
2438 if (s->method != meth) 2449 if (s->method != meth) {
2439 {
2440 if (s->handshake_func != NULL) 2450 if (s->handshake_func != NULL)
2441 conn=(s->handshake_func == s->method->ssl_connect); 2451 conn = (s->handshake_func == s->method->ssl_connect);
2442 2452
2443 if (s->method->version == meth->version) 2453 if (s->method->version == meth->version)
2444 s->method=meth; 2454 s->method = meth;
2445 else 2455 else {
2446 {
2447 s->method->ssl_free(s); 2456 s->method->ssl_free(s);
2448 s->method=meth; 2457 s->method = meth;
2449 ret=s->method->ssl_new(s); 2458 ret = s->method->ssl_new(s);
2450 } 2459 }
2451 2460
2452 if (conn == 1) 2461 if (conn == 1)
2453 s->handshake_func=meth->ssl_connect; 2462 s->handshake_func = meth->ssl_connect;
2454 else if (conn == 0) 2463 else if (conn == 0)
2455 s->handshake_func=meth->ssl_accept; 2464 s->handshake_func = meth->ssl_accept;
2456 }
2457 return(ret);
2458 } 2465 }
2466 return (ret);
2467}
2459 2468
2460int SSL_get_error(const SSL *s,int i) 2469int
2461 { 2470SSL_get_error(const SSL *s, int i)
2471{
2462 int reason; 2472 int reason;
2463 unsigned long l; 2473 unsigned long l;
2464 BIO *bio; 2474 BIO *bio;
2465 2475
2466 if (i > 0) return(SSL_ERROR_NONE); 2476 if (i > 0)
2477 return (SSL_ERROR_NONE);
2467 2478
2468 /* Make things return SSL_ERROR_SYSCALL when doing SSL_do_handshake 2479 /* Make things return SSL_ERROR_SYSCALL when doing SSL_do_handshake
2469 * etc, where we do encode the error */ 2480 * etc, where we do encode the error */
2470 if ((l=ERR_peek_error()) != 0) 2481 if ((l = ERR_peek_error()) != 0) {
2471 {
2472 if (ERR_GET_LIB(l) == ERR_LIB_SYS) 2482 if (ERR_GET_LIB(l) == ERR_LIB_SYS)
2473 return(SSL_ERROR_SYSCALL); 2483 return (SSL_ERROR_SYSCALL);
2474 else 2484 else
2475 return(SSL_ERROR_SSL); 2485 return (SSL_ERROR_SSL);
2476 } 2486 }
2477 2487
2478 if ((i < 0) && SSL_want_read(s)) 2488 if ((i < 0) && SSL_want_read(s)) {
2479 { 2489 bio = SSL_get_rbio(s);
2480 bio=SSL_get_rbio(s);
2481 if (BIO_should_read(bio)) 2490 if (BIO_should_read(bio))
2482 return(SSL_ERROR_WANT_READ); 2491 return (SSL_ERROR_WANT_READ);
2483 else if (BIO_should_write(bio)) 2492 else if (BIO_should_write(bio))
2484 /* This one doesn't make too much sense ... We never try 2493 /* This one doesn't make too much sense ... We never try
2485 * to write to the rbio, and an application program where 2494 * to write to the rbio, and an application program where
@@ -2490,131 +2499,129 @@ int SSL_get_error(const SSL *s,int i)
2490 * SSL_want_write(s)) and rbio and wbio *are* the same, 2499 * SSL_want_write(s)) and rbio and wbio *are* the same,
2491 * this test works around that bug; so it might be safer 2500 * this test works around that bug; so it might be safer
2492 * to keep it. */ 2501 * to keep it. */
2493 return(SSL_ERROR_WANT_WRITE); 2502 return (SSL_ERROR_WANT_WRITE);
2494 else if (BIO_should_io_special(bio)) 2503 else if (BIO_should_io_special(bio)) {
2495 { 2504 reason = BIO_get_retry_reason(bio);
2496 reason=BIO_get_retry_reason(bio);
2497 if (reason == BIO_RR_CONNECT) 2505 if (reason == BIO_RR_CONNECT)
2498 return(SSL_ERROR_WANT_CONNECT); 2506 return (SSL_ERROR_WANT_CONNECT);
2499 else if (reason == BIO_RR_ACCEPT) 2507 else if (reason == BIO_RR_ACCEPT)
2500 return(SSL_ERROR_WANT_ACCEPT); 2508 return (SSL_ERROR_WANT_ACCEPT);
2501 else 2509 else
2502 return(SSL_ERROR_SYSCALL); /* unknown */ 2510 return(SSL_ERROR_SYSCALL); /* unknown */
2503 }
2504 } 2511 }
2512 }
2505 2513
2506 if ((i < 0) && SSL_want_write(s)) 2514 if ((i < 0) && SSL_want_write(s)) {
2507 { 2515 bio = SSL_get_wbio(s);
2508 bio=SSL_get_wbio(s);
2509 if (BIO_should_write(bio)) 2516 if (BIO_should_write(bio))
2510 return(SSL_ERROR_WANT_WRITE); 2517 return (SSL_ERROR_WANT_WRITE);
2511 else if (BIO_should_read(bio)) 2518 else if (BIO_should_read(bio))
2512 /* See above (SSL_want_read(s) with BIO_should_write(bio)) */ 2519 /* See above (SSL_want_read(s) with BIO_should_write(bio)) */
2513 return(SSL_ERROR_WANT_READ); 2520 return (SSL_ERROR_WANT_READ);
2514 else if (BIO_should_io_special(bio)) 2521 else if (BIO_should_io_special(bio)) {
2515 { 2522 reason = BIO_get_retry_reason(bio);
2516 reason=BIO_get_retry_reason(bio);
2517 if (reason == BIO_RR_CONNECT) 2523 if (reason == BIO_RR_CONNECT)
2518 return(SSL_ERROR_WANT_CONNECT); 2524 return (SSL_ERROR_WANT_CONNECT);
2519 else if (reason == BIO_RR_ACCEPT) 2525 else if (reason == BIO_RR_ACCEPT)
2520 return(SSL_ERROR_WANT_ACCEPT); 2526 return (SSL_ERROR_WANT_ACCEPT);
2521 else 2527 else
2522 return(SSL_ERROR_SYSCALL); 2528 return (SSL_ERROR_SYSCALL);
2523 }
2524 }
2525 if ((i < 0) && SSL_want_x509_lookup(s))
2526 {
2527 return(SSL_ERROR_WANT_X509_LOOKUP);
2528 } 2529 }
2530 }
2531 if ((i < 0) && SSL_want_x509_lookup(s)) {
2532 return (SSL_ERROR_WANT_X509_LOOKUP);
2533 }
2529 2534
2530 if (i == 0) 2535 if (i == 0) {
2531 { 2536 if (s->version == SSL2_VERSION) {
2532 if (s->version == SSL2_VERSION)
2533 {
2534 /* assume it is the socket being closed */ 2537 /* assume it is the socket being closed */
2535 return(SSL_ERROR_ZERO_RETURN); 2538 return (SSL_ERROR_ZERO_RETURN);
2536 } 2539 } else {
2537 else
2538 {
2539 if ((s->shutdown & SSL_RECEIVED_SHUTDOWN) && 2540 if ((s->shutdown & SSL_RECEIVED_SHUTDOWN) &&
2540 (s->s3->warn_alert == SSL_AD_CLOSE_NOTIFY)) 2541 (s->s3->warn_alert == SSL_AD_CLOSE_NOTIFY))
2541 return(SSL_ERROR_ZERO_RETURN); 2542 return (SSL_ERROR_ZERO_RETURN);
2542 }
2543 } 2543 }
2544 return(SSL_ERROR_SYSCALL);
2545 } 2544 }
2545 return (SSL_ERROR_SYSCALL);
2546}
2546 2547
2547int SSL_do_handshake(SSL *s) 2548int
2548 { 2549SSL_do_handshake(SSL *s)
2549 int ret=1; 2550{
2551 int ret = 1;
2550 2552
2551 if (s->handshake_func == NULL) 2553 if (s->handshake_func == NULL) {
2552 { 2554 SSLerr(SSL_F_SSL_DO_HANDSHAKE, SSL_R_CONNECTION_TYPE_NOT_SET);
2553 SSLerr(SSL_F_SSL_DO_HANDSHAKE,SSL_R_CONNECTION_TYPE_NOT_SET); 2555 return (-1);
2554 return(-1); 2556 }
2555 }
2556 2557
2557 s->method->ssl_renegotiate_check(s); 2558 s->method->ssl_renegotiate_check(s);
2558 2559
2559 if (SSL_in_init(s) || SSL_in_before(s)) 2560 if (SSL_in_init(s) || SSL_in_before(s)) {
2560 { 2561 ret = s->handshake_func(s);
2561 ret=s->handshake_func(s);
2562 }
2563 return(ret);
2564 } 2562 }
2563 return (ret);
2564}
2565 2565
2566/* For the next 2 functions, SSL_clear() sets shutdown and so 2566/* For the next 2 functions, SSL_clear() sets shutdown and so
2567 * one of these calls will reset it */ 2567 * one of these calls will reset it */
2568void SSL_set_accept_state(SSL *s) 2568void
2569 { 2569SSL_set_accept_state(SSL *s)
2570 s->server=1; 2570{
2571 s->shutdown=0; 2571 s->server = 1;
2572 s->state=SSL_ST_ACCEPT|SSL_ST_BEFORE; 2572 s->shutdown = 0;
2573 s->handshake_func=s->method->ssl_accept; 2573 s->state = SSL_ST_ACCEPT|SSL_ST_BEFORE;
2574 s->handshake_func = s->method->ssl_accept;
2574 /* clear the current cipher */ 2575 /* clear the current cipher */
2575 ssl_clear_cipher_ctx(s); 2576 ssl_clear_cipher_ctx(s);
2576 ssl_clear_hash_ctx(&s->read_hash); 2577 ssl_clear_hash_ctx(&s->read_hash);
2577 ssl_clear_hash_ctx(&s->write_hash); 2578 ssl_clear_hash_ctx(&s->write_hash);
2578 } 2579}
2579 2580
2580void SSL_set_connect_state(SSL *s) 2581void
2581 { 2582SSL_set_connect_state(SSL *s)
2582 s->server=0; 2583{
2583 s->shutdown=0; 2584 s->server = 0;
2584 s->state=SSL_ST_CONNECT|SSL_ST_BEFORE; 2585 s->shutdown = 0;
2585 s->handshake_func=s->method->ssl_connect; 2586 s->state = SSL_ST_CONNECT|SSL_ST_BEFORE;
2587 s->handshake_func = s->method->ssl_connect;
2586 /* clear the current cipher */ 2588 /* clear the current cipher */
2587 ssl_clear_cipher_ctx(s); 2589 ssl_clear_cipher_ctx(s);
2588 ssl_clear_hash_ctx(&s->read_hash); 2590 ssl_clear_hash_ctx(&s->read_hash);
2589 ssl_clear_hash_ctx(&s->write_hash); 2591 ssl_clear_hash_ctx(&s->write_hash);
2590 } 2592}
2591 2593
2592int ssl_undefined_function(SSL *s) 2594int
2593 { 2595ssl_undefined_function(SSL *s)
2594 SSLerr(SSL_F_SSL_UNDEFINED_FUNCTION,ERR_R_SHOULD_NOT_HAVE_BEEN_CALLED); 2596{
2595 return(0); 2597 SSLerr(SSL_F_SSL_UNDEFINED_FUNCTION, ERR_R_SHOULD_NOT_HAVE_BEEN_CALLED);
2596 } 2598 return (0);
2599}
2597 2600
2598int ssl_undefined_void_function(void) 2601int
2599 { 2602ssl_undefined_void_function(void)
2600 SSLerr(SSL_F_SSL_UNDEFINED_VOID_FUNCTION,ERR_R_SHOULD_NOT_HAVE_BEEN_CALLED); 2603{
2601 return(0); 2604 SSLerr(SSL_F_SSL_UNDEFINED_VOID_FUNCTION, ERR_R_SHOULD_NOT_HAVE_BEEN_CALLED);
2602 } 2605 return (0);
2606}
2603 2607
2604int ssl_undefined_const_function(const SSL *s) 2608int
2605 { 2609ssl_undefined_const_function(const SSL *s)
2606 SSLerr(SSL_F_SSL_UNDEFINED_CONST_FUNCTION,ERR_R_SHOULD_NOT_HAVE_BEEN_CALLED); 2610{
2607 return(0); 2611 SSLerr(SSL_F_SSL_UNDEFINED_CONST_FUNCTION, ERR_R_SHOULD_NOT_HAVE_BEEN_CALLED);
2608 } 2612 return (0);
2613}
2609 2614
2610SSL_METHOD *ssl_bad_method(int ver) 2615SSL_METHOD
2611 { 2616*ssl_bad_method(int ver)
2612 SSLerr(SSL_F_SSL_BAD_METHOD,ERR_R_SHOULD_NOT_HAVE_BEEN_CALLED); 2617{
2613 return(NULL); 2618 SSLerr(SSL_F_SSL_BAD_METHOD, ERR_R_SHOULD_NOT_HAVE_BEEN_CALLED);
2614 } 2619 return (NULL);
2620}
2615 2621
2616const char *SSL_get_version(const SSL *s) 2622const char
2617 { 2623*SSL_get_version(const SSL *s)
2624{
2618 if (s->version == TLS1_2_VERSION) 2625 if (s->version == TLS1_2_VERSION)
2619 return("TLSv1.2"); 2626 return("TLSv1.2");
2620 else if (s->version == TLS1_1_VERSION) 2627 else if (s->version == TLS1_1_VERSION)
@@ -2627,29 +2634,27 @@ const char *SSL_get_version(const SSL *s)
2627 return("SSLv2"); 2634 return("SSLv2");
2628 else 2635 else
2629 return("unknown"); 2636 return("unknown");
2630 } 2637}
2631 2638
2632SSL *SSL_dup(SSL *s) 2639SSL
2633 { 2640*SSL_dup(SSL *s)
2641{
2634 STACK_OF(X509_NAME) *sk; 2642 STACK_OF(X509_NAME) *sk;
2635 X509_NAME *xn; 2643 X509_NAME *xn;
2636 SSL *ret; 2644 SSL *ret;
2637 int i; 2645 int i;
2638 2646
2639 if ((ret=SSL_new(SSL_get_SSL_CTX(s))) == NULL) 2647 if ((ret = SSL_new(SSL_get_SSL_CTX(s))) == NULL)
2640 return(NULL); 2648 return (NULL);
2641 2649
2642 ret->version = s->version; 2650 ret->version = s->version;
2643 ret->type = s->type; 2651 ret->type = s->type;
2644 ret->method = s->method; 2652 ret->method = s->method;
2645 2653
2646 if (s->session != NULL) 2654 if (s->session != NULL) {
2647 {
2648 /* This copies session-id, SSL_METHOD, sid_ctx, and 'cert' */ 2655 /* This copies session-id, SSL_METHOD, sid_ctx, and 'cert' */
2649 SSL_copy_session_id(ret,s); 2656 SSL_copy_session_id(ret, s);
2650 } 2657 } else {
2651 else
2652 {
2653 /* No session has been established yet, so we have to expect 2658 /* No session has been established yet, so we have to expect
2654 * that s->cert or ret->cert will be changed later -- 2659 * that s->cert or ret->cert will be changed later --
2655 * they should not both point to the same object, 2660 * they should not both point to the same object,
@@ -2659,56 +2664,50 @@ SSL *SSL_dup(SSL *s)
2659 ret->method = s->method; 2664 ret->method = s->method;
2660 ret->method->ssl_new(ret); 2665 ret->method->ssl_new(ret);
2661 2666
2662 if (s->cert != NULL) 2667 if (s->cert != NULL) {
2663 { 2668 if (ret->cert != NULL) {
2664 if (ret->cert != NULL)
2665 {
2666 ssl_cert_free(ret->cert); 2669 ssl_cert_free(ret->cert);
2667 } 2670 }
2668 ret->cert = ssl_cert_dup(s->cert); 2671 ret->cert = ssl_cert_dup(s->cert);
2669 if (ret->cert == NULL) 2672 if (ret->cert == NULL)
2670 goto err; 2673 goto err;
2671 }
2672
2673 SSL_set_session_id_context(ret,
2674 s->sid_ctx, s->sid_ctx_length);
2675 } 2674 }
2676 2675
2677 ret->options=s->options; 2676 SSL_set_session_id_context(ret,
2678 ret->mode=s->mode; 2677 s->sid_ctx, s->sid_ctx_length);
2679 SSL_set_max_cert_list(ret,SSL_get_max_cert_list(s)); 2678 }
2680 SSL_set_read_ahead(ret,SSL_get_read_ahead(s)); 2679
2680 ret->options = s->options;
2681 ret->mode = s->mode;
2682 SSL_set_max_cert_list(ret, SSL_get_max_cert_list(s));
2683 SSL_set_read_ahead(ret, SSL_get_read_ahead(s));
2681 ret->msg_callback = s->msg_callback; 2684 ret->msg_callback = s->msg_callback;
2682 ret->msg_callback_arg = s->msg_callback_arg; 2685 ret->msg_callback_arg = s->msg_callback_arg;
2683 SSL_set_verify(ret,SSL_get_verify_mode(s), 2686 SSL_set_verify(ret, SSL_get_verify_mode(s),
2684 SSL_get_verify_callback(s)); 2687 SSL_get_verify_callback(s));
2685 SSL_set_verify_depth(ret,SSL_get_verify_depth(s)); 2688 SSL_set_verify_depth(ret, SSL_get_verify_depth(s));
2686 ret->generate_session_id = s->generate_session_id; 2689 ret->generate_session_id = s->generate_session_id;
2687 2690
2688 SSL_set_info_callback(ret,SSL_get_info_callback(s)); 2691 SSL_set_info_callback(ret, SSL_get_info_callback(s));
2689 2692
2690 ret->debug=s->debug; 2693 ret->debug = s->debug;
2691 2694
2692 /* copy app data, a little dangerous perhaps */ 2695 /* copy app data, a little dangerous perhaps */
2693 if (!CRYPTO_dup_ex_data(CRYPTO_EX_INDEX_SSL, &ret->ex_data, &s->ex_data)) 2696 if (!CRYPTO_dup_ex_data(CRYPTO_EX_INDEX_SSL, &ret->ex_data, &s->ex_data))
2694 goto err; 2697 goto err;
2695 2698
2696 /* setup rbio, and wbio */ 2699 /* setup rbio, and wbio */
2697 if (s->rbio != NULL) 2700 if (s->rbio != NULL) {
2698 {
2699 if (!BIO_dup_state(s->rbio,(char *)&ret->rbio)) 2701 if (!BIO_dup_state(s->rbio,(char *)&ret->rbio))
2700 goto err; 2702 goto err;
2701 } 2703 }
2702 if (s->wbio != NULL) 2704 if (s->wbio != NULL) {
2703 { 2705 if (s->wbio != s->rbio) {
2704 if (s->wbio != s->rbio)
2705 {
2706 if (!BIO_dup_state(s->wbio,(char *)&ret->wbio)) 2706 if (!BIO_dup_state(s->wbio,(char *)&ret->wbio))
2707 goto err; 2707 goto err;
2708 } 2708 } else
2709 else 2709 ret->wbio = ret->rbio;
2710 ret->wbio=ret->rbio; 2710 }
2711 }
2712 ret->rwstate = s->rwstate; 2711 ret->rwstate = s->rwstate;
2713 ret->in_handshake = s->in_handshake; 2712 ret->in_handshake = s->in_handshake;
2714 ret->handshake_func = s->handshake_func; 2713 ret->handshake_func = s->handshake_func;
@@ -2716,222 +2715,228 @@ SSL *SSL_dup(SSL *s)
2716 ret->renegotiate = s->renegotiate; 2715 ret->renegotiate = s->renegotiate;
2717 ret->new_session = s->new_session; 2716 ret->new_session = s->new_session;
2718 ret->quiet_shutdown = s->quiet_shutdown; 2717 ret->quiet_shutdown = s->quiet_shutdown;
2719 ret->shutdown=s->shutdown; 2718 ret->shutdown = s->shutdown;
2720 ret->state=s->state; /* SSL_dup does not really work at any state, though */ 2719 ret->state=s->state; /* SSL_dup does not really work at any state, though */
2721 ret->rstate=s->rstate; 2720 ret->rstate = s->rstate;
2722 ret->init_num = 0; /* would have to copy ret->init_buf, ret->init_msg, ret->init_num, ret->init_off */ 2721 ret->init_num = 0; /* would have to copy ret->init_buf, ret->init_msg, ret->init_num, ret->init_off */
2723 ret->hit=s->hit; 2722 ret->hit = s->hit;
2724 2723
2725 X509_VERIFY_PARAM_inherit(ret->param, s->param); 2724 X509_VERIFY_PARAM_inherit(ret->param, s->param);
2726 2725
2727 /* dup the cipher_list and cipher_list_by_id stacks */ 2726 /* dup the cipher_list and cipher_list_by_id stacks */
2728 if (s->cipher_list != NULL) 2727 if (s->cipher_list != NULL) {
2729 { 2728 if ((ret->cipher_list = sk_SSL_CIPHER_dup(s->cipher_list)) == NULL)
2730 if ((ret->cipher_list=sk_SSL_CIPHER_dup(s->cipher_list)) == NULL)
2731 goto err; 2729 goto err;
2732 } 2730 }
2733 if (s->cipher_list_by_id != NULL) 2731 if (s->cipher_list_by_id != NULL)
2734 if ((ret->cipher_list_by_id=sk_SSL_CIPHER_dup(s->cipher_list_by_id)) 2732 if ((ret->cipher_list_by_id = sk_SSL_CIPHER_dup(s->cipher_list_by_id))
2735 == NULL) 2733 == NULL)
2736 goto err; 2734 goto err;
2737 2735
2738 /* Dup the client_CA list */ 2736 /* Dup the client_CA list */
2739 if (s->client_CA != NULL) 2737 if (s->client_CA != NULL) {
2740 { 2738 if ((sk = sk_X509_NAME_dup(s->client_CA)) == NULL) goto err;
2741 if ((sk=sk_X509_NAME_dup(s->client_CA)) == NULL) goto err; 2739 ret->client_CA = sk;
2742 ret->client_CA=sk; 2740 for (i = 0; i < sk_X509_NAME_num(sk); i++) {
2743 for (i=0; i<sk_X509_NAME_num(sk); i++) 2741 xn = sk_X509_NAME_value(sk, i);
2744 { 2742 if (sk_X509_NAME_set(sk, i, X509_NAME_dup(xn)) == NULL) {
2745 xn=sk_X509_NAME_value(sk,i);
2746 if (sk_X509_NAME_set(sk,i,X509_NAME_dup(xn)) == NULL)
2747 {
2748 X509_NAME_free(xn); 2743 X509_NAME_free(xn);
2749 goto err; 2744 goto err;
2750 }
2751 } 2745 }
2752 } 2746 }
2747 }
2753 2748
2754 if (0) 2749 if (0) {
2755 {
2756err: 2750err:
2757 if (ret != NULL) SSL_free(ret); 2751 if (ret != NULL)
2758 ret=NULL; 2752 SSL_free(ret);
2759 } 2753 ret = NULL;
2760 return(ret);
2761 } 2754 }
2755 return (ret);
2756}
2762 2757
2763void ssl_clear_cipher_ctx(SSL *s) 2758void
2764 { 2759ssl_clear_cipher_ctx(SSL *s)
2765 if (s->enc_read_ctx != NULL) 2760{
2766 { 2761 if (s->enc_read_ctx != NULL) {
2767 EVP_CIPHER_CTX_cleanup(s->enc_read_ctx); 2762 EVP_CIPHER_CTX_cleanup(s->enc_read_ctx);
2768 OPENSSL_free(s->enc_read_ctx); 2763 OPENSSL_free(s->enc_read_ctx);
2769 s->enc_read_ctx=NULL; 2764 s->enc_read_ctx = NULL;
2770 } 2765 }
2771 if (s->enc_write_ctx != NULL) 2766 if (s->enc_write_ctx != NULL) {
2772 {
2773 EVP_CIPHER_CTX_cleanup(s->enc_write_ctx); 2767 EVP_CIPHER_CTX_cleanup(s->enc_write_ctx);
2774 OPENSSL_free(s->enc_write_ctx); 2768 OPENSSL_free(s->enc_write_ctx);
2775 s->enc_write_ctx=NULL; 2769 s->enc_write_ctx = NULL;
2776 } 2770 }
2777#ifndef OPENSSL_NO_COMP 2771#ifndef OPENSSL_NO_COMP
2778 if (s->expand != NULL) 2772 if (s->expand != NULL) {
2779 {
2780 COMP_CTX_free(s->expand); 2773 COMP_CTX_free(s->expand);
2781 s->expand=NULL; 2774 s->expand = NULL;
2782 } 2775 }
2783 if (s->compress != NULL) 2776 if (s->compress != NULL) {
2784 {
2785 COMP_CTX_free(s->compress); 2777 COMP_CTX_free(s->compress);
2786 s->compress=NULL; 2778 s->compress = NULL;
2787 }
2788#endif
2789 } 2779 }
2780#endif
2781}
2790 2782
2791/* Fix this function so that it takes an optional type parameter */ 2783/* Fix this function so that it takes an optional type parameter */
2792X509 *SSL_get_certificate(const SSL *s) 2784X509
2793 { 2785*SSL_get_certificate(const SSL *s)
2786{
2794 if (s->cert != NULL) 2787 if (s->cert != NULL)
2795 return(s->cert->key->x509); 2788 return (s->cert->key->x509);
2796 else 2789 else
2797 return(NULL); 2790 return (NULL);
2798 } 2791}
2799 2792
2800/* Fix this function so that it takes an optional type parameter */ 2793/* Fix this function so that it takes an optional type parameter */
2801EVP_PKEY *SSL_get_privatekey(SSL *s) 2794EVP_PKEY
2802 { 2795*SSL_get_privatekey(SSL *s)
2796{
2803 if (s->cert != NULL) 2797 if (s->cert != NULL)
2804 return(s->cert->key->privatekey); 2798 return (s->cert->key->privatekey);
2805 else 2799 else
2806 return(NULL); 2800 return (NULL);
2807 } 2801}
2808 2802
2809const SSL_CIPHER *SSL_get_current_cipher(const SSL *s) 2803const SSL_CIPHER
2810 { 2804*SSL_get_current_cipher(const SSL *s)
2805{
2811 if ((s->session != NULL) && (s->session->cipher != NULL)) 2806 if ((s->session != NULL) && (s->session->cipher != NULL))
2812 return(s->session->cipher); 2807 return (s->session->cipher);
2813 return(NULL); 2808 return (NULL);
2814 } 2809}
2815#ifdef OPENSSL_NO_COMP 2810#ifdef OPENSSL_NO_COMP
2816const void *SSL_get_current_compression(SSL *s) 2811const void
2817 { 2812*SSL_get_current_compression(SSL *s)
2813{
2818 return NULL; 2814 return NULL;
2819 } 2815}
2820const void *SSL_get_current_expansion(SSL *s) 2816
2821 { 2817const void
2818*SSL_get_current_expansion(SSL *s)
2819{
2822 return NULL; 2820 return NULL;
2823 } 2821}
2824#else 2822#else
2825 2823
2826const COMP_METHOD *SSL_get_current_compression(SSL *s) 2824const COMP_METHOD
2827 { 2825*SSL_get_current_compression(SSL *s)
2826{
2828 if (s->compress != NULL) 2827 if (s->compress != NULL)
2829 return(s->compress->meth); 2828 return (s->compress->meth);
2830 return(NULL); 2829 return (NULL);
2831 } 2830}
2832 2831
2833const COMP_METHOD *SSL_get_current_expansion(SSL *s) 2832const COMP_METHOD
2834 { 2833*SSL_get_current_expansion(SSL *s)
2834{
2835 if (s->expand != NULL) 2835 if (s->expand != NULL)
2836 return(s->expand->meth); 2836 return (s->expand->meth);
2837 return(NULL); 2837 return (NULL);
2838 } 2838}
2839#endif 2839#endif
2840 2840
2841int ssl_init_wbio_buffer(SSL *s,int push) 2841int
2842 { 2842ssl_init_wbio_buffer(SSL *s, int push)
2843{
2843 BIO *bbio; 2844 BIO *bbio;
2844 2845
2845 if (s->bbio == NULL) 2846 if (s->bbio == NULL) {
2846 { 2847 bbio = BIO_new(BIO_f_buffer());
2847 bbio=BIO_new(BIO_f_buffer()); 2848 if (bbio == NULL)
2848 if (bbio == NULL) return(0); 2849 return (0);
2849 s->bbio=bbio; 2850 s->bbio = bbio;
2850 } 2851 } else {
2851 else 2852 bbio = s->bbio;
2852 {
2853 bbio=s->bbio;
2854 if (s->bbio == s->wbio) 2853 if (s->bbio == s->wbio)
2855 s->wbio=BIO_pop(s->wbio); 2854 s->wbio = BIO_pop(s->wbio);
2856 } 2855 }
2857 (void)BIO_reset(bbio); 2856 (void)BIO_reset(bbio);
2858/* if (!BIO_set_write_buffer_size(bbio,16*1024)) */ 2857/* if (!BIO_set_write_buffer_size(bbio,16*1024)) */
2859 if (!BIO_set_read_buffer_size(bbio,1)) 2858 if (!BIO_set_read_buffer_size(bbio, 1)) {
2860 { 2859 SSLerr(SSL_F_SSL_INIT_WBIO_BUFFER, ERR_R_BUF_LIB);
2861 SSLerr(SSL_F_SSL_INIT_WBIO_BUFFER,ERR_R_BUF_LIB); 2860 return (0);
2862 return(0); 2861 }
2863 } 2862 if (push) {
2864 if (push)
2865 {
2866 if (s->wbio != bbio) 2863 if (s->wbio != bbio)
2867 s->wbio=BIO_push(bbio,s->wbio); 2864 s->wbio = BIO_push(bbio, s->wbio);
2868 } 2865 } else {
2869 else
2870 {
2871 if (s->wbio == bbio) 2866 if (s->wbio == bbio)
2872 s->wbio=BIO_pop(bbio); 2867 s->wbio = BIO_pop(bbio);
2873 }
2874 return(1);
2875 } 2868 }
2869 return (1);
2870}
2876 2871
2877void ssl_free_wbio_buffer(SSL *s) 2872void
2878 { 2873ssl_free_wbio_buffer(SSL *s)
2879 if (s->bbio == NULL) return; 2874{
2875 if (s->bbio == NULL)
2876 return;
2880 2877
2881 if (s->bbio == s->wbio) 2878 if (s->bbio == s->wbio) {
2882 {
2883 /* remove buffering */ 2879 /* remove buffering */
2884 s->wbio=BIO_pop(s->wbio); 2880 s->wbio = BIO_pop(s->wbio);
2885#ifdef REF_CHECK /* not the usual REF_CHECK, but this avoids adding one more preprocessor symbol */ 2881#ifdef REF_CHECK /* not the usual REF_CHECK, but this avoids adding one more preprocessor symbol */
2886 assert(s->wbio != NULL); 2882 assert(s->wbio != NULL);
2887#endif 2883#endif
2888 } 2884 }
2889 BIO_free(s->bbio); 2885 BIO_free(s->bbio);
2890 s->bbio=NULL; 2886 s->bbio = NULL;
2891 } 2887}
2892
2893void SSL_CTX_set_quiet_shutdown(SSL_CTX *ctx,int mode)
2894 {
2895 ctx->quiet_shutdown=mode;
2896 }
2897 2888
2898int SSL_CTX_get_quiet_shutdown(const SSL_CTX *ctx) 2889void
2899 { 2890SSL_CTX_set_quiet_shutdown(SSL_CTX *ctx, int mode)
2900 return(ctx->quiet_shutdown); 2891{
2901 } 2892 ctx->quiet_shutdown = mode;
2893}
2902 2894
2903void SSL_set_quiet_shutdown(SSL *s,int mode) 2895int
2904 { 2896SSL_CTX_get_quiet_shutdown(const SSL_CTX *ctx)
2905 s->quiet_shutdown=mode; 2897{
2906 } 2898 return (ctx->quiet_shutdown);
2899}
2907 2900
2908int SSL_get_quiet_shutdown(const SSL *s) 2901void
2909 { 2902SSL_set_quiet_shutdown(SSL *s, int mode)
2910 return(s->quiet_shutdown); 2903{
2911 } 2904 s->quiet_shutdown = mode;
2905}
2912 2906
2913void SSL_set_shutdown(SSL *s,int mode) 2907int
2914 { 2908SSL_get_quiet_shutdown(const SSL *s)
2915 s->shutdown=mode; 2909{
2916 } 2910 return (s->quiet_shutdown);
2911}
2917 2912
2918int SSL_get_shutdown(const SSL *s) 2913void
2919 { 2914SSL_set_shutdown(SSL *s, int mode)
2920 return(s->shutdown); 2915{
2921 } 2916 s->shutdown = mode;
2917}
2922 2918
2923int SSL_version(const SSL *s) 2919int
2924 { 2920SSL_get_shutdown(const SSL *s)
2925 return(s->version); 2921{
2926 } 2922 return (s->shutdown);
2923}
2927 2924
2928SSL_CTX *SSL_get_SSL_CTX(const SSL *ssl) 2925int
2929 { 2926SSL_version(const SSL *s)
2930 return(ssl->ctx); 2927{
2931 } 2928 return (s->version);
2929}
2932 2930
2933SSL_CTX *SSL_set_SSL_CTX(SSL *ssl, SSL_CTX* ctx) 2931SSL_CTX
2934 { 2932*SSL_get_SSL_CTX(const SSL *ssl)
2933{
2934 return (ssl->ctx);
2935}
2936
2937SSL_CTX
2938*SSL_set_SSL_CTX(SSL *ssl, SSL_CTX* ctx)
2939{
2935 if (ssl->ctx == ctx) 2940 if (ssl->ctx == ctx)
2936 return ssl->ctx; 2941 return ssl->ctx;
2937#ifndef OPENSSL_NO_TLSEXT 2942#ifndef OPENSSL_NO_TLSEXT
@@ -2941,114 +2946,131 @@ SSL_CTX *SSL_set_SSL_CTX(SSL *ssl, SSL_CTX* ctx)
2941 if (ssl->cert != NULL) 2946 if (ssl->cert != NULL)
2942 ssl_cert_free(ssl->cert); 2947 ssl_cert_free(ssl->cert);
2943 ssl->cert = ssl_cert_dup(ctx->cert); 2948 ssl->cert = ssl_cert_dup(ctx->cert);
2944 CRYPTO_add(&ctx->references,1,CRYPTO_LOCK_SSL_CTX); 2949 CRYPTO_add(&ctx->references, 1, CRYPTO_LOCK_SSL_CTX);
2945 if (ssl->ctx != NULL) 2950 if (ssl->ctx != NULL)
2946 SSL_CTX_free(ssl->ctx); /* decrement reference count */ 2951 SSL_CTX_free(ssl->ctx); /* decrement reference count */
2947 ssl->ctx = ctx; 2952 ssl->ctx = ctx;
2948 return(ssl->ctx); 2953 return (ssl->ctx);
2949 } 2954}
2950 2955
2951#ifndef OPENSSL_NO_STDIO 2956#ifndef OPENSSL_NO_STDIO
2952int SSL_CTX_set_default_verify_paths(SSL_CTX *ctx) 2957int
2953 { 2958SSL_CTX_set_default_verify_paths(SSL_CTX *ctx)
2954 return(X509_STORE_set_default_paths(ctx->cert_store)); 2959{
2955 } 2960 return (X509_STORE_set_default_paths(ctx->cert_store));
2961}
2956 2962
2957int SSL_CTX_load_verify_locations(SSL_CTX *ctx, const char *CAfile, 2963int
2958 const char *CApath) 2964SSL_CTX_load_verify_locations(SSL_CTX *ctx, const char *CAfile,
2959 { 2965 const char *CApath)
2960 return(X509_STORE_load_locations(ctx->cert_store,CAfile,CApath)); 2966{
2961 } 2967 return (X509_STORE_load_locations(ctx->cert_store, CAfile, CApath));
2968}
2962#endif 2969#endif
2963 2970
2964void SSL_set_info_callback(SSL *ssl, 2971void
2965 void (*cb)(const SSL *ssl,int type,int val)) 2972SSL_set_info_callback(SSL *ssl,
2966 { 2973 void (*cb)(const SSL *ssl, int type, int val))
2967 ssl->info_callback=cb; 2974{
2968 } 2975 ssl->info_callback = cb;
2976}
2969 2977
2970/* One compiler (Diab DCC) doesn't like argument names in returned 2978/* One compiler (Diab DCC) doesn't like argument names in returned
2971 function pointer. */ 2979 function pointer. */
2972void (*SSL_get_info_callback(const SSL *ssl))(const SSL * /*ssl*/,int /*type*/,int /*val*/) 2980void (*SSL_get_info_callback(const SSL *ssl))(const SSL * /*ssl*/,int /*type*/,int /*val*/)
2973 { 2981{
2974 return ssl->info_callback; 2982 return ssl->info_callback;
2975 } 2983}
2976 2984
2977int SSL_state(const SSL *ssl) 2985int
2978 { 2986SSL_state(const SSL *ssl)
2979 return(ssl->state); 2987{
2980 } 2988 return (ssl->state);
2989}
2981 2990
2982void SSL_set_state(SSL *ssl, int state) 2991void
2983 { 2992SSL_set_state(SSL *ssl, int state)
2993{
2984 ssl->state = state; 2994 ssl->state = state;
2985 } 2995}
2986 2996
2987void SSL_set_verify_result(SSL *ssl,long arg) 2997void
2988 { 2998SSL_set_verify_result(SSL *ssl, long arg)
2989 ssl->verify_result=arg; 2999{
2990 } 3000 ssl->verify_result = arg;
3001}
2991 3002
2992long SSL_get_verify_result(const SSL *ssl) 3003long
2993 { 3004SSL_get_verify_result(const SSL *ssl)
2994 return(ssl->verify_result); 3005{
2995 } 3006 return (ssl->verify_result);
3007}
2996 3008
2997int SSL_get_ex_new_index(long argl,void *argp,CRYPTO_EX_new *new_func, 3009int
2998 CRYPTO_EX_dup *dup_func,CRYPTO_EX_free *free_func) 3010SSL_get_ex_new_index(long argl, void *argp, CRYPTO_EX_new *new_func,
2999 { 3011 CRYPTO_EX_dup *dup_func, CRYPTO_EX_free *free_func)
3012{
3000 return CRYPTO_get_ex_new_index(CRYPTO_EX_INDEX_SSL, argl, argp, 3013 return CRYPTO_get_ex_new_index(CRYPTO_EX_INDEX_SSL, argl, argp,
3001 new_func, dup_func, free_func); 3014 new_func, dup_func, free_func);
3002 } 3015}
3003 3016
3004int SSL_set_ex_data(SSL *s,int idx,void *arg) 3017int
3005 { 3018SSL_set_ex_data(SSL *s, int idx, void *arg)
3006 return(CRYPTO_set_ex_data(&s->ex_data,idx,arg)); 3019{
3007 } 3020 return (CRYPTO_set_ex_data(&s->ex_data, idx, arg));
3021}
3008 3022
3009void *SSL_get_ex_data(const SSL *s,int idx) 3023void
3010 { 3024*SSL_get_ex_data(const SSL *s, int idx)
3011 return(CRYPTO_get_ex_data(&s->ex_data,idx)); 3025{
3012 } 3026 return (CRYPTO_get_ex_data(&s->ex_data, idx));
3027}
3013 3028
3014int SSL_CTX_get_ex_new_index(long argl,void *argp,CRYPTO_EX_new *new_func, 3029int
3015 CRYPTO_EX_dup *dup_func,CRYPTO_EX_free *free_func) 3030SSL_CTX_get_ex_new_index(long argl, void *argp, CRYPTO_EX_new *new_func,
3016 { 3031 CRYPTO_EX_dup *dup_func, CRYPTO_EX_free *free_func)
3032{
3017 return CRYPTO_get_ex_new_index(CRYPTO_EX_INDEX_SSL_CTX, argl, argp, 3033 return CRYPTO_get_ex_new_index(CRYPTO_EX_INDEX_SSL_CTX, argl, argp,
3018 new_func, dup_func, free_func); 3034 new_func, dup_func, free_func);
3019 } 3035}
3020 3036
3021int SSL_CTX_set_ex_data(SSL_CTX *s,int idx,void *arg) 3037int
3022 { 3038SSL_CTX_set_ex_data(SSL_CTX *s, int idx, void *arg)
3023 return(CRYPTO_set_ex_data(&s->ex_data,idx,arg)); 3039{
3024 } 3040 return (CRYPTO_set_ex_data(&s->ex_data, idx, arg));
3041}
3025 3042
3026void *SSL_CTX_get_ex_data(const SSL_CTX *s,int idx) 3043void
3027 { 3044*SSL_CTX_get_ex_data(const SSL_CTX *s, int idx)
3028 return(CRYPTO_get_ex_data(&s->ex_data,idx)); 3045{
3029 } 3046 return (CRYPTO_get_ex_data(&s->ex_data, idx));
3047}
3030 3048
3031int ssl_ok(SSL *s) 3049int
3032 { 3050ssl_ok(SSL *s)
3033 return(1); 3051{
3034 } 3052 return (1);
3053}
3035 3054
3036X509_STORE *SSL_CTX_get_cert_store(const SSL_CTX *ctx) 3055X509_STORE
3037 { 3056*SSL_CTX_get_cert_store(const SSL_CTX *ctx)
3038 return(ctx->cert_store); 3057{
3039 } 3058 return (ctx->cert_store);
3059}
3040 3060
3041void SSL_CTX_set_cert_store(SSL_CTX *ctx,X509_STORE *store) 3061void
3042 { 3062SSL_CTX_set_cert_store(SSL_CTX *ctx, X509_STORE *store)
3063{
3043 if (ctx->cert_store != NULL) 3064 if (ctx->cert_store != NULL)
3044 X509_STORE_free(ctx->cert_store); 3065 X509_STORE_free(ctx->cert_store);
3045 ctx->cert_store=store; 3066 ctx->cert_store = store;
3046 } 3067}
3047 3068
3048int SSL_want(const SSL *s) 3069int
3049 { 3070SSL_want(const SSL *s)
3050 return(s->rwstate); 3071{
3051 } 3072 return (s->rwstate);
3073}
3052 3074
3053/*! 3075/*!
3054 * \brief Set the callback for generating temporary RSA keys. 3076 * \brief Set the callback for generating temporary RSA keys.
@@ -3057,19 +3079,21 @@ int SSL_want(const SSL *s)
3057 */ 3079 */
3058 3080
3059#ifndef OPENSSL_NO_RSA 3081#ifndef OPENSSL_NO_RSA
3060void SSL_CTX_set_tmp_rsa_callback(SSL_CTX *ctx,RSA *(*cb)(SSL *ssl, 3082void
3061 int is_export, 3083SSL_CTX_set_tmp_rsa_callback(SSL_CTX *ctx, RSA *(*cb)(SSL *ssl,
3062 int keylength)) 3084 int is_export,
3063 { 3085int keylength))
3064 SSL_CTX_callback_ctrl(ctx,SSL_CTRL_SET_TMP_RSA_CB,(void (*)(void))cb); 3086{
3065 } 3087 SSL_CTX_callback_ctrl(ctx, SSL_CTRL_SET_TMP_RSA_CB,(void (*)(void))cb);
3066 3088}
3067void SSL_set_tmp_rsa_callback(SSL *ssl,RSA *(*cb)(SSL *ssl, 3089
3068 int is_export, 3090void
3069 int keylength)) 3091SSL_set_tmp_rsa_callback(SSL *ssl, RSA *(*cb)(SSL *ssl,
3070 { 3092 int is_export,
3071 SSL_callback_ctrl(ssl,SSL_CTRL_SET_TMP_RSA_CB,(void (*)(void))cb); 3093int keylength))
3072 } 3094{
3095 SSL_callback_ctrl(ssl, SSL_CTRL_SET_TMP_RSA_CB,(void (*)(void))cb);
3096}
3073#endif 3097#endif
3074 3098
3075#ifdef DOXYGEN 3099#ifdef DOXYGEN
@@ -3083,8 +3107,9 @@ void SSL_set_tmp_rsa_callback(SSL *ssl,RSA *(*cb)(SSL *ssl,
3083 * \sa SSL_CTX_set_tmp_rsa_callback, SSL_set_tmp_rsa_callback 3107 * \sa SSL_CTX_set_tmp_rsa_callback, SSL_set_tmp_rsa_callback
3084 */ 3108 */
3085 3109
3086RSA *cb(SSL *ssl,int is_export,int keylength) 3110RSA
3087 {} 3111*cb(SSL *ssl, int is_export, int keylength)
3112{}
3088#endif 3113#endif
3089 3114
3090/*! 3115/*!
@@ -3094,133 +3119,142 @@ RSA *cb(SSL *ssl,int is_export,int keylength)
3094 */ 3119 */
3095 3120
3096#ifndef OPENSSL_NO_DH 3121#ifndef OPENSSL_NO_DH
3097void SSL_CTX_set_tmp_dh_callback(SSL_CTX *ctx,DH *(*dh)(SSL *ssl,int is_export, 3122void
3098 int keylength)) 3123SSL_CTX_set_tmp_dh_callback(SSL_CTX *ctx, DH *(*dh)(SSL *ssl, int is_export,
3099 { 3124 int keylength))
3100 SSL_CTX_callback_ctrl(ctx,SSL_CTRL_SET_TMP_DH_CB,(void (*)(void))dh); 3125{
3101 } 3126 SSL_CTX_callback_ctrl(ctx, SSL_CTRL_SET_TMP_DH_CB,(void (*)(void))dh);
3127}
3102 3128
3103void SSL_set_tmp_dh_callback(SSL *ssl,DH *(*dh)(SSL *ssl,int is_export, 3129void
3104 int keylength)) 3130SSL_set_tmp_dh_callback(SSL *ssl, DH *(*dh)(SSL *ssl, int is_export,
3105 { 3131 int keylength))
3106 SSL_callback_ctrl(ssl,SSL_CTRL_SET_TMP_DH_CB,(void (*)(void))dh); 3132{
3107 } 3133 SSL_callback_ctrl(ssl, SSL_CTRL_SET_TMP_DH_CB,(void (*)(void))dh);
3134}
3108#endif 3135#endif
3109 3136
3110#ifndef OPENSSL_NO_ECDH 3137#ifndef OPENSSL_NO_ECDH
3111void SSL_CTX_set_tmp_ecdh_callback(SSL_CTX *ctx,EC_KEY *(*ecdh)(SSL *ssl,int is_export, 3138void
3112 int keylength)) 3139SSL_CTX_set_tmp_ecdh_callback(SSL_CTX *ctx, EC_KEY *(*ecdh)(SSL *ssl, int is_export,
3113 { 3140 int keylength))
3114 SSL_CTX_callback_ctrl(ctx,SSL_CTRL_SET_TMP_ECDH_CB,(void (*)(void))ecdh); 3141{
3115 } 3142 SSL_CTX_callback_ctrl(ctx, SSL_CTRL_SET_TMP_ECDH_CB,(void (*)(void))ecdh);
3143}
3116 3144
3117void SSL_set_tmp_ecdh_callback(SSL *ssl,EC_KEY *(*ecdh)(SSL *ssl,int is_export, 3145void
3118 int keylength)) 3146SSL_set_tmp_ecdh_callback(SSL *ssl, EC_KEY *(*ecdh)(SSL *ssl, int is_export,
3119 { 3147 int keylength))
3120 SSL_callback_ctrl(ssl,SSL_CTRL_SET_TMP_ECDH_CB,(void (*)(void))ecdh); 3148{
3121 } 3149 SSL_callback_ctrl(ssl, SSL_CTRL_SET_TMP_ECDH_CB,(void (*)(void))ecdh);
3150}
3122#endif 3151#endif
3123 3152
3124#ifndef OPENSSL_NO_PSK 3153#ifndef OPENSSL_NO_PSK
3125int SSL_CTX_use_psk_identity_hint(SSL_CTX *ctx, const char *identity_hint) 3154int
3126 { 3155SSL_CTX_use_psk_identity_hint(SSL_CTX *ctx, const char *identity_hint)
3127 if (identity_hint != NULL && strlen(identity_hint) > PSK_MAX_IDENTITY_LEN) 3156{
3128 { 3157 if (identity_hint != NULL && strlen(identity_hint) > PSK_MAX_IDENTITY_LEN) {
3129 SSLerr(SSL_F_SSL_CTX_USE_PSK_IDENTITY_HINT, SSL_R_DATA_LENGTH_TOO_LONG); 3158 SSLerr(SSL_F_SSL_CTX_USE_PSK_IDENTITY_HINT, SSL_R_DATA_LENGTH_TOO_LONG);
3130 return 0; 3159 return 0;
3131 } 3160 }
3132 if (ctx->psk_identity_hint != NULL) 3161 if (ctx->psk_identity_hint != NULL)
3133 OPENSSL_free(ctx->psk_identity_hint); 3162 OPENSSL_free(ctx->psk_identity_hint);
3134 if (identity_hint != NULL) 3163 if (identity_hint != NULL) {
3135 {
3136 ctx->psk_identity_hint = BUF_strdup(identity_hint); 3164 ctx->psk_identity_hint = BUF_strdup(identity_hint);
3137 if (ctx->psk_identity_hint == NULL) 3165 if (ctx->psk_identity_hint == NULL)
3138 return 0; 3166 return 0;
3139 } 3167 } else
3140 else
3141 ctx->psk_identity_hint = NULL; 3168 ctx->psk_identity_hint = NULL;
3142 return 1; 3169 return 1;
3143 } 3170}
3144 3171
3145int SSL_use_psk_identity_hint(SSL *s, const char *identity_hint) 3172int
3146 { 3173SSL_use_psk_identity_hint(SSL *s, const char *identity_hint)
3174{
3147 if (s == NULL) 3175 if (s == NULL)
3148 return 0; 3176 return 0;
3149 3177
3150 if (s->session == NULL) 3178 if (s->session == NULL)
3151 return 1; /* session not created yet, ignored */ 3179 return 1; /* session not created yet, ignored */
3152 3180
3153 if (identity_hint != NULL && strlen(identity_hint) > PSK_MAX_IDENTITY_LEN) 3181 if (identity_hint != NULL && strlen(identity_hint) > PSK_MAX_IDENTITY_LEN) {
3154 {
3155 SSLerr(SSL_F_SSL_USE_PSK_IDENTITY_HINT, SSL_R_DATA_LENGTH_TOO_LONG); 3182 SSLerr(SSL_F_SSL_USE_PSK_IDENTITY_HINT, SSL_R_DATA_LENGTH_TOO_LONG);
3156 return 0; 3183 return 0;
3157 } 3184 }
3158 if (s->session->psk_identity_hint != NULL) 3185 if (s->session->psk_identity_hint != NULL)
3159 OPENSSL_free(s->session->psk_identity_hint); 3186 OPENSSL_free(s->session->psk_identity_hint);
3160 if (identity_hint != NULL) 3187 if (identity_hint != NULL) {
3161 {
3162 s->session->psk_identity_hint = BUF_strdup(identity_hint); 3188 s->session->psk_identity_hint = BUF_strdup(identity_hint);
3163 if (s->session->psk_identity_hint == NULL) 3189 if (s->session->psk_identity_hint == NULL)
3164 return 0; 3190 return 0;
3165 } 3191 } else
3166 else
3167 s->session->psk_identity_hint = NULL; 3192 s->session->psk_identity_hint = NULL;
3168 return 1; 3193 return 1;
3169 } 3194}
3170 3195
3171const char *SSL_get_psk_identity_hint(const SSL *s) 3196const char
3172 { 3197*SSL_get_psk_identity_hint(const SSL *s)
3198{
3173 if (s == NULL || s->session == NULL) 3199 if (s == NULL || s->session == NULL)
3174 return NULL; 3200 return NULL;
3175 return(s->session->psk_identity_hint); 3201 return (s->session->psk_identity_hint);
3176 } 3202}
3177 3203
3178const char *SSL_get_psk_identity(const SSL *s) 3204const char
3179 { 3205*SSL_get_psk_identity(const SSL *s)
3206{
3180 if (s == NULL || s->session == NULL) 3207 if (s == NULL || s->session == NULL)
3181 return NULL; 3208 return NULL;
3182 return(s->session->psk_identity); 3209 return (s->session->psk_identity);
3183 } 3210}
3184 3211
3185void SSL_set_psk_client_callback(SSL *s, 3212void
3213SSL_set_psk_client_callback(SSL *s,
3186 unsigned int (*cb)(SSL *ssl, const char *hint, 3214 unsigned int (*cb)(SSL *ssl, const char *hint,
3187 char *identity, unsigned int max_identity_len, unsigned char *psk, 3215char *identity, unsigned int max_identity_len, unsigned char *psk,
3188 unsigned int max_psk_len)) 3216 unsigned int max_psk_len))
3189 { 3217{
3190 s->psk_client_callback = cb; 3218 s->psk_client_callback = cb;
3191 } 3219}
3192 3220
3193void SSL_CTX_set_psk_client_callback(SSL_CTX *ctx, 3221void
3222SSL_CTX_set_psk_client_callback(SSL_CTX *ctx,
3194 unsigned int (*cb)(SSL *ssl, const char *hint, 3223 unsigned int (*cb)(SSL *ssl, const char *hint,
3195 char *identity, unsigned int max_identity_len, unsigned char *psk, 3224char *identity, unsigned int max_identity_len, unsigned char *psk,
3196 unsigned int max_psk_len)) 3225 unsigned int max_psk_len))
3197 { 3226{
3198 ctx->psk_client_callback = cb; 3227 ctx->psk_client_callback = cb;
3199 } 3228}
3200 3229
3201void SSL_set_psk_server_callback(SSL *s, 3230void
3231SSL_set_psk_server_callback(SSL *s,
3202 unsigned int (*cb)(SSL *ssl, const char *identity, 3232 unsigned int (*cb)(SSL *ssl, const char *identity,
3203 unsigned char *psk, unsigned int max_psk_len)) 3233unsigned char *psk, unsigned int max_psk_len))
3204 { 3234{
3205 s->psk_server_callback = cb; 3235 s->psk_server_callback = cb;
3206 } 3236}
3207 3237
3208void SSL_CTX_set_psk_server_callback(SSL_CTX *ctx, 3238void
3239SSL_CTX_set_psk_server_callback(SSL_CTX *ctx,
3209 unsigned int (*cb)(SSL *ssl, const char *identity, 3240 unsigned int (*cb)(SSL *ssl, const char *identity,
3210 unsigned char *psk, unsigned int max_psk_len)) 3241unsigned char *psk, unsigned int max_psk_len))
3211 { 3242{
3212 ctx->psk_server_callback = cb; 3243 ctx->psk_server_callback = cb;
3213 } 3244}
3214#endif 3245#endif
3215 3246
3216void SSL_CTX_set_msg_callback(SSL_CTX *ctx, void (*cb)(int write_p, int version, int content_type, const void *buf, size_t len, SSL *ssl, void *arg)) 3247void
3217 { 3248SSL_CTX_set_msg_callback(SSL_CTX *ctx, void (*cb)(int write_p, int version, int content_type, const void *buf, size_t len, SSL *ssl, void *arg))
3249{
3218 SSL_CTX_callback_ctrl(ctx, SSL_CTRL_SET_MSG_CALLBACK, (void (*)(void))cb); 3250 SSL_CTX_callback_ctrl(ctx, SSL_CTRL_SET_MSG_CALLBACK, (void (*)(void))cb);
3219 } 3251}
3220void SSL_set_msg_callback(SSL *ssl, void (*cb)(int write_p, int version, int content_type, const void *buf, size_t len, SSL *ssl, void *arg)) 3252
3221 { 3253void
3254SSL_set_msg_callback(SSL *ssl, void (*cb)(int write_p, int version, int content_type, const void *buf, size_t len, SSL *ssl, void *arg))
3255{
3222 SSL_callback_ctrl(ssl, SSL_CTRL_SET_MSG_CALLBACK, (void (*)(void))cb); 3256 SSL_callback_ctrl(ssl, SSL_CTRL_SET_MSG_CALLBACK, (void (*)(void))cb);
3223 } 3257}
3224 3258
3225/* Allocates new EVP_MD_CTX and sets pointer to it into given pointer 3259/* Allocates new EVP_MD_CTX and sets pointer to it into given pointer
3226 * vairable, freeing EVP_MD_CTX previously stored in that variable, if 3260 * vairable, freeing EVP_MD_CTX previously stored in that variable, if
@@ -3228,31 +3262,38 @@ void SSL_set_msg_callback(SSL *ssl, void (*cb)(int write_p, int version, int con
3228 * Returns newly allocated ctx; 3262 * Returns newly allocated ctx;
3229 */ 3263 */
3230 3264
3231EVP_MD_CTX *ssl_replace_hash(EVP_MD_CTX **hash,const EVP_MD *md) 3265EVP_MD_CTX
3266*ssl_replace_hash(EVP_MD_CTX **hash, const EVP_MD *md)
3232{ 3267{
3233 ssl_clear_hash_ctx(hash); 3268 ssl_clear_hash_ctx(hash);
3234 *hash = EVP_MD_CTX_create(); 3269 *hash = EVP_MD_CTX_create();
3235 if (md) EVP_DigestInit_ex(*hash,md,NULL); 3270 if (md)
3271 EVP_DigestInit_ex(*hash, md, NULL);
3236 return *hash; 3272 return *hash;
3237} 3273}
3238void ssl_clear_hash_ctx(EVP_MD_CTX **hash) 3274
3275void
3276ssl_clear_hash_ctx(EVP_MD_CTX **hash)
3239{ 3277{
3240 3278
3241 if (*hash) EVP_MD_CTX_destroy(*hash); 3279 if (*hash)
3242 *hash=NULL; 3280 EVP_MD_CTX_destroy(*hash);
3281 *hash = NULL;
3243} 3282}
3244 3283
3245void SSL_set_debug(SSL *s, int debug) 3284void
3246 { 3285SSL_set_debug(SSL *s, int debug)
3286{
3247 s->debug = debug; 3287 s->debug = debug;
3248 } 3288}
3249 3289
3250int SSL_cache_hit(SSL *s) 3290int
3251 { 3291SSL_cache_hit(SSL *s)
3292{
3252 return s->hit; 3293 return s->hit;
3253 } 3294}
3254 3295
3255IMPLEMENT_STACK_OF(SSL_CIPHER) 3296IMPLEMENT_STACK_OF(SSL_CIPHER)
3256IMPLEMENT_STACK_OF(SSL_COMP) 3297IMPLEMENT_STACK_OF(SSL_COMP)
3257IMPLEMENT_OBJ_BSEARCH_GLOBAL_CMP_FN(SSL_CIPHER, SSL_CIPHER, 3298IMPLEMENT_OBJ_BSEARCH_GLOBAL_CMP_FN(SSL_CIPHER, SSL_CIPHER,
3258 ssl_cipher_id); 3299ssl_cipher_id);
diff --git a/src/lib/libssl/src/ssl/ssl_rsa.c b/src/lib/libssl/src/ssl/ssl_rsa.c
index 60e7b66859..078df55f06 100644
--- a/src/lib/libssl/src/ssl/ssl_rsa.c
+++ b/src/lib/libssl/src/ssl/ssl_rsa.c
@@ -66,135 +66,126 @@
66 66
67static int ssl_set_cert(CERT *c, X509 *x509); 67static int ssl_set_cert(CERT *c, X509 *x509);
68static int ssl_set_pkey(CERT *c, EVP_PKEY *pkey); 68static int ssl_set_pkey(CERT *c, EVP_PKEY *pkey);
69int SSL_use_certificate(SSL *ssl, X509 *x) 69int
70 { 70SSL_use_certificate(SSL *ssl, X509 *x)
71 if (x == NULL) 71{
72 { 72 if (x == NULL) {
73 SSLerr(SSL_F_SSL_USE_CERTIFICATE,ERR_R_PASSED_NULL_PARAMETER); 73 SSLerr(SSL_F_SSL_USE_CERTIFICATE, ERR_R_PASSED_NULL_PARAMETER);
74 return(0); 74 return (0);
75 } 75 }
76 if (!ssl_cert_inst(&ssl->cert)) 76 if (!ssl_cert_inst(&ssl->cert)) {
77 { 77 SSLerr(SSL_F_SSL_USE_CERTIFICATE, ERR_R_MALLOC_FAILURE);
78 SSLerr(SSL_F_SSL_USE_CERTIFICATE,ERR_R_MALLOC_FAILURE); 78 return (0);
79 return(0);
80 }
81 return(ssl_set_cert(ssl->cert,x));
82 } 79 }
80 return (ssl_set_cert(ssl->cert, x));
81}
83 82
84#ifndef OPENSSL_NO_STDIO 83#ifndef OPENSSL_NO_STDIO
85int SSL_use_certificate_file(SSL *ssl, const char *file, int type) 84int
86 { 85SSL_use_certificate_file(SSL *ssl, const char *file, int type)
86{
87 int j; 87 int j;
88 BIO *in; 88 BIO *in;
89 int ret=0; 89 int ret = 0;
90 X509 *x=NULL; 90 X509 *x = NULL;
91 91
92 in=BIO_new(BIO_s_file_internal()); 92 in = BIO_new(BIO_s_file_internal());
93 if (in == NULL) 93 if (in == NULL) {
94 { 94 SSLerr(SSL_F_SSL_USE_CERTIFICATE_FILE, ERR_R_BUF_LIB);
95 SSLerr(SSL_F_SSL_USE_CERTIFICATE_FILE,ERR_R_BUF_LIB);
96 goto end; 95 goto end;
97 } 96 }
98 97
99 if (BIO_read_filename(in,file) <= 0) 98 if (BIO_read_filename(in, file) <= 0) {
100 { 99 SSLerr(SSL_F_SSL_USE_CERTIFICATE_FILE, ERR_R_SYS_LIB);
101 SSLerr(SSL_F_SSL_USE_CERTIFICATE_FILE,ERR_R_SYS_LIB);
102 goto end; 100 goto end;
103 } 101 }
104 if (type == SSL_FILETYPE_ASN1) 102 if (type == SSL_FILETYPE_ASN1) {
105 { 103 j = ERR_R_ASN1_LIB;
106 j=ERR_R_ASN1_LIB; 104 x = d2i_X509_bio(in, NULL);
107 x=d2i_X509_bio(in,NULL); 105 } else if (type == SSL_FILETYPE_PEM) {
108 } 106 j = ERR_R_PEM_LIB;
109 else if (type == SSL_FILETYPE_PEM) 107 x = PEM_read_bio_X509(in, NULL, ssl->ctx->default_passwd_callback, ssl->ctx->default_passwd_callback_userdata);
110 { 108 } else {
111 j=ERR_R_PEM_LIB; 109 SSLerr(SSL_F_SSL_USE_CERTIFICATE_FILE, SSL_R_BAD_SSL_FILETYPE);
112 x=PEM_read_bio_X509(in,NULL,ssl->ctx->default_passwd_callback,ssl->ctx->default_passwd_callback_userdata);
113 }
114 else
115 {
116 SSLerr(SSL_F_SSL_USE_CERTIFICATE_FILE,SSL_R_BAD_SSL_FILETYPE);
117 goto end; 110 goto end;
118 } 111 }
119 112
120 if (x == NULL) 113 if (x == NULL) {
121 { 114 SSLerr(SSL_F_SSL_USE_CERTIFICATE_FILE, j);
122 SSLerr(SSL_F_SSL_USE_CERTIFICATE_FILE,j);
123 goto end; 115 goto end;
124 } 116 }
125 117
126 ret=SSL_use_certificate(ssl,x); 118 ret = SSL_use_certificate(ssl, x);
127end: 119end:
128 if (x != NULL) X509_free(x); 120 if (x != NULL)
129 if (in != NULL) BIO_free(in); 121 X509_free(x);
130 return(ret); 122 if (in != NULL)
131 } 123 BIO_free(in);
124 return (ret);
125}
132#endif 126#endif
133 127
134int SSL_use_certificate_ASN1(SSL *ssl, const unsigned char *d, int len) 128int
135 { 129SSL_use_certificate_ASN1(SSL *ssl, const unsigned char *d, int len)
130{
136 X509 *x; 131 X509 *x;
137 int ret; 132 int ret;
138 133
139 x=d2i_X509(NULL,&d,(long)len); 134 x = d2i_X509(NULL, &d,(long)len);
140 if (x == NULL) 135 if (x == NULL) {
141 { 136 SSLerr(SSL_F_SSL_USE_CERTIFICATE_ASN1, ERR_R_ASN1_LIB);
142 SSLerr(SSL_F_SSL_USE_CERTIFICATE_ASN1,ERR_R_ASN1_LIB); 137 return (0);
143 return(0); 138 }
144 }
145 139
146 ret=SSL_use_certificate(ssl,x); 140 ret = SSL_use_certificate(ssl, x);
147 X509_free(x); 141 X509_free(x);
148 return(ret); 142 return (ret);
149 } 143}
150 144
151#ifndef OPENSSL_NO_RSA 145#ifndef OPENSSL_NO_RSA
152int SSL_use_RSAPrivateKey(SSL *ssl, RSA *rsa) 146int
153 { 147SSL_use_RSAPrivateKey(SSL *ssl, RSA *rsa)
148{
154 EVP_PKEY *pkey; 149 EVP_PKEY *pkey;
155 int ret; 150 int ret;
156 151
157 if (rsa == NULL) 152 if (rsa == NULL) {
158 { 153 SSLerr(SSL_F_SSL_USE_RSAPRIVATEKEY, ERR_R_PASSED_NULL_PARAMETER);
159 SSLerr(SSL_F_SSL_USE_RSAPRIVATEKEY,ERR_R_PASSED_NULL_PARAMETER); 154 return (0);
160 return(0); 155 }
161 } 156 if (!ssl_cert_inst(&ssl->cert)) {
162 if (!ssl_cert_inst(&ssl->cert)) 157 SSLerr(SSL_F_SSL_USE_RSAPRIVATEKEY, ERR_R_MALLOC_FAILURE);
163 { 158 return (0);
164 SSLerr(SSL_F_SSL_USE_RSAPRIVATEKEY,ERR_R_MALLOC_FAILURE); 159 }
165 return(0); 160 if ((pkey = EVP_PKEY_new()) == NULL) {
166 } 161 SSLerr(SSL_F_SSL_USE_RSAPRIVATEKEY, ERR_R_EVP_LIB);
167 if ((pkey=EVP_PKEY_new()) == NULL) 162 return (0);
168 { 163 }
169 SSLerr(SSL_F_SSL_USE_RSAPRIVATEKEY,ERR_R_EVP_LIB);
170 return(0);
171 }
172 164
173 RSA_up_ref(rsa); 165 RSA_up_ref(rsa);
174 EVP_PKEY_assign_RSA(pkey,rsa); 166 EVP_PKEY_assign_RSA(pkey, rsa);
175 167
176 ret=ssl_set_pkey(ssl->cert,pkey); 168 ret = ssl_set_pkey(ssl->cert, pkey);
177 EVP_PKEY_free(pkey); 169 EVP_PKEY_free(pkey);
178 return(ret); 170 return (ret);
179 } 171}
180#endif 172#endif
181 173
182static int ssl_set_pkey(CERT *c, EVP_PKEY *pkey) 174static int
183 { 175ssl_set_pkey(CERT *c, EVP_PKEY *pkey)
176{
184 int i; 177 int i;
185 178
186 i=ssl_cert_type(NULL,pkey); 179 i = ssl_cert_type(NULL, pkey);
187 if (i < 0) 180 if (i < 0) {
188 { 181 SSLerr(SSL_F_SSL_SET_PKEY, SSL_R_UNKNOWN_CERTIFICATE_TYPE);
189 SSLerr(SSL_F_SSL_SET_PKEY,SSL_R_UNKNOWN_CERTIFICATE_TYPE); 182 return (0);
190 return(0); 183 }
191 }
192 184
193 if (c->pkeys[i].x509 != NULL) 185 if (c->pkeys[i].x509 != NULL) {
194 {
195 EVP_PKEY *pktmp; 186 EVP_PKEY *pktmp;
196 pktmp = X509_get_pubkey(c->pkeys[i].x509); 187 pktmp = X509_get_pubkey(c->pkeys[i].x509);
197 EVP_PKEY_copy_parameters(pktmp,pkey); 188 EVP_PKEY_copy_parameters(pktmp, pkey);
198 EVP_PKEY_free(pktmp); 189 EVP_PKEY_free(pktmp);
199 ERR_clear_error(); 190 ERR_clear_error();
200 191
@@ -203,217 +194,200 @@ static int ssl_set_pkey(CERT *c, EVP_PKEY *pkey)
203 * for smart cards. */ 194 * for smart cards. */
204 if ((pkey->type == EVP_PKEY_RSA) && 195 if ((pkey->type == EVP_PKEY_RSA) &&
205 (RSA_flags(pkey->pkey.rsa) & RSA_METHOD_FLAG_NO_CHECK)) 196 (RSA_flags(pkey->pkey.rsa) & RSA_METHOD_FLAG_NO_CHECK))
206 ; 197;
207 else 198 else
208#endif 199#endif
209 if (!X509_check_private_key(c->pkeys[i].x509,pkey)) 200 if (!X509_check_private_key(c->pkeys[i].x509, pkey)) {
210 {
211 X509_free(c->pkeys[i].x509); 201 X509_free(c->pkeys[i].x509);
212 c->pkeys[i].x509 = NULL; 202 c->pkeys[i].x509 = NULL;
213 return 0; 203 return 0;
214 }
215 } 204 }
205 }
216 206
217 if (c->pkeys[i].privatekey != NULL) 207 if (c->pkeys[i].privatekey != NULL)
218 EVP_PKEY_free(c->pkeys[i].privatekey); 208 EVP_PKEY_free(c->pkeys[i].privatekey);
219 CRYPTO_add(&pkey->references,1,CRYPTO_LOCK_EVP_PKEY); 209 CRYPTO_add(&pkey->references, 1, CRYPTO_LOCK_EVP_PKEY);
220 c->pkeys[i].privatekey=pkey; 210 c->pkeys[i].privatekey = pkey;
221 c->key= &(c->pkeys[i]); 211 c->key = &(c->pkeys[i]);
222 212
223 c->valid=0; 213 c->valid = 0;
224 return(1); 214 return (1);
225 } 215}
226 216
227#ifndef OPENSSL_NO_RSA 217#ifndef OPENSSL_NO_RSA
228#ifndef OPENSSL_NO_STDIO 218#ifndef OPENSSL_NO_STDIO
229int SSL_use_RSAPrivateKey_file(SSL *ssl, const char *file, int type) 219int
230 { 220SSL_use_RSAPrivateKey_file(SSL *ssl, const char *file, int type)
231 int j,ret=0; 221{
222 int j, ret = 0;
232 BIO *in; 223 BIO *in;
233 RSA *rsa=NULL; 224 RSA *rsa = NULL;
234 225
235 in=BIO_new(BIO_s_file_internal()); 226 in = BIO_new(BIO_s_file_internal());
236 if (in == NULL) 227 if (in == NULL) {
237 { 228 SSLerr(SSL_F_SSL_USE_RSAPRIVATEKEY_FILE, ERR_R_BUF_LIB);
238 SSLerr(SSL_F_SSL_USE_RSAPRIVATEKEY_FILE,ERR_R_BUF_LIB);
239 goto end; 229 goto end;
240 } 230 }
241 231
242 if (BIO_read_filename(in,file) <= 0) 232 if (BIO_read_filename(in, file) <= 0) {
243 { 233 SSLerr(SSL_F_SSL_USE_RSAPRIVATEKEY_FILE, ERR_R_SYS_LIB);
244 SSLerr(SSL_F_SSL_USE_RSAPRIVATEKEY_FILE,ERR_R_SYS_LIB);
245 goto end; 234 goto end;
246 } 235 }
247 if (type == SSL_FILETYPE_ASN1) 236 if (type == SSL_FILETYPE_ASN1) {
248 { 237 j = ERR_R_ASN1_LIB;
249 j=ERR_R_ASN1_LIB; 238 rsa = d2i_RSAPrivateKey_bio(in, NULL);
250 rsa=d2i_RSAPrivateKey_bio(in,NULL); 239 } else if (type == SSL_FILETYPE_PEM) {
251 } 240 j = ERR_R_PEM_LIB;
252 else if (type == SSL_FILETYPE_PEM) 241 rsa = PEM_read_bio_RSAPrivateKey(in, NULL,
253 { 242 ssl->ctx->default_passwd_callback, ssl->ctx->default_passwd_callback_userdata);
254 j=ERR_R_PEM_LIB; 243 } else {
255 rsa=PEM_read_bio_RSAPrivateKey(in,NULL, 244 SSLerr(SSL_F_SSL_USE_RSAPRIVATEKEY_FILE, SSL_R_BAD_SSL_FILETYPE);
256 ssl->ctx->default_passwd_callback,ssl->ctx->default_passwd_callback_userdata);
257 }
258 else
259 {
260 SSLerr(SSL_F_SSL_USE_RSAPRIVATEKEY_FILE,SSL_R_BAD_SSL_FILETYPE);
261 goto end; 245 goto end;
262 } 246 }
263 if (rsa == NULL) 247 if (rsa == NULL) {
264 { 248 SSLerr(SSL_F_SSL_USE_RSAPRIVATEKEY_FILE, j);
265 SSLerr(SSL_F_SSL_USE_RSAPRIVATEKEY_FILE,j);
266 goto end; 249 goto end;
267 } 250 }
268 ret=SSL_use_RSAPrivateKey(ssl,rsa); 251 ret = SSL_use_RSAPrivateKey(ssl, rsa);
269 RSA_free(rsa); 252 RSA_free(rsa);
270end: 253end:
271 if (in != NULL) BIO_free(in); 254 if (in != NULL)
272 return(ret); 255 BIO_free(in);
273 } 256 return (ret);
257}
274#endif 258#endif
275 259
276int SSL_use_RSAPrivateKey_ASN1(SSL *ssl, unsigned char *d, long len) 260int
277 { 261SSL_use_RSAPrivateKey_ASN1(SSL *ssl, unsigned char *d, long len)
262{
278 int ret; 263 int ret;
279 const unsigned char *p; 264 const unsigned char *p;
280 RSA *rsa; 265 RSA *rsa;
281 266
282 p=d; 267 p = d;
283 if ((rsa=d2i_RSAPrivateKey(NULL,&p,(long)len)) == NULL) 268 if ((rsa = d2i_RSAPrivateKey(NULL, &p,(long)len)) == NULL) {
284 { 269 SSLerr(SSL_F_SSL_USE_RSAPRIVATEKEY_ASN1, ERR_R_ASN1_LIB);
285 SSLerr(SSL_F_SSL_USE_RSAPRIVATEKEY_ASN1,ERR_R_ASN1_LIB); 270 return (0);
286 return(0); 271 }
287 }
288 272
289 ret=SSL_use_RSAPrivateKey(ssl,rsa); 273 ret = SSL_use_RSAPrivateKey(ssl, rsa);
290 RSA_free(rsa); 274 RSA_free(rsa);
291 return(ret); 275 return (ret);
292 } 276}
293#endif /* !OPENSSL_NO_RSA */ 277#endif /* !OPENSSL_NO_RSA */
294 278
295int SSL_use_PrivateKey(SSL *ssl, EVP_PKEY *pkey) 279int
296 { 280SSL_use_PrivateKey(SSL *ssl, EVP_PKEY *pkey)
281{
297 int ret; 282 int ret;
298 283
299 if (pkey == NULL) 284 if (pkey == NULL) {
300 { 285 SSLerr(SSL_F_SSL_USE_PRIVATEKEY, ERR_R_PASSED_NULL_PARAMETER);
301 SSLerr(SSL_F_SSL_USE_PRIVATEKEY,ERR_R_PASSED_NULL_PARAMETER); 286 return (0);
302 return(0); 287 }
303 } 288 if (!ssl_cert_inst(&ssl->cert)) {
304 if (!ssl_cert_inst(&ssl->cert)) 289 SSLerr(SSL_F_SSL_USE_PRIVATEKEY, ERR_R_MALLOC_FAILURE);
305 { 290 return (0);
306 SSLerr(SSL_F_SSL_USE_PRIVATEKEY,ERR_R_MALLOC_FAILURE);
307 return(0);
308 }
309 ret=ssl_set_pkey(ssl->cert,pkey);
310 return(ret);
311 } 291 }
292 ret = ssl_set_pkey(ssl->cert, pkey);
293 return (ret);
294}
312 295
313#ifndef OPENSSL_NO_STDIO 296#ifndef OPENSSL_NO_STDIO
314int SSL_use_PrivateKey_file(SSL *ssl, const char *file, int type) 297int
315 { 298SSL_use_PrivateKey_file(SSL *ssl, const char *file, int type)
316 int j,ret=0; 299{
300 int j, ret = 0;
317 BIO *in; 301 BIO *in;
318 EVP_PKEY *pkey=NULL; 302 EVP_PKEY *pkey = NULL;
319 303
320 in=BIO_new(BIO_s_file_internal()); 304 in = BIO_new(BIO_s_file_internal());
321 if (in == NULL) 305 if (in == NULL) {
322 { 306 SSLerr(SSL_F_SSL_USE_PRIVATEKEY_FILE, ERR_R_BUF_LIB);
323 SSLerr(SSL_F_SSL_USE_PRIVATEKEY_FILE,ERR_R_BUF_LIB);
324 goto end; 307 goto end;
325 } 308 }
326 309
327 if (BIO_read_filename(in,file) <= 0) 310 if (BIO_read_filename(in, file) <= 0) {
328 { 311 SSLerr(SSL_F_SSL_USE_PRIVATEKEY_FILE, ERR_R_SYS_LIB);
329 SSLerr(SSL_F_SSL_USE_PRIVATEKEY_FILE,ERR_R_SYS_LIB);
330 goto end; 312 goto end;
331 } 313 }
332 if (type == SSL_FILETYPE_PEM) 314 if (type == SSL_FILETYPE_PEM) {
333 { 315 j = ERR_R_PEM_LIB;
334 j=ERR_R_PEM_LIB; 316 pkey = PEM_read_bio_PrivateKey(in, NULL,
335 pkey=PEM_read_bio_PrivateKey(in,NULL, 317 ssl->ctx->default_passwd_callback, ssl->ctx->default_passwd_callback_userdata);
336 ssl->ctx->default_passwd_callback,ssl->ctx->default_passwd_callback_userdata); 318 } else if (type == SSL_FILETYPE_ASN1) {
337 }
338 else if (type == SSL_FILETYPE_ASN1)
339 {
340 j = ERR_R_ASN1_LIB; 319 j = ERR_R_ASN1_LIB;
341 pkey = d2i_PrivateKey_bio(in,NULL); 320 pkey = d2i_PrivateKey_bio(in, NULL);
342 } 321 } else {
343 else 322 SSLerr(SSL_F_SSL_USE_PRIVATEKEY_FILE, SSL_R_BAD_SSL_FILETYPE);
344 {
345 SSLerr(SSL_F_SSL_USE_PRIVATEKEY_FILE,SSL_R_BAD_SSL_FILETYPE);
346 goto end; 323 goto end;
347 } 324 }
348 if (pkey == NULL) 325 if (pkey == NULL) {
349 { 326 SSLerr(SSL_F_SSL_USE_PRIVATEKEY_FILE, j);
350 SSLerr(SSL_F_SSL_USE_PRIVATEKEY_FILE,j);
351 goto end; 327 goto end;
352 } 328 }
353 ret=SSL_use_PrivateKey(ssl,pkey); 329 ret = SSL_use_PrivateKey(ssl, pkey);
354 EVP_PKEY_free(pkey); 330 EVP_PKEY_free(pkey);
355end: 331end:
356 if (in != NULL) BIO_free(in); 332 if (in != NULL)
357 return(ret); 333 BIO_free(in);
358 } 334 return (ret);
335}
359#endif 336#endif
360 337
361int SSL_use_PrivateKey_ASN1(int type, SSL *ssl, const unsigned char *d, long len) 338int
362 { 339SSL_use_PrivateKey_ASN1(int type, SSL *ssl, const unsigned char *d, long len)
340{
363 int ret; 341 int ret;
364 const unsigned char *p; 342 const unsigned char *p;
365 EVP_PKEY *pkey; 343 EVP_PKEY *pkey;
366 344
367 p=d; 345 p = d;
368 if ((pkey=d2i_PrivateKey(type,NULL,&p,(long)len)) == NULL) 346 if ((pkey = d2i_PrivateKey(type, NULL, &p,(long)len)) == NULL) {
369 { 347 SSLerr(SSL_F_SSL_USE_PRIVATEKEY_ASN1, ERR_R_ASN1_LIB);
370 SSLerr(SSL_F_SSL_USE_PRIVATEKEY_ASN1,ERR_R_ASN1_LIB); 348 return (0);
371 return(0); 349 }
372 }
373 350
374 ret=SSL_use_PrivateKey(ssl,pkey); 351 ret = SSL_use_PrivateKey(ssl, pkey);
375 EVP_PKEY_free(pkey); 352 EVP_PKEY_free(pkey);
376 return(ret); 353 return (ret);
354}
355
356int
357SSL_CTX_use_certificate(SSL_CTX *ctx, X509 *x)
358{
359 if (x == NULL) {
360 SSLerr(SSL_F_SSL_CTX_USE_CERTIFICATE, ERR_R_PASSED_NULL_PARAMETER);
361 return (0);
377 } 362 }
378 363 if (!ssl_cert_inst(&ctx->cert)) {
379int SSL_CTX_use_certificate(SSL_CTX *ctx, X509 *x) 364 SSLerr(SSL_F_SSL_CTX_USE_CERTIFICATE, ERR_R_MALLOC_FAILURE);
380 { 365 return (0);
381 if (x == NULL)
382 {
383 SSLerr(SSL_F_SSL_CTX_USE_CERTIFICATE,ERR_R_PASSED_NULL_PARAMETER);
384 return(0);
385 }
386 if (!ssl_cert_inst(&ctx->cert))
387 {
388 SSLerr(SSL_F_SSL_CTX_USE_CERTIFICATE,ERR_R_MALLOC_FAILURE);
389 return(0);
390 }
391 return(ssl_set_cert(ctx->cert, x));
392 } 366 }
367 return (ssl_set_cert(ctx->cert, x));
368}
393 369
394static int ssl_set_cert(CERT *c, X509 *x) 370static int
395 { 371ssl_set_cert(CERT *c, X509 *x)
372{
396 EVP_PKEY *pkey; 373 EVP_PKEY *pkey;
397 int i; 374 int i;
398 375
399 pkey=X509_get_pubkey(x); 376 pkey = X509_get_pubkey(x);
400 if (pkey == NULL) 377 if (pkey == NULL) {
401 { 378 SSLerr(SSL_F_SSL_SET_CERT, SSL_R_X509_LIB);
402 SSLerr(SSL_F_SSL_SET_CERT,SSL_R_X509_LIB); 379 return (0);
403 return(0); 380 }
404 }
405 381
406 i=ssl_cert_type(x,pkey); 382 i = ssl_cert_type(x, pkey);
407 if (i < 0) 383 if (i < 0) {
408 { 384 SSLerr(SSL_F_SSL_SET_CERT, SSL_R_UNKNOWN_CERTIFICATE_TYPE);
409 SSLerr(SSL_F_SSL_SET_CERT,SSL_R_UNKNOWN_CERTIFICATE_TYPE);
410 EVP_PKEY_free(pkey); 385 EVP_PKEY_free(pkey);
411 return(0); 386 return (0);
412 } 387 }
413 388
414 if (c->pkeys[i].privatekey != NULL) 389 if (c->pkeys[i].privatekey != NULL) {
415 { 390 EVP_PKEY_copy_parameters(pkey, c->pkeys[i].privatekey);
416 EVP_PKEY_copy_parameters(pkey,c->pkeys[i].privatekey);
417 ERR_clear_error(); 391 ERR_clear_error();
418 392
419#ifndef OPENSSL_NO_RSA 393#ifndef OPENSSL_NO_RSA
@@ -421,280 +395,259 @@ static int ssl_set_cert(CERT *c, X509 *x)
421 * for smart cards. */ 395 * for smart cards. */
422 if ((c->pkeys[i].privatekey->type == EVP_PKEY_RSA) && 396 if ((c->pkeys[i].privatekey->type == EVP_PKEY_RSA) &&
423 (RSA_flags(c->pkeys[i].privatekey->pkey.rsa) & 397 (RSA_flags(c->pkeys[i].privatekey->pkey.rsa) &
424 RSA_METHOD_FLAG_NO_CHECK)) 398 RSA_METHOD_FLAG_NO_CHECK))
425 ; 399;
426 else 400 else
427#endif /* OPENSSL_NO_RSA */ 401#endif /* OPENSSL_NO_RSA */
428 if (!X509_check_private_key(x,c->pkeys[i].privatekey)) 402 if (!X509_check_private_key(x, c->pkeys[i].privatekey)) {
429 {
430 /* don't fail for a cert/key mismatch, just free 403 /* don't fail for a cert/key mismatch, just free
431 * current private key (when switching to a different 404 * current private key (when switching to a different
432 * cert & key, first this function should be used, 405 * cert & key, first this function should be used,
433 * then ssl_set_pkey */ 406 * then ssl_set_pkey */
434 EVP_PKEY_free(c->pkeys[i].privatekey); 407 EVP_PKEY_free(c->pkeys[i].privatekey);
435 c->pkeys[i].privatekey=NULL; 408 c->pkeys[i].privatekey = NULL;
436 /* clear error queue */ 409 /* clear error queue */
437 ERR_clear_error(); 410 ERR_clear_error();
438 }
439 } 411 }
412 }
440 413
441 EVP_PKEY_free(pkey); 414 EVP_PKEY_free(pkey);
442 415
443 if (c->pkeys[i].x509 != NULL) 416 if (c->pkeys[i].x509 != NULL)
444 X509_free(c->pkeys[i].x509); 417 X509_free(c->pkeys[i].x509);
445 CRYPTO_add(&x->references,1,CRYPTO_LOCK_X509); 418 CRYPTO_add(&x->references, 1, CRYPTO_LOCK_X509);
446 c->pkeys[i].x509=x; 419 c->pkeys[i].x509 = x;
447 c->key= &(c->pkeys[i]); 420 c->key = &(c->pkeys[i]);
448 421
449 c->valid=0; 422 c->valid = 0;
450 return(1); 423 return (1);
451 } 424}
452 425
453#ifndef OPENSSL_NO_STDIO 426#ifndef OPENSSL_NO_STDIO
454int SSL_CTX_use_certificate_file(SSL_CTX *ctx, const char *file, int type) 427int
455 { 428SSL_CTX_use_certificate_file(SSL_CTX *ctx, const char *file, int type)
429{
456 int j; 430 int j;
457 BIO *in; 431 BIO *in;
458 int ret=0; 432 int ret = 0;
459 X509 *x=NULL; 433 X509 *x = NULL;
460 434
461 in=BIO_new(BIO_s_file_internal()); 435 in = BIO_new(BIO_s_file_internal());
462 if (in == NULL) 436 if (in == NULL) {
463 { 437 SSLerr(SSL_F_SSL_CTX_USE_CERTIFICATE_FILE, ERR_R_BUF_LIB);
464 SSLerr(SSL_F_SSL_CTX_USE_CERTIFICATE_FILE,ERR_R_BUF_LIB);
465 goto end; 438 goto end;
466 } 439 }
467 440
468 if (BIO_read_filename(in,file) <= 0) 441 if (BIO_read_filename(in, file) <= 0) {
469 { 442 SSLerr(SSL_F_SSL_CTX_USE_CERTIFICATE_FILE, ERR_R_SYS_LIB);
470 SSLerr(SSL_F_SSL_CTX_USE_CERTIFICATE_FILE,ERR_R_SYS_LIB);
471 goto end; 443 goto end;
472 } 444 }
473 if (type == SSL_FILETYPE_ASN1) 445 if (type == SSL_FILETYPE_ASN1) {
474 { 446 j = ERR_R_ASN1_LIB;
475 j=ERR_R_ASN1_LIB; 447 x = d2i_X509_bio(in, NULL);
476 x=d2i_X509_bio(in,NULL); 448 } else if (type == SSL_FILETYPE_PEM) {
477 } 449 j = ERR_R_PEM_LIB;
478 else if (type == SSL_FILETYPE_PEM) 450 x = PEM_read_bio_X509(in, NULL, ctx->default_passwd_callback, ctx->default_passwd_callback_userdata);
479 { 451 } else {
480 j=ERR_R_PEM_LIB; 452 SSLerr(SSL_F_SSL_CTX_USE_CERTIFICATE_FILE, SSL_R_BAD_SSL_FILETYPE);
481 x=PEM_read_bio_X509(in,NULL,ctx->default_passwd_callback,ctx->default_passwd_callback_userdata);
482 }
483 else
484 {
485 SSLerr(SSL_F_SSL_CTX_USE_CERTIFICATE_FILE,SSL_R_BAD_SSL_FILETYPE);
486 goto end; 453 goto end;
487 } 454 }
488 455
489 if (x == NULL) 456 if (x == NULL) {
490 { 457 SSLerr(SSL_F_SSL_CTX_USE_CERTIFICATE_FILE, j);
491 SSLerr(SSL_F_SSL_CTX_USE_CERTIFICATE_FILE,j);
492 goto end; 458 goto end;
493 } 459 }
494 460
495 ret=SSL_CTX_use_certificate(ctx,x); 461 ret = SSL_CTX_use_certificate(ctx, x);
496end: 462end:
497 if (x != NULL) X509_free(x); 463 if (x != NULL)
498 if (in != NULL) BIO_free(in); 464 X509_free(x);
499 return(ret); 465 if (in != NULL)
500 } 466 BIO_free(in);
467 return (ret);
468}
501#endif 469#endif
502 470
503int SSL_CTX_use_certificate_ASN1(SSL_CTX *ctx, int len, const unsigned char *d) 471int
504 { 472SSL_CTX_use_certificate_ASN1(SSL_CTX *ctx, int len, const unsigned char *d)
473{
505 X509 *x; 474 X509 *x;
506 int ret; 475 int ret;
507 476
508 x=d2i_X509(NULL,&d,(long)len); 477 x = d2i_X509(NULL, &d,(long)len);
509 if (x == NULL) 478 if (x == NULL) {
510 { 479 SSLerr(SSL_F_SSL_CTX_USE_CERTIFICATE_ASN1, ERR_R_ASN1_LIB);
511 SSLerr(SSL_F_SSL_CTX_USE_CERTIFICATE_ASN1,ERR_R_ASN1_LIB); 480 return (0);
512 return(0); 481 }
513 }
514 482
515 ret=SSL_CTX_use_certificate(ctx,x); 483 ret = SSL_CTX_use_certificate(ctx, x);
516 X509_free(x); 484 X509_free(x);
517 return(ret); 485 return (ret);
518 } 486}
519 487
520#ifndef OPENSSL_NO_RSA 488#ifndef OPENSSL_NO_RSA
521int SSL_CTX_use_RSAPrivateKey(SSL_CTX *ctx, RSA *rsa) 489int
522 { 490SSL_CTX_use_RSAPrivateKey(SSL_CTX *ctx, RSA *rsa)
491{
523 int ret; 492 int ret;
524 EVP_PKEY *pkey; 493 EVP_PKEY *pkey;
525 494
526 if (rsa == NULL) 495 if (rsa == NULL) {
527 { 496 SSLerr(SSL_F_SSL_CTX_USE_RSAPRIVATEKEY, ERR_R_PASSED_NULL_PARAMETER);
528 SSLerr(SSL_F_SSL_CTX_USE_RSAPRIVATEKEY,ERR_R_PASSED_NULL_PARAMETER); 497 return (0);
529 return(0); 498 }
530 } 499 if (!ssl_cert_inst(&ctx->cert)) {
531 if (!ssl_cert_inst(&ctx->cert)) 500 SSLerr(SSL_F_SSL_CTX_USE_RSAPRIVATEKEY, ERR_R_MALLOC_FAILURE);
532 { 501 return (0);
533 SSLerr(SSL_F_SSL_CTX_USE_RSAPRIVATEKEY,ERR_R_MALLOC_FAILURE); 502 }
534 return(0); 503 if ((pkey = EVP_PKEY_new()) == NULL) {
535 } 504 SSLerr(SSL_F_SSL_CTX_USE_RSAPRIVATEKEY, ERR_R_EVP_LIB);
536 if ((pkey=EVP_PKEY_new()) == NULL) 505 return (0);
537 { 506 }
538 SSLerr(SSL_F_SSL_CTX_USE_RSAPRIVATEKEY,ERR_R_EVP_LIB);
539 return(0);
540 }
541 507
542 RSA_up_ref(rsa); 508 RSA_up_ref(rsa);
543 EVP_PKEY_assign_RSA(pkey,rsa); 509 EVP_PKEY_assign_RSA(pkey, rsa);
544 510
545 ret=ssl_set_pkey(ctx->cert, pkey); 511 ret = ssl_set_pkey(ctx->cert, pkey);
546 EVP_PKEY_free(pkey); 512 EVP_PKEY_free(pkey);
547 return(ret); 513 return (ret);
548 } 514}
549 515
550#ifndef OPENSSL_NO_STDIO 516#ifndef OPENSSL_NO_STDIO
551int SSL_CTX_use_RSAPrivateKey_file(SSL_CTX *ctx, const char *file, int type) 517int
552 { 518SSL_CTX_use_RSAPrivateKey_file(SSL_CTX *ctx, const char *file, int type)
553 int j,ret=0; 519{
520 int j, ret = 0;
554 BIO *in; 521 BIO *in;
555 RSA *rsa=NULL; 522 RSA *rsa = NULL;
556 523
557 in=BIO_new(BIO_s_file_internal()); 524 in = BIO_new(BIO_s_file_internal());
558 if (in == NULL) 525 if (in == NULL) {
559 { 526 SSLerr(SSL_F_SSL_CTX_USE_RSAPRIVATEKEY_FILE, ERR_R_BUF_LIB);
560 SSLerr(SSL_F_SSL_CTX_USE_RSAPRIVATEKEY_FILE,ERR_R_BUF_LIB);
561 goto end; 527 goto end;
562 } 528 }
563 529
564 if (BIO_read_filename(in,file) <= 0) 530 if (BIO_read_filename(in, file) <= 0) {
565 { 531 SSLerr(SSL_F_SSL_CTX_USE_RSAPRIVATEKEY_FILE, ERR_R_SYS_LIB);
566 SSLerr(SSL_F_SSL_CTX_USE_RSAPRIVATEKEY_FILE,ERR_R_SYS_LIB);
567 goto end; 532 goto end;
568 } 533 }
569 if (type == SSL_FILETYPE_ASN1) 534 if (type == SSL_FILETYPE_ASN1) {
570 { 535 j = ERR_R_ASN1_LIB;
571 j=ERR_R_ASN1_LIB; 536 rsa = d2i_RSAPrivateKey_bio(in, NULL);
572 rsa=d2i_RSAPrivateKey_bio(in,NULL); 537 } else if (type == SSL_FILETYPE_PEM) {
573 } 538 j = ERR_R_PEM_LIB;
574 else if (type == SSL_FILETYPE_PEM) 539 rsa = PEM_read_bio_RSAPrivateKey(in, NULL,
575 { 540 ctx->default_passwd_callback, ctx->default_passwd_callback_userdata);
576 j=ERR_R_PEM_LIB; 541 } else {
577 rsa=PEM_read_bio_RSAPrivateKey(in,NULL, 542 SSLerr(SSL_F_SSL_CTX_USE_RSAPRIVATEKEY_FILE, SSL_R_BAD_SSL_FILETYPE);
578 ctx->default_passwd_callback,ctx->default_passwd_callback_userdata);
579 }
580 else
581 {
582 SSLerr(SSL_F_SSL_CTX_USE_RSAPRIVATEKEY_FILE,SSL_R_BAD_SSL_FILETYPE);
583 goto end; 543 goto end;
584 } 544 }
585 if (rsa == NULL) 545 if (rsa == NULL) {
586 { 546 SSLerr(SSL_F_SSL_CTX_USE_RSAPRIVATEKEY_FILE, j);
587 SSLerr(SSL_F_SSL_CTX_USE_RSAPRIVATEKEY_FILE,j);
588 goto end; 547 goto end;
589 } 548 }
590 ret=SSL_CTX_use_RSAPrivateKey(ctx,rsa); 549 ret = SSL_CTX_use_RSAPrivateKey(ctx, rsa);
591 RSA_free(rsa); 550 RSA_free(rsa);
592end: 551end:
593 if (in != NULL) BIO_free(in); 552 if (in != NULL)
594 return(ret); 553 BIO_free(in);
595 } 554 return (ret);
555}
596#endif 556#endif
597 557
598int SSL_CTX_use_RSAPrivateKey_ASN1(SSL_CTX *ctx, const unsigned char *d, long len) 558int
599 { 559SSL_CTX_use_RSAPrivateKey_ASN1(SSL_CTX *ctx, const unsigned char *d, long len)
560{
600 int ret; 561 int ret;
601 const unsigned char *p; 562 const unsigned char *p;
602 RSA *rsa; 563 RSA *rsa;
603 564
604 p=d; 565 p = d;
605 if ((rsa=d2i_RSAPrivateKey(NULL,&p,(long)len)) == NULL) 566 if ((rsa = d2i_RSAPrivateKey(NULL, &p,(long)len)) == NULL) {
606 { 567 SSLerr(SSL_F_SSL_CTX_USE_RSAPRIVATEKEY_ASN1, ERR_R_ASN1_LIB);
607 SSLerr(SSL_F_SSL_CTX_USE_RSAPRIVATEKEY_ASN1,ERR_R_ASN1_LIB); 568 return (0);
608 return(0); 569 }
609 }
610 570
611 ret=SSL_CTX_use_RSAPrivateKey(ctx,rsa); 571 ret = SSL_CTX_use_RSAPrivateKey(ctx, rsa);
612 RSA_free(rsa); 572 RSA_free(rsa);
613 return(ret); 573 return (ret);
614 } 574}
615#endif /* !OPENSSL_NO_RSA */ 575#endif /* !OPENSSL_NO_RSA */
616 576
617int SSL_CTX_use_PrivateKey(SSL_CTX *ctx, EVP_PKEY *pkey) 577int
618 { 578SSL_CTX_use_PrivateKey(SSL_CTX *ctx, EVP_PKEY *pkey)
619 if (pkey == NULL) 579{
620 { 580 if (pkey == NULL) {
621 SSLerr(SSL_F_SSL_CTX_USE_PRIVATEKEY,ERR_R_PASSED_NULL_PARAMETER); 581 SSLerr(SSL_F_SSL_CTX_USE_PRIVATEKEY, ERR_R_PASSED_NULL_PARAMETER);
622 return(0); 582 return (0);
623 }
624 if (!ssl_cert_inst(&ctx->cert))
625 {
626 SSLerr(SSL_F_SSL_CTX_USE_PRIVATEKEY,ERR_R_MALLOC_FAILURE);
627 return(0);
628 }
629 return(ssl_set_pkey(ctx->cert,pkey));
630 } 583 }
584 if (!ssl_cert_inst(&ctx->cert)) {
585 SSLerr(SSL_F_SSL_CTX_USE_PRIVATEKEY, ERR_R_MALLOC_FAILURE);
586 return (0);
587 }
588 return (ssl_set_pkey(ctx->cert, pkey));
589}
631 590
632#ifndef OPENSSL_NO_STDIO 591#ifndef OPENSSL_NO_STDIO
633int SSL_CTX_use_PrivateKey_file(SSL_CTX *ctx, const char *file, int type) 592int
634 { 593SSL_CTX_use_PrivateKey_file(SSL_CTX *ctx, const char *file, int type)
635 int j,ret=0; 594{
595 int j, ret = 0;
636 BIO *in; 596 BIO *in;
637 EVP_PKEY *pkey=NULL; 597 EVP_PKEY *pkey = NULL;
638 598
639 in=BIO_new(BIO_s_file_internal()); 599 in = BIO_new(BIO_s_file_internal());
640 if (in == NULL) 600 if (in == NULL) {
641 { 601 SSLerr(SSL_F_SSL_CTX_USE_PRIVATEKEY_FILE, ERR_R_BUF_LIB);
642 SSLerr(SSL_F_SSL_CTX_USE_PRIVATEKEY_FILE,ERR_R_BUF_LIB);
643 goto end; 602 goto end;
644 } 603 }
645 604
646 if (BIO_read_filename(in,file) <= 0) 605 if (BIO_read_filename(in, file) <= 0) {
647 { 606 SSLerr(SSL_F_SSL_CTX_USE_PRIVATEKEY_FILE, ERR_R_SYS_LIB);
648 SSLerr(SSL_F_SSL_CTX_USE_PRIVATEKEY_FILE,ERR_R_SYS_LIB);
649 goto end; 607 goto end;
650 } 608 }
651 if (type == SSL_FILETYPE_PEM) 609 if (type == SSL_FILETYPE_PEM) {
652 { 610 j = ERR_R_PEM_LIB;
653 j=ERR_R_PEM_LIB; 611 pkey = PEM_read_bio_PrivateKey(in, NULL,
654 pkey=PEM_read_bio_PrivateKey(in,NULL, 612 ctx->default_passwd_callback, ctx->default_passwd_callback_userdata);
655 ctx->default_passwd_callback,ctx->default_passwd_callback_userdata); 613 } else if (type == SSL_FILETYPE_ASN1) {
656 }
657 else if (type == SSL_FILETYPE_ASN1)
658 {
659 j = ERR_R_ASN1_LIB; 614 j = ERR_R_ASN1_LIB;
660 pkey = d2i_PrivateKey_bio(in,NULL); 615 pkey = d2i_PrivateKey_bio(in, NULL);
661 } 616 } else {
662 else 617 SSLerr(SSL_F_SSL_CTX_USE_PRIVATEKEY_FILE, SSL_R_BAD_SSL_FILETYPE);
663 {
664 SSLerr(SSL_F_SSL_CTX_USE_PRIVATEKEY_FILE,SSL_R_BAD_SSL_FILETYPE);
665 goto end; 618 goto end;
666 } 619 }
667 if (pkey == NULL) 620 if (pkey == NULL) {
668 { 621 SSLerr(SSL_F_SSL_CTX_USE_PRIVATEKEY_FILE, j);
669 SSLerr(SSL_F_SSL_CTX_USE_PRIVATEKEY_FILE,j);
670 goto end; 622 goto end;
671 } 623 }
672 ret=SSL_CTX_use_PrivateKey(ctx,pkey); 624 ret = SSL_CTX_use_PrivateKey(ctx, pkey);
673 EVP_PKEY_free(pkey); 625 EVP_PKEY_free(pkey);
674end: 626end:
675 if (in != NULL) BIO_free(in); 627 if (in != NULL)
676 return(ret); 628 BIO_free(in);
677 } 629 return (ret);
630}
678#endif 631#endif
679 632
680int SSL_CTX_use_PrivateKey_ASN1(int type, SSL_CTX *ctx, const unsigned char *d, 633int
681 long len) 634SSL_CTX_use_PrivateKey_ASN1(int type, SSL_CTX *ctx, const unsigned char *d,
682 { 635 long len)
636{
683 int ret; 637 int ret;
684 const unsigned char *p; 638 const unsigned char *p;
685 EVP_PKEY *pkey; 639 EVP_PKEY *pkey;
686 640
687 p=d; 641 p = d;
688 if ((pkey=d2i_PrivateKey(type,NULL,&p,(long)len)) == NULL) 642 if ((pkey = d2i_PrivateKey(type, NULL, &p,(long)len)) == NULL) {
689 { 643 SSLerr(SSL_F_SSL_CTX_USE_PRIVATEKEY_ASN1, ERR_R_ASN1_LIB);
690 SSLerr(SSL_F_SSL_CTX_USE_PRIVATEKEY_ASN1,ERR_R_ASN1_LIB); 644 return (0);
691 return(0); 645 }
692 }
693 646
694 ret=SSL_CTX_use_PrivateKey(ctx,pkey); 647 ret = SSL_CTX_use_PrivateKey(ctx, pkey);
695 EVP_PKEY_free(pkey); 648 EVP_PKEY_free(pkey);
696 return(ret); 649 return (ret);
697 } 650}
698 651
699 652
700#ifndef OPENSSL_NO_STDIO 653#ifndef OPENSSL_NO_STDIO
@@ -702,82 +655,79 @@ int SSL_CTX_use_PrivateKey_ASN1(int type, SSL_CTX *ctx, const unsigned char *d,
702 * possibly followed by a sequence of CA certificates that should be 655 * possibly followed by a sequence of CA certificates that should be
703 * sent to the peer in the Certificate message. 656 * sent to the peer in the Certificate message.
704 */ 657 */
705int SSL_CTX_use_certificate_chain_file(SSL_CTX *ctx, const char *file) 658int
706 { 659SSL_CTX_use_certificate_chain_file(SSL_CTX *ctx, const char *file)
660{
707 BIO *in; 661 BIO *in;
708 int ret=0; 662 int ret = 0;
709 X509 *x=NULL; 663 X509 *x = NULL;
710 664
711 ERR_clear_error(); /* clear error stack for SSL_CTX_use_certificate() */ 665 ERR_clear_error(); /* clear error stack for SSL_CTX_use_certificate() */
712 666
713 in = BIO_new(BIO_s_file_internal()); 667 in = BIO_new(BIO_s_file_internal());
714 if (in == NULL) 668 if (in == NULL) {
715 { 669 SSLerr(SSL_F_SSL_CTX_USE_CERTIFICATE_CHAIN_FILE, ERR_R_BUF_LIB);
716 SSLerr(SSL_F_SSL_CTX_USE_CERTIFICATE_CHAIN_FILE,ERR_R_BUF_LIB);
717 goto end; 670 goto end;
718 } 671 }
719 672
720 if (BIO_read_filename(in,file) <= 0) 673 if (BIO_read_filename(in, file) <= 0) {
721 { 674 SSLerr(SSL_F_SSL_CTX_USE_CERTIFICATE_CHAIN_FILE, ERR_R_SYS_LIB);
722 SSLerr(SSL_F_SSL_CTX_USE_CERTIFICATE_CHAIN_FILE,ERR_R_SYS_LIB);
723 goto end; 675 goto end;
724 } 676 }
725 677
726 x=PEM_read_bio_X509_AUX(in,NULL,ctx->default_passwd_callback, 678 x = PEM_read_bio_X509_AUX(in, NULL, ctx->default_passwd_callback,
727 ctx->default_passwd_callback_userdata); 679 ctx->default_passwd_callback_userdata);
728 if (x == NULL) 680 if (x == NULL) {
729 { 681 SSLerr(SSL_F_SSL_CTX_USE_CERTIFICATE_CHAIN_FILE, ERR_R_PEM_LIB);
730 SSLerr(SSL_F_SSL_CTX_USE_CERTIFICATE_CHAIN_FILE,ERR_R_PEM_LIB);
731 goto end; 682 goto end;
732 } 683 }
733 684
734 ret = SSL_CTX_use_certificate(ctx, x); 685 ret = SSL_CTX_use_certificate(ctx, x);
735 686
736 if (ERR_peek_error() != 0) 687 if (ERR_peek_error() != 0)
737 ret = 0; /* Key/certificate mismatch doesn't imply ret==0 ... */ 688 ret = 0;
738 if (ret) 689 /* Key/certificate mismatch doesn't imply ret==0 ... */
739 { 690 if (ret) {
740 /* If we could set up our certificate, now proceed to 691 /* If we could set up our certificate, now proceed to
741 * the CA certificates. 692 * the CA certificates.
742 */ 693 */
743 X509 *ca; 694 X509 *ca;
744 int r; 695 int r;
745 unsigned long err; 696 unsigned long err;
746 697
747 if (ctx->extra_certs != NULL) 698 if (ctx->extra_certs != NULL) {
748 {
749 sk_X509_pop_free(ctx->extra_certs, X509_free); 699 sk_X509_pop_free(ctx->extra_certs, X509_free);
750 ctx->extra_certs = NULL; 700 ctx->extra_certs = NULL;
751 } 701 }
752 702
753 while ((ca = PEM_read_bio_X509(in, NULL, 703 while ((ca = PEM_read_bio_X509(in, NULL,
754 ctx->default_passwd_callback, 704 ctx->default_passwd_callback,
755 ctx->default_passwd_callback_userdata)) 705 ctx->default_passwd_callback_userdata))
756 != NULL) 706 != NULL) {
757 {
758 r = SSL_CTX_add_extra_chain_cert(ctx, ca); 707 r = SSL_CTX_add_extra_chain_cert(ctx, ca);
759 if (!r) 708 if (!r) {
760 {
761 X509_free(ca); 709 X509_free(ca);
762 ret = 0; 710 ret = 0;
763 goto end; 711 goto end;
764 } 712 }
765 /* Note that we must not free r if it was successfully 713 /* Note that we must not free r if it was successfully
766 * added to the chain (while we must free the main 714 * added to the chain (while we must free the main
767 * certificate, since its reference count is increased 715 * certificate, since its reference count is increased
768 * by SSL_CTX_use_certificate). */ 716 * by SSL_CTX_use_certificate). */
769 } 717 }
770 /* When the while loop ends, it's usually just EOF. */ 718 /* When the while loop ends, it's usually just EOF. */
771 err = ERR_peek_last_error(); 719 err = ERR_peek_last_error();
772 if (ERR_GET_LIB(err) == ERR_LIB_PEM && ERR_GET_REASON(err) == PEM_R_NO_START_LINE) 720 if (ERR_GET_LIB(err) == ERR_LIB_PEM && ERR_GET_REASON(err) == PEM_R_NO_START_LINE)
773 ERR_clear_error(); 721 ERR_clear_error();
774 else 722 else
775 ret = 0; /* some real error */ 723 ret = 0; /* some real error */
776 } 724 }
777 725
778end: 726end:
779 if (x != NULL) X509_free(x); 727 if (x != NULL)
780 if (in != NULL) BIO_free(in); 728 X509_free(x);
781 return(ret); 729 if (in != NULL)
782 } 730 BIO_free(in);
731 return (ret);
732}
783#endif 733#endif
diff --git a/src/lib/libssl/src/ssl/ssl_sess.c b/src/lib/libssl/src/ssl/ssl_sess.c
index ad40fadd02..b29115862b 100644
--- a/src/lib/libssl/src/ssl/ssl_sess.c
+++ b/src/lib/libssl/src/ssl/ssl_sess.c
@@ -144,68 +144,74 @@
144#include "ssl_locl.h" 144#include "ssl_locl.h"
145 145
146static void SSL_SESSION_list_remove(SSL_CTX *ctx, SSL_SESSION *s); 146static void SSL_SESSION_list_remove(SSL_CTX *ctx, SSL_SESSION *s);
147static void SSL_SESSION_list_add(SSL_CTX *ctx,SSL_SESSION *s); 147static void SSL_SESSION_list_add(SSL_CTX *ctx, SSL_SESSION *s);
148static int remove_session_lock(SSL_CTX *ctx, SSL_SESSION *c, int lck); 148static int remove_session_lock(SSL_CTX *ctx, SSL_SESSION *c, int lck);
149 149
150SSL_SESSION *SSL_get_session(const SSL *ssl) 150SSL_SESSION
151*SSL_get_session(const SSL *ssl)
151/* aka SSL_get0_session; gets 0 objects, just returns a copy of the pointer */ 152/* aka SSL_get0_session; gets 0 objects, just returns a copy of the pointer */
152 { 153{
153 return(ssl->session); 154 return (ssl->session);
154 } 155}
155 156
156SSL_SESSION *SSL_get1_session(SSL *ssl) 157SSL_SESSION
158*SSL_get1_session(SSL *ssl)
157/* variant of SSL_get_session: caller really gets something */ 159/* variant of SSL_get_session: caller really gets something */
158 { 160{
159 SSL_SESSION *sess; 161 SSL_SESSION *sess;
160 /* Need to lock this all up rather than just use CRYPTO_add so that 162 /* Need to lock this all up rather than just use CRYPTO_add so that
161 * somebody doesn't free ssl->session between when we check it's 163 * somebody doesn't free ssl->session between when we check it's
162 * non-null and when we up the reference count. */ 164 * non-null and when we up the reference count. */
163 CRYPTO_w_lock(CRYPTO_LOCK_SSL_SESSION); 165 CRYPTO_w_lock(CRYPTO_LOCK_SSL_SESSION);
164 sess = ssl->session; 166 sess = ssl->session;
165 if(sess) 167 if (sess)
166 sess->references++; 168 sess->references++;
167 CRYPTO_w_unlock(CRYPTO_LOCK_SSL_SESSION); 169 CRYPTO_w_unlock(CRYPTO_LOCK_SSL_SESSION);
168 return(sess); 170 return (sess);
169 } 171}
170 172
171int SSL_SESSION_get_ex_new_index(long argl, void *argp, CRYPTO_EX_new *new_func, 173int
172 CRYPTO_EX_dup *dup_func, CRYPTO_EX_free *free_func) 174SSL_SESSION_get_ex_new_index(long argl, void *argp, CRYPTO_EX_new *new_func,
173 { 175 CRYPTO_EX_dup *dup_func, CRYPTO_EX_free *free_func)
176{
174 return CRYPTO_get_ex_new_index(CRYPTO_EX_INDEX_SSL_SESSION, argl, argp, 177 return CRYPTO_get_ex_new_index(CRYPTO_EX_INDEX_SSL_SESSION, argl, argp,
175 new_func, dup_func, free_func); 178 new_func, dup_func, free_func);
176 } 179}
177 180
178int SSL_SESSION_set_ex_data(SSL_SESSION *s, int idx, void *arg) 181int
179 { 182SSL_SESSION_set_ex_data(SSL_SESSION *s, int idx, void *arg)
180 return(CRYPTO_set_ex_data(&s->ex_data,idx,arg)); 183{
181 } 184 return (CRYPTO_set_ex_data(&s->ex_data, idx, arg));
185}
182 186
183void *SSL_SESSION_get_ex_data(const SSL_SESSION *s, int idx) 187void
184 { 188*SSL_SESSION_get_ex_data(const SSL_SESSION *s, int idx)
185 return(CRYPTO_get_ex_data(&s->ex_data,idx)); 189{
186 } 190 return (CRYPTO_get_ex_data(&s->ex_data, idx));
191}
187 192
188SSL_SESSION *SSL_SESSION_new(void) 193SSL_SESSION
189 { 194*SSL_SESSION_new(void)
195{
190 SSL_SESSION *ss; 196 SSL_SESSION *ss;
191 197
192 ss=(SSL_SESSION *)OPENSSL_malloc(sizeof(SSL_SESSION)); 198 ss = (SSL_SESSION *)OPENSSL_malloc(sizeof(SSL_SESSION));
193 if (ss == NULL) 199 if (ss == NULL) {
194 { 200 SSLerr(SSL_F_SSL_SESSION_NEW, ERR_R_MALLOC_FAILURE);
195 SSLerr(SSL_F_SSL_SESSION_NEW,ERR_R_MALLOC_FAILURE); 201 return (0);
196 return(0); 202 }
197 } 203 memset(ss, 0, sizeof(SSL_SESSION));
198 memset(ss,0,sizeof(SSL_SESSION));
199 204
200 ss->verify_result = 1; /* avoid 0 (= X509_V_OK) just in case */ 205 ss->verify_result = 1; /* avoid 0 (= X509_V_OK) just in case */
201 ss->references=1; 206 ss->references = 1;
202 ss->timeout=60*5+4; /* 5 minute timeout by default */ 207 ss->timeout=60*5+4; /* 5 minute timeout by default */
203 ss->time=(unsigned long)time(NULL); 208 ss->time = (unsigned long)time(NULL);
204 ss->prev=NULL; 209 ss->prev = NULL;
205 ss->next=NULL; 210 ss->next = NULL;
206 ss->compress_meth=0; 211 ss->compress_meth = 0;
207#ifndef OPENSSL_NO_TLSEXT 212#ifndef OPENSSL_NO_TLSEXT
208 ss->tlsext_hostname = NULL; 213 ss->tlsext_hostname = NULL;
214
209#ifndef OPENSSL_NO_EC 215#ifndef OPENSSL_NO_EC
210 ss->tlsext_ecpointformatlist_length = 0; 216 ss->tlsext_ecpointformatlist_length = 0;
211 ss->tlsext_ecpointformatlist = NULL; 217 ss->tlsext_ecpointformatlist = NULL;
@@ -215,26 +221,28 @@ SSL_SESSION *SSL_SESSION_new(void)
215#endif 221#endif
216 CRYPTO_new_ex_data(CRYPTO_EX_INDEX_SSL_SESSION, ss, &ss->ex_data); 222 CRYPTO_new_ex_data(CRYPTO_EX_INDEX_SSL_SESSION, ss, &ss->ex_data);
217#ifndef OPENSSL_NO_PSK 223#ifndef OPENSSL_NO_PSK
218 ss->psk_identity_hint=NULL; 224 ss->psk_identity_hint = NULL;
219 ss->psk_identity=NULL; 225 ss->psk_identity = NULL;
220#endif 226#endif
221#ifndef OPENSSL_NO_SRP 227#ifndef OPENSSL_NO_SRP
222 ss->srp_username=NULL; 228 ss->srp_username = NULL;
223#endif 229#endif
224 return(ss); 230 return (ss);
225 } 231}
226 232
227const unsigned char *SSL_SESSION_get_id(const SSL_SESSION *s, unsigned int *len) 233const unsigned char
228 { 234*SSL_SESSION_get_id(const SSL_SESSION *s, unsigned int *len)
229 if(len) 235{
236 if (len)
230 *len = s->session_id_length; 237 *len = s->session_id_length;
231 return s->session_id; 238 return s->session_id;
232 } 239}
233 240
234unsigned int SSL_SESSION_get_compress_id(const SSL_SESSION *s) 241unsigned int
235 { 242SSL_SESSION_get_compress_id(const SSL_SESSION *s)
243{
236 return s->compress_meth; 244 return s->compress_meth;
237 } 245}
238 246
239/* Even with SSLv2, we have 16 bytes (128 bits) of session ID space. SSLv3/TLSv1 247/* Even with SSLv2, we have 16 bytes (128 bits) of session ID space. SSLv3/TLSv1
240 * has 32 bytes (256 bits). As such, filling the ID with random gunk repeatedly 248 * has 32 bytes (256 bits). As such, filling the ID with random gunk repeatedly
@@ -246,16 +254,17 @@ unsigned int SSL_SESSION_get_compress_id(const SSL_SESSION *s)
246 * store that many sessions is perhaps a more interesting question ... */ 254 * store that many sessions is perhaps a more interesting question ... */
247 255
248#define MAX_SESS_ID_ATTEMPTS 10 256#define MAX_SESS_ID_ATTEMPTS 10
249static int def_generate_session_id(const SSL *ssl, unsigned char *id, 257static int
250 unsigned int *id_len) 258def_generate_session_id(const SSL *ssl, unsigned char *id,
259 unsigned int *id_len)
251{ 260{
252 unsigned int retry = 0; 261 unsigned int retry = 0;
253 do 262 do
254 if (RAND_pseudo_bytes(id, *id_len) <= 0) 263 if (RAND_pseudo_bytes(id, *id_len) <= 0)
255 return 0; 264 return 0;
256 while(SSL_has_matching_session_id(ssl, id, *id_len) && 265 while (SSL_has_matching_session_id(ssl, id, *id_len) &&
257 (++retry < MAX_SESS_ID_ATTEMPTS)); 266 (++retry < MAX_SESS_ID_ATTEMPTS));
258 if(retry < MAX_SESS_ID_ATTEMPTS) 267 if (retry < MAX_SESS_ID_ATTEMPTS)
259 return 1; 268 return 1;
260 /* else - woops a session_id match */ 269 /* else - woops a session_id match */
261 /* XXX We should also check the external cache -- 270 /* XXX We should also check the external cache --
@@ -269,120 +278,100 @@ static int def_generate_session_id(const SSL *ssl, unsigned char *id,
269 return 0; 278 return 0;
270} 279}
271 280
272int ssl_get_new_session(SSL *s, int session) 281int
273 { 282ssl_get_new_session(SSL *s, int session)
283{
274 /* This gets used by clients and servers. */ 284 /* This gets used by clients and servers. */
275 285
276 unsigned int tmp; 286 unsigned int tmp;
277 SSL_SESSION *ss=NULL; 287 SSL_SESSION *ss = NULL;
278 GEN_SESSION_CB cb = def_generate_session_id; 288 GEN_SESSION_CB cb = def_generate_session_id;
279 289
280 if ((ss=SSL_SESSION_new()) == NULL) return(0); 290 if ((ss = SSL_SESSION_new()) == NULL) return (0);
281 291
282 /* If the context has a default timeout, use it */ 292 /* If the context has a default timeout, use it */
283 if (s->session_ctx->session_timeout == 0) 293 if (s->session_ctx->session_timeout == 0)
284 ss->timeout=SSL_get_default_timeout(s); 294 ss->timeout = SSL_get_default_timeout(s);
285 else 295 else
286 ss->timeout=s->session_ctx->session_timeout; 296 ss->timeout = s->session_ctx->session_timeout;
287 297
288 if (s->session != NULL) 298 if (s->session != NULL) {
289 {
290 SSL_SESSION_free(s->session); 299 SSL_SESSION_free(s->session);
291 s->session=NULL; 300 s->session = NULL;
292 } 301 }
293 302
294 if (session) 303 if (session) {
295 { 304 if (s->version == SSL2_VERSION) {
296 if (s->version == SSL2_VERSION) 305 ss->ssl_version = SSL2_VERSION;
297 { 306 ss->session_id_length = SSL2_SSL_SESSION_ID_LENGTH;
298 ss->ssl_version=SSL2_VERSION; 307 } else if (s->version == SSL3_VERSION) {
299 ss->session_id_length=SSL2_SSL_SESSION_ID_LENGTH; 308 ss->ssl_version = SSL3_VERSION;
300 } 309 ss->session_id_length = SSL3_SSL_SESSION_ID_LENGTH;
301 else if (s->version == SSL3_VERSION) 310 } else if (s->version == TLS1_VERSION) {
302 { 311 ss->ssl_version = TLS1_VERSION;
303 ss->ssl_version=SSL3_VERSION; 312 ss->session_id_length = SSL3_SSL_SESSION_ID_LENGTH;
304 ss->session_id_length=SSL3_SSL_SESSION_ID_LENGTH; 313 } else if (s->version == TLS1_1_VERSION) {
305 } 314 ss->ssl_version = TLS1_1_VERSION;
306 else if (s->version == TLS1_VERSION) 315 ss->session_id_length = SSL3_SSL_SESSION_ID_LENGTH;
307 { 316 } else if (s->version == TLS1_2_VERSION) {
308 ss->ssl_version=TLS1_VERSION; 317 ss->ssl_version = TLS1_2_VERSION;
309 ss->session_id_length=SSL3_SSL_SESSION_ID_LENGTH; 318 ss->session_id_length = SSL3_SSL_SESSION_ID_LENGTH;
310 } 319 } else if (s->version == DTLS1_BAD_VER) {
311 else if (s->version == TLS1_1_VERSION) 320 ss->ssl_version = DTLS1_BAD_VER;
312 { 321 ss->session_id_length = SSL3_SSL_SESSION_ID_LENGTH;
313 ss->ssl_version=TLS1_1_VERSION; 322 } else if (s->version == DTLS1_VERSION) {
314 ss->session_id_length=SSL3_SSL_SESSION_ID_LENGTH; 323 ss->ssl_version = DTLS1_VERSION;
315 } 324 ss->session_id_length = SSL3_SSL_SESSION_ID_LENGTH;
316 else if (s->version == TLS1_2_VERSION) 325 } else {
317 { 326 SSLerr(SSL_F_SSL_GET_NEW_SESSION, SSL_R_UNSUPPORTED_SSL_VERSION);
318 ss->ssl_version=TLS1_2_VERSION;
319 ss->session_id_length=SSL3_SSL_SESSION_ID_LENGTH;
320 }
321 else if (s->version == DTLS1_BAD_VER)
322 {
323 ss->ssl_version=DTLS1_BAD_VER;
324 ss->session_id_length=SSL3_SSL_SESSION_ID_LENGTH;
325 }
326 else if (s->version == DTLS1_VERSION)
327 {
328 ss->ssl_version=DTLS1_VERSION;
329 ss->session_id_length=SSL3_SSL_SESSION_ID_LENGTH;
330 }
331 else
332 {
333 SSLerr(SSL_F_SSL_GET_NEW_SESSION,SSL_R_UNSUPPORTED_SSL_VERSION);
334 SSL_SESSION_free(ss); 327 SSL_SESSION_free(ss);
335 return(0); 328 return (0);
336 } 329 }
337#ifndef OPENSSL_NO_TLSEXT 330#ifndef OPENSSL_NO_TLSEXT
338 /* If RFC4507 ticket use empty session ID */ 331 /* If RFC4507 ticket use empty session ID */
339 if (s->tlsext_ticket_expected) 332 if (s->tlsext_ticket_expected) {
340 {
341 ss->session_id_length = 0; 333 ss->session_id_length = 0;
342 goto sess_id_done; 334 goto sess_id_done;
343 } 335 }
344#endif 336#endif
345 /* Choose which callback will set the session ID */ 337 /* Choose which callback will set the session ID */
346 CRYPTO_r_lock(CRYPTO_LOCK_SSL_CTX); 338 CRYPTO_r_lock(CRYPTO_LOCK_SSL_CTX);
347 if(s->generate_session_id) 339 if (s->generate_session_id)
348 cb = s->generate_session_id; 340 cb = s->generate_session_id;
349 else if(s->session_ctx->generate_session_id) 341 else if (s->session_ctx->generate_session_id)
350 cb = s->session_ctx->generate_session_id; 342 cb = s->session_ctx->generate_session_id;
351 CRYPTO_r_unlock(CRYPTO_LOCK_SSL_CTX); 343 CRYPTO_r_unlock(CRYPTO_LOCK_SSL_CTX);
352 /* Choose a session ID */ 344 /* Choose a session ID */
353 tmp = ss->session_id_length; 345 tmp = ss->session_id_length;
354 if(!cb(s, ss->session_id, &tmp)) 346 if (!cb(s, ss->session_id, &tmp)) {
355 {
356 /* The callback failed */ 347 /* The callback failed */
357 SSLerr(SSL_F_SSL_GET_NEW_SESSION, 348 SSLerr(SSL_F_SSL_GET_NEW_SESSION,
358 SSL_R_SSL_SESSION_ID_CALLBACK_FAILED); 349 SSL_R_SSL_SESSION_ID_CALLBACK_FAILED);
359 SSL_SESSION_free(ss); 350 SSL_SESSION_free(ss);
360 return(0); 351 return (0);
361 } 352 }
362 /* Don't allow the callback to set the session length to zero. 353 /* Don't allow the callback to set the session length to zero.
363 * nor set it higher than it was. */ 354 * nor set it higher than it was. */
364 if(!tmp || (tmp > ss->session_id_length)) 355 if (!tmp || (tmp > ss->session_id_length)) {
365 {
366 /* The callback set an illegal length */ 356 /* The callback set an illegal length */
367 SSLerr(SSL_F_SSL_GET_NEW_SESSION, 357 SSLerr(SSL_F_SSL_GET_NEW_SESSION,
368 SSL_R_SSL_SESSION_ID_HAS_BAD_LENGTH); 358 SSL_R_SSL_SESSION_ID_HAS_BAD_LENGTH);
369 SSL_SESSION_free(ss); 359 SSL_SESSION_free(ss);
370 return(0); 360 return (0);
371 } 361 }
372 /* If the session length was shrunk and we're SSLv2, pad it */ 362 /* If the session length was shrunk and we're SSLv2, pad it */
373 if((tmp < ss->session_id_length) && (s->version == SSL2_VERSION)) 363 if ((tmp < ss->session_id_length) && (s->version == SSL2_VERSION))
374 memset(ss->session_id + tmp, 0, ss->session_id_length - tmp); 364 memset(ss->session_id + tmp, 0, ss->session_id_length - tmp);
375 else 365 else
376 ss->session_id_length = tmp; 366 ss->session_id_length = tmp;
377 /* Finally, check for a conflict */ 367 /* Finally, check for a conflict */
378 if(SSL_has_matching_session_id(s, ss->session_id, 368 if (SSL_has_matching_session_id(s, ss->session_id,
379 ss->session_id_length)) 369 ss->session_id_length)) {
380 {
381 SSLerr(SSL_F_SSL_GET_NEW_SESSION, 370 SSLerr(SSL_F_SSL_GET_NEW_SESSION,
382 SSL_R_SSL_SESSION_ID_CONFLICT); 371 SSL_R_SSL_SESSION_ID_CONFLICT);
383 SSL_SESSION_free(ss); 372 SSL_SESSION_free(ss);
384 return(0); 373 return (0);
385 } 374 }
386#ifndef OPENSSL_NO_TLSEXT 375#ifndef OPENSSL_NO_TLSEXT
387 sess_id_done: 376 sess_id_done:
388 if (s->tlsext_hostname) { 377 if (s->tlsext_hostname) {
@@ -391,55 +380,50 @@ int ssl_get_new_session(SSL *s, int session)
391 SSLerr(SSL_F_SSL_GET_NEW_SESSION, ERR_R_INTERNAL_ERROR); 380 SSLerr(SSL_F_SSL_GET_NEW_SESSION, ERR_R_INTERNAL_ERROR);
392 SSL_SESSION_free(ss); 381 SSL_SESSION_free(ss);
393 return 0; 382 return 0;
394 }
395 } 383 }
384 }
396#ifndef OPENSSL_NO_EC 385#ifndef OPENSSL_NO_EC
397 if (s->tlsext_ecpointformatlist) 386 if (s->tlsext_ecpointformatlist) {
398 { 387 if (ss->tlsext_ecpointformatlist != NULL)
399 if (ss->tlsext_ecpointformatlist != NULL) OPENSSL_free(ss->tlsext_ecpointformatlist); 388 OPENSSL_free(ss->tlsext_ecpointformatlist);
400 if ((ss->tlsext_ecpointformatlist = OPENSSL_malloc(s->tlsext_ecpointformatlist_length)) == NULL) 389 if ((ss->tlsext_ecpointformatlist = OPENSSL_malloc(s->tlsext_ecpointformatlist_length)) == NULL) {
401 {
402 SSLerr(SSL_F_SSL_GET_NEW_SESSION, ERR_R_MALLOC_FAILURE); 390 SSLerr(SSL_F_SSL_GET_NEW_SESSION, ERR_R_MALLOC_FAILURE);
403 SSL_SESSION_free(ss); 391 SSL_SESSION_free(ss);
404 return 0; 392 return 0;
405 } 393 }
406 ss->tlsext_ecpointformatlist_length = s->tlsext_ecpointformatlist_length; 394 ss->tlsext_ecpointformatlist_length = s->tlsext_ecpointformatlist_length;
407 memcpy(ss->tlsext_ecpointformatlist, s->tlsext_ecpointformatlist, s->tlsext_ecpointformatlist_length); 395 memcpy(ss->tlsext_ecpointformatlist, s->tlsext_ecpointformatlist, s->tlsext_ecpointformatlist_length);
408 } 396 }
409 if (s->tlsext_ellipticcurvelist) 397 if (s->tlsext_ellipticcurvelist) {
410 { 398 if (ss->tlsext_ellipticcurvelist != NULL)
411 if (ss->tlsext_ellipticcurvelist != NULL) OPENSSL_free(ss->tlsext_ellipticcurvelist); 399 OPENSSL_free(ss->tlsext_ellipticcurvelist);
412 if ((ss->tlsext_ellipticcurvelist = OPENSSL_malloc(s->tlsext_ellipticcurvelist_length)) == NULL) 400 if ((ss->tlsext_ellipticcurvelist = OPENSSL_malloc(s->tlsext_ellipticcurvelist_length)) == NULL) {
413 {
414 SSLerr(SSL_F_SSL_GET_NEW_SESSION, ERR_R_MALLOC_FAILURE); 401 SSLerr(SSL_F_SSL_GET_NEW_SESSION, ERR_R_MALLOC_FAILURE);
415 SSL_SESSION_free(ss); 402 SSL_SESSION_free(ss);
416 return 0; 403 return 0;
417 } 404 }
418 ss->tlsext_ellipticcurvelist_length = s->tlsext_ellipticcurvelist_length; 405 ss->tlsext_ellipticcurvelist_length = s->tlsext_ellipticcurvelist_length;
419 memcpy(ss->tlsext_ellipticcurvelist, s->tlsext_ellipticcurvelist, s->tlsext_ellipticcurvelist_length); 406 memcpy(ss->tlsext_ellipticcurvelist, s->tlsext_ellipticcurvelist, s->tlsext_ellipticcurvelist_length);
420 } 407 }
421#endif 408#endif
422#endif 409#endif
423 } 410 } else {
424 else 411 ss->session_id_length = 0;
425 { 412 }
426 ss->session_id_length=0;
427 }
428 413
429 if (s->sid_ctx_length > sizeof ss->sid_ctx) 414 if (s->sid_ctx_length > sizeof ss->sid_ctx) {
430 {
431 SSLerr(SSL_F_SSL_GET_NEW_SESSION, ERR_R_INTERNAL_ERROR); 415 SSLerr(SSL_F_SSL_GET_NEW_SESSION, ERR_R_INTERNAL_ERROR);
432 SSL_SESSION_free(ss); 416 SSL_SESSION_free(ss);
433 return 0; 417 return 0;
434 } 418 }
435 memcpy(ss->sid_ctx,s->sid_ctx,s->sid_ctx_length); 419 memcpy(ss->sid_ctx, s->sid_ctx, s->sid_ctx_length);
436 ss->sid_ctx_length=s->sid_ctx_length; 420 ss->sid_ctx_length = s->sid_ctx_length;
437 s->session=ss; 421 s->session = ss;
438 ss->ssl_version=s->version; 422 ss->ssl_version = s->version;
439 ss->verify_result = X509_V_OK; 423 ss->verify_result = X509_V_OK;
440 424
441 return(1); 425 return (1);
442 } 426}
443 427
444/* ssl_get_prev attempts to find an SSL_SESSION to be used to resume this 428/* ssl_get_prev attempts to find an SSL_SESSION to be used to resume this
445 * connection. It is only called by servers. 429 * connection. It is only called by servers.
@@ -460,12 +444,13 @@ int ssl_get_new_session(SSL *s, int session)
460 * - Both for new and resumed sessions, s->tlsext_ticket_expected is set to 1 444 * - Both for new and resumed sessions, s->tlsext_ticket_expected is set to 1
461 * if the server should issue a new session ticket (to 0 otherwise). 445 * if the server should issue a new session ticket (to 0 otherwise).
462 */ 446 */
463int ssl_get_prev_session(SSL *s, unsigned char *session_id, int len, 447int
464 const unsigned char *limit) 448ssl_get_prev_session(SSL *s, unsigned char *session_id, int len,
465 { 449 const unsigned char *limit)
450{
466 /* This is used only by servers. */ 451 /* This is used only by servers. */
467 452
468 SSL_SESSION *ret=NULL; 453 SSL_SESSION *ret = NULL;
469 int fatal = 0; 454 int fatal = 0;
470 int try_session_cache = 1; 455 int try_session_cache = 1;
471#ifndef OPENSSL_NO_TLSEXT 456#ifndef OPENSSL_NO_TLSEXT
@@ -480,8 +465,7 @@ int ssl_get_prev_session(SSL *s, unsigned char *session_id, int len,
480 465
481#ifndef OPENSSL_NO_TLSEXT 466#ifndef OPENSSL_NO_TLSEXT
482 r = tls1_process_ticket(s, session_id, len, limit, &ret); /* sets s->tlsext_ticket_expected */ 467 r = tls1_process_ticket(s, session_id, len, limit, &ret); /* sets s->tlsext_ticket_expected */
483 switch (r) 468 switch (r) {
484 {
485 case -1: /* Error during processing */ 469 case -1: /* Error during processing */
486 fatal = 1; 470 fatal = 1;
487 goto err; 471 goto err;
@@ -494,39 +478,35 @@ int ssl_get_prev_session(SSL *s, unsigned char *session_id, int len,
494 break; 478 break;
495 default: 479 default:
496 abort(); 480 abort();
497 } 481 }
498#endif 482#endif
499 483
500 if (try_session_cache && 484 if (try_session_cache &&
501 ret == NULL && 485 ret == NULL &&
502 !(s->session_ctx->session_cache_mode & SSL_SESS_CACHE_NO_INTERNAL_LOOKUP)) 486 !(s->session_ctx->session_cache_mode & SSL_SESS_CACHE_NO_INTERNAL_LOOKUP)) {
503 {
504 SSL_SESSION data; 487 SSL_SESSION data;
505 data.ssl_version=s->version; 488 data.ssl_version = s->version;
506 data.session_id_length=len; 489 data.session_id_length = len;
507 if (len == 0) 490 if (len == 0)
508 return 0; 491 return 0;
509 memcpy(data.session_id,session_id,len); 492 memcpy(data.session_id, session_id, len);
510 CRYPTO_r_lock(CRYPTO_LOCK_SSL_CTX); 493 CRYPTO_r_lock(CRYPTO_LOCK_SSL_CTX);
511 ret=lh_SSL_SESSION_retrieve(s->session_ctx->sessions,&data); 494 ret = lh_SSL_SESSION_retrieve(s->session_ctx->sessions, &data);
512 if (ret != NULL) 495 if (ret != NULL) {
513 {
514 /* don't allow other threads to steal it: */ 496 /* don't allow other threads to steal it: */
515 CRYPTO_add(&ret->references,1,CRYPTO_LOCK_SSL_SESSION); 497 CRYPTO_add(&ret->references, 1, CRYPTO_LOCK_SSL_SESSION);
516 } 498 }
517 CRYPTO_r_unlock(CRYPTO_LOCK_SSL_CTX); 499 CRYPTO_r_unlock(CRYPTO_LOCK_SSL_CTX);
518 if (ret == NULL) 500 if (ret == NULL)
519 s->session_ctx->stats.sess_miss++; 501 s->session_ctx->stats.sess_miss++;
520 } 502 }
521 503
522 if (try_session_cache && 504 if (try_session_cache &&
523 ret == NULL && 505 ret == NULL &&
524 s->session_ctx->get_session_cb != NULL) 506 s->session_ctx->get_session_cb != NULL) {
525 { 507 int copy = 1;
526 int copy=1; 508
527 509 if ((ret = s->session_ctx->get_session_cb(s, session_id, len, &copy))) {
528 if ((ret=s->session_ctx->get_session_cb(s,session_id,len,&copy)))
529 {
530 s->session_ctx->stats.sess_cb_hit++; 510 s->session_ctx->stats.sess_cb_hit++;
531 511
532 /* Increment reference count now if the session callback 512 /* Increment reference count now if the session callback
@@ -535,16 +515,16 @@ int ssl_get_prev_session(SSL *s, unsigned char *session_id, int len,
535 * it must handle the reference count itself [i.e. copy == 0], 515 * it must handle the reference count itself [i.e. copy == 0],
536 * or things won't be thread-safe). */ 516 * or things won't be thread-safe). */
537 if (copy) 517 if (copy)
538 CRYPTO_add(&ret->references,1,CRYPTO_LOCK_SSL_SESSION); 518 CRYPTO_add(&ret->references, 1, CRYPTO_LOCK_SSL_SESSION);
539 519
540 /* Add the externally cached session to the internal 520 /* Add the externally cached session to the internal
541 * cache as well if and only if we are supposed to. */ 521 * cache as well if and only if we are supposed to. */
542 if(!(s->session_ctx->session_cache_mode & SSL_SESS_CACHE_NO_INTERNAL_STORE)) 522 if (!(s->session_ctx->session_cache_mode & SSL_SESS_CACHE_NO_INTERNAL_STORE))
543 /* The following should not return 1, otherwise, 523 /* The following should not return 1, otherwise,
544 * things are very strange */ 524 * things are very strange */
545 SSL_CTX_add_session(s->session_ctx,ret); 525 SSL_CTX_add_session(s->session_ctx, ret);
546 }
547 } 526 }
527 }
548 528
549 if (ret == NULL) 529 if (ret == NULL)
550 goto err; 530 goto err;
@@ -552,15 +532,13 @@ int ssl_get_prev_session(SSL *s, unsigned char *session_id, int len,
552 /* Now ret is non-NULL and we own one of its reference counts. */ 532 /* Now ret is non-NULL and we own one of its reference counts. */
553 533
554 if (ret->sid_ctx_length != s->sid_ctx_length 534 if (ret->sid_ctx_length != s->sid_ctx_length
555 || memcmp(ret->sid_ctx,s->sid_ctx,ret->sid_ctx_length)) 535 || memcmp(ret->sid_ctx, s->sid_ctx, ret->sid_ctx_length)) {
556 {
557 /* We have the session requested by the client, but we don't 536 /* We have the session requested by the client, but we don't
558 * want to use it in this context. */ 537 * want to use it in this context. */
559 goto err; /* treat like cache miss */ 538 goto err; /* treat like cache miss */
560 } 539 }
561 540
562 if((s->verify_mode & SSL_VERIFY_PEER) && s->sid_ctx_length == 0) 541 if ((s->verify_mode & SSL_VERIFY_PEER) && s->sid_ctx_length == 0) {
563 {
564 /* We can't be sure if this session is being used out of 542 /* We can't be sure if this session is being used out of
565 * context, which is especially important for SSL_VERIFY_PEER. 543 * context, which is especially important for SSL_VERIFY_PEER.
566 * The application should have used SSL[_CTX]_set_session_id_context. 544 * The application should have used SSL[_CTX]_set_session_id_context.
@@ -570,87 +548,83 @@ int ssl_get_prev_session(SSL *s, unsigned char *session_id, int len,
570 * applications to effectively disable the session cache by 548 * applications to effectively disable the session cache by
571 * accident without anyone noticing). 549 * accident without anyone noticing).
572 */ 550 */
573 551
574 SSLerr(SSL_F_SSL_GET_PREV_SESSION,SSL_R_SESSION_ID_CONTEXT_UNINITIALIZED); 552 SSLerr(SSL_F_SSL_GET_PREV_SESSION, SSL_R_SESSION_ID_CONTEXT_UNINITIALIZED);
575 fatal = 1; 553 fatal = 1;
576 goto err; 554 goto err;
577 } 555 }
578 556
579 if (ret->cipher == NULL) 557 if (ret->cipher == NULL) {
580 { 558 unsigned char buf[5], *p;
581 unsigned char buf[5],*p;
582 unsigned long l; 559 unsigned long l;
583 560
584 p=buf; 561 p = buf;
585 l=ret->cipher_id; 562 l = ret->cipher_id;
586 l2n(l,p); 563 l2n(l, p);
587 if ((ret->ssl_version>>8) >= SSL3_VERSION_MAJOR) 564 if ((ret->ssl_version >> 8) >= SSL3_VERSION_MAJOR)
588 ret->cipher=ssl_get_cipher_by_char(s,&(buf[2])); 565 ret->cipher = ssl_get_cipher_by_char(s, &(buf[2]));
589 else 566 else
590 ret->cipher=ssl_get_cipher_by_char(s,&(buf[1])); 567 ret->cipher = ssl_get_cipher_by_char(s, &(buf[1]));
591 if (ret->cipher == NULL) 568 if (ret->cipher == NULL)
592 goto err; 569 goto err;
593 } 570 }
594 571
595 if (ret->timeout < (long)(time(NULL) - ret->time)) /* timeout */ 572 if (ret->timeout < (long)(time(NULL) - ret->time)) /* timeout */
596 { 573 {
597 s->session_ctx->stats.sess_timeout++; 574 s->session_ctx->stats.sess_timeout++;
598 if (try_session_cache) 575 if (try_session_cache) {
599 {
600 /* session was from the cache, so remove it */ 576 /* session was from the cache, so remove it */
601 SSL_CTX_remove_session(s->session_ctx,ret); 577 SSL_CTX_remove_session(s->session_ctx, ret);
602 }
603 goto err;
604 } 578 }
579 goto err;
580 }
605 581
606 s->session_ctx->stats.sess_hit++; 582 s->session_ctx->stats.sess_hit++;
607 583
608 if (s->session != NULL) 584 if (s->session != NULL)
609 SSL_SESSION_free(s->session); 585 SSL_SESSION_free(s->session);
610 s->session=ret; 586 s->session = ret;
611 s->verify_result = s->session->verify_result; 587 s->verify_result = s->session->verify_result;
612 return 1; 588 return 1;
613 589
614 err: 590 err:
615 if (ret != NULL) 591 if (ret != NULL) {
616 {
617 SSL_SESSION_free(ret); 592 SSL_SESSION_free(ret);
618#ifndef OPENSSL_NO_TLSEXT 593#ifndef OPENSSL_NO_TLSEXT
619 if (!try_session_cache) 594 if (!try_session_cache) {
620 {
621 /* The session was from a ticket, so we should 595 /* The session was from a ticket, so we should
622 * issue a ticket for the new session */ 596 * issue a ticket for the new session */
623 s->tlsext_ticket_expected = 1; 597 s->tlsext_ticket_expected = 1;
624 }
625#endif
626 } 598 }
599#endif
600 }
627 if (fatal) 601 if (fatal)
628 return -1; 602 return -1;
629 else 603 else
630 return 0; 604 return 0;
631 } 605}
632 606
633int SSL_CTX_add_session(SSL_CTX *ctx, SSL_SESSION *c) 607int
634 { 608SSL_CTX_add_session(SSL_CTX *ctx, SSL_SESSION *c)
635 int ret=0; 609{
610 int ret = 0;
636 SSL_SESSION *s; 611 SSL_SESSION *s;
637 612
638 /* add just 1 reference count for the SSL_CTX's session cache 613 /* add just 1 reference count for the SSL_CTX's session cache
639 * even though it has two ways of access: each session is in a 614 * even though it has two ways of access: each session is in a
640 * doubly linked list and an lhash */ 615 * doubly linked list and an lhash */
641 CRYPTO_add(&c->references,1,CRYPTO_LOCK_SSL_SESSION); 616 CRYPTO_add(&c->references, 1, CRYPTO_LOCK_SSL_SESSION);
642 /* if session c is in already in cache, we take back the increment later */ 617 /* if session c is in already in cache, we take back the increment later */
643 618
644 CRYPTO_w_lock(CRYPTO_LOCK_SSL_CTX); 619 CRYPTO_w_lock(CRYPTO_LOCK_SSL_CTX);
645 s=lh_SSL_SESSION_insert(ctx->sessions,c); 620 s = lh_SSL_SESSION_insert(ctx->sessions, c);
646 621
647 /* s != NULL iff we already had a session with the given PID. 622 /* s != NULL iff we already had a session with the given PID.
648 * In this case, s == c should hold (then we did not really modify 623 * In this case, s == c should hold (then we did not really modify
649 * ctx->sessions), or we're in trouble. */ 624 * ctx->sessions), or we're in trouble. */
650 if (s != NULL && s != c) 625 if (s != NULL && s != c) {
651 {
652 /* We *are* in trouble ... */ 626 /* We *are* in trouble ... */
653 SSL_SESSION_list_remove(ctx,s); 627 SSL_SESSION_list_remove(ctx, s);
654 SSL_SESSION_free(s); 628 SSL_SESSION_free(s);
655 /* ... so pretend the other session did not exist in cache 629 /* ... so pretend the other session did not exist in cache
656 * (we cannot handle two SSL_SESSION structures with identical 630 * (we cannot handle two SSL_SESSION structures with identical
@@ -658,114 +632,117 @@ int SSL_CTX_add_session(SSL_CTX *ctx, SSL_SESSION *c)
658 * two threads concurrently obtain the same session from an external 632 * two threads concurrently obtain the same session from an external
659 * cache) */ 633 * cache) */
660 s = NULL; 634 s = NULL;
661 } 635 }
662 636
663 /* Put at the head of the queue unless it is already in the cache */ 637 /* Put at the head of the queue unless it is already in the cache */
664 if (s == NULL) 638 if (s == NULL)
665 SSL_SESSION_list_add(ctx,c); 639 SSL_SESSION_list_add(ctx, c);
666 640
667 if (s != NULL) 641 if (s != NULL) {
668 {
669 /* existing cache entry -- decrement previously incremented reference 642 /* existing cache entry -- decrement previously incremented reference
670 * count because it already takes into account the cache */ 643 * count because it already takes into account the cache */
671 644
672 SSL_SESSION_free(s); /* s == c */ 645 SSL_SESSION_free(s); /* s == c */
673 ret=0; 646 ret = 0;
674 } 647 } else {
675 else
676 {
677 /* new cache entry -- remove old ones if cache has become too large */ 648 /* new cache entry -- remove old ones if cache has become too large */
678
679 ret=1;
680 649
681 if (SSL_CTX_sess_get_cache_size(ctx) > 0) 650 ret = 1;
682 { 651
652 if (SSL_CTX_sess_get_cache_size(ctx) > 0) {
683 while (SSL_CTX_sess_number(ctx) > 653 while (SSL_CTX_sess_number(ctx) >
684 SSL_CTX_sess_get_cache_size(ctx)) 654 SSL_CTX_sess_get_cache_size(ctx)) {
685 {
686 if (!remove_session_lock(ctx, 655 if (!remove_session_lock(ctx,
687 ctx->session_cache_tail, 0)) 656 ctx->session_cache_tail, 0))
688 break; 657 break;
689 else 658 else
690 ctx->stats.sess_cache_full++; 659 ctx->stats.sess_cache_full++;
691 }
692 } 660 }
693 } 661 }
694 CRYPTO_w_unlock(CRYPTO_LOCK_SSL_CTX);
695 return(ret);
696 } 662 }
663 CRYPTO_w_unlock(CRYPTO_LOCK_SSL_CTX);
664 return (ret);
665}
697 666
698int SSL_CTX_remove_session(SSL_CTX *ctx, SSL_SESSION *c) 667int
668SSL_CTX_remove_session(SSL_CTX *ctx, SSL_SESSION *c)
699{ 669{
700 return remove_session_lock(ctx, c, 1); 670 return remove_session_lock(ctx, c, 1);
701} 671}
702 672
703static int remove_session_lock(SSL_CTX *ctx, SSL_SESSION *c, int lck) 673static int
704 { 674remove_session_lock(SSL_CTX *ctx, SSL_SESSION *c, int lck)
675{
705 SSL_SESSION *r; 676 SSL_SESSION *r;
706 int ret=0; 677 int ret = 0;
707 678
708 if ((c != NULL) && (c->session_id_length != 0)) 679 if ((c != NULL) && (c->session_id_length != 0)) {
709 { 680 if (lck)
710 if(lck) CRYPTO_w_lock(CRYPTO_LOCK_SSL_CTX); 681 CRYPTO_w_lock(CRYPTO_LOCK_SSL_CTX);
711 if ((r = lh_SSL_SESSION_retrieve(ctx->sessions,c)) == c) 682 if ((r = lh_SSL_SESSION_retrieve(ctx->sessions, c)) == c) {
712 { 683 ret = 1;
713 ret=1; 684 r = lh_SSL_SESSION_delete(ctx->sessions, c);
714 r=lh_SSL_SESSION_delete(ctx->sessions,c); 685 SSL_SESSION_list_remove(ctx, c);
715 SSL_SESSION_list_remove(ctx,c); 686 }
716 }
717 687
718 if(lck) CRYPTO_w_unlock(CRYPTO_LOCK_SSL_CTX); 688 if (lck)
689 CRYPTO_w_unlock(CRYPTO_LOCK_SSL_CTX);
719 690
720 if (ret) 691 if (ret) {
721 { 692 r->not_resumable = 1;
722 r->not_resumable=1;
723 if (ctx->remove_session_cb != NULL) 693 if (ctx->remove_session_cb != NULL)
724 ctx->remove_session_cb(ctx,r); 694 ctx->remove_session_cb(ctx, r);
725 SSL_SESSION_free(r); 695 SSL_SESSION_free(r);
726 }
727 } 696 }
728 else 697 } else
729 ret=0; 698 ret = 0;
730 return(ret); 699 return (ret);
731 } 700}
732 701
733void SSL_SESSION_free(SSL_SESSION *ss) 702void
734 { 703SSL_SESSION_free(SSL_SESSION *ss)
704{
735 int i; 705 int i;
736 706
737 if(ss == NULL) 707 if (ss == NULL)
738 return; 708 return;
739 709
740 i=CRYPTO_add(&ss->references,-1,CRYPTO_LOCK_SSL_SESSION); 710 i = CRYPTO_add(&ss->references, -1, CRYPTO_LOCK_SSL_SESSION);
741#ifdef REF_PRINT 711#ifdef REF_PRINT
742 REF_PRINT("SSL_SESSION",ss); 712 REF_PRINT("SSL_SESSION", ss);
743#endif 713#endif
744 if (i > 0) return; 714 if (i > 0)
715 return;
745#ifdef REF_CHECK 716#ifdef REF_CHECK
746 if (i < 0) 717 if (i < 0) {
747 { 718 fprintf(stderr, "SSL_SESSION_free, bad reference count\n");
748 fprintf(stderr,"SSL_SESSION_free, bad reference count\n");
749 abort(); /* ok */ 719 abort(); /* ok */
750 } 720 }
751#endif 721#endif
752 722
753 CRYPTO_free_ex_data(CRYPTO_EX_INDEX_SSL_SESSION, ss, &ss->ex_data); 723 CRYPTO_free_ex_data(CRYPTO_EX_INDEX_SSL_SESSION, ss, &ss->ex_data);
754 724
755 OPENSSL_cleanse(ss->key_arg,sizeof ss->key_arg); 725 OPENSSL_cleanse(ss->key_arg, sizeof ss->key_arg);
756 OPENSSL_cleanse(ss->master_key,sizeof ss->master_key); 726 OPENSSL_cleanse(ss->master_key, sizeof ss->master_key);
757 OPENSSL_cleanse(ss->session_id,sizeof ss->session_id); 727 OPENSSL_cleanse(ss->session_id, sizeof ss->session_id);
758 if (ss->sess_cert != NULL) ssl_sess_cert_free(ss->sess_cert); 728 if (ss->sess_cert != NULL)
759 if (ss->peer != NULL) X509_free(ss->peer); 729 ssl_sess_cert_free(ss->sess_cert);
760 if (ss->ciphers != NULL) sk_SSL_CIPHER_free(ss->ciphers); 730 if (ss->peer != NULL)
731 X509_free(ss->peer);
732 if (ss->ciphers != NULL)
733 sk_SSL_CIPHER_free(ss->ciphers);
761#ifndef OPENSSL_NO_TLSEXT 734#ifndef OPENSSL_NO_TLSEXT
762 if (ss->tlsext_hostname != NULL) OPENSSL_free(ss->tlsext_hostname); 735 if (ss->tlsext_hostname != NULL)
763 if (ss->tlsext_tick != NULL) OPENSSL_free(ss->tlsext_tick); 736 OPENSSL_free(ss->tlsext_hostname);
737 if (ss->tlsext_tick != NULL)
738 OPENSSL_free(ss->tlsext_tick);
764#ifndef OPENSSL_NO_EC 739#ifndef OPENSSL_NO_EC
765 ss->tlsext_ecpointformatlist_length = 0; 740 ss->tlsext_ecpointformatlist_length = 0;
766 if (ss->tlsext_ecpointformatlist != NULL) OPENSSL_free(ss->tlsext_ecpointformatlist); 741 if (ss->tlsext_ecpointformatlist != NULL)
742 OPENSSL_free(ss->tlsext_ecpointformatlist);
767 ss->tlsext_ellipticcurvelist_length = 0; 743 ss->tlsext_ellipticcurvelist_length = 0;
768 if (ss->tlsext_ellipticcurvelist != NULL) OPENSSL_free(ss->tlsext_ellipticcurvelist); 744 if (ss->tlsext_ellipticcurvelist != NULL)
745 OPENSSL_free(ss->tlsext_ellipticcurvelist);
769#endif /* OPENSSL_NO_EC */ 746#endif /* OPENSSL_NO_EC */
770#endif 747#endif
771#ifndef OPENSSL_NO_PSK 748#ifndef OPENSSL_NO_PSK
@@ -778,382 +755,389 @@ void SSL_SESSION_free(SSL_SESSION *ss)
778 if (ss->srp_username != NULL) 755 if (ss->srp_username != NULL)
779 OPENSSL_free(ss->srp_username); 756 OPENSSL_free(ss->srp_username);
780#endif 757#endif
781 OPENSSL_cleanse(ss,sizeof(*ss)); 758 OPENSSL_cleanse(ss, sizeof(*ss));
782 OPENSSL_free(ss); 759 OPENSSL_free(ss);
783 } 760}
784 761
785int SSL_set_session(SSL *s, SSL_SESSION *session) 762int
786 { 763SSL_set_session(SSL *s, SSL_SESSION *session)
787 int ret=0; 764{
765 int ret = 0;
788 const SSL_METHOD *meth; 766 const SSL_METHOD *meth;
789 767
790 if (session != NULL) 768 if (session != NULL) {
791 { 769 meth = s->ctx->method->get_ssl_method(session->ssl_version);
792 meth=s->ctx->method->get_ssl_method(session->ssl_version);
793 if (meth == NULL) 770 if (meth == NULL)
794 meth=s->method->get_ssl_method(session->ssl_version); 771 meth = s->method->get_ssl_method(session->ssl_version);
795 if (meth == NULL) 772 if (meth == NULL) {
796 { 773 SSLerr(SSL_F_SSL_SET_SESSION, SSL_R_UNABLE_TO_FIND_SSL_METHOD);
797 SSLerr(SSL_F_SSL_SET_SESSION,SSL_R_UNABLE_TO_FIND_SSL_METHOD); 774 return (0);
798 return(0); 775 }
799 }
800 776
801 if (meth != s->method) 777 if (meth != s->method) {
802 { 778 if (!SSL_set_ssl_method(s, meth))
803 if (!SSL_set_ssl_method(s,meth)) 779 return (0);
804 return(0); 780 }
805 }
806 781
807#ifndef OPENSSL_NO_KRB5 782#ifndef OPENSSL_NO_KRB5
808 if (s->kssl_ctx && !s->kssl_ctx->client_princ && 783 if (s->kssl_ctx && !s->kssl_ctx->client_princ &&
809 session->krb5_client_princ_len > 0) 784 session->krb5_client_princ_len > 0) {
810 { 785 s->kssl_ctx->client_princ = (char *)OPENSSL_malloc(session->krb5_client_princ_len + 1);
811 s->kssl_ctx->client_princ = (char *)OPENSSL_malloc(session->krb5_client_princ_len + 1); 786 memcpy(s->kssl_ctx->client_princ, session->krb5_client_princ,
812 memcpy(s->kssl_ctx->client_princ,session->krb5_client_princ, 787 session->krb5_client_princ_len);
813 session->krb5_client_princ_len); 788 s->kssl_ctx->client_princ[session->krb5_client_princ_len] = '\0';
814 s->kssl_ctx->client_princ[session->krb5_client_princ_len] = '\0'; 789 }
815 }
816#endif /* OPENSSL_NO_KRB5 */ 790#endif /* OPENSSL_NO_KRB5 */
817 791
818 /* CRYPTO_w_lock(CRYPTO_LOCK_SSL);*/ 792 /* CRYPTO_w_lock(CRYPTO_LOCK_SSL);*/
819 CRYPTO_add(&session->references,1,CRYPTO_LOCK_SSL_SESSION); 793 CRYPTO_add(&session->references, 1, CRYPTO_LOCK_SSL_SESSION);
820 if (s->session != NULL) 794 if (s->session != NULL)
821 SSL_SESSION_free(s->session); 795 SSL_SESSION_free(s->session);
822 s->session=session; 796 s->session = session;
823 s->verify_result = s->session->verify_result; 797 s->verify_result = s->session->verify_result;
824 /* CRYPTO_w_unlock(CRYPTO_LOCK_SSL);*/ 798 /* CRYPTO_w_unlock(CRYPTO_LOCK_SSL);*/
825 ret=1; 799 ret = 1;
826 } 800 } else {
827 else 801 if (s->session != NULL) {
828 {
829 if (s->session != NULL)
830 {
831 SSL_SESSION_free(s->session); 802 SSL_SESSION_free(s->session);
832 s->session=NULL; 803 s->session = NULL;
833 } 804 }
834 805
835 meth=s->ctx->method; 806 meth = s->ctx->method;
836 if (meth != s->method) 807 if (meth != s->method) {
837 { 808 if (!SSL_set_ssl_method(s, meth))
838 if (!SSL_set_ssl_method(s,meth)) 809 return (0);
839 return(0);
840 }
841 ret=1;
842 } 810 }
843 return(ret); 811 ret = 1;
844 } 812 }
813 return (ret);
814}
845 815
846long SSL_SESSION_set_timeout(SSL_SESSION *s, long t) 816long
847 { 817SSL_SESSION_set_timeout(SSL_SESSION *s, long t)
848 if (s == NULL) return(0); 818{
849 s->timeout=t; 819 if (s == NULL)
850 return(1); 820 return (0);
851 } 821 s->timeout = t;
822 return (1);
823}
852 824
853long SSL_SESSION_get_timeout(const SSL_SESSION *s) 825long
854 { 826SSL_SESSION_get_timeout(const SSL_SESSION *s)
855 if (s == NULL) return(0); 827{
856 return(s->timeout); 828 if (s == NULL)
857 } 829 return (0);
830 return (s->timeout);
831}
858 832
859long SSL_SESSION_get_time(const SSL_SESSION *s) 833long
860 { 834SSL_SESSION_get_time(const SSL_SESSION *s)
861 if (s == NULL) return(0); 835{
862 return(s->time); 836 if (s == NULL)
863 } 837 return (0);
838 return (s->time);
839}
864 840
865long SSL_SESSION_set_time(SSL_SESSION *s, long t) 841long
866 { 842SSL_SESSION_set_time(SSL_SESSION *s, long t)
867 if (s == NULL) return(0); 843{
868 s->time=t; 844 if (s == NULL)
869 return(t); 845 return (0);
870 } 846 s->time = t;
847 return (t);
848}
871 849
872X509 *SSL_SESSION_get0_peer(SSL_SESSION *s) 850X509
873 { 851*SSL_SESSION_get0_peer(SSL_SESSION *s)
852{
874 return s->peer; 853 return s->peer;
875 } 854}
876 855
877int SSL_SESSION_set1_id_context(SSL_SESSION *s,const unsigned char *sid_ctx, 856int
878 unsigned int sid_ctx_len) 857SSL_SESSION_set1_id_context(SSL_SESSION *s, const unsigned char *sid_ctx,
879 { 858 unsigned int sid_ctx_len)
880 if(sid_ctx_len > SSL_MAX_SID_CTX_LENGTH) 859{
881 { 860 if (sid_ctx_len > SSL_MAX_SID_CTX_LENGTH) {
882 SSLerr(SSL_F_SSL_SESSION_SET1_ID_CONTEXT,SSL_R_SSL_SESSION_ID_CONTEXT_TOO_LONG); 861 SSLerr(SSL_F_SSL_SESSION_SET1_ID_CONTEXT, SSL_R_SSL_SESSION_ID_CONTEXT_TOO_LONG);
883 return 0; 862 return 0;
884 } 863 }
885 s->sid_ctx_length=sid_ctx_len; 864 s->sid_ctx_length = sid_ctx_len;
886 memcpy(s->sid_ctx,sid_ctx,sid_ctx_len); 865 memcpy(s->sid_ctx, sid_ctx, sid_ctx_len);
887 866
888 return 1; 867 return 1;
889 } 868}
890 869
891long SSL_CTX_set_timeout(SSL_CTX *s, long t) 870long
892 { 871SSL_CTX_set_timeout(SSL_CTX *s, long t)
872{
893 long l; 873 long l;
894 if (s == NULL) return(0); 874 if (s == NULL)
895 l=s->session_timeout; 875 return (0);
896 s->session_timeout=t; 876 l = s->session_timeout;
897 return(l); 877 s->session_timeout = t;
898 } 878 return (l);
879}
899 880
900long SSL_CTX_get_timeout(const SSL_CTX *s) 881long
901 { 882SSL_CTX_get_timeout(const SSL_CTX *s)
902 if (s == NULL) return(0); 883{
903 return(s->session_timeout); 884 if (s == NULL)
904 } 885 return (0);
886 return (s->session_timeout);
887}
905 888
906#ifndef OPENSSL_NO_TLSEXT 889#ifndef OPENSSL_NO_TLSEXT
907int SSL_set_session_secret_cb(SSL *s, int (*tls_session_secret_cb)(SSL *s, void *secret, int *secret_len, 890int
908 STACK_OF(SSL_CIPHER) *peer_ciphers, SSL_CIPHER **cipher, void *arg), void *arg) 891SSL_set_session_secret_cb(SSL *s, int (*tls_session_secret_cb)(SSL *s, void *secret, int *secret_len,
909 { 892 STACK_OF(SSL_CIPHER) *peer_ciphers, SSL_CIPHER **cipher, void *arg), void *arg)
910 if (s == NULL) return(0); 893{
894 if (s == NULL)
895 return (0);
911 s->tls_session_secret_cb = tls_session_secret_cb; 896 s->tls_session_secret_cb = tls_session_secret_cb;
912 s->tls_session_secret_cb_arg = arg; 897 s->tls_session_secret_cb_arg = arg;
913 return(1); 898 return (1);
914 } 899}
915 900
916int SSL_set_session_ticket_ext_cb(SSL *s, tls_session_ticket_ext_cb_fn cb, 901int
917 void *arg) 902SSL_set_session_ticket_ext_cb(SSL *s, tls_session_ticket_ext_cb_fn cb,
918 { 903 void *arg)
919 if (s == NULL) return(0); 904{
905 if (s == NULL)
906 return (0);
920 s->tls_session_ticket_ext_cb = cb; 907 s->tls_session_ticket_ext_cb = cb;
921 s->tls_session_ticket_ext_cb_arg = arg; 908 s->tls_session_ticket_ext_cb_arg = arg;
922 return(1); 909 return (1);
923 } 910}
924 911
925int SSL_set_session_ticket_ext(SSL *s, void *ext_data, int ext_len) 912int
926 { 913SSL_set_session_ticket_ext(SSL *s, void *ext_data, int ext_len)
927 if (s->version >= TLS1_VERSION) 914{
928 { 915 if (s->version >= TLS1_VERSION) {
929 if (s->tlsext_session_ticket) 916 if (s->tlsext_session_ticket) {
930 {
931 OPENSSL_free(s->tlsext_session_ticket); 917 OPENSSL_free(s->tlsext_session_ticket);
932 s->tlsext_session_ticket = NULL; 918 s->tlsext_session_ticket = NULL;
933 } 919 }
934 920
935 s->tlsext_session_ticket = OPENSSL_malloc(sizeof(TLS_SESSION_TICKET_EXT) + ext_len); 921 s->tlsext_session_ticket = OPENSSL_malloc(sizeof(TLS_SESSION_TICKET_EXT) + ext_len);
936 if (!s->tlsext_session_ticket) 922 if (!s->tlsext_session_ticket) {
937 {
938 SSLerr(SSL_F_SSL_SET_SESSION_TICKET_EXT, ERR_R_MALLOC_FAILURE); 923 SSLerr(SSL_F_SSL_SET_SESSION_TICKET_EXT, ERR_R_MALLOC_FAILURE);
939 return 0; 924 return 0;
940 } 925 }
941 926
942 if (ext_data) 927 if (ext_data) {
943 {
944 s->tlsext_session_ticket->length = ext_len; 928 s->tlsext_session_ticket->length = ext_len;
945 s->tlsext_session_ticket->data = s->tlsext_session_ticket + 1; 929 s->tlsext_session_ticket->data = s->tlsext_session_ticket + 1;
946 memcpy(s->tlsext_session_ticket->data, ext_data, ext_len); 930 memcpy(s->tlsext_session_ticket->data, ext_data, ext_len);
947 } 931 } else {
948 else
949 {
950 s->tlsext_session_ticket->length = 0; 932 s->tlsext_session_ticket->length = 0;
951 s->tlsext_session_ticket->data = NULL; 933 s->tlsext_session_ticket->data = NULL;
952 } 934 }
953 935
954 return 1; 936 return 1;
955 } 937 }
956 938
957 return 0; 939 return 0;
958 } 940}
959#endif /* OPENSSL_NO_TLSEXT */ 941#endif /* OPENSSL_NO_TLSEXT */
960 942
961typedef struct timeout_param_st 943typedef struct timeout_param_st {
962 {
963 SSL_CTX *ctx; 944 SSL_CTX *ctx;
964 long time; 945 long time;
965 LHASH_OF(SSL_SESSION) *cache; 946 LHASH_OF(SSL_SESSION) *cache;
966 } TIMEOUT_PARAM; 947} TIMEOUT_PARAM;
967 948
968static void timeout_doall_arg(SSL_SESSION *s, TIMEOUT_PARAM *p) 949static void
969 { 950timeout_doall_arg(SSL_SESSION *s, TIMEOUT_PARAM *p)
951{
970 if ((p->time == 0) || (p->time > (s->time+s->timeout))) /* timeout */ 952 if ((p->time == 0) || (p->time > (s->time+s->timeout))) /* timeout */
971 { 953 {
972 /* The reason we don't call SSL_CTX_remove_session() is to 954 /* The reason we don't call SSL_CTX_remove_session() is to
973 * save on locking overhead */ 955 * save on locking overhead */
974 (void)lh_SSL_SESSION_delete(p->cache,s); 956 (void)lh_SSL_SESSION_delete(p->cache, s);
975 SSL_SESSION_list_remove(p->ctx,s); 957 SSL_SESSION_list_remove(p->ctx, s);
976 s->not_resumable=1; 958 s->not_resumable = 1;
977 if (p->ctx->remove_session_cb != NULL) 959 if (p->ctx->remove_session_cb != NULL)
978 p->ctx->remove_session_cb(p->ctx,s); 960 p->ctx->remove_session_cb(p->ctx, s);
979 SSL_SESSION_free(s); 961 SSL_SESSION_free(s);
980 }
981 } 962 }
963}
982 964
983static IMPLEMENT_LHASH_DOALL_ARG_FN(timeout, SSL_SESSION, TIMEOUT_PARAM) 965static
966IMPLEMENT_LHASH_DOALL_ARG_FN(timeout, SSL_SESSION, TIMEOUT_PARAM)
984 967
985void SSL_CTX_flush_sessions(SSL_CTX *s, long t) 968void
986 { 969SSL_CTX_flush_sessions(SSL_CTX *s, long t)
970{
987 unsigned long i; 971 unsigned long i;
988 TIMEOUT_PARAM tp; 972 TIMEOUT_PARAM tp;
989 973
990 tp.ctx=s; 974 tp.ctx = s;
991 tp.cache=s->sessions; 975 tp.cache = s->sessions;
992 if (tp.cache == NULL) return; 976 if (tp.cache == NULL)
993 tp.time=t; 977 return;
978 tp.time = t;
994 CRYPTO_w_lock(CRYPTO_LOCK_SSL_CTX); 979 CRYPTO_w_lock(CRYPTO_LOCK_SSL_CTX);
995 i=CHECKED_LHASH_OF(SSL_SESSION, tp.cache)->down_load; 980 i = CHECKED_LHASH_OF(SSL_SESSION, tp.cache)->down_load;
996 CHECKED_LHASH_OF(SSL_SESSION, tp.cache)->down_load=0; 981 CHECKED_LHASH_OF(SSL_SESSION, tp.cache)->down_load = 0;
997 lh_SSL_SESSION_doall_arg(tp.cache, LHASH_DOALL_ARG_FN(timeout), 982 lh_SSL_SESSION_doall_arg(tp.cache, LHASH_DOALL_ARG_FN(timeout),
998 TIMEOUT_PARAM, &tp); 983 TIMEOUT_PARAM, &tp);
999 CHECKED_LHASH_OF(SSL_SESSION, tp.cache)->down_load=i; 984 CHECKED_LHASH_OF(SSL_SESSION, tp.cache)->down_load = i;
1000 CRYPTO_w_unlock(CRYPTO_LOCK_SSL_CTX); 985 CRYPTO_w_unlock(CRYPTO_LOCK_SSL_CTX);
1001 } 986}
1002 987
1003int ssl_clear_bad_session(SSL *s) 988int
1004 { 989ssl_clear_bad_session(SSL *s)
1005 if ( (s->session != NULL) && 990{
991 if ((s->session != NULL) &&
1006 !(s->shutdown & SSL_SENT_SHUTDOWN) && 992 !(s->shutdown & SSL_SENT_SHUTDOWN) &&
1007 !(SSL_in_init(s) || SSL_in_before(s))) 993 !(SSL_in_init(s) || SSL_in_before(s))) {
1008 { 994 SSL_CTX_remove_session(s->ctx, s->session);
1009 SSL_CTX_remove_session(s->ctx,s->session); 995 return (1);
1010 return(1); 996 } else
1011 } 997 return (0);
1012 else 998}
1013 return(0);
1014 }
1015 999
1016/* locked by SSL_CTX in the calling function */ 1000/* locked by SSL_CTX in the calling function */
1017static void SSL_SESSION_list_remove(SSL_CTX *ctx, SSL_SESSION *s) 1001static void
1018 { 1002SSL_SESSION_list_remove(SSL_CTX *ctx, SSL_SESSION *s)
1019 if ((s->next == NULL) || (s->prev == NULL)) return; 1003{
1004 if ((s->next == NULL)
1005 || (s->prev == NULL)) return;
1020 1006
1021 if (s->next == (SSL_SESSION *)&(ctx->session_cache_tail)) 1007 if (s->next == (SSL_SESSION *)&(ctx->session_cache_tail))
1022 { /* last element in list */ 1008 { /* last element in list */
1023 if (s->prev == (SSL_SESSION *)&(ctx->session_cache_head)) 1009 if (s->prev == (SSL_SESSION *)&(ctx->session_cache_head))
1024 { /* only one element in list */ 1010 { /* only one element in list */
1025 ctx->session_cache_head=NULL; 1011 ctx->session_cache_head = NULL;
1026 ctx->session_cache_tail=NULL; 1012 ctx->session_cache_tail = NULL;
1027 } 1013 } else {
1028 else 1014 ctx->session_cache_tail = s->prev;
1029 { 1015 s->prev->next = (SSL_SESSION *)&(ctx->session_cache_tail);
1030 ctx->session_cache_tail=s->prev;
1031 s->prev->next=(SSL_SESSION *)&(ctx->session_cache_tail);
1032 }
1033 } 1016 }
1034 else 1017 } else {
1035 {
1036 if (s->prev == (SSL_SESSION *)&(ctx->session_cache_head)) 1018 if (s->prev == (SSL_SESSION *)&(ctx->session_cache_head))
1037 { /* first element in list */ 1019 { /* first element in list */
1038 ctx->session_cache_head=s->next; 1020 ctx->session_cache_head = s->next;
1039 s->next->prev=(SSL_SESSION *)&(ctx->session_cache_head); 1021 s->next->prev = (SSL_SESSION *)&(ctx->session_cache_head);
1040 } 1022 } else
1041 else 1023 { /* middle of list */
1042 { /* middle of list */ 1024 s->next->prev = s->prev;
1043 s->next->prev=s->prev; 1025 s->prev->next = s->next;
1044 s->prev->next=s->next;
1045 }
1046 } 1026 }
1047 s->prev=s->next=NULL;
1048 } 1027 }
1028 s->prev = s->next = NULL;
1029}
1049 1030
1050static void SSL_SESSION_list_add(SSL_CTX *ctx, SSL_SESSION *s) 1031static void
1051 { 1032SSL_SESSION_list_add(SSL_CTX *ctx, SSL_SESSION *s)
1033{
1052 if ((s->next != NULL) && (s->prev != NULL)) 1034 if ((s->next != NULL) && (s->prev != NULL))
1053 SSL_SESSION_list_remove(ctx,s); 1035 SSL_SESSION_list_remove(ctx, s);
1054 1036
1055 if (ctx->session_cache_head == NULL) 1037 if (ctx->session_cache_head == NULL) {
1056 { 1038 ctx->session_cache_head = s;
1057 ctx->session_cache_head=s; 1039 ctx->session_cache_tail = s;
1058 ctx->session_cache_tail=s; 1040 s->prev = (SSL_SESSION *)&(ctx->session_cache_head);
1059 s->prev=(SSL_SESSION *)&(ctx->session_cache_head); 1041 s->next = (SSL_SESSION *)&(ctx->session_cache_tail);
1060 s->next=(SSL_SESSION *)&(ctx->session_cache_tail); 1042 } else {
1061 } 1043 s->next = ctx->session_cache_head;
1062 else 1044 s->next->prev = s;
1063 { 1045 s->prev = (SSL_SESSION *)&(ctx->session_cache_head);
1064 s->next=ctx->session_cache_head; 1046 ctx->session_cache_head = s;
1065 s->next->prev=s;
1066 s->prev=(SSL_SESSION *)&(ctx->session_cache_head);
1067 ctx->session_cache_head=s;
1068 }
1069 } 1047 }
1048}
1070 1049
1071void SSL_CTX_sess_set_new_cb(SSL_CTX *ctx, 1050void
1072 int (*cb)(struct ssl_st *ssl,SSL_SESSION *sess)) 1051SSL_CTX_sess_set_new_cb(SSL_CTX *ctx,
1073 { 1052 int (*cb)(struct ssl_st *ssl, SSL_SESSION *sess)) {
1074 ctx->new_session_cb=cb; 1053 ctx->new_session_cb = cb;
1075 } 1054}
1076 1055
1077int (*SSL_CTX_sess_get_new_cb(SSL_CTX *ctx))(SSL *ssl, SSL_SESSION *sess) 1056int (*SSL_CTX_sess_get_new_cb(SSL_CTX *ctx))(SSL *ssl, SSL_SESSION *sess)
1078 { 1057{
1079 return ctx->new_session_cb; 1058 return ctx->new_session_cb;
1080 } 1059}
1081 1060
1082void SSL_CTX_sess_set_remove_cb(SSL_CTX *ctx, 1061void
1083 void (*cb)(SSL_CTX *ctx,SSL_SESSION *sess)) 1062SSL_CTX_sess_set_remove_cb(SSL_CTX *ctx,
1084 { 1063 void (*cb)(SSL_CTX *ctx, SSL_SESSION *sess))
1085 ctx->remove_session_cb=cb; 1064{
1086 } 1065 ctx->remove_session_cb = cb;
1066}
1087 1067
1088void (*SSL_CTX_sess_get_remove_cb(SSL_CTX *ctx))(SSL_CTX * ctx,SSL_SESSION *sess) 1068void (*SSL_CTX_sess_get_remove_cb(SSL_CTX *ctx))(SSL_CTX * ctx, SSL_SESSION *sess)
1089 { 1069{
1090 return ctx->remove_session_cb; 1070 return ctx->remove_session_cb;
1091 } 1071}
1092 1072
1093void SSL_CTX_sess_set_get_cb(SSL_CTX *ctx, 1073void
1094 SSL_SESSION *(*cb)(struct ssl_st *ssl, 1074SSL_CTX_sess_set_get_cb(SSL_CTX *ctx,
1095 unsigned char *data,int len,int *copy)) 1075 SSL_SESSION *(*cb)(struct ssl_st *ssl,
1096 { 1076unsigned char *data, int len, int *copy))
1097 ctx->get_session_cb=cb; 1077{
1098 } 1078 ctx->get_session_cb = cb;
1079}
1099 1080
1100SSL_SESSION * (*SSL_CTX_sess_get_get_cb(SSL_CTX *ctx))(SSL *ssl, 1081SSL_SESSION * (*SSL_CTX_sess_get_get_cb(SSL_CTX *ctx))(SSL *ssl,
1101 unsigned char *data,int len,int *copy) 1082 unsigned char *data, int len, int *copy)
1102 { 1083{
1103 return ctx->get_session_cb; 1084 return ctx->get_session_cb;
1104 } 1085}
1105 1086
1106void SSL_CTX_set_info_callback(SSL_CTX *ctx, 1087void
1107 void (*cb)(const SSL *ssl,int type,int val)) 1088SSL_CTX_set_info_callback(SSL_CTX *ctx,
1108 { 1089 void (*cb)(const SSL *ssl, int type, int val))
1109 ctx->info_callback=cb; 1090{
1110 } 1091 ctx->info_callback = cb;
1092}
1111 1093
1112void (*SSL_CTX_get_info_callback(SSL_CTX *ctx))(const SSL *ssl,int type,int val) 1094void (*SSL_CTX_get_info_callback(SSL_CTX *ctx))(const SSL *ssl, int type, int val)
1113 { 1095{
1114 return ctx->info_callback; 1096 return ctx->info_callback;
1115 } 1097}
1116 1098
1117void SSL_CTX_set_client_cert_cb(SSL_CTX *ctx, 1099void
1118 int (*cb)(SSL *ssl, X509 **x509, EVP_PKEY **pkey)) 1100SSL_CTX_set_client_cert_cb(SSL_CTX *ctx,
1119 { 1101 int (*cb)(SSL *ssl, X509 **x509, EVP_PKEY **pkey))
1120 ctx->client_cert_cb=cb; 1102{
1121 } 1103 ctx->client_cert_cb = cb;
1104}
1122 1105
1123int (*SSL_CTX_get_client_cert_cb(SSL_CTX *ctx))(SSL * ssl, X509 ** x509 , EVP_PKEY **pkey) 1106int (*SSL_CTX_get_client_cert_cb(SSL_CTX *ctx))(SSL * ssl, X509 ** x509 , EVP_PKEY **pkey)
1124 { 1107{
1125 return ctx->client_cert_cb; 1108 return ctx->client_cert_cb;
1126 } 1109}
1127 1110
1128#ifndef OPENSSL_NO_ENGINE 1111#ifndef OPENSSL_NO_ENGINE
1129int SSL_CTX_set_client_cert_engine(SSL_CTX *ctx, ENGINE *e) 1112int
1130 { 1113SSL_CTX_set_client_cert_engine(SSL_CTX *ctx, ENGINE *e)
1131 if (!ENGINE_init(e)) 1114{
1132 { 1115 if (!ENGINE_init(e)) {
1133 SSLerr(SSL_F_SSL_CTX_SET_CLIENT_CERT_ENGINE, ERR_R_ENGINE_LIB); 1116 SSLerr(SSL_F_SSL_CTX_SET_CLIENT_CERT_ENGINE, ERR_R_ENGINE_LIB);
1134 return 0; 1117 return 0;
1135 } 1118 }
1136 if(!ENGINE_get_ssl_client_cert_function(e)) 1119 if (!ENGINE_get_ssl_client_cert_function(e)) {
1137 {
1138 SSLerr(SSL_F_SSL_CTX_SET_CLIENT_CERT_ENGINE, SSL_R_NO_CLIENT_CERT_METHOD); 1120 SSLerr(SSL_F_SSL_CTX_SET_CLIENT_CERT_ENGINE, SSL_R_NO_CLIENT_CERT_METHOD);
1139 ENGINE_finish(e); 1121 ENGINE_finish(e);
1140 return 0; 1122 return 0;
1141 } 1123 }
1142 ctx->client_cert_engine = e; 1124 ctx->client_cert_engine = e;
1143 return 1; 1125 return 1;
1144 } 1126}
1145#endif 1127#endif
1146 1128
1147void SSL_CTX_set_cookie_generate_cb(SSL_CTX *ctx, 1129void
1148 int (*cb)(SSL *ssl, unsigned char *cookie, unsigned int *cookie_len)) 1130SSL_CTX_set_cookie_generate_cb(SSL_CTX *ctx,
1149 { 1131 int (*cb)(SSL *ssl, unsigned char *cookie, unsigned int *cookie_len))
1150 ctx->app_gen_cookie_cb=cb; 1132{
1151 } 1133 ctx->app_gen_cookie_cb = cb;
1134}
1152 1135
1153void SSL_CTX_set_cookie_verify_cb(SSL_CTX *ctx, 1136void
1154 int (*cb)(SSL *ssl, unsigned char *cookie, unsigned int cookie_len)) 1137SSL_CTX_set_cookie_verify_cb(SSL_CTX *ctx,
1155 { 1138 int (*cb)(SSL *ssl, unsigned char *cookie, unsigned int cookie_len))
1156 ctx->app_verify_cookie_cb=cb; 1139{
1157 } 1140 ctx->app_verify_cookie_cb = cb;
1141}
1158 1142
1159IMPLEMENT_PEM_rw(SSL_SESSION, SSL_SESSION, PEM_STRING_SSL_SESSION, SSL_SESSION) 1143IMPLEMENT_PEM_rw(SSL_SESSION, SSL_SESSION, PEM_STRING_SSL_SESSION, SSL_SESSION)
diff --git a/src/lib/libssl/src/ssl/ssl_stat.c b/src/lib/libssl/src/ssl/ssl_stat.c
index 144b81e55f..3d9371cdd7 100644
--- a/src/lib/libssl/src/ssl/ssl_stat.c
+++ b/src/lib/libssl/src/ssl/ssl_stat.c
@@ -85,311 +85,533 @@
85#include <stdio.h> 85#include <stdio.h>
86#include "ssl_locl.h" 86#include "ssl_locl.h"
87 87
88const char *SSL_state_string_long(const SSL *s) 88const char
89 { 89*SSL_state_string_long(const SSL *s)
90{
90 const char *str; 91 const char *str;
91 92
92 switch (s->state) 93 switch (s->state) {
93 { 94 case SSL_ST_BEFORE:
94case SSL_ST_BEFORE: str="before SSL initialization"; break; 95 str="before SSL initialization"; break;
95case SSL_ST_ACCEPT: str="before accept initialization"; break; 96 case SSL_ST_ACCEPT:
96case SSL_ST_CONNECT: str="before connect initialization"; break; 97 str="before accept initialization"; break;
97case SSL_ST_OK: str="SSL negotiation finished successfully"; break; 98 case SSL_ST_CONNECT:
98case SSL_ST_RENEGOTIATE: str="SSL renegotiate ciphers"; break; 99 str="before connect initialization"; break;
99case SSL_ST_BEFORE|SSL_ST_CONNECT: str="before/connect initialization"; break; 100 case SSL_ST_OK:
100case SSL_ST_OK|SSL_ST_CONNECT: str="ok/connect SSL initialization"; break; 101 str="SSL negotiation finished successfully"; break;
101case SSL_ST_BEFORE|SSL_ST_ACCEPT: str="before/accept initialization"; break; 102 case SSL_ST_RENEGOTIATE:
102case SSL_ST_OK|SSL_ST_ACCEPT: str="ok/accept SSL initialization"; break; 103 str="SSL renegotiate ciphers"; break;
104 case SSL_ST_BEFORE|SSL_ST_CONNECT:
105 str="before/connect initialization"; break;
106 case SSL_ST_OK|SSL_ST_CONNECT:
107 str="ok/connect SSL initialization"; break;
108 case SSL_ST_BEFORE|SSL_ST_ACCEPT:
109 str="before/accept initialization"; break;
110 case SSL_ST_OK|SSL_ST_ACCEPT:
111 str="ok/accept SSL initialization"; break;
103#ifndef OPENSSL_NO_SSL2 112#ifndef OPENSSL_NO_SSL2
104case SSL2_ST_CLIENT_START_ENCRYPTION: str="SSLv2 client start encryption"; break; 113 case SSL2_ST_CLIENT_START_ENCRYPTION:
105case SSL2_ST_SERVER_START_ENCRYPTION: str="SSLv2 server start encryption"; break; 114 str="SSLv2 client start encryption"; break;
106case SSL2_ST_SEND_CLIENT_HELLO_A: str="SSLv2 write client hello A"; break; 115 case SSL2_ST_SERVER_START_ENCRYPTION:
107case SSL2_ST_SEND_CLIENT_HELLO_B: str="SSLv2 write client hello B"; break; 116 str="SSLv2 server start encryption"; break;
108case SSL2_ST_GET_SERVER_HELLO_A: str="SSLv2 read server hello A"; break; 117 case SSL2_ST_SEND_CLIENT_HELLO_A:
109case SSL2_ST_GET_SERVER_HELLO_B: str="SSLv2 read server hello B"; break; 118 str="SSLv2 write client hello A"; break;
110case SSL2_ST_SEND_CLIENT_MASTER_KEY_A: str="SSLv2 write client master key A"; break; 119 case SSL2_ST_SEND_CLIENT_HELLO_B:
111case SSL2_ST_SEND_CLIENT_MASTER_KEY_B: str="SSLv2 write client master key B"; break; 120 str="SSLv2 write client hello B"; break;
112case SSL2_ST_SEND_CLIENT_FINISHED_A: str="SSLv2 write client finished A"; break; 121 case SSL2_ST_GET_SERVER_HELLO_A:
113case SSL2_ST_SEND_CLIENT_FINISHED_B: str="SSLv2 write client finished B"; break; 122 str="SSLv2 read server hello A"; break;
114case SSL2_ST_SEND_CLIENT_CERTIFICATE_A: str="SSLv2 write client certificate A"; break; 123 case SSL2_ST_GET_SERVER_HELLO_B:
115case SSL2_ST_SEND_CLIENT_CERTIFICATE_B: str="SSLv2 write client certificate B"; break; 124 str="SSLv2 read server hello B"; break;
116case SSL2_ST_SEND_CLIENT_CERTIFICATE_C: str="SSLv2 write client certificate C"; break; 125 case SSL2_ST_SEND_CLIENT_MASTER_KEY_A:
117case SSL2_ST_SEND_CLIENT_CERTIFICATE_D: str="SSLv2 write client certificate D"; break; 126 str="SSLv2 write client master key A"; break;
118case SSL2_ST_GET_SERVER_VERIFY_A: str="SSLv2 read server verify A"; break; 127 case SSL2_ST_SEND_CLIENT_MASTER_KEY_B:
119case SSL2_ST_GET_SERVER_VERIFY_B: str="SSLv2 read server verify B"; break; 128 str="SSLv2 write client master key B"; break;
120case SSL2_ST_GET_SERVER_FINISHED_A: str="SSLv2 read server finished A"; break; 129 case SSL2_ST_SEND_CLIENT_FINISHED_A:
121case SSL2_ST_GET_SERVER_FINISHED_B: str="SSLv2 read server finished B"; break; 130 str="SSLv2 write client finished A"; break;
122case SSL2_ST_GET_CLIENT_HELLO_A: str="SSLv2 read client hello A"; break; 131 case SSL2_ST_SEND_CLIENT_FINISHED_B:
123case SSL2_ST_GET_CLIENT_HELLO_B: str="SSLv2 read client hello B"; break; 132 str="SSLv2 write client finished B"; break;
124case SSL2_ST_GET_CLIENT_HELLO_C: str="SSLv2 read client hello C"; break; 133 case SSL2_ST_SEND_CLIENT_CERTIFICATE_A:
125case SSL2_ST_SEND_SERVER_HELLO_A: str="SSLv2 write server hello A"; break; 134 str="SSLv2 write client certificate A"; break;
126case SSL2_ST_SEND_SERVER_HELLO_B: str="SSLv2 write server hello B"; break; 135 case SSL2_ST_SEND_CLIENT_CERTIFICATE_B:
127case SSL2_ST_GET_CLIENT_MASTER_KEY_A: str="SSLv2 read client master key A"; break; 136 str="SSLv2 write client certificate B"; break;
128case SSL2_ST_GET_CLIENT_MASTER_KEY_B: str="SSLv2 read client master key B"; break; 137 case SSL2_ST_SEND_CLIENT_CERTIFICATE_C:
129case SSL2_ST_SEND_SERVER_VERIFY_A: str="SSLv2 write server verify A"; break; 138 str="SSLv2 write client certificate C"; break;
130case SSL2_ST_SEND_SERVER_VERIFY_B: str="SSLv2 write server verify B"; break; 139 case SSL2_ST_SEND_CLIENT_CERTIFICATE_D:
131case SSL2_ST_SEND_SERVER_VERIFY_C: str="SSLv2 write server verify C"; break; 140 str="SSLv2 write client certificate D"; break;
132case SSL2_ST_GET_CLIENT_FINISHED_A: str="SSLv2 read client finished A"; break; 141 case SSL2_ST_GET_SERVER_VERIFY_A:
133case SSL2_ST_GET_CLIENT_FINISHED_B: str="SSLv2 read client finished B"; break; 142 str="SSLv2 read server verify A"; break;
134case SSL2_ST_SEND_SERVER_FINISHED_A: str="SSLv2 write server finished A"; break; 143 case SSL2_ST_GET_SERVER_VERIFY_B:
135case SSL2_ST_SEND_SERVER_FINISHED_B: str="SSLv2 write server finished B"; break; 144 str="SSLv2 read server verify B"; break;
136case SSL2_ST_SEND_REQUEST_CERTIFICATE_A: str="SSLv2 write request certificate A"; break; 145 case SSL2_ST_GET_SERVER_FINISHED_A:
137case SSL2_ST_SEND_REQUEST_CERTIFICATE_B: str="SSLv2 write request certificate B"; break; 146 str="SSLv2 read server finished A"; break;
138case SSL2_ST_SEND_REQUEST_CERTIFICATE_C: str="SSLv2 write request certificate C"; break; 147 case SSL2_ST_GET_SERVER_FINISHED_B:
139case SSL2_ST_SEND_REQUEST_CERTIFICATE_D: str="SSLv2 write request certificate D"; break; 148 str="SSLv2 read server finished B"; break;
140case SSL2_ST_X509_GET_SERVER_CERTIFICATE: str="SSLv2 X509 read server certificate"; break; 149 case SSL2_ST_GET_CLIENT_HELLO_A:
141case SSL2_ST_X509_GET_CLIENT_CERTIFICATE: str="SSLv2 X509 read client certificate"; break; 150 str="SSLv2 read client hello A"; break;
151 case SSL2_ST_GET_CLIENT_HELLO_B:
152 str="SSLv2 read client hello B"; break;
153 case SSL2_ST_GET_CLIENT_HELLO_C:
154 str="SSLv2 read client hello C"; break;
155 case SSL2_ST_SEND_SERVER_HELLO_A:
156 str="SSLv2 write server hello A"; break;
157 case SSL2_ST_SEND_SERVER_HELLO_B:
158 str="SSLv2 write server hello B"; break;
159 case SSL2_ST_GET_CLIENT_MASTER_KEY_A:
160 str="SSLv2 read client master key A"; break;
161 case SSL2_ST_GET_CLIENT_MASTER_KEY_B:
162 str="SSLv2 read client master key B"; break;
163 case SSL2_ST_SEND_SERVER_VERIFY_A:
164 str="SSLv2 write server verify A"; break;
165 case SSL2_ST_SEND_SERVER_VERIFY_B:
166 str="SSLv2 write server verify B"; break;
167 case SSL2_ST_SEND_SERVER_VERIFY_C:
168 str="SSLv2 write server verify C"; break;
169 case SSL2_ST_GET_CLIENT_FINISHED_A:
170 str="SSLv2 read client finished A"; break;
171 case SSL2_ST_GET_CLIENT_FINISHED_B:
172 str="SSLv2 read client finished B"; break;
173 case SSL2_ST_SEND_SERVER_FINISHED_A:
174 str="SSLv2 write server finished A"; break;
175 case SSL2_ST_SEND_SERVER_FINISHED_B:
176 str="SSLv2 write server finished B"; break;
177 case SSL2_ST_SEND_REQUEST_CERTIFICATE_A:
178 str="SSLv2 write request certificate A"; break;
179 case SSL2_ST_SEND_REQUEST_CERTIFICATE_B:
180 str="SSLv2 write request certificate B"; break;
181 case SSL2_ST_SEND_REQUEST_CERTIFICATE_C:
182 str="SSLv2 write request certificate C"; break;
183 case SSL2_ST_SEND_REQUEST_CERTIFICATE_D:
184 str="SSLv2 write request certificate D"; break;
185 case SSL2_ST_X509_GET_SERVER_CERTIFICATE:
186 str="SSLv2 X509 read server certificate"; break;
187 case SSL2_ST_X509_GET_CLIENT_CERTIFICATE:
188 str="SSLv2 X509 read client certificate"; break;
142#endif 189#endif
143 190
144#ifndef OPENSSL_NO_SSL3 191#ifndef OPENSSL_NO_SSL3
145/* SSLv3 additions */ 192/* SSLv3 additions */
146case SSL3_ST_CW_CLNT_HELLO_A: str="SSLv3 write client hello A"; break; 193 case SSL3_ST_CW_CLNT_HELLO_A:
147case SSL3_ST_CW_CLNT_HELLO_B: str="SSLv3 write client hello B"; break; 194 str="SSLv3 write client hello A"; break;
148case SSL3_ST_CR_SRVR_HELLO_A: str="SSLv3 read server hello A"; break; 195 case SSL3_ST_CW_CLNT_HELLO_B:
149case SSL3_ST_CR_SRVR_HELLO_B: str="SSLv3 read server hello B"; break; 196 str="SSLv3 write client hello B"; break;
150case SSL3_ST_CR_CERT_A: str="SSLv3 read server certificate A"; break; 197 case SSL3_ST_CR_SRVR_HELLO_A:
151case SSL3_ST_CR_CERT_B: str="SSLv3 read server certificate B"; break; 198 str="SSLv3 read server hello A"; break;
152case SSL3_ST_CR_KEY_EXCH_A: str="SSLv3 read server key exchange A"; break; 199 case SSL3_ST_CR_SRVR_HELLO_B:
153case SSL3_ST_CR_KEY_EXCH_B: str="SSLv3 read server key exchange B"; break; 200 str="SSLv3 read server hello B"; break;
154case SSL3_ST_CR_CERT_REQ_A: str="SSLv3 read server certificate request A"; break; 201 case SSL3_ST_CR_CERT_A:
155case SSL3_ST_CR_CERT_REQ_B: str="SSLv3 read server certificate request B"; break; 202 str="SSLv3 read server certificate A"; break;
156case SSL3_ST_CR_SESSION_TICKET_A: str="SSLv3 read server session ticket A";break; 203 case SSL3_ST_CR_CERT_B:
157case SSL3_ST_CR_SESSION_TICKET_B: str="SSLv3 read server session ticket B";break; 204 str="SSLv3 read server certificate B"; break;
158case SSL3_ST_CR_SRVR_DONE_A: str="SSLv3 read server done A"; break; 205 case SSL3_ST_CR_KEY_EXCH_A:
159case SSL3_ST_CR_SRVR_DONE_B: str="SSLv3 read server done B"; break; 206 str="SSLv3 read server key exchange A"; break;
160case SSL3_ST_CW_CERT_A: str="SSLv3 write client certificate A"; break; 207 case SSL3_ST_CR_KEY_EXCH_B:
161case SSL3_ST_CW_CERT_B: str="SSLv3 write client certificate B"; break; 208 str="SSLv3 read server key exchange B"; break;
162case SSL3_ST_CW_CERT_C: str="SSLv3 write client certificate C"; break; 209 case SSL3_ST_CR_CERT_REQ_A:
163case SSL3_ST_CW_CERT_D: str="SSLv3 write client certificate D"; break; 210 str="SSLv3 read server certificate request A"; break;
164case SSL3_ST_CW_KEY_EXCH_A: str="SSLv3 write client key exchange A"; break; 211 case SSL3_ST_CR_CERT_REQ_B:
165case SSL3_ST_CW_KEY_EXCH_B: str="SSLv3 write client key exchange B"; break; 212 str="SSLv3 read server certificate request B"; break;
166case SSL3_ST_CW_CERT_VRFY_A: str="SSLv3 write certificate verify A"; break; 213 case SSL3_ST_CR_SESSION_TICKET_A:
167case SSL3_ST_CW_CERT_VRFY_B: str="SSLv3 write certificate verify B"; break; 214 str="SSLv3 read server session ticket A";break;
215 case SSL3_ST_CR_SESSION_TICKET_B:
216 str="SSLv3 read server session ticket B";break;
217 case SSL3_ST_CR_SRVR_DONE_A:
218 str="SSLv3 read server done A"; break;
219 case SSL3_ST_CR_SRVR_DONE_B:
220 str="SSLv3 read server done B"; break;
221 case SSL3_ST_CW_CERT_A:
222 str="SSLv3 write client certificate A"; break;
223 case SSL3_ST_CW_CERT_B:
224 str="SSLv3 write client certificate B"; break;
225 case SSL3_ST_CW_CERT_C:
226 str="SSLv3 write client certificate C"; break;
227 case SSL3_ST_CW_CERT_D:
228 str="SSLv3 write client certificate D"; break;
229 case SSL3_ST_CW_KEY_EXCH_A:
230 str="SSLv3 write client key exchange A"; break;
231 case SSL3_ST_CW_KEY_EXCH_B:
232 str="SSLv3 write client key exchange B"; break;
233 case SSL3_ST_CW_CERT_VRFY_A:
234 str="SSLv3 write certificate verify A"; break;
235 case SSL3_ST_CW_CERT_VRFY_B:
236 str="SSLv3 write certificate verify B"; break;
168 237
169case SSL3_ST_CW_CHANGE_A: 238 case SSL3_ST_CW_CHANGE_A:
170case SSL3_ST_SW_CHANGE_A: str="SSLv3 write change cipher spec A"; break; 239 case SSL3_ST_SW_CHANGE_A:
171case SSL3_ST_CW_CHANGE_B: 240 str="SSLv3 write change cipher spec A"; break;
172case SSL3_ST_SW_CHANGE_B: str="SSLv3 write change cipher spec B"; break; 241 case SSL3_ST_CW_CHANGE_B:
173case SSL3_ST_CW_FINISHED_A: 242 case SSL3_ST_SW_CHANGE_B:
174case SSL3_ST_SW_FINISHED_A: str="SSLv3 write finished A"; break; 243 str="SSLv3 write change cipher spec B"; break;
175case SSL3_ST_CW_FINISHED_B: 244 case SSL3_ST_CW_FINISHED_A:
176case SSL3_ST_SW_FINISHED_B: str="SSLv3 write finished B"; break; 245 case SSL3_ST_SW_FINISHED_A:
177case SSL3_ST_CR_CHANGE_A: 246 str="SSLv3 write finished A"; break;
178case SSL3_ST_SR_CHANGE_A: str="SSLv3 read change cipher spec A"; break; 247 case SSL3_ST_CW_FINISHED_B:
179case SSL3_ST_CR_CHANGE_B: 248 case SSL3_ST_SW_FINISHED_B:
180case SSL3_ST_SR_CHANGE_B: str="SSLv3 read change cipher spec B"; break; 249 str="SSLv3 write finished B"; break;
181case SSL3_ST_CR_FINISHED_A: 250 case SSL3_ST_CR_CHANGE_A:
182case SSL3_ST_SR_FINISHED_A: str="SSLv3 read finished A"; break; 251 case SSL3_ST_SR_CHANGE_A:
183case SSL3_ST_CR_FINISHED_B: 252 str="SSLv3 read change cipher spec A"; break;
184case SSL3_ST_SR_FINISHED_B: str="SSLv3 read finished B"; break; 253 case SSL3_ST_CR_CHANGE_B:
254 case SSL3_ST_SR_CHANGE_B:
255 str="SSLv3 read change cipher spec B"; break;
256 case SSL3_ST_CR_FINISHED_A:
257 case SSL3_ST_SR_FINISHED_A:
258 str="SSLv3 read finished A"; break;
259 case SSL3_ST_CR_FINISHED_B:
260 case SSL3_ST_SR_FINISHED_B:
261 str="SSLv3 read finished B"; break;
185 262
186case SSL3_ST_CW_FLUSH: 263 case SSL3_ST_CW_FLUSH:
187case SSL3_ST_SW_FLUSH: str="SSLv3 flush data"; break; 264 case SSL3_ST_SW_FLUSH:
265 str="SSLv3 flush data"; break;
188 266
189case SSL3_ST_SR_CLNT_HELLO_A: str="SSLv3 read client hello A"; break; 267 case SSL3_ST_SR_CLNT_HELLO_A:
190case SSL3_ST_SR_CLNT_HELLO_B: str="SSLv3 read client hello B"; break; 268 str="SSLv3 read client hello A"; break;
191case SSL3_ST_SR_CLNT_HELLO_C: str="SSLv3 read client hello C"; break; 269 case SSL3_ST_SR_CLNT_HELLO_B:
192case SSL3_ST_SW_HELLO_REQ_A: str="SSLv3 write hello request A"; break; 270 str="SSLv3 read client hello B"; break;
193case SSL3_ST_SW_HELLO_REQ_B: str="SSLv3 write hello request B"; break; 271 case SSL3_ST_SR_CLNT_HELLO_C:
194case SSL3_ST_SW_HELLO_REQ_C: str="SSLv3 write hello request C"; break; 272 str="SSLv3 read client hello C"; break;
195case SSL3_ST_SW_SRVR_HELLO_A: str="SSLv3 write server hello A"; break; 273 case SSL3_ST_SW_HELLO_REQ_A:
196case SSL3_ST_SW_SRVR_HELLO_B: str="SSLv3 write server hello B"; break; 274 str="SSLv3 write hello request A"; break;
197case SSL3_ST_SW_CERT_A: str="SSLv3 write certificate A"; break; 275 case SSL3_ST_SW_HELLO_REQ_B:
198case SSL3_ST_SW_CERT_B: str="SSLv3 write certificate B"; break; 276 str="SSLv3 write hello request B"; break;
199case SSL3_ST_SW_KEY_EXCH_A: str="SSLv3 write key exchange A"; break; 277 case SSL3_ST_SW_HELLO_REQ_C:
200case SSL3_ST_SW_KEY_EXCH_B: str="SSLv3 write key exchange B"; break; 278 str="SSLv3 write hello request C"; break;
201case SSL3_ST_SW_CERT_REQ_A: str="SSLv3 write certificate request A"; break; 279 case SSL3_ST_SW_SRVR_HELLO_A:
202case SSL3_ST_SW_CERT_REQ_B: str="SSLv3 write certificate request B"; break; 280 str="SSLv3 write server hello A"; break;
203case SSL3_ST_SW_SESSION_TICKET_A: str="SSLv3 write session ticket A"; break; 281 case SSL3_ST_SW_SRVR_HELLO_B:
204case SSL3_ST_SW_SESSION_TICKET_B: str="SSLv3 write session ticket B"; break; 282 str="SSLv3 write server hello B"; break;
205case SSL3_ST_SW_SRVR_DONE_A: str="SSLv3 write server done A"; break; 283 case SSL3_ST_SW_CERT_A:
206case SSL3_ST_SW_SRVR_DONE_B: str="SSLv3 write server done B"; break; 284 str="SSLv3 write certificate A"; break;
207case SSL3_ST_SR_CERT_A: str="SSLv3 read client certificate A"; break; 285 case SSL3_ST_SW_CERT_B:
208case SSL3_ST_SR_CERT_B: str="SSLv3 read client certificate B"; break; 286 str="SSLv3 write certificate B"; break;
209case SSL3_ST_SR_KEY_EXCH_A: str="SSLv3 read client key exchange A"; break; 287 case SSL3_ST_SW_KEY_EXCH_A:
210case SSL3_ST_SR_KEY_EXCH_B: str="SSLv3 read client key exchange B"; break; 288 str="SSLv3 write key exchange A"; break;
211case SSL3_ST_SR_CERT_VRFY_A: str="SSLv3 read certificate verify A"; break; 289 case SSL3_ST_SW_KEY_EXCH_B:
212case SSL3_ST_SR_CERT_VRFY_B: str="SSLv3 read certificate verify B"; break; 290 str="SSLv3 write key exchange B"; break;
291 case SSL3_ST_SW_CERT_REQ_A:
292 str="SSLv3 write certificate request A"; break;
293 case SSL3_ST_SW_CERT_REQ_B:
294 str="SSLv3 write certificate request B"; break;
295 case SSL3_ST_SW_SESSION_TICKET_A:
296 str="SSLv3 write session ticket A"; break;
297 case SSL3_ST_SW_SESSION_TICKET_B:
298 str="SSLv3 write session ticket B"; break;
299 case SSL3_ST_SW_SRVR_DONE_A:
300 str="SSLv3 write server done A"; break;
301 case SSL3_ST_SW_SRVR_DONE_B:
302 str="SSLv3 write server done B"; break;
303 case SSL3_ST_SR_CERT_A:
304 str="SSLv3 read client certificate A"; break;
305 case SSL3_ST_SR_CERT_B:
306 str="SSLv3 read client certificate B"; break;
307 case SSL3_ST_SR_KEY_EXCH_A:
308 str="SSLv3 read client key exchange A"; break;
309 case SSL3_ST_SR_KEY_EXCH_B:
310 str="SSLv3 read client key exchange B"; break;
311 case SSL3_ST_SR_CERT_VRFY_A:
312 str="SSLv3 read certificate verify A"; break;
313 case SSL3_ST_SR_CERT_VRFY_B:
314 str="SSLv3 read certificate verify B"; break;
213#endif 315#endif
214 316
215#if !defined(OPENSSL_NO_SSL2) && !defined(OPENSSL_NO_SSL3) 317#if !defined(OPENSSL_NO_SSL2) && !defined(OPENSSL_NO_SSL3)
216/* SSLv2/v3 compatibility states */ 318/* SSLv2/v3 compatibility states */
217/* client */ 319/* client */
218case SSL23_ST_CW_CLNT_HELLO_A: str="SSLv2/v3 write client hello A"; break; 320 case SSL23_ST_CW_CLNT_HELLO_A:
219case SSL23_ST_CW_CLNT_HELLO_B: str="SSLv2/v3 write client hello B"; break; 321 str="SSLv2/v3 write client hello A"; break;
220case SSL23_ST_CR_SRVR_HELLO_A: str="SSLv2/v3 read server hello A"; break; 322 case SSL23_ST_CW_CLNT_HELLO_B:
221case SSL23_ST_CR_SRVR_HELLO_B: str="SSLv2/v3 read server hello B"; break; 323 str="SSLv2/v3 write client hello B"; break;
324 case SSL23_ST_CR_SRVR_HELLO_A:
325 str="SSLv2/v3 read server hello A"; break;
326 case SSL23_ST_CR_SRVR_HELLO_B:
327 str="SSLv2/v3 read server hello B"; break;
222/* server */ 328/* server */
223case SSL23_ST_SR_CLNT_HELLO_A: str="SSLv2/v3 read client hello A"; break; 329 case SSL23_ST_SR_CLNT_HELLO_A:
224case SSL23_ST_SR_CLNT_HELLO_B: str="SSLv2/v3 read client hello B"; break; 330 str="SSLv2/v3 read client hello A"; break;
331 case SSL23_ST_SR_CLNT_HELLO_B:
332 str="SSLv2/v3 read client hello B"; break;
225#endif 333#endif
226 334
227/* DTLS */ 335/* DTLS */
228case DTLS1_ST_CR_HELLO_VERIFY_REQUEST_A: str="DTLS1 read hello verify request A"; break; 336 case DTLS1_ST_CR_HELLO_VERIFY_REQUEST_A:
229case DTLS1_ST_CR_HELLO_VERIFY_REQUEST_B: str="DTLS1 read hello verify request B"; break; 337 str="DTLS1 read hello verify request A"; break;
230case DTLS1_ST_SW_HELLO_VERIFY_REQUEST_A: str="DTLS1 write hello verify request A"; break; 338 case DTLS1_ST_CR_HELLO_VERIFY_REQUEST_B:
231case DTLS1_ST_SW_HELLO_VERIFY_REQUEST_B: str="DTLS1 write hello verify request B"; break; 339 str="DTLS1 read hello verify request B"; break;
340 case DTLS1_ST_SW_HELLO_VERIFY_REQUEST_A:
341 str="DTLS1 write hello verify request A"; break;
342 case DTLS1_ST_SW_HELLO_VERIFY_REQUEST_B:
343 str="DTLS1 write hello verify request B"; break;
232 344
233default: str="unknown state"; break; 345 default:
234 } 346 str="unknown state"; break;
235 return(str);
236 } 347 }
348 return (str);
349}
237 350
238const char *SSL_rstate_string_long(const SSL *s) 351const char
239 { 352*SSL_rstate_string_long(const SSL *s)
353{
240 const char *str; 354 const char *str;
241 355
242 switch (s->rstate) 356 switch (s->rstate) {
243 { 357 case SSL_ST_READ_HEADER:
244 case SSL_ST_READ_HEADER: str="read header"; break; 358 str="read header"; break;
245 case SSL_ST_READ_BODY: str="read body"; break; 359 case SSL_ST_READ_BODY:
246 case SSL_ST_READ_DONE: str="read done"; break; 360 str="read body"; break;
247 default: str="unknown"; break; 361 case SSL_ST_READ_DONE:
248 } 362 str="read done"; break;
249 return(str); 363 default:
364 str="unknown"; break;
250 } 365 }
366 return (str);
367}
251 368
252const char *SSL_state_string(const SSL *s) 369const char
253 { 370*SSL_state_string(const SSL *s)
371{
254 const char *str; 372 const char *str;
255 373
256 switch (s->state) 374 switch (s->state) {
257 { 375 case SSL_ST_BEFORE:
258case SSL_ST_BEFORE: str="PINIT "; break; 376 str="PINIT "; break;
259case SSL_ST_ACCEPT: str="AINIT "; break; 377 case SSL_ST_ACCEPT:
260case SSL_ST_CONNECT: str="CINIT "; break; 378 str="AINIT "; break;
261case SSL_ST_OK: str="SSLOK "; break; 379 case SSL_ST_CONNECT:
380 str="CINIT "; break;
381 case SSL_ST_OK:
382 str="SSLOK "; break;
262#ifndef OPENSSL_NO_SSL2 383#ifndef OPENSSL_NO_SSL2
263case SSL2_ST_CLIENT_START_ENCRYPTION: str="2CSENC"; break; 384 case SSL2_ST_CLIENT_START_ENCRYPTION:
264case SSL2_ST_SERVER_START_ENCRYPTION: str="2SSENC"; break; 385 str="2CSENC"; break;
265case SSL2_ST_SEND_CLIENT_HELLO_A: str="2SCH_A"; break; 386 case SSL2_ST_SERVER_START_ENCRYPTION:
266case SSL2_ST_SEND_CLIENT_HELLO_B: str="2SCH_B"; break; 387 str="2SSENC"; break;
267case SSL2_ST_GET_SERVER_HELLO_A: str="2GSH_A"; break; 388 case SSL2_ST_SEND_CLIENT_HELLO_A:
268case SSL2_ST_GET_SERVER_HELLO_B: str="2GSH_B"; break; 389 str="2SCH_A"; break;
269case SSL2_ST_SEND_CLIENT_MASTER_KEY_A: str="2SCMKA"; break; 390 case SSL2_ST_SEND_CLIENT_HELLO_B:
270case SSL2_ST_SEND_CLIENT_MASTER_KEY_B: str="2SCMKB"; break; 391 str="2SCH_B"; break;
271case SSL2_ST_SEND_CLIENT_FINISHED_A: str="2SCF_A"; break; 392 case SSL2_ST_GET_SERVER_HELLO_A:
272case SSL2_ST_SEND_CLIENT_FINISHED_B: str="2SCF_B"; break; 393 str="2GSH_A"; break;
273case SSL2_ST_SEND_CLIENT_CERTIFICATE_A: str="2SCC_A"; break; 394 case SSL2_ST_GET_SERVER_HELLO_B:
274case SSL2_ST_SEND_CLIENT_CERTIFICATE_B: str="2SCC_B"; break; 395 str="2GSH_B"; break;
275case SSL2_ST_SEND_CLIENT_CERTIFICATE_C: str="2SCC_C"; break; 396 case SSL2_ST_SEND_CLIENT_MASTER_KEY_A:
276case SSL2_ST_SEND_CLIENT_CERTIFICATE_D: str="2SCC_D"; break; 397 str="2SCMKA"; break;
277case SSL2_ST_GET_SERVER_VERIFY_A: str="2GSV_A"; break; 398 case SSL2_ST_SEND_CLIENT_MASTER_KEY_B:
278case SSL2_ST_GET_SERVER_VERIFY_B: str="2GSV_B"; break; 399 str="2SCMKB"; break;
279case SSL2_ST_GET_SERVER_FINISHED_A: str="2GSF_A"; break; 400 case SSL2_ST_SEND_CLIENT_FINISHED_A:
280case SSL2_ST_GET_SERVER_FINISHED_B: str="2GSF_B"; break; 401 str="2SCF_A"; break;
281case SSL2_ST_GET_CLIENT_HELLO_A: str="2GCH_A"; break; 402 case SSL2_ST_SEND_CLIENT_FINISHED_B:
282case SSL2_ST_GET_CLIENT_HELLO_B: str="2GCH_B"; break; 403 str="2SCF_B"; break;
283case SSL2_ST_GET_CLIENT_HELLO_C: str="2GCH_C"; break; 404 case SSL2_ST_SEND_CLIENT_CERTIFICATE_A:
284case SSL2_ST_SEND_SERVER_HELLO_A: str="2SSH_A"; break; 405 str="2SCC_A"; break;
285case SSL2_ST_SEND_SERVER_HELLO_B: str="2SSH_B"; break; 406 case SSL2_ST_SEND_CLIENT_CERTIFICATE_B:
286case SSL2_ST_GET_CLIENT_MASTER_KEY_A: str="2GCMKA"; break; 407 str="2SCC_B"; break;
287case SSL2_ST_GET_CLIENT_MASTER_KEY_B: str="2GCMKA"; break; 408 case SSL2_ST_SEND_CLIENT_CERTIFICATE_C:
288case SSL2_ST_SEND_SERVER_VERIFY_A: str="2SSV_A"; break; 409 str="2SCC_C"; break;
289case SSL2_ST_SEND_SERVER_VERIFY_B: str="2SSV_B"; break; 410 case SSL2_ST_SEND_CLIENT_CERTIFICATE_D:
290case SSL2_ST_SEND_SERVER_VERIFY_C: str="2SSV_C"; break; 411 str="2SCC_D"; break;
291case SSL2_ST_GET_CLIENT_FINISHED_A: str="2GCF_A"; break; 412 case SSL2_ST_GET_SERVER_VERIFY_A:
292case SSL2_ST_GET_CLIENT_FINISHED_B: str="2GCF_B"; break; 413 str="2GSV_A"; break;
293case SSL2_ST_SEND_SERVER_FINISHED_A: str="2SSF_A"; break; 414 case SSL2_ST_GET_SERVER_VERIFY_B:
294case SSL2_ST_SEND_SERVER_FINISHED_B: str="2SSF_B"; break; 415 str="2GSV_B"; break;
295case SSL2_ST_SEND_REQUEST_CERTIFICATE_A: str="2SRC_A"; break; 416 case SSL2_ST_GET_SERVER_FINISHED_A:
296case SSL2_ST_SEND_REQUEST_CERTIFICATE_B: str="2SRC_B"; break; 417 str="2GSF_A"; break;
297case SSL2_ST_SEND_REQUEST_CERTIFICATE_C: str="2SRC_C"; break; 418 case SSL2_ST_GET_SERVER_FINISHED_B:
298case SSL2_ST_SEND_REQUEST_CERTIFICATE_D: str="2SRC_D"; break; 419 str="2GSF_B"; break;
299case SSL2_ST_X509_GET_SERVER_CERTIFICATE: str="2X9GSC"; break; 420 case SSL2_ST_GET_CLIENT_HELLO_A:
300case SSL2_ST_X509_GET_CLIENT_CERTIFICATE: str="2X9GCC"; break; 421 str="2GCH_A"; break;
422 case SSL2_ST_GET_CLIENT_HELLO_B:
423 str="2GCH_B"; break;
424 case SSL2_ST_GET_CLIENT_HELLO_C:
425 str="2GCH_C"; break;
426 case SSL2_ST_SEND_SERVER_HELLO_A:
427 str="2SSH_A"; break;
428 case SSL2_ST_SEND_SERVER_HELLO_B:
429 str="2SSH_B"; break;
430 case SSL2_ST_GET_CLIENT_MASTER_KEY_A:
431 str="2GCMKA"; break;
432 case SSL2_ST_GET_CLIENT_MASTER_KEY_B:
433 str="2GCMKA"; break;
434 case SSL2_ST_SEND_SERVER_VERIFY_A:
435 str="2SSV_A"; break;
436 case SSL2_ST_SEND_SERVER_VERIFY_B:
437 str="2SSV_B"; break;
438 case SSL2_ST_SEND_SERVER_VERIFY_C:
439 str="2SSV_C"; break;
440 case SSL2_ST_GET_CLIENT_FINISHED_A:
441 str="2GCF_A"; break;
442 case SSL2_ST_GET_CLIENT_FINISHED_B:
443 str="2GCF_B"; break;
444 case SSL2_ST_SEND_SERVER_FINISHED_A:
445 str="2SSF_A"; break;
446 case SSL2_ST_SEND_SERVER_FINISHED_B:
447 str="2SSF_B"; break;
448 case SSL2_ST_SEND_REQUEST_CERTIFICATE_A:
449 str="2SRC_A"; break;
450 case SSL2_ST_SEND_REQUEST_CERTIFICATE_B:
451 str="2SRC_B"; break;
452 case SSL2_ST_SEND_REQUEST_CERTIFICATE_C:
453 str="2SRC_C"; break;
454 case SSL2_ST_SEND_REQUEST_CERTIFICATE_D:
455 str="2SRC_D"; break;
456 case SSL2_ST_X509_GET_SERVER_CERTIFICATE:
457 str="2X9GSC"; break;
458 case SSL2_ST_X509_GET_CLIENT_CERTIFICATE:
459 str="2X9GCC"; break;
301#endif 460#endif
302 461
303#ifndef OPENSSL_NO_SSL3 462#ifndef OPENSSL_NO_SSL3
304/* SSLv3 additions */ 463/* SSLv3 additions */
305case SSL3_ST_SW_FLUSH: 464 case SSL3_ST_SW_FLUSH:
306case SSL3_ST_CW_FLUSH: str="3FLUSH"; break; 465 case SSL3_ST_CW_FLUSH:
307case SSL3_ST_CW_CLNT_HELLO_A: str="3WCH_A"; break; 466 str="3FLUSH"; break;
308case SSL3_ST_CW_CLNT_HELLO_B: str="3WCH_B"; break; 467 case SSL3_ST_CW_CLNT_HELLO_A:
309case SSL3_ST_CR_SRVR_HELLO_A: str="3RSH_A"; break; 468 str="3WCH_A"; break;
310case SSL3_ST_CR_SRVR_HELLO_B: str="3RSH_B"; break; 469 case SSL3_ST_CW_CLNT_HELLO_B:
311case SSL3_ST_CR_CERT_A: str="3RSC_A"; break; 470 str="3WCH_B"; break;
312case SSL3_ST_CR_CERT_B: str="3RSC_B"; break; 471 case SSL3_ST_CR_SRVR_HELLO_A:
313case SSL3_ST_CR_KEY_EXCH_A: str="3RSKEA"; break; 472 str="3RSH_A"; break;
314case SSL3_ST_CR_KEY_EXCH_B: str="3RSKEB"; break; 473 case SSL3_ST_CR_SRVR_HELLO_B:
315case SSL3_ST_CR_CERT_REQ_A: str="3RCR_A"; break; 474 str="3RSH_B"; break;
316case SSL3_ST_CR_CERT_REQ_B: str="3RCR_B"; break; 475 case SSL3_ST_CR_CERT_A:
317case SSL3_ST_CR_SRVR_DONE_A: str="3RSD_A"; break; 476 str="3RSC_A"; break;
318case SSL3_ST_CR_SRVR_DONE_B: str="3RSD_B"; break; 477 case SSL3_ST_CR_CERT_B:
319case SSL3_ST_CW_CERT_A: str="3WCC_A"; break; 478 str="3RSC_B"; break;
320case SSL3_ST_CW_CERT_B: str="3WCC_B"; break; 479 case SSL3_ST_CR_KEY_EXCH_A:
321case SSL3_ST_CW_CERT_C: str="3WCC_C"; break; 480 str="3RSKEA"; break;
322case SSL3_ST_CW_CERT_D: str="3WCC_D"; break; 481 case SSL3_ST_CR_KEY_EXCH_B:
323case SSL3_ST_CW_KEY_EXCH_A: str="3WCKEA"; break; 482 str="3RSKEB"; break;
324case SSL3_ST_CW_KEY_EXCH_B: str="3WCKEB"; break; 483 case SSL3_ST_CR_CERT_REQ_A:
325case SSL3_ST_CW_CERT_VRFY_A: str="3WCV_A"; break; 484 str="3RCR_A"; break;
326case SSL3_ST_CW_CERT_VRFY_B: str="3WCV_B"; break; 485 case SSL3_ST_CR_CERT_REQ_B:
486 str="3RCR_B"; break;
487 case SSL3_ST_CR_SRVR_DONE_A:
488 str="3RSD_A"; break;
489 case SSL3_ST_CR_SRVR_DONE_B:
490 str="3RSD_B"; break;
491 case SSL3_ST_CW_CERT_A:
492 str="3WCC_A"; break;
493 case SSL3_ST_CW_CERT_B:
494 str="3WCC_B"; break;
495 case SSL3_ST_CW_CERT_C:
496 str="3WCC_C"; break;
497 case SSL3_ST_CW_CERT_D:
498 str="3WCC_D"; break;
499 case SSL3_ST_CW_KEY_EXCH_A:
500 str="3WCKEA"; break;
501 case SSL3_ST_CW_KEY_EXCH_B:
502 str="3WCKEB"; break;
503 case SSL3_ST_CW_CERT_VRFY_A:
504 str="3WCV_A"; break;
505 case SSL3_ST_CW_CERT_VRFY_B:
506 str="3WCV_B"; break;
327 507
328case SSL3_ST_SW_CHANGE_A: 508 case SSL3_ST_SW_CHANGE_A:
329case SSL3_ST_CW_CHANGE_A: str="3WCCSA"; break; 509 case SSL3_ST_CW_CHANGE_A:
330case SSL3_ST_SW_CHANGE_B: 510 str="3WCCSA"; break;
331case SSL3_ST_CW_CHANGE_B: str="3WCCSB"; break; 511 case SSL3_ST_SW_CHANGE_B:
332case SSL3_ST_SW_FINISHED_A: 512 case SSL3_ST_CW_CHANGE_B:
333case SSL3_ST_CW_FINISHED_A: str="3WFINA"; break; 513 str="3WCCSB"; break;
334case SSL3_ST_SW_FINISHED_B: 514 case SSL3_ST_SW_FINISHED_A:
335case SSL3_ST_CW_FINISHED_B: str="3WFINB"; break; 515 case SSL3_ST_CW_FINISHED_A:
336case SSL3_ST_SR_CHANGE_A: 516 str="3WFINA"; break;
337case SSL3_ST_CR_CHANGE_A: str="3RCCSA"; break; 517 case SSL3_ST_SW_FINISHED_B:
338case SSL3_ST_SR_CHANGE_B: 518 case SSL3_ST_CW_FINISHED_B:
339case SSL3_ST_CR_CHANGE_B: str="3RCCSB"; break; 519 str="3WFINB"; break;
340case SSL3_ST_SR_FINISHED_A: 520 case SSL3_ST_SR_CHANGE_A:
341case SSL3_ST_CR_FINISHED_A: str="3RFINA"; break; 521 case SSL3_ST_CR_CHANGE_A:
342case SSL3_ST_SR_FINISHED_B: 522 str="3RCCSA"; break;
343case SSL3_ST_CR_FINISHED_B: str="3RFINB"; break; 523 case SSL3_ST_SR_CHANGE_B:
524 case SSL3_ST_CR_CHANGE_B:
525 str="3RCCSB"; break;
526 case SSL3_ST_SR_FINISHED_A:
527 case SSL3_ST_CR_FINISHED_A:
528 str="3RFINA"; break;
529 case SSL3_ST_SR_FINISHED_B:
530 case SSL3_ST_CR_FINISHED_B:
531 str="3RFINB"; break;
344 532
345case SSL3_ST_SW_HELLO_REQ_A: str="3WHR_A"; break; 533 case SSL3_ST_SW_HELLO_REQ_A:
346case SSL3_ST_SW_HELLO_REQ_B: str="3WHR_B"; break; 534 str="3WHR_A"; break;
347case SSL3_ST_SW_HELLO_REQ_C: str="3WHR_C"; break; 535 case SSL3_ST_SW_HELLO_REQ_B:
348case SSL3_ST_SR_CLNT_HELLO_A: str="3RCH_A"; break; 536 str="3WHR_B"; break;
349case SSL3_ST_SR_CLNT_HELLO_B: str="3RCH_B"; break; 537 case SSL3_ST_SW_HELLO_REQ_C:
350case SSL3_ST_SR_CLNT_HELLO_C: str="3RCH_C"; break; 538 str="3WHR_C"; break;
351case SSL3_ST_SW_SRVR_HELLO_A: str="3WSH_A"; break; 539 case SSL3_ST_SR_CLNT_HELLO_A:
352case SSL3_ST_SW_SRVR_HELLO_B: str="3WSH_B"; break; 540 str="3RCH_A"; break;
353case SSL3_ST_SW_CERT_A: str="3WSC_A"; break; 541 case SSL3_ST_SR_CLNT_HELLO_B:
354case SSL3_ST_SW_CERT_B: str="3WSC_B"; break; 542 str="3RCH_B"; break;
355case SSL3_ST_SW_KEY_EXCH_A: str="3WSKEA"; break; 543 case SSL3_ST_SR_CLNT_HELLO_C:
356case SSL3_ST_SW_KEY_EXCH_B: str="3WSKEB"; break; 544 str="3RCH_C"; break;
357case SSL3_ST_SW_CERT_REQ_A: str="3WCR_A"; break; 545 case SSL3_ST_SW_SRVR_HELLO_A:
358case SSL3_ST_SW_CERT_REQ_B: str="3WCR_B"; break; 546 str="3WSH_A"; break;
359case SSL3_ST_SW_SRVR_DONE_A: str="3WSD_A"; break; 547 case SSL3_ST_SW_SRVR_HELLO_B:
360case SSL3_ST_SW_SRVR_DONE_B: str="3WSD_B"; break; 548 str="3WSH_B"; break;
361case SSL3_ST_SR_CERT_A: str="3RCC_A"; break; 549 case SSL3_ST_SW_CERT_A:
362case SSL3_ST_SR_CERT_B: str="3RCC_B"; break; 550 str="3WSC_A"; break;
363case SSL3_ST_SR_KEY_EXCH_A: str="3RCKEA"; break; 551 case SSL3_ST_SW_CERT_B:
364case SSL3_ST_SR_KEY_EXCH_B: str="3RCKEB"; break; 552 str="3WSC_B"; break;
365case SSL3_ST_SR_CERT_VRFY_A: str="3RCV_A"; break; 553 case SSL3_ST_SW_KEY_EXCH_A:
366case SSL3_ST_SR_CERT_VRFY_B: str="3RCV_B"; break; 554 str="3WSKEA"; break;
555 case SSL3_ST_SW_KEY_EXCH_B:
556 str="3WSKEB"; break;
557 case SSL3_ST_SW_CERT_REQ_A:
558 str="3WCR_A"; break;
559 case SSL3_ST_SW_CERT_REQ_B:
560 str="3WCR_B"; break;
561 case SSL3_ST_SW_SRVR_DONE_A:
562 str="3WSD_A"; break;
563 case SSL3_ST_SW_SRVR_DONE_B:
564 str="3WSD_B"; break;
565 case SSL3_ST_SR_CERT_A:
566 str="3RCC_A"; break;
567 case SSL3_ST_SR_CERT_B:
568 str="3RCC_B"; break;
569 case SSL3_ST_SR_KEY_EXCH_A:
570 str="3RCKEA"; break;
571 case SSL3_ST_SR_KEY_EXCH_B:
572 str="3RCKEB"; break;
573 case SSL3_ST_SR_CERT_VRFY_A:
574 str="3RCV_A"; break;
575 case SSL3_ST_SR_CERT_VRFY_B:
576 str="3RCV_B"; break;
367#endif 577#endif
368 578
369#if !defined(OPENSSL_NO_SSL2) && !defined(OPENSSL_NO_SSL3) 579#if !defined(OPENSSL_NO_SSL2) && !defined(OPENSSL_NO_SSL3)
370/* SSLv2/v3 compatibility states */ 580/* SSLv2/v3 compatibility states */
371/* client */ 581/* client */
372case SSL23_ST_CW_CLNT_HELLO_A: str="23WCHA"; break; 582 case SSL23_ST_CW_CLNT_HELLO_A:
373case SSL23_ST_CW_CLNT_HELLO_B: str="23WCHB"; break; 583 str="23WCHA"; break;
374case SSL23_ST_CR_SRVR_HELLO_A: str="23RSHA"; break; 584 case SSL23_ST_CW_CLNT_HELLO_B:
375case SSL23_ST_CR_SRVR_HELLO_B: str="23RSHA"; break; 585 str="23WCHB"; break;
586 case SSL23_ST_CR_SRVR_HELLO_A:
587 str="23RSHA"; break;
588 case SSL23_ST_CR_SRVR_HELLO_B:
589 str="23RSHA"; break;
376/* server */ 590/* server */
377case SSL23_ST_SR_CLNT_HELLO_A: str="23RCHA"; break; 591 case SSL23_ST_SR_CLNT_HELLO_A:
378case SSL23_ST_SR_CLNT_HELLO_B: str="23RCHB"; break; 592 str="23RCHA"; break;
593 case SSL23_ST_SR_CLNT_HELLO_B:
594 str="23RCHB"; break;
379#endif 595#endif
380/* DTLS */ 596/* DTLS */
381case DTLS1_ST_CR_HELLO_VERIFY_REQUEST_A: str="DRCHVA"; break; 597 case DTLS1_ST_CR_HELLO_VERIFY_REQUEST_A:
382case DTLS1_ST_CR_HELLO_VERIFY_REQUEST_B: str="DRCHVB"; break; 598 str="DRCHVA"; break;
383case DTLS1_ST_SW_HELLO_VERIFY_REQUEST_A: str="DWCHVA"; break; 599 case DTLS1_ST_CR_HELLO_VERIFY_REQUEST_B:
384case DTLS1_ST_SW_HELLO_VERIFY_REQUEST_B: str="DWCHVB"; break; 600 str="DRCHVB"; break;
601 case DTLS1_ST_SW_HELLO_VERIFY_REQUEST_A:
602 str="DWCHVA"; break;
603 case DTLS1_ST_SW_HELLO_VERIFY_REQUEST_B:
604 str="DWCHVB"; break;
385 605
386default: str="UNKWN "; break; 606 default:
387 } 607 str="UNKWN "; break;
388 return(str);
389 } 608 }
609 return (str);
610}
390 611
391const char *SSL_alert_type_string_long(int value) 612const char
392 { 613*SSL_alert_type_string_long(int value)
614{
393 value>>=8; 615 value>>=8;
394 if (value == SSL3_AL_WARNING) 616 if (value == SSL3_AL_WARNING)
395 return("warning"); 617 return("warning");
@@ -397,10 +619,11 @@ const char *SSL_alert_type_string_long(int value)
397 return("fatal"); 619 return("fatal");
398 else 620 else
399 return("unknown"); 621 return("unknown");
400 } 622}
401 623
402const char *SSL_alert_type_string(int value) 624const char
403 { 625*SSL_alert_type_string(int value)
626{
404 value>>=8; 627 value>>=8;
405 if (value == SSL3_AL_WARNING) 628 if (value == SSL3_AL_WARNING)
406 return("W"); 629 return("W");
@@ -408,55 +631,86 @@ const char *SSL_alert_type_string(int value)
408 return("F"); 631 return("F");
409 else 632 else
410 return("U"); 633 return("U");
411 } 634}
412 635
413const char *SSL_alert_desc_string(int value) 636const char
414 { 637*SSL_alert_desc_string(int value)
638{
415 const char *str; 639 const char *str;
416 640
417 switch (value & 0xff) 641 switch (value & 0xff) {
418 { 642 case SSL3_AD_CLOSE_NOTIFY:
419 case SSL3_AD_CLOSE_NOTIFY: str="CN"; break; 643 str="CN"; break;
420 case SSL3_AD_UNEXPECTED_MESSAGE: str="UM"; break; 644 case SSL3_AD_UNEXPECTED_MESSAGE:
421 case SSL3_AD_BAD_RECORD_MAC: str="BM"; break; 645 str="UM"; break;
422 case SSL3_AD_DECOMPRESSION_FAILURE: str="DF"; break; 646 case SSL3_AD_BAD_RECORD_MAC:
423 case SSL3_AD_HANDSHAKE_FAILURE: str="HF"; break; 647 str="BM"; break;
424 case SSL3_AD_NO_CERTIFICATE: str="NC"; break; 648 case SSL3_AD_DECOMPRESSION_FAILURE:
425 case SSL3_AD_BAD_CERTIFICATE: str="BC"; break; 649 str="DF"; break;
426 case SSL3_AD_UNSUPPORTED_CERTIFICATE: str="UC"; break; 650 case SSL3_AD_HANDSHAKE_FAILURE:
427 case SSL3_AD_CERTIFICATE_REVOKED: str="CR"; break; 651 str="HF"; break;
428 case SSL3_AD_CERTIFICATE_EXPIRED: str="CE"; break; 652 case SSL3_AD_NO_CERTIFICATE:
429 case SSL3_AD_CERTIFICATE_UNKNOWN: str="CU"; break; 653 str="NC"; break;
430 case SSL3_AD_ILLEGAL_PARAMETER: str="IP"; break; 654 case SSL3_AD_BAD_CERTIFICATE:
431 case TLS1_AD_DECRYPTION_FAILED: str="DC"; break; 655 str="BC"; break;
432 case TLS1_AD_RECORD_OVERFLOW: str="RO"; break; 656 case SSL3_AD_UNSUPPORTED_CERTIFICATE:
433 case TLS1_AD_UNKNOWN_CA: str="CA"; break; 657 str="UC"; break;
434 case TLS1_AD_ACCESS_DENIED: str="AD"; break; 658 case SSL3_AD_CERTIFICATE_REVOKED:
435 case TLS1_AD_DECODE_ERROR: str="DE"; break; 659 str="CR"; break;
436 case TLS1_AD_DECRYPT_ERROR: str="CY"; break; 660 case SSL3_AD_CERTIFICATE_EXPIRED:
437 case TLS1_AD_EXPORT_RESTRICTION: str="ER"; break; 661 str="CE"; break;
438 case TLS1_AD_PROTOCOL_VERSION: str="PV"; break; 662 case SSL3_AD_CERTIFICATE_UNKNOWN:
439 case TLS1_AD_INSUFFICIENT_SECURITY: str="IS"; break; 663 str="CU"; break;
440 case TLS1_AD_INTERNAL_ERROR: str="IE"; break; 664 case SSL3_AD_ILLEGAL_PARAMETER:
441 case TLS1_AD_USER_CANCELLED: str="US"; break; 665 str="IP"; break;
442 case TLS1_AD_NO_RENEGOTIATION: str="NR"; break; 666 case TLS1_AD_DECRYPTION_FAILED:
443 case TLS1_AD_UNSUPPORTED_EXTENSION: str="UE"; break; 667 str="DC"; break;
444 case TLS1_AD_CERTIFICATE_UNOBTAINABLE: str="CO"; break; 668 case TLS1_AD_RECORD_OVERFLOW:
445 case TLS1_AD_UNRECOGNIZED_NAME: str="UN"; break; 669 str="RO"; break;
446 case TLS1_AD_BAD_CERTIFICATE_STATUS_RESPONSE: str="BR"; break; 670 case TLS1_AD_UNKNOWN_CA:
447 case TLS1_AD_BAD_CERTIFICATE_HASH_VALUE: str="BH"; break; 671 str="CA"; break;
448 case TLS1_AD_UNKNOWN_PSK_IDENTITY: str="UP"; break; 672 case TLS1_AD_ACCESS_DENIED:
449 default: str="UK"; break; 673 str="AD"; break;
450 } 674 case TLS1_AD_DECODE_ERROR:
451 return(str); 675 str="DE"; break;
676 case TLS1_AD_DECRYPT_ERROR:
677 str="CY"; break;
678 case TLS1_AD_EXPORT_RESTRICTION:
679 str="ER"; break;
680 case TLS1_AD_PROTOCOL_VERSION:
681 str="PV"; break;
682 case TLS1_AD_INSUFFICIENT_SECURITY:
683 str="IS"; break;
684 case TLS1_AD_INTERNAL_ERROR:
685 str="IE"; break;
686 case TLS1_AD_USER_CANCELLED:
687 str="US"; break;
688 case TLS1_AD_NO_RENEGOTIATION:
689 str="NR"; break;
690 case TLS1_AD_UNSUPPORTED_EXTENSION:
691 str="UE"; break;
692 case TLS1_AD_CERTIFICATE_UNOBTAINABLE:
693 str="CO"; break;
694 case TLS1_AD_UNRECOGNIZED_NAME:
695 str="UN"; break;
696 case TLS1_AD_BAD_CERTIFICATE_STATUS_RESPONSE:
697 str="BR"; break;
698 case TLS1_AD_BAD_CERTIFICATE_HASH_VALUE:
699 str="BH"; break;
700 case TLS1_AD_UNKNOWN_PSK_IDENTITY:
701 str="UP"; break;
702 default:
703 str="UK"; break;
452 } 704 }
705 return (str);
706}
453 707
454const char *SSL_alert_desc_string_long(int value) 708const char
455 { 709*SSL_alert_desc_string_long(int value)
710{
456 const char *str; 711 const char *str;
457 712
458 switch (value & 0xff) 713 switch (value & 0xff) {
459 {
460 case SSL3_AD_CLOSE_NOTIFY: 714 case SSL3_AD_CLOSE_NOTIFY:
461 str="close notify"; 715 str="close notify";
462 break; 716 break;
@@ -547,21 +801,26 @@ const char *SSL_alert_desc_string_long(int value)
547 case TLS1_AD_UNKNOWN_PSK_IDENTITY: 801 case TLS1_AD_UNKNOWN_PSK_IDENTITY:
548 str="unknown PSK identity"; 802 str="unknown PSK identity";
549 break; 803 break;
550 default: str="unknown"; break; 804 default:
551 } 805 str="unknown"; break;
552 return(str);
553 } 806 }
807 return (str);
808}
554 809
555const char *SSL_rstate_string(const SSL *s) 810const char
556 { 811*SSL_rstate_string(const SSL *s)
812{
557 const char *str; 813 const char *str;
558 814
559 switch (s->rstate) 815 switch (s->rstate) {
560 { 816 case SSL_ST_READ_HEADER:
561 case SSL_ST_READ_HEADER:str="RH"; break; 817 str="RH"; break;
562 case SSL_ST_READ_BODY: str="RB"; break; 818 case SSL_ST_READ_BODY:
563 case SSL_ST_READ_DONE: str="RD"; break; 819 str="RB"; break;
564 default: str="unknown"; break; 820 case SSL_ST_READ_DONE:
565 } 821 str="RD"; break;
566 return(str); 822 default:
823 str="unknown"; break;
567 } 824 }
825 return (str);
826}
diff --git a/src/lib/libssl/src/ssl/ssl_task.c b/src/lib/libssl/src/ssl/ssl_task.c
index 366204f097..25d20b06a0 100644
--- a/src/lib/libssl/src/ssl/ssl_task.c
+++ b/src/lib/libssl/src/ssl/ssl_task.c
@@ -134,24 +134,28 @@ int LIB$INIT_TIMER(), LIB$SHOW_TIMER();
134#include <openssl/ssl.h> 134#include <openssl/ssl.h>
135#include <openssl/err.h> 135#include <openssl/err.h>
136 136
137int verify_callback(int ok, X509 *xs, X509 *xi, int depth, 137int
138 int error); 138verify_callback(int ok, X509 *xs, X509 *xi, int depth,
139BIO *bio_err=NULL; 139int error);
140BIO *bio_stdout=NULL; 140BIO *bio_err = NULL;
141BIO *bio_stdout = NULL;
141BIO_METHOD *BIO_s_rtcp(); 142BIO_METHOD *BIO_s_rtcp();
142 143
143static char *cipher=NULL; 144static char *cipher = NULL;
144int verbose=1; 145int verbose = 1;
145#ifdef FIONBIO 146#ifdef FIONBIO
146static int s_nbio=0; 147static int s_nbio = 0;
147#endif 148#endif
148#define TEST_SERVER_CERT "SSL_SERVER_CERTIFICATE" 149#define TEST_SERVER_CERT "SSL_SERVER_CERTIFICATE"
149/*************************************************************************/ 150/*************************************************************************/
150struct rpc_msg { /* Should have member alignment inhibited */ 151 struct rpc_msg { /* Should have member alignment inhibited */
151 char channel; /* 'A'-app data. 'R'-remote client 'G'-global */ 152 char channel;
152 char function; /* 'G'-get, 'P'-put, 'C'-confirm, 'X'-close */ 153 /* 'A'-app data. 'R'-remote client 'G'-global */
153 unsigned short int length; /* Amount of data returned or max to return */ 154 char function;
154 char data[4092]; /* variable data */ 155 /* 'G'-get, 'P'-put, 'C'-confirm, 'X'-close */
156 unsigned short int length; /* Amount of data returned or max to return */
157 char data[4092];
158 /* variable data */
155}; 159};
156#define RPC_HDR_SIZE (sizeof(struct rpc_msg) - 4092) 160#define RPC_HDR_SIZE (sizeof(struct rpc_msg) - 4092)
157 161
@@ -159,9 +163,9 @@ static $DESCRIPTOR(sysnet, "SYS$NET");
159typedef unsigned short io_channel; 163typedef unsigned short io_channel;
160 164
161struct io_status { 165struct io_status {
162 unsigned short status; 166 unsigned short status;
163 unsigned short count; 167 unsigned short count;
164 unsigned long stsval; 168 unsigned long stsval;
165}; 169};
166int doit(io_channel chan, SSL_CTX *s_ctx ); 170int doit(io_channel chan, SSL_CTX *s_ctx );
167/*****************************************************************************/ 171/*****************************************************************************/
@@ -169,63 +173,66 @@ int doit(io_channel chan, SSL_CTX *s_ctx );
169 */ 173 */
170static int get ( io_channel chan, char *buffer, int maxlen, int *length ) 174static int get ( io_channel chan, char *buffer, int maxlen, int *length )
171{ 175{
172 int status; 176 int status;
173 struct io_status iosb; 177 struct io_status iosb;
174 status = SYS$QIOW ( 0, chan, IO$_READVBLK, &iosb, 0, 0, 178 status = SYS$QIOW ( 0, chan, IO$_READVBLK, &iosb, 0, 0,
175 buffer, maxlen, 0, 0, 0, 0 ); 179 buffer, maxlen, 0, 0, 0, 0 );
176 if ( (status&1) == 1 ) status = iosb.status; 180 if ((status&1)
177 if ( (status&1) == 1 ) *length = iosb.count; 181 == 1 ) status = iosb.status;
178 return status; 182 if ((status&1)
183 == 1 ) *length = iosb.count;
184 return status;
179} 185}
180 186
181static int put ( io_channel chan, char *buffer, int length ) 187static int put ( io_channel chan, char *buffer, int length )
182{ 188{
183 int status; 189 int status;
184 struct io_status iosb; 190 struct io_status iosb;
185 status = SYS$QIOW ( 0, chan, IO$_WRITEVBLK, &iosb, 0, 0, 191 status = SYS$QIOW ( 0, chan, IO$_WRITEVBLK, &iosb, 0, 0,
186 buffer, length, 0, 0, 0, 0 ); 192 buffer, length, 0, 0, 0, 0 );
187 if ( (status&1) == 1 ) status = iosb.status; 193 if ((status&1)
188 return status; 194 == 1 ) status = iosb.status;
195 return status;
189} 196}
190/***************************************************************************/ 197/***************************************************************************/
191/* Handle operations on the 'G' channel. 198/* Handle operations on the 'G' channel.
192 */ 199 */
193static int general_request ( io_channel chan, struct rpc_msg *msg, int length ) 200static int general_request ( io_channel chan, struct rpc_msg *msg, int length ) {
194{ 201 return 48;
195 return 48;
196} 202}
197/***************************************************************************/ 203/***************************************************************************/
198int main ( int argc, char **argv ) 204int main ( int argc, char **argv )
199{ 205{
200 int status, length; 206 int status, length;
201 io_channel chan; 207 io_channel chan;
202 struct rpc_msg msg; 208 struct rpc_msg msg;
203 209
204 char *CApath=NULL,*CAfile=NULL; 210 char *CApath = NULL, *CAfile = NULL;
205 int badop=0; 211 int badop = 0;
206 int ret=1; 212 int ret = 1;
207 int client_auth=0; 213 int client_auth = 0;
208 int server_auth=0; 214 int server_auth = 0;
209 SSL_CTX *s_ctx=NULL; 215 SSL_CTX *s_ctx = NULL;
210 /* 216 /*
211 * Confirm logical link with initiating client. 217 * Confirm logical link with initiating client.
212 */ 218 */
213 LIB$INIT_TIMER(); 219 LIB$INIT_TIMER();
214 status = SYS$ASSIGN ( &sysnet, &chan, 0, 0, 0 ); 220 status = SYS$ASSIGN ( &sysnet, &chan, 0, 0, 0 );
215 printf("status of assign to SYS$NET: %d\n", status ); 221 printf("status of assign to SYS$NET: %d\n", status );
216 /* 222 /*
217 * Initialize standard out and error files. 223 * Initialize standard out and error files.
218 */ 224 */
219 if (bio_err == NULL) 225 if (bio_err == NULL)
220 if ((bio_err=BIO_new(BIO_s_file())) != NULL) 226 if ((bio_err = BIO_new(BIO_s_file())) != NULL)
221 BIO_set_fp(bio_err,stderr,BIO_NOCLOSE); 227 BIO_set_fp(bio_err, stderr, BIO_NOCLOSE);
222 if (bio_stdout == NULL) 228 if (bio_stdout == NULL)
223 if ((bio_stdout=BIO_new(BIO_s_file())) != NULL) 229 if ((bio_stdout = BIO_new(BIO_s_file())) != NULL)
224 BIO_set_fp(bio_stdout,stdout,BIO_NOCLOSE); 230 BIO_set_fp(bio_stdout, stdout, BIO_NOCLOSE);
225 /* 231 /*
226 * get the preferred cipher list and other initialization 232 * get the preferred cipher list and other initialization
227 */ 233 */
228 if (cipher == NULL) cipher=getenv("SSL_CIPHER"); 234 if (cipher == NULL)
235 cipher = getenv("SSL_CIPHER");
229 printf("cipher list: %s\n", cipher ? cipher : "{undefined}" ); 236 printf("cipher list: %s\n", cipher ? cipher : "{undefined}" );
230 237
231 SSL_load_error_strings(); 238 SSL_load_error_strings();
@@ -234,48 +241,53 @@ int main ( int argc, char **argv )
234/* DRM, this was the original, but there is no such thing as SSLv2() 241/* DRM, this was the original, but there is no such thing as SSLv2()
235 s_ctx=SSL_CTX_new(SSLv2()); 242 s_ctx=SSL_CTX_new(SSLv2());
236*/ 243*/
237 s_ctx=SSL_CTX_new(SSLv2_server_method()); 244 s_ctx = SSL_CTX_new(SSLv2_server_method());
238 245
239 if (s_ctx == NULL) goto end; 246 if (s_ctx == NULL)
247 goto end;
240 248
241 SSL_CTX_use_certificate_file(s_ctx,TEST_SERVER_CERT,SSL_FILETYPE_PEM); 249 SSL_CTX_use_certificate_file(s_ctx, TEST_SERVER_CERT, SSL_FILETYPE_PEM);
242 SSL_CTX_use_RSAPrivateKey_file(s_ctx,TEST_SERVER_CERT,SSL_FILETYPE_PEM); 250 SSL_CTX_use_RSAPrivateKey_file(s_ctx, TEST_SERVER_CERT, SSL_FILETYPE_PEM);
243 printf("Loaded server certificate: '%s'\n", TEST_SERVER_CERT ); 251 printf("Loaded server certificate: '%s'\n", TEST_SERVER_CERT );
244 252
245 /* 253 /*
246 * Take commands from client until bad status. 254 * Take commands from client until bad status.
247 */ 255 */
248 LIB$SHOW_TIMER(); 256 LIB$SHOW_TIMER();
249 status = doit ( chan, s_ctx ); 257 status = doit ( chan, s_ctx );
250 LIB$SHOW_TIMER(); 258 LIB$SHOW_TIMER();
251 /* 259 /*
252 * do final cleanup and exit. 260 * do final cleanup and exit.
253 */ 261 */
254end: 262end:
255 if (s_ctx != NULL) SSL_CTX_free(s_ctx); 263 if (s_ctx != NULL)
256 LIB$SHOW_TIMER(); 264 SSL_CTX_free(s_ctx);
257 return 1; 265 LIB$SHOW_TIMER();
266 return 1;
258} 267}
259 268
260int doit(io_channel chan, SSL_CTX *s_ctx ) 269int
270doit(io_channel chan, SSL_CTX *s_ctx )
261{ 271{
262 int status, length, link_state; 272 int status, length, link_state;
263 struct rpc_msg msg; 273 struct rpc_msg msg;
264 274
265 SSL *s_ssl=NULL; 275 SSL *s_ssl = NULL;
266 BIO *c_to_s=NULL; 276 BIO *c_to_s = NULL;
267 BIO *s_to_c=NULL; 277 BIO *s_to_c = NULL;
268 BIO *c_bio=NULL; 278 BIO *c_bio = NULL;
269 BIO *s_bio=NULL; 279 BIO *s_bio = NULL;
270 int i; 280 int i;
271 int done=0; 281 int done = 0;
272 282
273 s_ssl=SSL_new(s_ctx); 283 s_ssl = SSL_new(s_ctx);
274 if (s_ssl == NULL) goto err; 284 if (s_ssl == NULL)
285 goto err;
275 286
276 c_to_s=BIO_new(BIO_s_rtcp()); 287 c_to_s = BIO_new(BIO_s_rtcp());
277 s_to_c=BIO_new(BIO_s_rtcp()); 288 s_to_c = BIO_new(BIO_s_rtcp());
278 if ((s_to_c == NULL) || (c_to_s == NULL)) goto err; 289 if ((s_to_c == NULL)
290 || (c_to_s == NULL)) goto err;
279/* original, DRM 24-SEP-1997 291/* original, DRM 24-SEP-1997
280 BIO_set_fd ( c_to_s, "", chan ); 292 BIO_set_fd ( c_to_s, "", chan );
281 BIO_set_fd ( s_to_c, "", chan ); 293 BIO_set_fd ( s_to_c, "", chan );
@@ -283,13 +295,14 @@ int doit(io_channel chan, SSL_CTX *s_ctx )
283 BIO_set_fd ( c_to_s, 0, chan ); 295 BIO_set_fd ( c_to_s, 0, chan );
284 BIO_set_fd ( s_to_c, 0, chan ); 296 BIO_set_fd ( s_to_c, 0, chan );
285 297
286 c_bio=BIO_new(BIO_f_ssl()); 298 c_bio = BIO_new(BIO_f_ssl());
287 s_bio=BIO_new(BIO_f_ssl()); 299 s_bio = BIO_new(BIO_f_ssl());
288 if ((c_bio == NULL) || (s_bio == NULL)) goto err; 300 if ((c_bio == NULL)
301 || (s_bio == NULL)) goto err;
289 302
290 SSL_set_accept_state(s_ssl); 303 SSL_set_accept_state(s_ssl);
291 SSL_set_bio(s_ssl,c_to_s,s_to_c); 304 SSL_set_bio(s_ssl, c_to_s, s_to_c);
292 BIO_set_ssl(s_bio,s_ssl,BIO_CLOSE); 305 BIO_set_ssl(s_bio, s_ssl, BIO_CLOSE);
293 306
294 /* We can always do writes */ 307 /* We can always do writes */
295 printf("Begin doit main loop\n"); 308 printf("Begin doit main loop\n");
@@ -300,59 +313,65 @@ int doit(io_channel chan, SSL_CTX *s_ctx )
300 /* 313 /*
301 * Wait for remote end to request data action on A channel. 314 * Wait for remote end to request data action on A channel.
302 */ 315 */
303 while ( link_state == 0 ) { 316 while (link_state == 0 ) {
304 status = get ( chan, (char *) &msg, sizeof(msg), &length ); 317 status = get ( chan, (char *) &msg, sizeof(msg), &length );
305 if ( (status&1) == 0 ) { 318 if ((status&1) == 0 ) {
306 printf("Error in main loop get: %d\n", status ); 319 printf("Error in main loop get: %d\n", status );
307 link_state = 3; 320 link_state = 3;
308 break; 321 break;
309 } 322 }
310 if ( length < RPC_HDR_SIZE ) { 323 if (length < RPC_HDR_SIZE ) {
311 printf("Error in main loop get size: %d\n", length ); 324 printf("Error in main loop get size: %d\n", length );
312 break; 325 break;
313 link_state = 3; 326 link_state = 3;
314 } 327 }
315 if ( msg.channel != 'A' ) { 328 if (msg.channel != 'A' ) {
316 printf("Error in main loop, unexpected channel: %c\n", 329 printf("Error in main loop, unexpected channel: %c\n",
317 msg.channel ); 330 msg.channel );
318 break; 331 break;
319 link_state = 3; 332 link_state = 3;
320 } 333 }
321 if ( msg.function == 'G' ) { 334 if (msg.function == 'G' ) {
322 link_state = 1; 335 link_state = 1;
323 } else if ( msg.function == 'P' ) { 336 } else if (msg.function == 'P' ) {
324 link_state = 2; /* write pending */ 337 link_state = 2; /* write pending */
325 } else if ( msg.function == 'X' ) { 338 } else if (msg.function == 'X' ) {
326 link_state = 3; 339 link_state = 3;
327 } else { 340 } else {
328 link_state = 3; 341 link_state = 3;
329 } 342 }
330 }
331 if ( link_state == 1 ) {
332 i = BIO_read ( s_bio, msg.data, msg.length );
333 if ( i < 0 ) link_state = 3;
334 else {
335 msg.channel = 'A';
336 msg.function = 'C'; /* confirm */
337 msg.length = i;
338 status = put ( chan, (char *) &msg, i+RPC_HDR_SIZE );
339 if ( (status&1) == 0 ) break;
340 link_state = 0;
341 } 343 }
342 } else if ( link_state == 2 ) { 344 if (link_state == 1 ) {
343 i = BIO_write ( s_bio, msg.data, msg.length ); 345 i = BIO_read ( s_bio, msg.data, msg.length );
344 if ( i < 0 ) link_state = 3; 346 if (i < 0 )
345 else { 347 link_state = 3;
346 msg.channel = 'A'; 348 else {
347 msg.function = 'C'; /* confirm */ 349 msg.channel = 'A';
348 msg.length = 0; 350 msg.function = 'C';
349 status = put ( chan, (char *) &msg, RPC_HDR_SIZE ); 351 /* confirm */
350 if ( (status&1) == 0 ) break; 352 msg.length = i;
351 link_state = 0; 353 status = put ( chan, (char *) &msg, i + RPC_HDR_SIZE );
354 if ((status&1)
355 == 0 ) break;
356 link_state = 0;
357 }
358 } else if (link_state == 2 ) {
359 i = BIO_write ( s_bio, msg.data, msg.length );
360 if (i < 0 )
361 link_state = 3;
362 else {
363 msg.channel = 'A';
364 msg.function = 'C';
365 /* confirm */
366 msg.length = 0;
367 status = put ( chan, (char *) &msg, RPC_HDR_SIZE );
368 if ((status&1)
369 == 0 ) break;
370 link_state = 0;
371 }
352 } 372 }
353 }
354 } 373 }
355 fprintf(stdout,"DONE\n"); 374 fprintf(stdout, "DONE\n");
356err: 375err:
357 /* We have to set the BIO's to NULL otherwise they will be 376 /* We have to set the BIO's to NULL otherwise they will be
358 * free()ed twice. Once when th s_ssl is SSL_free()ed and 377 * free()ed twice. Once when th s_ssl is SSL_free()ed and
@@ -361,12 +380,16 @@ err:
361 * BIO structure and SSL_set_bio() and SSL_free() automatically 380 * BIO structure and SSL_set_bio() and SSL_free() automatically
362 * BIO_free non NULL entries. 381 * BIO_free non NULL entries.
363 * You should not normally do this or be required to do this */ 382 * You should not normally do this or be required to do this */
364 s_ssl->rbio=NULL; 383 s_ssl->rbio = NULL;
365 s_ssl->wbio=NULL; 384 s_ssl->wbio = NULL;
366 385
367 if (c_to_s != NULL) BIO_free(c_to_s); 386 if (c_to_s != NULL)
368 if (s_to_c != NULL) BIO_free(s_to_c); 387 BIO_free(c_to_s);
369 if (c_bio != NULL) BIO_free(c_bio); 388 if (s_to_c != NULL)
370 if (s_bio != NULL) BIO_free(s_bio); 389 BIO_free(s_to_c);
371 return(0); 390 if (c_bio != NULL)
391 BIO_free(c_bio);
392 if (s_bio != NULL)
393 BIO_free(s_bio);
394 return (0);
372} 395}
diff --git a/src/lib/libssl/src/ssl/ssl_txt.c b/src/lib/libssl/src/ssl/ssl_txt.c
index 6479d52c0c..5186e396ec 100644
--- a/src/lib/libssl/src/ssl/ssl_txt.c
+++ b/src/lib/libssl/src/ssl/ssl_txt.c
@@ -87,30 +87,33 @@
87#include "ssl_locl.h" 87#include "ssl_locl.h"
88 88
89#ifndef OPENSSL_NO_FP_API 89#ifndef OPENSSL_NO_FP_API
90int SSL_SESSION_print_fp(FILE *fp, const SSL_SESSION *x) 90int
91 { 91SSL_SESSION_print_fp(FILE *fp, const SSL_SESSION *x)
92{
92 BIO *b; 93 BIO *b;
93 int ret; 94 int ret;
94 95
95 if ((b=BIO_new(BIO_s_file_internal())) == NULL) 96 if ((b = BIO_new(BIO_s_file_internal())) == NULL) {
96 { 97 SSLerr(SSL_F_SSL_SESSION_PRINT_FP, ERR_R_BUF_LIB);
97 SSLerr(SSL_F_SSL_SESSION_PRINT_FP,ERR_R_BUF_LIB); 98 return (0);
98 return(0);
99 }
100 BIO_set_fp(b,fp,BIO_NOCLOSE);
101 ret=SSL_SESSION_print(b,x);
102 BIO_free(b);
103 return(ret);
104 } 99 }
100 BIO_set_fp(b, fp, BIO_NOCLOSE);
101 ret = SSL_SESSION_print(b, x);
102 BIO_free(b);
103 return (ret);
104}
105#endif 105#endif
106 106
107int SSL_SESSION_print(BIO *bp, const SSL_SESSION *x) 107int
108 { 108SSL_SESSION_print(BIO *bp, const SSL_SESSION *x)
109{
109 unsigned int i; 110 unsigned int i;
110 const char *s; 111 const char *s;
111 112
112 if (x == NULL) goto err; 113 if (x == NULL)
113 if (BIO_puts(bp,"SSL-Session:\n") <= 0) goto err; 114 goto err;
115 if (BIO_puts(bp, "SSL-Session:\n")
116 <= 0) goto err;
114 if (x->ssl_version == SSL2_VERSION) 117 if (x->ssl_version == SSL2_VERSION)
115 s="SSLv2"; 118 s="SSLv2";
116 else if (x->ssl_version == SSL3_VERSION) 119 else if (x->ssl_version == SSL3_VERSION)
@@ -127,122 +130,122 @@ int SSL_SESSION_print(BIO *bp, const SSL_SESSION *x)
127 s="DTLSv1-bad"; 130 s="DTLSv1-bad";
128 else 131 else
129 s="unknown"; 132 s="unknown";
130 if (BIO_printf(bp," Protocol : %s\n",s) <= 0) goto err; 133 if (BIO_printf(bp, " Protocol : %s\n", s)
134 <= 0) goto err;
131 135
132 if (x->cipher == NULL) 136 if (x->cipher == NULL) {
133 { 137 if (((x->cipher_id) & 0xff000000) == 0x02000000) {
134 if (((x->cipher_id) & 0xff000000) == 0x02000000) 138 if (BIO_printf(bp, " Cipher : %06lX\n", x->cipher_id&0xffffff) <= 0)
135 {
136 if (BIO_printf(bp," Cipher : %06lX\n",x->cipher_id&0xffffff) <= 0)
137 goto err; 139 goto err;
138 } 140 } else {
139 else 141 if (BIO_printf(bp, " Cipher : %04lX\n", x->cipher_id&0xffff) <= 0)
140 {
141 if (BIO_printf(bp," Cipher : %04lX\n",x->cipher_id&0xffff) <= 0)
142 goto err; 142 goto err;
143 }
144 } 143 }
145 else 144 } else {
146 { 145 if (BIO_printf(bp, " Cipher : %s\n",((x->cipher == NULL)?"unknown":x->cipher->name)) <= 0)
147 if (BIO_printf(bp," Cipher : %s\n",((x->cipher == NULL)?"unknown":x->cipher->name)) <= 0)
148 goto err; 146 goto err;
149 } 147 }
150 if (BIO_puts(bp," Session-ID: ") <= 0) goto err; 148 if (BIO_puts(bp, " Session-ID: ")
151 for (i=0; i<x->session_id_length; i++) 149 <= 0) goto err;
152 { 150 for (i = 0; i < x->session_id_length; i++) {
153 if (BIO_printf(bp,"%02X",x->session_id[i]) <= 0) goto err; 151 if (BIO_printf(bp, "%02X", x->session_id[i])
154 } 152 <= 0) goto err;
155 if (BIO_puts(bp,"\n Session-ID-ctx: ") <= 0) goto err; 153 }
156 for (i=0; i<x->sid_ctx_length; i++) 154 if (BIO_puts(bp, "\n Session-ID-ctx: ")
157 { 155 <= 0) goto err;
158 if (BIO_printf(bp,"%02X",x->sid_ctx[i]) <= 0) 156 for (i = 0; i < x->sid_ctx_length; i++) {
157 if (BIO_printf(bp, "%02X", x->sid_ctx[i]) <= 0)
159 goto err; 158 goto err;
160 } 159 }
161 if (BIO_puts(bp,"\n Master-Key: ") <= 0) goto err; 160 if (BIO_puts(bp, "\n Master-Key: ")
162 for (i=0; i<(unsigned int)x->master_key_length; i++) 161 <= 0) goto err;
163 { 162 for (i = 0; i < (unsigned int)x->master_key_length; i++) {
164 if (BIO_printf(bp,"%02X",x->master_key[i]) <= 0) goto err; 163 if (BIO_printf(bp, "%02X", x->master_key[i])
165 } 164 <= 0) goto err;
166 if (BIO_puts(bp,"\n Key-Arg : ") <= 0) goto err; 165 }
167 if (x->key_arg_length == 0) 166 if (BIO_puts(bp, "\n Key-Arg : ")
168 { 167 <= 0) goto err;
169 if (BIO_puts(bp,"None") <= 0) goto err; 168 if (x->key_arg_length == 0) {
170 } 169 if (BIO_puts(bp, "None")
171 else 170 <= 0) goto err;
172 for (i=0; i<x->key_arg_length; i++) 171 } else
173 { 172 for (i = 0; i < x->key_arg_length; i++) {
174 if (BIO_printf(bp,"%02X",x->key_arg[i]) <= 0) goto err; 173 if (BIO_printf(bp, "%02X", x->key_arg[i])
175 } 174 <= 0) goto err;
175 }
176#ifndef OPENSSL_NO_KRB5 176#ifndef OPENSSL_NO_KRB5
177 if (BIO_puts(bp,"\n Krb5 Principal: ") <= 0) goto err; 177 if (BIO_puts(bp, "\n Krb5 Principal: ")
178 if (x->krb5_client_princ_len == 0) 178 <= 0) goto err;
179 { 179 if (x->krb5_client_princ_len == 0) {
180 if (BIO_puts(bp,"None") <= 0) goto err; 180 if (BIO_puts(bp, "None")
181 } 181 <= 0) goto err;
182 else 182 } else
183 for (i=0; i<x->krb5_client_princ_len; i++) 183 for (i = 0; i < x->krb5_client_princ_len; i++) {
184 { 184 if (BIO_printf(bp, "%02X", x->krb5_client_princ[i])
185 if (BIO_printf(bp,"%02X",x->krb5_client_princ[i]) <= 0) goto err; 185 <= 0) goto err;
186 } 186 }
187#endif /* OPENSSL_NO_KRB5 */ 187#endif /* OPENSSL_NO_KRB5 */
188#ifndef OPENSSL_NO_PSK 188#ifndef OPENSSL_NO_PSK
189 if (BIO_puts(bp,"\n PSK identity: ") <= 0) goto err; 189 if (BIO_puts(bp, "\n PSK identity: ")
190 if (BIO_printf(bp, "%s", x->psk_identity ? x->psk_identity : "None") <= 0) goto err; 190 <= 0) goto err;
191 if (BIO_puts(bp,"\n PSK identity hint: ") <= 0) goto err; 191 if (BIO_printf(bp, "%s", x->psk_identity ? x->psk_identity : "None")
192 if (BIO_printf(bp, "%s", x->psk_identity_hint ? x->psk_identity_hint : "None") <= 0) goto err; 192 <= 0) goto err;
193 if (BIO_puts(bp, "\n PSK identity hint: ")
194 <= 0) goto err;
195 if (BIO_printf(bp, "%s", x->psk_identity_hint ? x->psk_identity_hint : "None")
196 <= 0) goto err;
193#endif 197#endif
194#ifndef OPENSSL_NO_SRP 198#ifndef OPENSSL_NO_SRP
195 if (BIO_puts(bp,"\n SRP username: ") <= 0) goto err; 199 if (BIO_puts(bp, "\n SRP username: ")
196 if (BIO_printf(bp, "%s", x->srp_username ? x->srp_username : "None") <= 0) goto err; 200 <= 0) goto err;
201 if (BIO_printf(bp, "%s", x->srp_username ? x->srp_username : "None")
202 <= 0) goto err;
197#endif 203#endif
198#ifndef OPENSSL_NO_TLSEXT 204#ifndef OPENSSL_NO_TLSEXT
199 if (x->tlsext_tick_lifetime_hint) 205 if (x->tlsext_tick_lifetime_hint) {
200 {
201 if (BIO_printf(bp, 206 if (BIO_printf(bp,
202 "\n TLS session ticket lifetime hint: %ld (seconds)", 207 "\n TLS session ticket lifetime hint: %ld (seconds)",
203 x->tlsext_tick_lifetime_hint) <=0) 208 x->tlsext_tick_lifetime_hint) <=0)
204 goto err; 209 goto err;
205 } 210 }
206 if (x->tlsext_tick) 211 if (x->tlsext_tick) {
207 { 212 if (BIO_puts(bp, "\n TLS session ticket:\n")
208 if (BIO_puts(bp, "\n TLS session ticket:\n") <= 0) goto err; 213 <= 0) goto err;
209 if (BIO_dump_indent(bp, (char *)x->tlsext_tick, x->tlsext_ticklen, 4) <= 0) 214 if (BIO_dump_indent(bp, (char *)x->tlsext_tick, x->tlsext_ticklen, 4) <= 0)
210 goto err; 215 goto err;
211 } 216 }
212#endif 217#endif
213 218
214#ifndef OPENSSL_NO_COMP 219#ifndef OPENSSL_NO_COMP
215 if (x->compress_meth != 0) 220 if (x->compress_meth != 0) {
216 {
217 SSL_COMP *comp = NULL; 221 SSL_COMP *comp = NULL;
218 222
219 ssl_cipher_get_evp(x,NULL,NULL,NULL,NULL,&comp); 223 ssl_cipher_get_evp(x, NULL, NULL, NULL, NULL, &comp);
220 if (comp == NULL) 224 if (comp == NULL) {
221 { 225 if (BIO_printf(bp, "\n Compression: %d", x->compress_meth)
222 if (BIO_printf(bp,"\n Compression: %d",x->compress_meth) <= 0) goto err; 226 <= 0) goto err;
227 } else {
228 if (BIO_printf(bp, "\n Compression: %d (%s)", comp->id, comp->method->name) <= 0) goto err;
223 } 229 }
224 else 230 }
225 {
226 if (BIO_printf(bp,"\n Compression: %d (%s)", comp->id,comp->method->name) <= 0) goto err;
227 }
228 }
229#endif 231#endif
230 if (x->time != 0L) 232 if (x->time != 0L) {
231 { 233 if (BIO_printf(bp, "\n Start Time: %ld", x->time)
232 if (BIO_printf(bp, "\n Start Time: %ld",x->time) <= 0) goto err; 234 <= 0) goto err;
233 } 235 }
234 if (x->timeout != 0L) 236 if (x->timeout != 0L) {
235 { 237 if (BIO_printf(bp, "\n Timeout : %ld (sec)", x->timeout) <= 0) goto err;
236 if (BIO_printf(bp, "\n Timeout : %ld (sec)",x->timeout) <= 0) goto err;
237 } 238 }
238 if (BIO_puts(bp,"\n") <= 0) goto err; 239 if (BIO_puts(bp, "\n")
240 <= 0) goto err;
239 241
240 if (BIO_puts(bp, " Verify return code: ") <= 0) goto err; 242 if (BIO_puts(bp, " Verify return code: ")
243 <= 0) goto err;
241 if (BIO_printf(bp, "%ld (%s)\n", x->verify_result, 244 if (BIO_printf(bp, "%ld (%s)\n", x->verify_result,
242 X509_verify_cert_error_string(x->verify_result)) <= 0) goto err; 245 X509_verify_cert_error_string(x->verify_result)) <= 0) goto err;
243 246
244 return(1); 247 return (1);
245err: 248err:
246 return(0); 249 return (0);
247 } 250}
248 251
diff --git a/src/lib/libssl/ssl_algs.c b/src/lib/libssl/ssl_algs.c
index 9c34d19725..76644bda91 100644
--- a/src/lib/libssl/ssl_algs.c
+++ b/src/lib/libssl/ssl_algs.c
@@ -61,8 +61,9 @@
61#include <openssl/lhash.h> 61#include <openssl/lhash.h>
62#include "ssl_locl.h" 62#include "ssl_locl.h"
63 63
64int SSL_library_init(void) 64int
65 { 65SSL_library_init(void)
66{
66 67
67#ifndef OPENSSL_NO_DES 68#ifndef OPENSSL_NO_DES
68 EVP_add_cipher(EVP_des_cbc()); 69 EVP_add_cipher(EVP_des_cbc());
@@ -104,16 +105,16 @@ int SSL_library_init(void)
104#ifndef OPENSSL_NO_SEED 105#ifndef OPENSSL_NO_SEED
105 EVP_add_cipher(EVP_seed_cbc()); 106 EVP_add_cipher(EVP_seed_cbc());
106#endif 107#endif
107 108
108#ifndef OPENSSL_NO_MD5 109#ifndef OPENSSL_NO_MD5
109 EVP_add_digest(EVP_md5()); 110 EVP_add_digest(EVP_md5());
110 EVP_add_digest_alias(SN_md5,"ssl2-md5"); 111 EVP_add_digest_alias(SN_md5, "ssl2-md5");
111 EVP_add_digest_alias(SN_md5,"ssl3-md5"); 112 EVP_add_digest_alias(SN_md5, "ssl3-md5");
112#endif 113#endif
113#ifndef OPENSSL_NO_SHA 114#ifndef OPENSSL_NO_SHA
114 EVP_add_digest(EVP_sha1()); /* RSA with sha1 */ 115 EVP_add_digest(EVP_sha1()); /* RSA with sha1 */
115 EVP_add_digest_alias(SN_sha1,"ssl3-sha1"); 116 EVP_add_digest_alias(SN_sha1, "ssl3-sha1");
116 EVP_add_digest_alias(SN_sha1WithRSAEncryption,SN_sha1WithRSA); 117 EVP_add_digest_alias(SN_sha1WithRSAEncryption, SN_sha1WithRSA);
117#endif 118#endif
118#ifndef OPENSSL_NO_SHA256 119#ifndef OPENSSL_NO_SHA256
119 EVP_add_digest(EVP_sha224()); 120 EVP_add_digest(EVP_sha224());
@@ -125,9 +126,9 @@ int SSL_library_init(void)
125#endif 126#endif
126#if !defined(OPENSSL_NO_SHA) && !defined(OPENSSL_NO_DSA) 127#if !defined(OPENSSL_NO_SHA) && !defined(OPENSSL_NO_DSA)
127 EVP_add_digest(EVP_dss1()); /* DSA with sha1 */ 128 EVP_add_digest(EVP_dss1()); /* DSA with sha1 */
128 EVP_add_digest_alias(SN_dsaWithSHA1,SN_dsaWithSHA1_2); 129 EVP_add_digest_alias(SN_dsaWithSHA1, SN_dsaWithSHA1_2);
129 EVP_add_digest_alias(SN_dsaWithSHA1,"DSS1"); 130 EVP_add_digest_alias(SN_dsaWithSHA1, "DSS1");
130 EVP_add_digest_alias(SN_dsaWithSHA1,"dss1"); 131 EVP_add_digest_alias(SN_dsaWithSHA1, "dss1");
131#endif 132#endif
132#ifndef OPENSSL_NO_ECDSA 133#ifndef OPENSSL_NO_ECDSA
133 EVP_add_digest(EVP_ecdsa()); 134 EVP_add_digest(EVP_ecdsa());
@@ -145,6 +146,6 @@ int SSL_library_init(void)
145#endif 146#endif
146 /* initialize cipher/digest methods table */ 147 /* initialize cipher/digest methods table */
147 ssl_load_ciphers(); 148 ssl_load_ciphers();
148 return(1); 149 return (1);
149 } 150}
150 151
diff --git a/src/lib/libssl/ssl_asn1.c b/src/lib/libssl/ssl_asn1.c
index 38540be1e5..51668db785 100644
--- a/src/lib/libssl/ssl_asn1.c
+++ b/src/lib/libssl/ssl_asn1.c
@@ -89,8 +89,7 @@
89#include <openssl/objects.h> 89#include <openssl/objects.h>
90#include <openssl/x509.h> 90#include <openssl/x509.h>
91 91
92typedef struct ssl_session_asn1_st 92typedef struct ssl_session_asn1_st {
93 {
94 ASN1_INTEGER version; 93 ASN1_INTEGER version;
95 ASN1_INTEGER ssl_version; 94 ASN1_INTEGER ssl_version;
96 ASN1_OCTET_STRING cipher; 95 ASN1_OCTET_STRING cipher;
@@ -100,7 +99,7 @@ typedef struct ssl_session_asn1_st
100 ASN1_OCTET_STRING session_id_context; 99 ASN1_OCTET_STRING session_id_context;
101 ASN1_OCTET_STRING key_arg; 100 ASN1_OCTET_STRING key_arg;
102#ifndef OPENSSL_NO_KRB5 101#ifndef OPENSSL_NO_KRB5
103 ASN1_OCTET_STRING krb5_princ; 102 ASN1_OCTET_STRING krb5_princ;
104#endif /* OPENSSL_NO_KRB5 */ 103#endif /* OPENSSL_NO_KRB5 */
105 ASN1_INTEGER time; 104 ASN1_INTEGER time;
106 ASN1_INTEGER timeout; 105 ASN1_INTEGER timeout;
@@ -117,169 +116,156 @@ typedef struct ssl_session_asn1_st
117#ifndef OPENSSL_NO_SRP 116#ifndef OPENSSL_NO_SRP
118 ASN1_OCTET_STRING srp_username; 117 ASN1_OCTET_STRING srp_username;
119#endif /* OPENSSL_NO_SRP */ 118#endif /* OPENSSL_NO_SRP */
120 } SSL_SESSION_ASN1; 119} SSL_SESSION_ASN1;
121 120
122int i2d_SSL_SESSION(SSL_SESSION *in, unsigned char **pp) 121int
123 { 122i2d_SSL_SESSION(SSL_SESSION *in, unsigned char **pp)
123{
124#define LSIZE2 (sizeof(long)*2) 124#define LSIZE2 (sizeof(long)*2)
125 int v1=0,v2=0,v3=0,v4=0,v5=0,v7=0,v8=0; 125 int v1 = 0, v2 = 0, v3 = 0, v4 = 0, v5 = 0, v7 = 0, v8 = 0;
126 unsigned char buf[4],ibuf1[LSIZE2],ibuf2[LSIZE2]; 126 unsigned char buf[4], ibuf1[LSIZE2], ibuf2[LSIZE2];
127 unsigned char ibuf3[LSIZE2],ibuf4[LSIZE2],ibuf5[LSIZE2]; 127 unsigned char ibuf3[LSIZE2], ibuf4[LSIZE2], ibuf5[LSIZE2];
128#ifndef OPENSSL_NO_TLSEXT 128#ifndef OPENSSL_NO_TLSEXT
129 int v6=0,v9=0,v10=0; 129 int v6 = 0, v9 = 0, v10 = 0;
130 unsigned char ibuf6[LSIZE2]; 130 unsigned char ibuf6[LSIZE2];
131#endif 131#endif
132#ifndef OPENSSL_NO_COMP 132#ifndef OPENSSL_NO_COMP
133 unsigned char cbuf; 133 unsigned char cbuf;
134 int v11=0; 134 int v11 = 0;
135#endif 135#endif
136#ifndef OPENSSL_NO_SRP 136#ifndef OPENSSL_NO_SRP
137 int v12=0; 137 int v12 = 0;
138#endif 138#endif
139 long l; 139 long l;
140 SSL_SESSION_ASN1 a; 140 SSL_SESSION_ASN1 a;
141 M_ASN1_I2D_vars(in); 141 M_ASN1_I2D_vars(in);
142 142
143 if ((in == NULL) || ((in->cipher == NULL) && (in->cipher_id == 0))) 143 if ((in == NULL) || ((in->cipher == NULL) && (in->cipher_id == 0)))
144 return(0); 144 return (0);
145 145
146 /* Note that I cheat in the following 2 assignments. I know 146 /* Note that I cheat in the following 2 assignments. I know
147 * that if the ASN1_INTEGER passed to ASN1_INTEGER_set 147 * that if the ASN1_INTEGER passed to ASN1_INTEGER_set
148 * is > sizeof(long)+1, the buffer will not be re-OPENSSL_malloc()ed. 148 * is > sizeof(long)+1, the buffer will not be re-OPENSSL_malloc()ed.
149 * This is a bit evil but makes things simple, no dynamic allocation 149 * This is a bit evil but makes things simple, no dynamic allocation
150 * to clean up :-) */ 150 * to clean up :-) */
151 a.version.length=LSIZE2; 151 a.version.length = LSIZE2;
152 a.version.type=V_ASN1_INTEGER; 152 a.version.type = V_ASN1_INTEGER;
153 a.version.data=ibuf1; 153 a.version.data = ibuf1;
154 ASN1_INTEGER_set(&(a.version),SSL_SESSION_ASN1_VERSION); 154 ASN1_INTEGER_set(&(a.version), SSL_SESSION_ASN1_VERSION);
155 155
156 a.ssl_version.length=LSIZE2; 156 a.ssl_version.length = LSIZE2;
157 a.ssl_version.type=V_ASN1_INTEGER; 157 a.ssl_version.type = V_ASN1_INTEGER;
158 a.ssl_version.data=ibuf2; 158 a.ssl_version.data = ibuf2;
159 ASN1_INTEGER_set(&(a.ssl_version),in->ssl_version); 159 ASN1_INTEGER_set(&(a.ssl_version), in->ssl_version);
160 160
161 a.cipher.type=V_ASN1_OCTET_STRING; 161 a.cipher.type = V_ASN1_OCTET_STRING;
162 a.cipher.data=buf; 162 a.cipher.data = buf;
163 163
164 if (in->cipher == NULL) 164 if (in->cipher == NULL)
165 l=in->cipher_id; 165 l = in->cipher_id;
166 else 166 else
167 l=in->cipher->id; 167 l = in->cipher->id;
168 if (in->ssl_version == SSL2_VERSION) 168 if (in->ssl_version == SSL2_VERSION) {
169 { 169 a.cipher.length = 3;
170 a.cipher.length=3; 170 buf[0] = ((unsigned char)(l >> 16L))&0xff;
171 buf[0]=((unsigned char)(l>>16L))&0xff; 171 buf[1] = ((unsigned char)(l >> 8L))&0xff;
172 buf[1]=((unsigned char)(l>> 8L))&0xff; 172 buf[2] = ((unsigned char)(l ))&0xff;
173 buf[2]=((unsigned char)(l ))&0xff; 173 } else {
174 } 174 a.cipher.length = 2;
175 else 175 buf[0] = ((unsigned char)(l >> 8L))&0xff;
176 { 176 buf[1] = ((unsigned char)(l ))&0xff;
177 a.cipher.length=2; 177 }
178 buf[0]=((unsigned char)(l>>8L))&0xff;
179 buf[1]=((unsigned char)(l ))&0xff;
180 }
181 178
182#ifndef OPENSSL_NO_COMP 179#ifndef OPENSSL_NO_COMP
183 if (in->compress_meth) 180 if (in->compress_meth) {
184 {
185 cbuf = (unsigned char)in->compress_meth; 181 cbuf = (unsigned char)in->compress_meth;
186 a.comp_id.length = 1; 182 a.comp_id.length = 1;
187 a.comp_id.type = V_ASN1_OCTET_STRING; 183 a.comp_id.type = V_ASN1_OCTET_STRING;
188 a.comp_id.data = &cbuf; 184 a.comp_id.data = &cbuf;
189 } 185 }
190#endif 186#endif
191 187
192 a.master_key.length=in->master_key_length; 188 a.master_key.length = in->master_key_length;
193 a.master_key.type=V_ASN1_OCTET_STRING; 189 a.master_key.type = V_ASN1_OCTET_STRING;
194 a.master_key.data=in->master_key; 190 a.master_key.data = in->master_key;
195 191
196 a.session_id.length=in->session_id_length; 192 a.session_id.length = in->session_id_length;
197 a.session_id.type=V_ASN1_OCTET_STRING; 193 a.session_id.type = V_ASN1_OCTET_STRING;
198 a.session_id.data=in->session_id; 194 a.session_id.data = in->session_id;
199 195
200 a.session_id_context.length=in->sid_ctx_length; 196 a.session_id_context.length = in->sid_ctx_length;
201 a.session_id_context.type=V_ASN1_OCTET_STRING; 197 a.session_id_context.type = V_ASN1_OCTET_STRING;
202 a.session_id_context.data=in->sid_ctx; 198 a.session_id_context.data = in->sid_ctx;
203 199
204 a.key_arg.length=in->key_arg_length; 200 a.key_arg.length = in->key_arg_length;
205 a.key_arg.type=V_ASN1_OCTET_STRING; 201 a.key_arg.type = V_ASN1_OCTET_STRING;
206 a.key_arg.data=in->key_arg; 202 a.key_arg.data = in->key_arg;
207 203
208#ifndef OPENSSL_NO_KRB5 204#ifndef OPENSSL_NO_KRB5
209 if (in->krb5_client_princ_len) 205 if (in->krb5_client_princ_len) {
210 { 206 a.krb5_princ.length = in->krb5_client_princ_len;
211 a.krb5_princ.length=in->krb5_client_princ_len; 207 a.krb5_princ.type = V_ASN1_OCTET_STRING;
212 a.krb5_princ.type=V_ASN1_OCTET_STRING; 208 a.krb5_princ.data = in->krb5_client_princ;
213 a.krb5_princ.data=in->krb5_client_princ; 209 }
214 }
215#endif /* OPENSSL_NO_KRB5 */ 210#endif /* OPENSSL_NO_KRB5 */
216 211
217 if (in->time != 0L) 212 if (in->time != 0L) {
218 { 213 a.time.length = LSIZE2;
219 a.time.length=LSIZE2; 214 a.time.type = V_ASN1_INTEGER;
220 a.time.type=V_ASN1_INTEGER; 215 a.time.data = ibuf3;
221 a.time.data=ibuf3; 216 ASN1_INTEGER_set(&(a.time), in->time);
222 ASN1_INTEGER_set(&(a.time),in->time); 217 }
223 }
224 218
225 if (in->timeout != 0L) 219 if (in->timeout != 0L) {
226 { 220 a.timeout.length = LSIZE2;
227 a.timeout.length=LSIZE2; 221 a.timeout.type = V_ASN1_INTEGER;
228 a.timeout.type=V_ASN1_INTEGER; 222 a.timeout.data = ibuf4;
229 a.timeout.data=ibuf4; 223 ASN1_INTEGER_set(&(a.timeout), in->timeout);
230 ASN1_INTEGER_set(&(a.timeout),in->timeout); 224 }
231 }
232 225
233 if (in->verify_result != X509_V_OK) 226 if (in->verify_result != X509_V_OK) {
234 { 227 a.verify_result.length = LSIZE2;
235 a.verify_result.length=LSIZE2; 228 a.verify_result.type = V_ASN1_INTEGER;
236 a.verify_result.type=V_ASN1_INTEGER; 229 a.verify_result.data = ibuf5;
237 a.verify_result.data=ibuf5; 230 ASN1_INTEGER_set(&a.verify_result, in->verify_result);
238 ASN1_INTEGER_set(&a.verify_result,in->verify_result); 231 }
239 }
240 232
241#ifndef OPENSSL_NO_TLSEXT 233#ifndef OPENSSL_NO_TLSEXT
242 if (in->tlsext_hostname) 234 if (in->tlsext_hostname) {
243 { 235 a.tlsext_hostname.length = strlen(in->tlsext_hostname);
244 a.tlsext_hostname.length=strlen(in->tlsext_hostname); 236 a.tlsext_hostname.type = V_ASN1_OCTET_STRING;
245 a.tlsext_hostname.type=V_ASN1_OCTET_STRING; 237 a.tlsext_hostname.data = (unsigned char *)in->tlsext_hostname;
246 a.tlsext_hostname.data=(unsigned char *)in->tlsext_hostname; 238 }
247 } 239 if (in->tlsext_tick) {
248 if (in->tlsext_tick) 240 a.tlsext_tick.length = in->tlsext_ticklen;
249 { 241 a.tlsext_tick.type = V_ASN1_OCTET_STRING;
250 a.tlsext_tick.length= in->tlsext_ticklen; 242 a.tlsext_tick.data = (unsigned char *)in->tlsext_tick;
251 a.tlsext_tick.type=V_ASN1_OCTET_STRING; 243 }
252 a.tlsext_tick.data=(unsigned char *)in->tlsext_tick; 244 if (in->tlsext_tick_lifetime_hint > 0) {
253 } 245 a.tlsext_tick_lifetime.length = LSIZE2;
254 if (in->tlsext_tick_lifetime_hint > 0) 246 a.tlsext_tick_lifetime.type = V_ASN1_INTEGER;
255 { 247 a.tlsext_tick_lifetime.data = ibuf6;
256 a.tlsext_tick_lifetime.length=LSIZE2; 248 ASN1_INTEGER_set(&a.tlsext_tick_lifetime, in->tlsext_tick_lifetime_hint);
257 a.tlsext_tick_lifetime.type=V_ASN1_INTEGER; 249 }
258 a.tlsext_tick_lifetime.data=ibuf6;
259 ASN1_INTEGER_set(&a.tlsext_tick_lifetime,in->tlsext_tick_lifetime_hint);
260 }
261#endif /* OPENSSL_NO_TLSEXT */ 250#endif /* OPENSSL_NO_TLSEXT */
262#ifndef OPENSSL_NO_PSK 251#ifndef OPENSSL_NO_PSK
263 if (in->psk_identity_hint) 252 if (in->psk_identity_hint) {
264 { 253 a.psk_identity_hint.length = strlen(in->psk_identity_hint);
265 a.psk_identity_hint.length=strlen(in->psk_identity_hint); 254 a.psk_identity_hint.type = V_ASN1_OCTET_STRING;
266 a.psk_identity_hint.type=V_ASN1_OCTET_STRING; 255 a.psk_identity_hint.data = (unsigned char *)(in->psk_identity_hint);
267 a.psk_identity_hint.data=(unsigned char *)(in->psk_identity_hint); 256 }
268 } 257 if (in->psk_identity) {
269 if (in->psk_identity) 258 a.psk_identity.length = strlen(in->psk_identity);
270 { 259 a.psk_identity.type = V_ASN1_OCTET_STRING;
271 a.psk_identity.length=strlen(in->psk_identity); 260 a.psk_identity.data = (unsigned char *)(in->psk_identity);
272 a.psk_identity.type=V_ASN1_OCTET_STRING; 261 }
273 a.psk_identity.data=(unsigned char *)(in->psk_identity);
274 }
275#endif /* OPENSSL_NO_PSK */ 262#endif /* OPENSSL_NO_PSK */
276#ifndef OPENSSL_NO_SRP 263#ifndef OPENSSL_NO_SRP
277 if (in->srp_username) 264 if (in->srp_username) {
278 { 265 a.srp_username.length = strlen(in->srp_username);
279 a.srp_username.length=strlen(in->srp_username); 266 a.srp_username.type = V_ASN1_OCTET_STRING;
280 a.srp_username.type=V_ASN1_OCTET_STRING; 267 a.srp_username.data = (unsigned char *)(in->srp_username);
281 a.srp_username.data=(unsigned char *)(in->srp_username); 268 }
282 }
283#endif /* OPENSSL_NO_SRP */ 269#endif /* OPENSSL_NO_SRP */
284 270
285 M_ASN1_I2D_len(&(a.version), i2d_ASN1_INTEGER); 271 M_ASN1_I2D_len(&(a.version), i2d_ASN1_INTEGER);
@@ -289,41 +275,41 @@ int i2d_SSL_SESSION(SSL_SESSION *in, unsigned char **pp)
289 M_ASN1_I2D_len(&(a.master_key), i2d_ASN1_OCTET_STRING); 275 M_ASN1_I2D_len(&(a.master_key), i2d_ASN1_OCTET_STRING);
290#ifndef OPENSSL_NO_KRB5 276#ifndef OPENSSL_NO_KRB5
291 if (in->krb5_client_princ_len) 277 if (in->krb5_client_princ_len)
292 M_ASN1_I2D_len(&(a.krb5_princ), i2d_ASN1_OCTET_STRING); 278 M_ASN1_I2D_len(&(a.krb5_princ), i2d_ASN1_OCTET_STRING);
293#endif /* OPENSSL_NO_KRB5 */ 279#endif /* OPENSSL_NO_KRB5 */
294 if (in->key_arg_length > 0) 280 if (in->key_arg_length > 0)
295 M_ASN1_I2D_len_IMP_opt(&(a.key_arg),i2d_ASN1_OCTET_STRING); 281 M_ASN1_I2D_len_IMP_opt(&(a.key_arg), i2d_ASN1_OCTET_STRING);
296 if (in->time != 0L) 282 if (in->time != 0L)
297 M_ASN1_I2D_len_EXP_opt(&(a.time),i2d_ASN1_INTEGER,1,v1); 283 M_ASN1_I2D_len_EXP_opt(&(a.time), i2d_ASN1_INTEGER, 1, v1);
298 if (in->timeout != 0L) 284 if (in->timeout != 0L)
299 M_ASN1_I2D_len_EXP_opt(&(a.timeout),i2d_ASN1_INTEGER,2,v2); 285 M_ASN1_I2D_len_EXP_opt(&(a.timeout), i2d_ASN1_INTEGER, 2, v2);
300 if (in->peer != NULL) 286 if (in->peer != NULL)
301 M_ASN1_I2D_len_EXP_opt(in->peer,i2d_X509,3,v3); 287 M_ASN1_I2D_len_EXP_opt(in->peer, i2d_X509, 3, v3);
302 M_ASN1_I2D_len_EXP_opt(&a.session_id_context,i2d_ASN1_OCTET_STRING,4,v4); 288 M_ASN1_I2D_len_EXP_opt(&a.session_id_context, i2d_ASN1_OCTET_STRING, 4, v4);
303 if (in->verify_result != X509_V_OK) 289 if (in->verify_result != X509_V_OK)
304 M_ASN1_I2D_len_EXP_opt(&(a.verify_result),i2d_ASN1_INTEGER,5,v5); 290 M_ASN1_I2D_len_EXP_opt(&(a.verify_result), i2d_ASN1_INTEGER, 5, v5);
305 291
306#ifndef OPENSSL_NO_TLSEXT 292#ifndef OPENSSL_NO_TLSEXT
307 if (in->tlsext_tick_lifetime_hint > 0) 293 if (in->tlsext_tick_lifetime_hint > 0)
308 M_ASN1_I2D_len_EXP_opt(&a.tlsext_tick_lifetime, i2d_ASN1_INTEGER,9,v9); 294 M_ASN1_I2D_len_EXP_opt(&a.tlsext_tick_lifetime, i2d_ASN1_INTEGER, 9, v9);
309 if (in->tlsext_tick) 295 if (in->tlsext_tick)
310 M_ASN1_I2D_len_EXP_opt(&(a.tlsext_tick), i2d_ASN1_OCTET_STRING,10,v10); 296 M_ASN1_I2D_len_EXP_opt(&(a.tlsext_tick), i2d_ASN1_OCTET_STRING, 10, v10);
311 if (in->tlsext_hostname) 297 if (in->tlsext_hostname)
312 M_ASN1_I2D_len_EXP_opt(&(a.tlsext_hostname), i2d_ASN1_OCTET_STRING,6,v6); 298 M_ASN1_I2D_len_EXP_opt(&(a.tlsext_hostname), i2d_ASN1_OCTET_STRING, 6, v6);
313#ifndef OPENSSL_NO_COMP 299#ifndef OPENSSL_NO_COMP
314 if (in->compress_meth) 300 if (in->compress_meth)
315 M_ASN1_I2D_len_EXP_opt(&(a.comp_id), i2d_ASN1_OCTET_STRING,11,v11); 301 M_ASN1_I2D_len_EXP_opt(&(a.comp_id), i2d_ASN1_OCTET_STRING, 11, v11);
316#endif 302#endif
317#endif /* OPENSSL_NO_TLSEXT */ 303#endif /* OPENSSL_NO_TLSEXT */
318#ifndef OPENSSL_NO_PSK 304#ifndef OPENSSL_NO_PSK
319 if (in->psk_identity_hint) 305 if (in->psk_identity_hint)
320 M_ASN1_I2D_len_EXP_opt(&(a.psk_identity_hint), i2d_ASN1_OCTET_STRING,7,v7); 306 M_ASN1_I2D_len_EXP_opt(&(a.psk_identity_hint), i2d_ASN1_OCTET_STRING, 7, v7);
321 if (in->psk_identity) 307 if (in->psk_identity)
322 M_ASN1_I2D_len_EXP_opt(&(a.psk_identity), i2d_ASN1_OCTET_STRING,8,v8); 308 M_ASN1_I2D_len_EXP_opt(&(a.psk_identity), i2d_ASN1_OCTET_STRING, 8, v8);
323#endif /* OPENSSL_NO_PSK */ 309#endif /* OPENSSL_NO_PSK */
324#ifndef OPENSSL_NO_SRP 310#ifndef OPENSSL_NO_SRP
325 if (in->srp_username) 311 if (in->srp_username)
326 M_ASN1_I2D_len_EXP_opt(&(a.srp_username), i2d_ASN1_OCTET_STRING,12,v12); 312 M_ASN1_I2D_len_EXP_opt(&(a.srp_username), i2d_ASN1_OCTET_STRING, 12, v12);
327#endif /* OPENSSL_NO_SRP */ 313#endif /* OPENSSL_NO_SRP */
328 314
329 M_ASN1_I2D_seq_total(); 315 M_ASN1_I2D_seq_total();
@@ -335,308 +321,296 @@ int i2d_SSL_SESSION(SSL_SESSION *in, unsigned char **pp)
335 M_ASN1_I2D_put(&(a.master_key), i2d_ASN1_OCTET_STRING); 321 M_ASN1_I2D_put(&(a.master_key), i2d_ASN1_OCTET_STRING);
336#ifndef OPENSSL_NO_KRB5 322#ifndef OPENSSL_NO_KRB5
337 if (in->krb5_client_princ_len) 323 if (in->krb5_client_princ_len)
338 M_ASN1_I2D_put(&(a.krb5_princ), i2d_ASN1_OCTET_STRING); 324 M_ASN1_I2D_put(&(a.krb5_princ), i2d_ASN1_OCTET_STRING);
339#endif /* OPENSSL_NO_KRB5 */ 325#endif /* OPENSSL_NO_KRB5 */
340 if (in->key_arg_length > 0) 326 if (in->key_arg_length > 0)
341 M_ASN1_I2D_put_IMP_opt(&(a.key_arg),i2d_ASN1_OCTET_STRING,0); 327 M_ASN1_I2D_put_IMP_opt(&(a.key_arg), i2d_ASN1_OCTET_STRING, 0);
342 if (in->time != 0L) 328 if (in->time != 0L)
343 M_ASN1_I2D_put_EXP_opt(&(a.time),i2d_ASN1_INTEGER,1,v1); 329 M_ASN1_I2D_put_EXP_opt(&(a.time), i2d_ASN1_INTEGER, 1, v1);
344 if (in->timeout != 0L) 330 if (in->timeout != 0L)
345 M_ASN1_I2D_put_EXP_opt(&(a.timeout),i2d_ASN1_INTEGER,2,v2); 331 M_ASN1_I2D_put_EXP_opt(&(a.timeout), i2d_ASN1_INTEGER, 2, v2);
346 if (in->peer != NULL) 332 if (in->peer != NULL)
347 M_ASN1_I2D_put_EXP_opt(in->peer,i2d_X509,3,v3); 333 M_ASN1_I2D_put_EXP_opt(in->peer, i2d_X509, 3, v3);
348 M_ASN1_I2D_put_EXP_opt(&a.session_id_context,i2d_ASN1_OCTET_STRING,4, 334 M_ASN1_I2D_put_EXP_opt(&a.session_id_context, i2d_ASN1_OCTET_STRING, 4,
349 v4); 335 v4);
350 if (in->verify_result != X509_V_OK) 336 if (in->verify_result != X509_V_OK)
351 M_ASN1_I2D_put_EXP_opt(&a.verify_result,i2d_ASN1_INTEGER,5,v5); 337 M_ASN1_I2D_put_EXP_opt(&a.verify_result, i2d_ASN1_INTEGER, 5, v5);
352#ifndef OPENSSL_NO_TLSEXT 338#ifndef OPENSSL_NO_TLSEXT
353 if (in->tlsext_hostname) 339 if (in->tlsext_hostname)
354 M_ASN1_I2D_put_EXP_opt(&(a.tlsext_hostname), i2d_ASN1_OCTET_STRING,6,v6); 340 M_ASN1_I2D_put_EXP_opt(&(a.tlsext_hostname), i2d_ASN1_OCTET_STRING, 6, v6);
355#endif /* OPENSSL_NO_TLSEXT */ 341#endif /* OPENSSL_NO_TLSEXT */
356#ifndef OPENSSL_NO_PSK 342#ifndef OPENSSL_NO_PSK
357 if (in->psk_identity_hint) 343 if (in->psk_identity_hint)
358 M_ASN1_I2D_put_EXP_opt(&(a.psk_identity_hint), i2d_ASN1_OCTET_STRING,7,v7); 344 M_ASN1_I2D_put_EXP_opt(&(a.psk_identity_hint), i2d_ASN1_OCTET_STRING, 7, v7);
359 if (in->psk_identity) 345 if (in->psk_identity)
360 M_ASN1_I2D_put_EXP_opt(&(a.psk_identity), i2d_ASN1_OCTET_STRING,8,v8); 346 M_ASN1_I2D_put_EXP_opt(&(a.psk_identity), i2d_ASN1_OCTET_STRING, 8, v8);
361#endif /* OPENSSL_NO_PSK */ 347#endif /* OPENSSL_NO_PSK */
362#ifndef OPENSSL_NO_TLSEXT 348#ifndef OPENSSL_NO_TLSEXT
363 if (in->tlsext_tick_lifetime_hint > 0) 349 if (in->tlsext_tick_lifetime_hint > 0)
364 M_ASN1_I2D_put_EXP_opt(&a.tlsext_tick_lifetime, i2d_ASN1_INTEGER,9,v9); 350 M_ASN1_I2D_put_EXP_opt(&a.tlsext_tick_lifetime, i2d_ASN1_INTEGER, 9, v9);
365 if (in->tlsext_tick) 351 if (in->tlsext_tick)
366 M_ASN1_I2D_put_EXP_opt(&(a.tlsext_tick), i2d_ASN1_OCTET_STRING,10,v10); 352 M_ASN1_I2D_put_EXP_opt(&(a.tlsext_tick), i2d_ASN1_OCTET_STRING, 10, v10);
367#endif /* OPENSSL_NO_TLSEXT */ 353#endif /* OPENSSL_NO_TLSEXT */
368#ifndef OPENSSL_NO_COMP 354#ifndef OPENSSL_NO_COMP
369 if (in->compress_meth) 355 if (in->compress_meth)
370 M_ASN1_I2D_put_EXP_opt(&(a.comp_id), i2d_ASN1_OCTET_STRING,11,v11); 356 M_ASN1_I2D_put_EXP_opt(&(a.comp_id), i2d_ASN1_OCTET_STRING, 11, v11);
371#endif 357#endif
372#ifndef OPENSSL_NO_SRP 358#ifndef OPENSSL_NO_SRP
373 if (in->srp_username) 359 if (in->srp_username)
374 M_ASN1_I2D_put_EXP_opt(&(a.srp_username), i2d_ASN1_OCTET_STRING,12,v12); 360 M_ASN1_I2D_put_EXP_opt(&(a.srp_username), i2d_ASN1_OCTET_STRING, 12, v12);
375#endif /* OPENSSL_NO_SRP */ 361#endif /* OPENSSL_NO_SRP */
376 M_ASN1_I2D_finish(); 362 M_ASN1_I2D_finish();
377 } 363}
378 364
379SSL_SESSION *d2i_SSL_SESSION(SSL_SESSION **a, const unsigned char **pp, 365SSL_SESSION
380 long length) 366*d2i_SSL_SESSION(SSL_SESSION **a, const unsigned char **pp,
381 { 367long length)
382 int ssl_version=0,i; 368{
369 int ssl_version = 0, i;
383 long id; 370 long id;
384 ASN1_INTEGER ai,*aip; 371 ASN1_INTEGER ai, *aip;
385 ASN1_OCTET_STRING os,*osp; 372 ASN1_OCTET_STRING os, *osp;
386 M_ASN1_D2I_vars(a,SSL_SESSION *,SSL_SESSION_new); 373 M_ASN1_D2I_vars(a, SSL_SESSION *, SSL_SESSION_new);
387 374
388 aip= &ai; 375 aip = &ai;
389 osp= &os; 376 osp = &os;
390 377
391 M_ASN1_D2I_Init(); 378 M_ASN1_D2I_Init();
392 M_ASN1_D2I_start_sequence(); 379 M_ASN1_D2I_start_sequence();
393 380
394 ai.data=NULL; ai.length=0; 381 ai.data = NULL;
395 M_ASN1_D2I_get_x(ASN1_INTEGER,aip,d2i_ASN1_INTEGER); 382 ai.length = 0;
396 if (ai.data != NULL) { OPENSSL_free(ai.data); ai.data=NULL; ai.length=0; } 383 M_ASN1_D2I_get_x(ASN1_INTEGER, aip, d2i_ASN1_INTEGER);
384 if (ai.data != NULL) {
385 OPENSSL_free(ai.data);
386 ai.data = NULL;
387 ai.length = 0;
388 }
397 389
398 /* we don't care about the version right now :-) */ 390 /* we don't care about the version right now :-) */
399 M_ASN1_D2I_get_x(ASN1_INTEGER,aip,d2i_ASN1_INTEGER); 391 M_ASN1_D2I_get_x(ASN1_INTEGER, aip, d2i_ASN1_INTEGER);
400 ssl_version=(int)ASN1_INTEGER_get(aip); 392 ssl_version = (int)ASN1_INTEGER_get(aip);
401 ret->ssl_version=ssl_version; 393 ret->ssl_version = ssl_version;
402 if (ai.data != NULL) { OPENSSL_free(ai.data); ai.data=NULL; ai.length=0; } 394 if (ai.data != NULL) {
403 395 OPENSSL_free(ai.data);
404 os.data=NULL; os.length=0; 396 ai.data = NULL;
405 M_ASN1_D2I_get_x(ASN1_OCTET_STRING,osp,d2i_ASN1_OCTET_STRING); 397 ai.length = 0;
406 if (ssl_version == SSL2_VERSION) 398 }
407 { 399
408 if (os.length != 3) 400 os.data = NULL;
409 { 401 os.length = 0;
410 c.error=SSL_R_CIPHER_CODE_WRONG_LENGTH; 402 M_ASN1_D2I_get_x(ASN1_OCTET_STRING, osp, d2i_ASN1_OCTET_STRING);
403 if (ssl_version == SSL2_VERSION) {
404 if (os.length != 3) {
405 c.error = SSL_R_CIPHER_CODE_WRONG_LENGTH;
411 goto err; 406 goto err;
412 }
413 id=0x02000000L|
414 ((unsigned long)os.data[0]<<16L)|
415 ((unsigned long)os.data[1]<< 8L)|
416 (unsigned long)os.data[2];
417 } 407 }
418 else if ((ssl_version>>8) >= SSL3_VERSION_MAJOR) 408 id = 0x02000000L|
419 { 409 ((unsigned long)os.data[0]<<16L)|
420 if (os.length != 2) 410 ((unsigned long)os.data[1]<< 8L)|
421 { 411 (unsigned long)os.data[2];
422 c.error=SSL_R_CIPHER_CODE_WRONG_LENGTH; 412 } else if ((ssl_version >> 8) >= SSL3_VERSION_MAJOR) {
413 if (os.length != 2) {
414 c.error = SSL_R_CIPHER_CODE_WRONG_LENGTH;
423 goto err; 415 goto err;
424 }
425 id=0x03000000L|
426 ((unsigned long)os.data[0]<<8L)|
427 (unsigned long)os.data[1];
428 } 416 }
429 else 417 id = 0x03000000L|
430 { 418 ((unsigned long)os.data[0]<<8L)|
431 c.error=SSL_R_UNKNOWN_SSL_VERSION; 419 (unsigned long)os.data[1];
420 } else {
421 c.error = SSL_R_UNKNOWN_SSL_VERSION;
432 goto err; 422 goto err;
433 } 423 }
434 424
435 ret->cipher=NULL; 425 ret->cipher = NULL;
436 ret->cipher_id=id; 426 ret->cipher_id = id;
437 427
438 M_ASN1_D2I_get_x(ASN1_OCTET_STRING,osp,d2i_ASN1_OCTET_STRING); 428 M_ASN1_D2I_get_x(ASN1_OCTET_STRING, osp, d2i_ASN1_OCTET_STRING);
439 if ((ssl_version>>8) >= SSL3_VERSION_MAJOR) 429 if ((ssl_version >> 8) >= SSL3_VERSION_MAJOR)
440 i=SSL3_MAX_SSL_SESSION_ID_LENGTH; 430 i = SSL3_MAX_SSL_SESSION_ID_LENGTH;
441 else /* if (ssl_version>>8 == SSL2_VERSION_MAJOR) */ 431 else /* if (ssl_version>>8 == SSL2_VERSION_MAJOR) */
442 i=SSL2_MAX_SSL_SESSION_ID_LENGTH; 432 i = SSL2_MAX_SSL_SESSION_ID_LENGTH;
443 433
444 if (os.length > i) 434 if (os.length > i)
445 os.length = i; 435 os.length = i;
446 if (os.length > (int)sizeof(ret->session_id)) /* can't happen */ 436 if (os.length > (int)sizeof(ret->session_id)) /* can't happen */
447 os.length = sizeof(ret->session_id); 437 os.length = sizeof(ret->session_id);
448 438
449 ret->session_id_length=os.length; 439 ret->session_id_length = os.length;
450 OPENSSL_assert(os.length <= (int)sizeof(ret->session_id)); 440 OPENSSL_assert(os.length <= (int)sizeof(ret->session_id));
451 memcpy(ret->session_id,os.data,os.length); 441 memcpy(ret->session_id, os.data, os.length);
452 442
453 M_ASN1_D2I_get_x(ASN1_OCTET_STRING,osp,d2i_ASN1_OCTET_STRING); 443 M_ASN1_D2I_get_x(ASN1_OCTET_STRING, osp, d2i_ASN1_OCTET_STRING);
454 if (os.length > SSL_MAX_MASTER_KEY_LENGTH) 444 if (os.length > SSL_MAX_MASTER_KEY_LENGTH)
455 ret->master_key_length=SSL_MAX_MASTER_KEY_LENGTH; 445 ret->master_key_length = SSL_MAX_MASTER_KEY_LENGTH;
456 else 446 else
457 ret->master_key_length=os.length; 447 ret->master_key_length = os.length;
458 memcpy(ret->master_key,os.data,ret->master_key_length); 448 memcpy(ret->master_key, os.data, ret->master_key_length);
459 449
460 os.length=0; 450 os.length = 0;
461 451
462#ifndef OPENSSL_NO_KRB5 452#ifndef OPENSSL_NO_KRB5
463 os.length=0; 453 os.length = 0;
464 M_ASN1_D2I_get_opt(osp,d2i_ASN1_OCTET_STRING,V_ASN1_OCTET_STRING); 454 M_ASN1_D2I_get_opt(osp, d2i_ASN1_OCTET_STRING, V_ASN1_OCTET_STRING);
465 if (os.data) 455 if (os.data) {
466 { 456 if (os.length > SSL_MAX_KRB5_PRINCIPAL_LENGTH)
467 if (os.length > SSL_MAX_KRB5_PRINCIPAL_LENGTH) 457 ret->krb5_client_princ_len = 0;
468 ret->krb5_client_princ_len=0;
469 else 458 else
470 ret->krb5_client_princ_len=os.length; 459 ret->krb5_client_princ_len = os.length;
471 memcpy(ret->krb5_client_princ,os.data,ret->krb5_client_princ_len); 460 memcpy(ret->krb5_client_princ, os.data, ret->krb5_client_princ_len);
472 OPENSSL_free(os.data); 461 OPENSSL_free(os.data);
473 os.data = NULL; 462 os.data = NULL;
474 os.length = 0; 463 os.length = 0;
475 } 464 } else
476 else 465 ret->krb5_client_princ_len = 0;
477 ret->krb5_client_princ_len=0;
478#endif /* OPENSSL_NO_KRB5 */ 466#endif /* OPENSSL_NO_KRB5 */
479 467
480 M_ASN1_D2I_get_IMP_opt(osp,d2i_ASN1_OCTET_STRING,0,V_ASN1_OCTET_STRING); 468 M_ASN1_D2I_get_IMP_opt(osp, d2i_ASN1_OCTET_STRING, 0, V_ASN1_OCTET_STRING);
481 if (os.length > SSL_MAX_KEY_ARG_LENGTH) 469 if (os.length > SSL_MAX_KEY_ARG_LENGTH)
482 ret->key_arg_length=SSL_MAX_KEY_ARG_LENGTH; 470 ret->key_arg_length = SSL_MAX_KEY_ARG_LENGTH;
483 else 471 else
484 ret->key_arg_length=os.length; 472 ret->key_arg_length = os.length;
485 memcpy(ret->key_arg,os.data,ret->key_arg_length); 473 memcpy(ret->key_arg, os.data, ret->key_arg_length);
486 if (os.data != NULL) OPENSSL_free(os.data); 474 if (os.data != NULL)
487 475 OPENSSL_free(os.data);
488 ai.length=0;
489 M_ASN1_D2I_get_EXP_opt(aip,d2i_ASN1_INTEGER,1);
490 if (ai.data != NULL)
491 {
492 ret->time=ASN1_INTEGER_get(aip);
493 OPENSSL_free(ai.data); ai.data=NULL; ai.length=0;
494 }
495 else
496 ret->time=(unsigned long)time(NULL);
497
498 ai.length=0;
499 M_ASN1_D2I_get_EXP_opt(aip,d2i_ASN1_INTEGER,2);
500 if (ai.data != NULL)
501 {
502 ret->timeout=ASN1_INTEGER_get(aip);
503 OPENSSL_free(ai.data); ai.data=NULL; ai.length=0;
504 }
505 else
506 ret->timeout=3;
507 476
508 if (ret->peer != NULL) 477 ai.length = 0;
509 { 478 M_ASN1_D2I_get_EXP_opt(aip, d2i_ASN1_INTEGER, 1);
479 if (ai.data != NULL) {
480 ret->time = ASN1_INTEGER_get(aip);
481 OPENSSL_free(ai.data);
482 ai.data = NULL;
483 ai.length = 0;
484 } else
485 ret->time = (unsigned long)time(NULL);
486
487 ai.length = 0;
488 M_ASN1_D2I_get_EXP_opt(aip, d2i_ASN1_INTEGER, 2);
489 if (ai.data != NULL) {
490 ret->timeout = ASN1_INTEGER_get(aip);
491 OPENSSL_free(ai.data);
492 ai.data = NULL;
493 ai.length = 0;
494 } else
495 ret->timeout = 3;
496
497 if (ret->peer != NULL) {
510 X509_free(ret->peer); 498 X509_free(ret->peer);
511 ret->peer=NULL; 499 ret->peer = NULL;
512 } 500 }
513 M_ASN1_D2I_get_EXP_opt(ret->peer,d2i_X509,3); 501 M_ASN1_D2I_get_EXP_opt(ret->peer, d2i_X509, 3);
514 502
515 os.length=0; 503 os.length = 0;
516 os.data=NULL; 504 os.data = NULL;
517 M_ASN1_D2I_get_EXP_opt(osp,d2i_ASN1_OCTET_STRING,4); 505 M_ASN1_D2I_get_EXP_opt(osp, d2i_ASN1_OCTET_STRING, 4);
518 506
519 if(os.data != NULL) 507 if (os.data != NULL) {
520 { 508 if (os.length > SSL_MAX_SID_CTX_LENGTH) {
521 if (os.length > SSL_MAX_SID_CTX_LENGTH) 509 c.error = SSL_R_BAD_LENGTH;
522 { 510 goto err;
523 c.error=SSL_R_BAD_LENGTH; 511 } else {
524 goto err; 512 ret->sid_ctx_length = os.length;
525 } 513 memcpy(ret->sid_ctx, os.data, os.length);
526 else
527 {
528 ret->sid_ctx_length=os.length;
529 memcpy(ret->sid_ctx,os.data,os.length);
530 }
531 OPENSSL_free(os.data); os.data=NULL; os.length=0;
532 }
533 else
534 ret->sid_ctx_length=0;
535
536 ai.length=0;
537 M_ASN1_D2I_get_EXP_opt(aip,d2i_ASN1_INTEGER,5);
538 if (ai.data != NULL)
539 {
540 ret->verify_result=ASN1_INTEGER_get(aip);
541 OPENSSL_free(ai.data); ai.data=NULL; ai.length=0;
542 } 514 }
543 else 515 OPENSSL_free(os.data);
544 ret->verify_result=X509_V_OK; 516 os.data = NULL;
517 os.length = 0;
518 } else
519 ret->sid_ctx_length = 0;
520
521 ai.length = 0;
522 M_ASN1_D2I_get_EXP_opt(aip, d2i_ASN1_INTEGER, 5);
523 if (ai.data != NULL) {
524 ret->verify_result = ASN1_INTEGER_get(aip);
525 OPENSSL_free(ai.data);
526 ai.data = NULL;
527 ai.length = 0;
528 } else
529 ret->verify_result = X509_V_OK;
545 530
546#ifndef OPENSSL_NO_TLSEXT 531#ifndef OPENSSL_NO_TLSEXT
547 os.length=0; 532 os.length = 0;
548 os.data=NULL; 533 os.data = NULL;
549 M_ASN1_D2I_get_EXP_opt(osp,d2i_ASN1_OCTET_STRING,6); 534 M_ASN1_D2I_get_EXP_opt(osp, d2i_ASN1_OCTET_STRING, 6);
550 if (os.data) 535 if (os.data) {
551 {
552 ret->tlsext_hostname = BUF_strndup((char *)os.data, os.length); 536 ret->tlsext_hostname = BUF_strndup((char *)os.data, os.length);
553 OPENSSL_free(os.data); 537 OPENSSL_free(os.data);
554 os.data = NULL; 538 os.data = NULL;
555 os.length = 0; 539 os.length = 0;
556 } 540 } else
557 else 541 ret->tlsext_hostname = NULL;
558 ret->tlsext_hostname=NULL;
559#endif /* OPENSSL_NO_TLSEXT */ 542#endif /* OPENSSL_NO_TLSEXT */
560 543
561#ifndef OPENSSL_NO_PSK 544#ifndef OPENSSL_NO_PSK
562 os.length=0; 545 os.length = 0;
563 os.data=NULL; 546 os.data = NULL;
564 M_ASN1_D2I_get_EXP_opt(osp,d2i_ASN1_OCTET_STRING,7); 547 M_ASN1_D2I_get_EXP_opt(osp, d2i_ASN1_OCTET_STRING, 7);
565 if (os.data) 548 if (os.data) {
566 {
567 ret->psk_identity_hint = BUF_strndup((char *)os.data, os.length); 549 ret->psk_identity_hint = BUF_strndup((char *)os.data, os.length);
568 OPENSSL_free(os.data); 550 OPENSSL_free(os.data);
569 os.data = NULL; 551 os.data = NULL;
570 os.length = 0; 552 os.length = 0;
571 } 553 } else
572 else 554 ret->psk_identity_hint = NULL;
573 ret->psk_identity_hint=NULL;
574 555
575 os.length=0; 556 os.length = 0;
576 os.data=NULL; 557 os.data = NULL;
577 M_ASN1_D2I_get_EXP_opt(osp,d2i_ASN1_OCTET_STRING,8); 558 M_ASN1_D2I_get_EXP_opt(osp, d2i_ASN1_OCTET_STRING, 8);
578 if (os.data) 559 if (os.data) {
579 {
580 ret->psk_identity = BUF_strndup((char *)os.data, os.length); 560 ret->psk_identity = BUF_strndup((char *)os.data, os.length);
581 OPENSSL_free(os.data); 561 OPENSSL_free(os.data);
582 os.data = NULL; 562 os.data = NULL;
583 os.length = 0; 563 os.length = 0;
584 } 564 } else
585 else 565 ret->psk_identity = NULL;
586 ret->psk_identity=NULL;
587#endif /* OPENSSL_NO_PSK */ 566#endif /* OPENSSL_NO_PSK */
588 567
589#ifndef OPENSSL_NO_TLSEXT 568#ifndef OPENSSL_NO_TLSEXT
590 ai.length=0; 569 ai.length = 0;
591 M_ASN1_D2I_get_EXP_opt(aip,d2i_ASN1_INTEGER,9); 570 M_ASN1_D2I_get_EXP_opt(aip, d2i_ASN1_INTEGER, 9);
592 if (ai.data != NULL) 571 if (ai.data != NULL) {
593 { 572 ret->tlsext_tick_lifetime_hint = ASN1_INTEGER_get(aip);
594 ret->tlsext_tick_lifetime_hint=ASN1_INTEGER_get(aip); 573 OPENSSL_free(ai.data);
595 OPENSSL_free(ai.data); ai.data=NULL; ai.length=0; 574 ai.data = NULL;
596 } 575 ai.length = 0;
597 else if (ret->tlsext_ticklen && ret->session_id_length) 576 } else if (ret->tlsext_ticklen && ret->session_id_length)
598 ret->tlsext_tick_lifetime_hint = -1; 577 ret->tlsext_tick_lifetime_hint = -1;
599 else 578 else
600 ret->tlsext_tick_lifetime_hint=0; 579 ret->tlsext_tick_lifetime_hint = 0;
601 os.length=0; 580 os.length = 0;
602 os.data=NULL; 581 os.data = NULL;
603 M_ASN1_D2I_get_EXP_opt(osp,d2i_ASN1_OCTET_STRING,10); 582 M_ASN1_D2I_get_EXP_opt(osp, d2i_ASN1_OCTET_STRING, 10);
604 if (os.data) 583 if (os.data) {
605 {
606 ret->tlsext_tick = os.data; 584 ret->tlsext_tick = os.data;
607 ret->tlsext_ticklen = os.length; 585 ret->tlsext_ticklen = os.length;
608 os.data = NULL; 586 os.data = NULL;
609 os.length = 0; 587 os.length = 0;
610 } 588 } else
611 else 589 ret->tlsext_tick = NULL;
612 ret->tlsext_tick=NULL;
613#endif /* OPENSSL_NO_TLSEXT */ 590#endif /* OPENSSL_NO_TLSEXT */
614#ifndef OPENSSL_NO_COMP 591#ifndef OPENSSL_NO_COMP
615 os.length=0; 592 os.length = 0;
616 os.data=NULL; 593 os.data = NULL;
617 M_ASN1_D2I_get_EXP_opt(osp,d2i_ASN1_OCTET_STRING,11); 594 M_ASN1_D2I_get_EXP_opt(osp, d2i_ASN1_OCTET_STRING, 11);
618 if (os.data) 595 if (os.data) {
619 {
620 ret->compress_meth = os.data[0]; 596 ret->compress_meth = os.data[0];
621 OPENSSL_free(os.data); 597 OPENSSL_free(os.data);
622 os.data = NULL; 598 os.data = NULL;
623 } 599 }
624#endif 600#endif
625 601
626#ifndef OPENSSL_NO_SRP 602#ifndef OPENSSL_NO_SRP
627 os.length=0; 603 os.length = 0;
628 os.data=NULL; 604 os.data = NULL;
629 M_ASN1_D2I_get_EXP_opt(osp,d2i_ASN1_OCTET_STRING,12); 605 M_ASN1_D2I_get_EXP_opt(osp, d2i_ASN1_OCTET_STRING, 12);
630 if (os.data) 606 if (os.data) {
631 {
632 ret->srp_username = BUF_strndup((char *)os.data, os.length); 607 ret->srp_username = BUF_strndup((char *)os.data, os.length);
633 OPENSSL_free(os.data); 608 OPENSSL_free(os.data);
634 os.data = NULL; 609 os.data = NULL;
635 os.length = 0; 610 os.length = 0;
636 } 611 } else
637 else 612 ret->srp_username = NULL;
638 ret->srp_username=NULL;
639#endif /* OPENSSL_NO_SRP */ 613#endif /* OPENSSL_NO_SRP */
640 614
641 M_ASN1_D2I_Finish(a,SSL_SESSION_free,SSL_F_D2I_SSL_SESSION); 615 M_ASN1_D2I_Finish(a, SSL_SESSION_free, SSL_F_D2I_SSL_SESSION);
642 } 616}
diff --git a/src/lib/libssl/ssl_cert.c b/src/lib/libssl/ssl_cert.c
index 1aaddc351f..79eb4ee031 100644
--- a/src/lib/libssl/ssl_cert.c
+++ b/src/lib/libssl/ssl_cert.c
@@ -132,36 +132,36 @@
132#include <openssl/bn.h> 132#include <openssl/bn.h>
133#include "ssl_locl.h" 133#include "ssl_locl.h"
134 134
135int SSL_get_ex_data_X509_STORE_CTX_idx(void) 135int
136 { 136SSL_get_ex_data_X509_STORE_CTX_idx(void)
137 static volatile int ssl_x509_store_ctx_idx= -1; 137{
138 static volatile int ssl_x509_store_ctx_idx = -1;
138 int got_write_lock = 0; 139 int got_write_lock = 0;
139 140
140 CRYPTO_r_lock(CRYPTO_LOCK_SSL_CTX); 141 CRYPTO_r_lock(CRYPTO_LOCK_SSL_CTX);
141 142
142 if (ssl_x509_store_ctx_idx < 0) 143 if (ssl_x509_store_ctx_idx < 0) {
143 {
144 CRYPTO_r_unlock(CRYPTO_LOCK_SSL_CTX); 144 CRYPTO_r_unlock(CRYPTO_LOCK_SSL_CTX);
145 CRYPTO_w_lock(CRYPTO_LOCK_SSL_CTX); 145 CRYPTO_w_lock(CRYPTO_LOCK_SSL_CTX);
146 got_write_lock = 1; 146 got_write_lock = 1;
147 147
148 if (ssl_x509_store_ctx_idx < 0) 148 if (ssl_x509_store_ctx_idx < 0) {
149 { 149 ssl_x509_store_ctx_idx = X509_STORE_CTX_get_ex_new_index(
150 ssl_x509_store_ctx_idx=X509_STORE_CTX_get_ex_new_index( 150 0, "SSL for verify callback", NULL, NULL, NULL);
151 0,"SSL for verify callback",NULL,NULL,NULL);
152 }
153 } 151 }
152 }
154 153
155 if (got_write_lock) 154 if (got_write_lock)
156 CRYPTO_w_unlock(CRYPTO_LOCK_SSL_CTX); 155 CRYPTO_w_unlock(CRYPTO_LOCK_SSL_CTX);
157 else 156 else
158 CRYPTO_r_unlock(CRYPTO_LOCK_SSL_CTX); 157 CRYPTO_r_unlock(CRYPTO_LOCK_SSL_CTX);
159 158
160 return ssl_x509_store_ctx_idx; 159 return ssl_x509_store_ctx_idx;
161 } 160}
162 161
163static void ssl_cert_set_default_md(CERT *cert) 162static void
164 { 163ssl_cert_set_default_md(CERT *cert)
164{
165 /* Set digest values to defaults */ 165 /* Set digest values to defaults */
166#ifndef OPENSSL_NO_DSA 166#ifndef OPENSSL_NO_DSA
167 cert->pkeys[SSL_PKEY_DSA_SIGN].digest = EVP_sha1(); 167 cert->pkeys[SSL_PKEY_DSA_SIGN].digest = EVP_sha1();
@@ -173,37 +173,37 @@ static void ssl_cert_set_default_md(CERT *cert)
173#ifndef OPENSSL_NO_ECDSA 173#ifndef OPENSSL_NO_ECDSA
174 cert->pkeys[SSL_PKEY_ECC].digest = EVP_sha1(); 174 cert->pkeys[SSL_PKEY_ECC].digest = EVP_sha1();
175#endif 175#endif
176 } 176}
177 177
178CERT *ssl_cert_new(void) 178CERT
179 { 179*ssl_cert_new(void)
180{
180 CERT *ret; 181 CERT *ret;
181 182
182 ret=(CERT *)OPENSSL_malloc(sizeof(CERT)); 183 ret = (CERT *)OPENSSL_malloc(sizeof(CERT));
183 if (ret == NULL) 184 if (ret == NULL) {
184 { 185 SSLerr(SSL_F_SSL_CERT_NEW, ERR_R_MALLOC_FAILURE);
185 SSLerr(SSL_F_SSL_CERT_NEW,ERR_R_MALLOC_FAILURE); 186 return (NULL);
186 return(NULL); 187 }
187 } 188 memset(ret, 0, sizeof(CERT));
188 memset(ret,0,sizeof(CERT));
189 189
190 ret->key= &(ret->pkeys[SSL_PKEY_RSA_ENC]); 190 ret->key = &(ret->pkeys[SSL_PKEY_RSA_ENC]);
191 ret->references=1; 191 ret->references = 1;
192 ssl_cert_set_default_md(ret); 192 ssl_cert_set_default_md(ret);
193 return(ret); 193 return (ret);
194 } 194}
195 195
196CERT *ssl_cert_dup(CERT *cert) 196CERT
197 { 197*ssl_cert_dup(CERT *cert)
198{
198 CERT *ret; 199 CERT *ret;
199 int i; 200 int i;
200 201
201 ret = (CERT *)OPENSSL_malloc(sizeof(CERT)); 202 ret = (CERT *)OPENSSL_malloc(sizeof(CERT));
202 if (ret == NULL) 203 if (ret == NULL) {
203 {
204 SSLerr(SSL_F_SSL_CERT_DUP, ERR_R_MALLOC_FAILURE); 204 SSLerr(SSL_F_SSL_CERT_DUP, ERR_R_MALLOC_FAILURE);
205 return(NULL); 205 return (NULL);
206 } 206 }
207 207
208 memset(ret, 0, sizeof(CERT)); 208 memset(ret, 0, sizeof(CERT));
209 209
@@ -218,77 +218,64 @@ CERT *ssl_cert_dup(CERT *cert)
218 ret->export_mask_a = cert->export_mask_a; 218 ret->export_mask_a = cert->export_mask_a;
219 219
220#ifndef OPENSSL_NO_RSA 220#ifndef OPENSSL_NO_RSA
221 if (cert->rsa_tmp != NULL) 221 if (cert->rsa_tmp != NULL) {
222 {
223 RSA_up_ref(cert->rsa_tmp); 222 RSA_up_ref(cert->rsa_tmp);
224 ret->rsa_tmp = cert->rsa_tmp; 223 ret->rsa_tmp = cert->rsa_tmp;
225 } 224 }
226 ret->rsa_tmp_cb = cert->rsa_tmp_cb; 225 ret->rsa_tmp_cb = cert->rsa_tmp_cb;
227#endif 226#endif
228 227
229#ifndef OPENSSL_NO_DH 228#ifndef OPENSSL_NO_DH
230 if (cert->dh_tmp != NULL) 229 if (cert->dh_tmp != NULL) {
231 {
232 ret->dh_tmp = DHparams_dup(cert->dh_tmp); 230 ret->dh_tmp = DHparams_dup(cert->dh_tmp);
233 if (ret->dh_tmp == NULL) 231 if (ret->dh_tmp == NULL) {
234 {
235 SSLerr(SSL_F_SSL_CERT_DUP, ERR_R_DH_LIB); 232 SSLerr(SSL_F_SSL_CERT_DUP, ERR_R_DH_LIB);
236 goto err; 233 goto err;
237 } 234 }
238 if (cert->dh_tmp->priv_key) 235 if (cert->dh_tmp->priv_key) {
239 {
240 BIGNUM *b = BN_dup(cert->dh_tmp->priv_key); 236 BIGNUM *b = BN_dup(cert->dh_tmp->priv_key);
241 if (!b) 237 if (!b) {
242 {
243 SSLerr(SSL_F_SSL_CERT_DUP, ERR_R_BN_LIB); 238 SSLerr(SSL_F_SSL_CERT_DUP, ERR_R_BN_LIB);
244 goto err; 239 goto err;
245 }
246 ret->dh_tmp->priv_key = b;
247 } 240 }
248 if (cert->dh_tmp->pub_key) 241 ret->dh_tmp->priv_key = b;
249 { 242 }
243 if (cert->dh_tmp->pub_key) {
250 BIGNUM *b = BN_dup(cert->dh_tmp->pub_key); 244 BIGNUM *b = BN_dup(cert->dh_tmp->pub_key);
251 if (!b) 245 if (!b) {
252 {
253 SSLerr(SSL_F_SSL_CERT_DUP, ERR_R_BN_LIB); 246 SSLerr(SSL_F_SSL_CERT_DUP, ERR_R_BN_LIB);
254 goto err; 247 goto err;
255 }
256 ret->dh_tmp->pub_key = b;
257 } 248 }
249 ret->dh_tmp->pub_key = b;
258 } 250 }
251 }
259 ret->dh_tmp_cb = cert->dh_tmp_cb; 252 ret->dh_tmp_cb = cert->dh_tmp_cb;
260#endif 253#endif
261 254
262#ifndef OPENSSL_NO_ECDH 255#ifndef OPENSSL_NO_ECDH
263 if (cert->ecdh_tmp) 256 if (cert->ecdh_tmp) {
264 {
265 ret->ecdh_tmp = EC_KEY_dup(cert->ecdh_tmp); 257 ret->ecdh_tmp = EC_KEY_dup(cert->ecdh_tmp);
266 if (ret->ecdh_tmp == NULL) 258 if (ret->ecdh_tmp == NULL) {
267 {
268 SSLerr(SSL_F_SSL_CERT_DUP, ERR_R_EC_LIB); 259 SSLerr(SSL_F_SSL_CERT_DUP, ERR_R_EC_LIB);
269 goto err; 260 goto err;
270 }
271 } 261 }
262 }
272 ret->ecdh_tmp_cb = cert->ecdh_tmp_cb; 263 ret->ecdh_tmp_cb = cert->ecdh_tmp_cb;
273#endif 264#endif
274 265
275 for (i = 0; i < SSL_PKEY_NUM; i++) 266 for (i = 0; i < SSL_PKEY_NUM; i++) {
276 { 267 if (cert->pkeys[i].x509 != NULL) {
277 if (cert->pkeys[i].x509 != NULL)
278 {
279 ret->pkeys[i].x509 = cert->pkeys[i].x509; 268 ret->pkeys[i].x509 = cert->pkeys[i].x509;
280 CRYPTO_add(&ret->pkeys[i].x509->references, 1, 269 CRYPTO_add(&ret->pkeys[i].x509->references, 1,
281 CRYPTO_LOCK_X509); 270 CRYPTO_LOCK_X509);
282 } 271 }
283 272
284 if (cert->pkeys[i].privatekey != NULL) 273 if (cert->pkeys[i].privatekey != NULL) {
285 {
286 ret->pkeys[i].privatekey = cert->pkeys[i].privatekey; 274 ret->pkeys[i].privatekey = cert->pkeys[i].privatekey;
287 CRYPTO_add(&ret->pkeys[i].privatekey->references, 1, 275 CRYPTO_add(&ret->pkeys[i].privatekey->references, 1,
288 CRYPTO_LOCK_EVP_PKEY); 276 CRYPTO_LOCK_EVP_PKEY);
289 277
290 switch(i) 278 switch (i) {
291 {
292 /* If there was anything special to do for 279 /* If there was anything special to do for
293 * certain types of keys, we'd do it here. 280 * certain types of keys, we'd do it here.
294 * (Nothing at the moment, I think.) */ 281 * (Nothing at the moment, I think.) */
@@ -297,11 +284,11 @@ CERT *ssl_cert_dup(CERT *cert)
297 case SSL_PKEY_RSA_SIGN: 284 case SSL_PKEY_RSA_SIGN:
298 /* We have an RSA key. */ 285 /* We have an RSA key. */
299 break; 286 break;
300 287
301 case SSL_PKEY_DSA_SIGN: 288 case SSL_PKEY_DSA_SIGN:
302 /* We have a DSA key. */ 289 /* We have a DSA key. */
303 break; 290 break;
304 291
305 case SSL_PKEY_DH_RSA: 292 case SSL_PKEY_DH_RSA:
306 case SSL_PKEY_DH_DSA: 293 case SSL_PKEY_DH_DSA:
307 /* We have a DH key. */ 294 /* We have a DH key. */
@@ -314,21 +301,21 @@ CERT *ssl_cert_dup(CERT *cert)
314 default: 301 default:
315 /* Can't happen. */ 302 /* Can't happen. */
316 SSLerr(SSL_F_SSL_CERT_DUP, SSL_R_LIBRARY_BUG); 303 SSLerr(SSL_F_SSL_CERT_DUP, SSL_R_LIBRARY_BUG);
317 }
318 } 304 }
319 } 305 }
320 306 }
307
321 /* ret->extra_certs *should* exist, but currently the own certificate 308 /* ret->extra_certs *should* exist, but currently the own certificate
322 * chain is held inside SSL_CTX */ 309 * chain is held inside SSL_CTX */
323 310
324 ret->references=1; 311 ret->references = 1;
325 /* Set digests to defaults. NB: we don't copy existing values as they 312 /* Set digests to defaults. NB: we don't copy existing values as they
326 * will be set during handshake. 313 * will be set during handshake.
327 */ 314 */
328 ssl_cert_set_default_md(ret); 315 ssl_cert_set_default_md(ret);
329 316
330 return(ret); 317 return (ret);
331 318
332#if !defined(OPENSSL_NO_DH) || !defined(OPENSSL_NO_ECDH) 319#if !defined(OPENSSL_NO_DH) || !defined(OPENSSL_NO_ECDH)
333err: 320err:
334#endif 321#endif
@@ -345,50 +332,52 @@ err:
345 EC_KEY_free(ret->ecdh_tmp); 332 EC_KEY_free(ret->ecdh_tmp);
346#endif 333#endif
347 334
348 for (i = 0; i < SSL_PKEY_NUM; i++) 335 for (i = 0; i < SSL_PKEY_NUM; i++) {
349 {
350 if (ret->pkeys[i].x509 != NULL) 336 if (ret->pkeys[i].x509 != NULL)
351 X509_free(ret->pkeys[i].x509); 337 X509_free(ret->pkeys[i].x509);
352 if (ret->pkeys[i].privatekey != NULL) 338 if (ret->pkeys[i].privatekey != NULL)
353 EVP_PKEY_free(ret->pkeys[i].privatekey); 339 EVP_PKEY_free(ret->pkeys[i].privatekey);
354 } 340 }
355 341
356 return NULL; 342 return NULL;
357 } 343}
358 344
359 345
360void ssl_cert_free(CERT *c) 346void
361 { 347ssl_cert_free(CERT *c)
348{
362 int i; 349 int i;
363 350
364 if(c == NULL) 351 if (c == NULL)
365 return; 352 return;
366 353
367 i=CRYPTO_add(&c->references,-1,CRYPTO_LOCK_SSL_CERT); 354 i = CRYPTO_add(&c->references, -1, CRYPTO_LOCK_SSL_CERT);
368#ifdef REF_PRINT 355#ifdef REF_PRINT
369 REF_PRINT("CERT",c); 356 REF_PRINT("CERT", c);
370#endif 357#endif
371 if (i > 0) return; 358 if (i > 0)
359 return;
372#ifdef REF_CHECK 360#ifdef REF_CHECK
373 if (i < 0) 361 if (i < 0) {
374 { 362 fprintf(stderr, "ssl_cert_free, bad reference count\n");
375 fprintf(stderr,"ssl_cert_free, bad reference count\n");
376 abort(); /* ok */ 363 abort(); /* ok */
377 } 364 }
378#endif 365#endif
379 366
380#ifndef OPENSSL_NO_RSA 367#ifndef OPENSSL_NO_RSA
381 if (c->rsa_tmp) RSA_free(c->rsa_tmp); 368 if (c->rsa_tmp)
369 RSA_free(c->rsa_tmp);
382#endif 370#endif
383#ifndef OPENSSL_NO_DH 371#ifndef OPENSSL_NO_DH
384 if (c->dh_tmp) DH_free(c->dh_tmp); 372 if (c->dh_tmp)
373 DH_free(c->dh_tmp);
385#endif 374#endif
386#ifndef OPENSSL_NO_ECDH 375#ifndef OPENSSL_NO_ECDH
387 if (c->ecdh_tmp) EC_KEY_free(c->ecdh_tmp); 376 if (c->ecdh_tmp)
377 EC_KEY_free(c->ecdh_tmp);
388#endif 378#endif
389 379
390 for (i=0; i<SSL_PKEY_NUM; i++) 380 for (i = 0; i < SSL_PKEY_NUM; i++) {
391 {
392 if (c->pkeys[i].x509 != NULL) 381 if (c->pkeys[i].x509 != NULL)
393 X509_free(c->pkeys[i].x509); 382 X509_free(c->pkeys[i].x509);
394 if (c->pkeys[i].privatekey != NULL) 383 if (c->pkeys[i].privatekey != NULL)
@@ -397,12 +386,13 @@ void ssl_cert_free(CERT *c)
397 if (c->pkeys[i].publickey != NULL) 386 if (c->pkeys[i].publickey != NULL)
398 EVP_PKEY_free(c->pkeys[i].publickey); 387 EVP_PKEY_free(c->pkeys[i].publickey);
399#endif 388#endif
400 }
401 OPENSSL_free(c);
402 } 389 }
390 OPENSSL_free(c);
391}
403 392
404int ssl_cert_inst(CERT **o) 393int
405 { 394ssl_cert_inst(CERT **o)
395{
406 /* Create a CERT if there isn't already one 396 /* Create a CERT if there isn't already one
407 * (which cannot really happen, as it is initially created in 397 * (which cannot really happen, as it is initially created in
408 * SSL_CTX_new; but the earlier code usually allows for that one 398 * SSL_CTX_new; but the earlier code usually allows for that one
@@ -412,44 +402,42 @@ int ssl_cert_inst(CERT **o)
412 * s->cert being NULL, otherwise we could do without the 402 * s->cert being NULL, otherwise we could do without the
413 * initialization in SSL_CTX_new). 403 * initialization in SSL_CTX_new).
414 */ 404 */
415 405
416 if (o == NULL) 406 if (o == NULL) {
417 {
418 SSLerr(SSL_F_SSL_CERT_INST, ERR_R_PASSED_NULL_PARAMETER); 407 SSLerr(SSL_F_SSL_CERT_INST, ERR_R_PASSED_NULL_PARAMETER);
419 return(0); 408 return (0);
420 } 409 }
421 if (*o == NULL) 410 if (*o == NULL) {
422 { 411 if ((*o = ssl_cert_new()) == NULL) {
423 if ((*o = ssl_cert_new()) == NULL)
424 {
425 SSLerr(SSL_F_SSL_CERT_INST, ERR_R_MALLOC_FAILURE); 412 SSLerr(SSL_F_SSL_CERT_INST, ERR_R_MALLOC_FAILURE);
426 return(0); 413 return (0);
427 }
428 } 414 }
429 return(1);
430 } 415 }
416 return (1);
417}
431 418
432 419
433SESS_CERT *ssl_sess_cert_new(void) 420SESS_CERT
434 { 421*ssl_sess_cert_new(void)
422{
435 SESS_CERT *ret; 423 SESS_CERT *ret;
436 424
437 ret = OPENSSL_malloc(sizeof *ret); 425 ret = OPENSSL_malloc(sizeof *ret);
438 if (ret == NULL) 426 if (ret == NULL) {
439 {
440 SSLerr(SSL_F_SSL_SESS_CERT_NEW, ERR_R_MALLOC_FAILURE); 427 SSLerr(SSL_F_SSL_SESS_CERT_NEW, ERR_R_MALLOC_FAILURE);
441 return NULL; 428 return NULL;
442 } 429 }
443 430
444 memset(ret, 0 ,sizeof *ret); 431 memset(ret, 0 , sizeof *ret);
445 ret->peer_key = &(ret->peer_pkeys[SSL_PKEY_RSA_ENC]); 432 ret->peer_key = &(ret->peer_pkeys[SSL_PKEY_RSA_ENC]);
446 ret->references = 1; 433 ret->references = 1;
447 434
448 return ret; 435 return ret;
449 } 436}
450 437
451void ssl_sess_cert_free(SESS_CERT *sc) 438void
452 { 439ssl_sess_cert_free(SESS_CERT *sc)
440{
453 int i; 441 int i;
454 442
455 if (sc == NULL) 443 if (sc == NULL)
@@ -462,27 +450,25 @@ void ssl_sess_cert_free(SESS_CERT *sc)
462 if (i > 0) 450 if (i > 0)
463 return; 451 return;
464#ifdef REF_CHECK 452#ifdef REF_CHECK
465 if (i < 0) 453 if (i < 0) {
466 { 454 fprintf(stderr, "ssl_sess_cert_free, bad reference count\n");
467 fprintf(stderr,"ssl_sess_cert_free, bad reference count\n");
468 abort(); /* ok */ 455 abort(); /* ok */
469 } 456 }
470#endif 457#endif
471 458
472 /* i == 0 */ 459 /* i == 0 */
473 if (sc->cert_chain != NULL) 460 if (sc->cert_chain != NULL)
474 sk_X509_pop_free(sc->cert_chain, X509_free); 461 sk_X509_pop_free(sc->cert_chain, X509_free);
475 for (i = 0; i < SSL_PKEY_NUM; i++) 462 for (i = 0; i < SSL_PKEY_NUM; i++) {
476 {
477 if (sc->peer_pkeys[i].x509 != NULL) 463 if (sc->peer_pkeys[i].x509 != NULL)
478 X509_free(sc->peer_pkeys[i].x509); 464 X509_free(sc->peer_pkeys[i].x509);
479#if 0 /* We don't have the peer's private key. These lines are just 465#if 0 /* We don't have the peer's private key. These lines are just
480 * here as a reminder that we're still using a not-quite-appropriate 466 * here as a reminder that we're still using a not-quite-appropriate
481 * data structure. */ 467 * data structure. */
482 if (sc->peer_pkeys[i].privatekey != NULL) 468 if (sc->peer_pkeys[i].privatekey != NULL)
483 EVP_PKEY_free(sc->peer_pkeys[i].privatekey); 469 EVP_PKEY_free(sc->peer_pkeys[i].privatekey);
484#endif 470#endif
485 } 471 }
486 472
487#ifndef OPENSSL_NO_RSA 473#ifndef OPENSSL_NO_RSA
488 if (sc->peer_rsa_tmp != NULL) 474 if (sc->peer_rsa_tmp != NULL)
@@ -498,34 +484,35 @@ void ssl_sess_cert_free(SESS_CERT *sc)
498#endif 484#endif
499 485
500 OPENSSL_free(sc); 486 OPENSSL_free(sc);
501 } 487}
502 488
503int ssl_set_peer_cert_type(SESS_CERT *sc,int type) 489int
504 { 490ssl_set_peer_cert_type(SESS_CERT *sc, int type)
491{
505 sc->peer_cert_type = type; 492 sc->peer_cert_type = type;
506 return(1); 493 return (1);
507 } 494}
508 495
509int ssl_verify_cert_chain(SSL *s,STACK_OF(X509) *sk) 496int
510 { 497ssl_verify_cert_chain(SSL *s, STACK_OF(X509) *sk)
498{
511 X509 *x; 499 X509 *x;
512 int i; 500 int i;
513 X509_STORE_CTX ctx; 501 X509_STORE_CTX ctx;
514 502
515 if ((sk == NULL) || (sk_X509_num(sk) == 0)) 503 if ((sk == NULL) || (sk_X509_num(sk) == 0))
516 return(0); 504 return (0);
517 505
518 x=sk_X509_value(sk,0); 506 x = sk_X509_value(sk, 0);
519 if(!X509_STORE_CTX_init(&ctx,s->ctx->cert_store,x,sk)) 507 if (!X509_STORE_CTX_init(&ctx, s->ctx->cert_store, x, sk)) {
520 { 508 SSLerr(SSL_F_SSL_VERIFY_CERT_CHAIN, ERR_R_X509_LIB);
521 SSLerr(SSL_F_SSL_VERIFY_CERT_CHAIN,ERR_R_X509_LIB); 509 return (0);
522 return(0); 510 }
523 }
524#if 0 511#if 0
525 if (SSL_get_verify_depth(s) >= 0) 512 if (SSL_get_verify_depth(s) >= 0)
526 X509_STORE_CTX_set_depth(&ctx, SSL_get_verify_depth(s)); 513 X509_STORE_CTX_set_depth(&ctx, SSL_get_verify_depth(s));
527#endif 514#endif
528 X509_STORE_CTX_set_ex_data(&ctx,SSL_get_ex_data_X509_STORE_CTX_idx(),s); 515 X509_STORE_CTX_set_ex_data(&ctx, SSL_get_ex_data_X509_STORE_CTX_idx(), s);
529 516
530 /* We need to inherit the verify parameters. These can be determined by 517 /* We need to inherit the verify parameters. These can be determined by
531 * the context: if its a server it will verify SSL client certificates 518 * the context: if its a server it will verify SSL client certificates
@@ -533,7 +520,7 @@ int ssl_verify_cert_chain(SSL *s,STACK_OF(X509) *sk)
533 */ 520 */
534 521
535 X509_STORE_CTX_set_default(&ctx, 522 X509_STORE_CTX_set_default(&ctx,
536 s->server ? "ssl_client" : "ssl_server"); 523 s->server ? "ssl_client" : "ssl_server");
537 /* Anything non-default in "param" should overwrite anything in the 524 /* Anything non-default in "param" should overwrite anything in the
538 * ctx. 525 * ctx.
539 */ 526 */
@@ -544,121 +531,127 @@ int ssl_verify_cert_chain(SSL *s,STACK_OF(X509) *sk)
544 531
545 if (s->ctx->app_verify_callback != NULL) 532 if (s->ctx->app_verify_callback != NULL)
546#if 1 /* new with OpenSSL 0.9.7 */ 533#if 1 /* new with OpenSSL 0.9.7 */
547 i=s->ctx->app_verify_callback(&ctx, s->ctx->app_verify_arg); 534 i = s->ctx->app_verify_callback(&ctx, s->ctx->app_verify_arg);
535
548#else 536#else
549 i=s->ctx->app_verify_callback(&ctx); /* should pass app_verify_arg */ 537 i=s->ctx->app_verify_callback(&ctx); /* should pass app_verify_arg */
550#endif 538#endif
551 else 539 else {
552 {
553#ifndef OPENSSL_NO_X509_VERIFY 540#ifndef OPENSSL_NO_X509_VERIFY
554 i=X509_verify_cert(&ctx); 541 i = X509_verify_cert(&ctx);
555#else 542#else
556 i=0; 543 i = 0;
557 ctx.error=X509_V_ERR_APPLICATION_VERIFICATION; 544 ctx.error = X509_V_ERR_APPLICATION_VERIFICATION;
558 SSLerr(SSL_F_SSL_VERIFY_CERT_CHAIN,SSL_R_NO_VERIFY_CALLBACK); 545 SSLerr(SSL_F_SSL_VERIFY_CERT_CHAIN, SSL_R_NO_VERIFY_CALLBACK);
559#endif 546#endif
560 } 547 }
561 548
562 s->verify_result=ctx.error; 549 s->verify_result = ctx.error;
563 X509_STORE_CTX_cleanup(&ctx); 550 X509_STORE_CTX_cleanup(&ctx);
564 551
565 return(i); 552 return (i);
566 } 553}
567 554
568static void set_client_CA_list(STACK_OF(X509_NAME) **ca_list,STACK_OF(X509_NAME) *name_list) 555static void
569 { 556set_client_CA_list(STACK_OF(X509_NAME) **ca_list, STACK_OF(X509_NAME) *name_list)
557{
570 if (*ca_list != NULL) 558 if (*ca_list != NULL)
571 sk_X509_NAME_pop_free(*ca_list,X509_NAME_free); 559 sk_X509_NAME_pop_free(*ca_list, X509_NAME_free);
572 560
573 *ca_list=name_list; 561 *ca_list = name_list;
574 } 562}
575 563
576STACK_OF(X509_NAME) *SSL_dup_CA_list(STACK_OF(X509_NAME) *sk) 564STACK_OF(X509_NAME)
577 { 565*SSL_dup_CA_list(STACK_OF(X509_NAME) *sk)
566{
578 int i; 567 int i;
579 STACK_OF(X509_NAME) *ret; 568 STACK_OF(X509_NAME) *ret;
580 X509_NAME *name; 569 X509_NAME *name;
581 570
582 ret=sk_X509_NAME_new_null(); 571 ret = sk_X509_NAME_new_null();
583 for (i=0; i<sk_X509_NAME_num(sk); i++) 572 for (i = 0; i < sk_X509_NAME_num(sk); i++) {
584 { 573 name = X509_NAME_dup(sk_X509_NAME_value(sk, i));
585 name=X509_NAME_dup(sk_X509_NAME_value(sk,i)); 574 if ((name == NULL) || !sk_X509_NAME_push(ret, name)) {
586 if ((name == NULL) || !sk_X509_NAME_push(ret,name)) 575 sk_X509_NAME_pop_free(ret, X509_NAME_free);
587 { 576 return (NULL);
588 sk_X509_NAME_pop_free(ret,X509_NAME_free);
589 return(NULL);
590 }
591 } 577 }
592 return(ret);
593 } 578 }
594 579 return (ret);
595void SSL_set_client_CA_list(SSL *s,STACK_OF(X509_NAME) *name_list) 580}
596 { 581
597 set_client_CA_list(&(s->client_CA),name_list); 582void
598 } 583SSL_set_client_CA_list(SSL *s, STACK_OF(X509_NAME) *name_list)
599 584{
600void SSL_CTX_set_client_CA_list(SSL_CTX *ctx,STACK_OF(X509_NAME) *name_list) 585 set_client_CA_list(&(s->client_CA), name_list);
601 { 586}
602 set_client_CA_list(&(ctx->client_CA),name_list); 587
603 } 588void
604 589SSL_CTX_set_client_CA_list(SSL_CTX *ctx, STACK_OF(X509_NAME) *name_list)
605STACK_OF(X509_NAME) *SSL_CTX_get_client_CA_list(const SSL_CTX *ctx) 590{
606 { 591 set_client_CA_list(&(ctx->client_CA), name_list);
607 return(ctx->client_CA); 592}
608 } 593
609 594STACK_OF(X509_NAME)
610STACK_OF(X509_NAME) *SSL_get_client_CA_list(const SSL *s) 595*SSL_CTX_get_client_CA_list(const SSL_CTX *ctx)
611 { 596{
597 return (ctx->client_CA);
598}
599
600STACK_OF(X509_NAME)
601*SSL_get_client_CA_list(const SSL *s)
602{
612 if (s->type == SSL_ST_CONNECT) 603 if (s->type == SSL_ST_CONNECT)
613 { /* we are in the client */ 604 { /* we are in the client */
614 if (((s->version>>8) == SSL3_VERSION_MAJOR) && 605 if (((s->version >> 8) == SSL3_VERSION_MAJOR) &&
615 (s->s3 != NULL)) 606 (s->s3 != NULL))
616 return(s->s3->tmp.ca_names); 607 return (s->s3->tmp.ca_names);
617 else 608 else
618 return(NULL); 609 return (NULL);
619 } 610 } else {
620 else
621 {
622 if (s->client_CA != NULL) 611 if (s->client_CA != NULL)
623 return(s->client_CA); 612 return (s->client_CA);
624 else 613 else
625 return(s->ctx->client_CA); 614 return (s->ctx->client_CA);
626 }
627 } 615 }
616}
628 617
629static int add_client_CA(STACK_OF(X509_NAME) **sk,X509 *x) 618static int
630 { 619add_client_CA(STACK_OF(X509_NAME) **sk, X509 *x)
620{
631 X509_NAME *name; 621 X509_NAME *name;
632 622
633 if (x == NULL) return(0); 623 if (x == NULL)
634 if ((*sk == NULL) && ((*sk=sk_X509_NAME_new_null()) == NULL)) 624 return (0);
635 return(0); 625 if ((*sk == NULL) && ((*sk = sk_X509_NAME_new_null()) == NULL))
636 626 return (0);
637 if ((name=X509_NAME_dup(X509_get_subject_name(x))) == NULL)
638 return(0);
639
640 if (!sk_X509_NAME_push(*sk,name))
641 {
642 X509_NAME_free(name);
643 return(0);
644 }
645 return(1);
646 }
647 627
648int SSL_add_client_CA(SSL *ssl,X509 *x) 628 if ((name = X509_NAME_dup(X509_get_subject_name(x))) == NULL)
649 { 629 return (0);
650 return(add_client_CA(&(ssl->client_CA),x));
651 }
652 630
653int SSL_CTX_add_client_CA(SSL_CTX *ctx,X509 *x) 631 if (!sk_X509_NAME_push(*sk, name)) {
654 { 632 X509_NAME_free(name);
655 return(add_client_CA(&(ctx->client_CA),x)); 633 return (0);
656 }
657
658static int xname_cmp(const X509_NAME * const *a, const X509_NAME * const *b)
659 {
660 return(X509_NAME_cmp(*a,*b));
661 } 634 }
635 return (1);
636}
637
638int
639SSL_add_client_CA(SSL *ssl, X509 *x)
640{
641 return (add_client_CA(&(ssl->client_CA), x));
642}
643
644int
645SSL_CTX_add_client_CA(SSL_CTX *ctx, X509 *x)
646{
647 return (add_client_CA(&(ctx->client_CA), x));
648}
649
650static int
651xname_cmp(const X509_NAME * const *a, const X509_NAME * const *b)
652{
653 return (X509_NAME_cmp(*a, *b));
654}
662 655
663#ifndef OPENSSL_NO_STDIO 656#ifndef OPENSSL_NO_STDIO
664/*! 657/*!
@@ -669,65 +662,65 @@ static int xname_cmp(const X509_NAME * const *a, const X509_NAME * const *b)
669 * \param file the file containing one or more certs. 662 * \param file the file containing one or more certs.
670 * \return a ::STACK containing the certs. 663 * \return a ::STACK containing the certs.
671 */ 664 */
672STACK_OF(X509_NAME) *SSL_load_client_CA_file(const char *file) 665STACK_OF(X509_NAME)
673 { 666*SSL_load_client_CA_file(const char *file)
667{
674 BIO *in; 668 BIO *in;
675 X509 *x=NULL; 669 X509 *x = NULL;
676 X509_NAME *xn=NULL; 670 X509_NAME *xn = NULL;
677 STACK_OF(X509_NAME) *ret = NULL,*sk; 671 STACK_OF(X509_NAME) *ret = NULL, *sk;
678 672
679 sk=sk_X509_NAME_new(xname_cmp); 673 sk = sk_X509_NAME_new(xname_cmp);
680 674
681 in=BIO_new(BIO_s_file_internal()); 675 in = BIO_new(BIO_s_file_internal());
682 676
683 if ((sk == NULL) || (in == NULL)) 677 if ((sk == NULL) || (in == NULL)) {
684 { 678 SSLerr(SSL_F_SSL_LOAD_CLIENT_CA_FILE, ERR_R_MALLOC_FAILURE);
685 SSLerr(SSL_F_SSL_LOAD_CLIENT_CA_FILE,ERR_R_MALLOC_FAILURE);
686 goto err; 679 goto err;
687 } 680 }
688 681
689 if (!BIO_read_filename(in,file)) 682 if (!BIO_read_filename(in, file))
690 goto err; 683 goto err;
691 684
692 for (;;) 685 for (;;) {
693 { 686 if (PEM_read_bio_X509(in, &x, NULL, NULL) == NULL)
694 if (PEM_read_bio_X509(in,&x,NULL,NULL) == NULL)
695 break; 687 break;
696 if (ret == NULL) 688 if (ret == NULL) {
697 {
698 ret = sk_X509_NAME_new_null(); 689 ret = sk_X509_NAME_new_null();
699 if (ret == NULL) 690 if (ret == NULL) {
700 { 691 SSLerr(SSL_F_SSL_LOAD_CLIENT_CA_FILE, ERR_R_MALLOC_FAILURE);
701 SSLerr(SSL_F_SSL_LOAD_CLIENT_CA_FILE,ERR_R_MALLOC_FAILURE);
702 goto err; 692 goto err;
703 }
704 } 693 }
705 if ((xn=X509_get_subject_name(x)) == NULL) goto err; 694 }
706 /* check for duplicates */ 695 if ((xn = X509_get_subject_name(x)) == NULL) goto err;
707 xn=X509_NAME_dup(xn); 696 /* check for duplicates */
708 if (xn == NULL) goto err; 697 xn = X509_NAME_dup(xn);
709 if (sk_X509_NAME_find(sk,xn) >= 0) 698 if (xn == NULL)
699 goto err;
700 if (sk_X509_NAME_find(sk, xn) >= 0)
710 X509_NAME_free(xn); 701 X509_NAME_free(xn);
711 else 702 else {
712 { 703 sk_X509_NAME_push(sk, xn);
713 sk_X509_NAME_push(sk,xn); 704 sk_X509_NAME_push(ret, xn);
714 sk_X509_NAME_push(ret,xn);
715 }
716 } 705 }
706 }
717 707
718 if (0) 708 if (0) {
719 {
720err: 709err:
721 if (ret != NULL) sk_X509_NAME_pop_free(ret,X509_NAME_free); 710 if (ret != NULL)
722 ret=NULL; 711 sk_X509_NAME_pop_free(ret, X509_NAME_free);
723 } 712 ret = NULL;
724 if (sk != NULL) sk_X509_NAME_free(sk); 713 }
725 if (in != NULL) BIO_free(in); 714 if (sk != NULL)
726 if (x != NULL) X509_free(x); 715 sk_X509_NAME_free(sk);
716 if (in != NULL)
717 BIO_free(in);
718 if (x != NULL)
719 X509_free(x);
727 if (ret != NULL) 720 if (ret != NULL)
728 ERR_clear_error(); 721 ERR_clear_error();
729 return(ret); 722 return (ret);
730 } 723}
731#endif 724#endif
732 725
733/*! 726/*!
@@ -739,57 +732,56 @@ err:
739 * certs may have been added to \c stack. 732 * certs may have been added to \c stack.
740 */ 733 */
741 734
742int SSL_add_file_cert_subjects_to_stack(STACK_OF(X509_NAME) *stack, 735int
743 const char *file) 736SSL_add_file_cert_subjects_to_stack(STACK_OF(X509_NAME) *stack,
744 { 737 const char *file)
738{
745 BIO *in; 739 BIO *in;
746 X509 *x=NULL; 740 X509 *x = NULL;
747 X509_NAME *xn=NULL; 741 X509_NAME *xn = NULL;
748 int ret=1; 742 int ret = 1;
749 int (*oldcmp)(const X509_NAME * const *a, const X509_NAME * const *b); 743 int (*oldcmp)(const X509_NAME * const *a, const X509_NAME * const *b);
750 744
751 oldcmp=sk_X509_NAME_set_cmp_func(stack,xname_cmp); 745 oldcmp = sk_X509_NAME_set_cmp_func(stack, xname_cmp);
752 746
753 in=BIO_new(BIO_s_file_internal()); 747 in = BIO_new(BIO_s_file_internal());
754 748
755 if (in == NULL) 749 if (in == NULL) {
756 { 750 SSLerr(SSL_F_SSL_ADD_FILE_CERT_SUBJECTS_TO_STACK, ERR_R_MALLOC_FAILURE);
757 SSLerr(SSL_F_SSL_ADD_FILE_CERT_SUBJECTS_TO_STACK,ERR_R_MALLOC_FAILURE);
758 goto err; 751 goto err;
759 } 752 }
760 753
761 if (!BIO_read_filename(in,file)) 754 if (!BIO_read_filename(in, file))
762 goto err; 755 goto err;
763 756
764 for (;;) 757 for (;;) {
765 { 758 if (PEM_read_bio_X509(in, &x, NULL, NULL) == NULL)
766 if (PEM_read_bio_X509(in,&x,NULL,NULL) == NULL)
767 break; 759 break;
768 if ((xn=X509_get_subject_name(x)) == NULL) goto err; 760 if ((xn = X509_get_subject_name(x)) == NULL) goto err;
769 xn=X509_NAME_dup(xn); 761 xn = X509_NAME_dup(xn);
770 if (xn == NULL) goto err; 762 if (xn == NULL)
771 if (sk_X509_NAME_find(stack,xn) >= 0) 763 goto err;
764 if (sk_X509_NAME_find(stack, xn) >= 0)
772 X509_NAME_free(xn); 765 X509_NAME_free(xn);
773 else 766 else
774 sk_X509_NAME_push(stack,xn); 767 sk_X509_NAME_push(stack, xn);
775 } 768 }
776 769
777 ERR_clear_error(); 770 ERR_clear_error();
778 771
779 if (0) 772 if (0) {
780 {
781err: 773err:
782 ret=0; 774 ret = 0;
783 } 775 }
784 if(in != NULL) 776 if (in != NULL)
785 BIO_free(in); 777 BIO_free(in);
786 if(x != NULL) 778 if (x != NULL)
787 X509_free(x); 779 X509_free(x);
788 780
789 (void)sk_X509_NAME_set_cmp_func(stack,oldcmp); 781 (void)sk_X509_NAME_set_cmp_func(stack, oldcmp);
790 782
791 return ret; 783 return ret;
792 } 784}
793 785
794/*! 786/*!
795 * Add a directory of certs to a stack. 787 * Add a directory of certs to a stack.
@@ -802,9 +794,10 @@ err:
802 * certs may have been added to \c stack. 794 * certs may have been added to \c stack.
803 */ 795 */
804 796
805int SSL_add_dir_cert_subjects_to_stack(STACK_OF(X509_NAME) *stack, 797int
806 const char *dir) 798SSL_add_dir_cert_subjects_to_stack(STACK_OF(X509_NAME) *stack,
807 { 799 const char *dir)
800{
808 OPENSSL_DIR_CTX *d = NULL; 801 OPENSSL_DIR_CTX *d = NULL;
809 const char *filename; 802 const char *filename;
810 int ret = 0; 803 int ret = 0;
@@ -813,36 +806,34 @@ int SSL_add_dir_cert_subjects_to_stack(STACK_OF(X509_NAME) *stack,
813 806
814 /* Note that a side effect is that the CAs will be sorted by name */ 807 /* Note that a side effect is that the CAs will be sorted by name */
815 808
816 while((filename = OPENSSL_DIR_read(&d, dir))) 809 while ((filename = OPENSSL_DIR_read(&d, dir))) {
817 {
818 char buf[1024]; 810 char buf[1024];
819 int r; 811 int r;
820 812
821 if(strlen(dir)+strlen(filename)+2 > sizeof buf) 813 if (strlen(dir) + strlen(filename) + 2 > sizeof buf) {
822 { 814 SSLerr(SSL_F_SSL_ADD_DIR_CERT_SUBJECTS_TO_STACK, SSL_R_PATH_TOO_LONG);
823 SSLerr(SSL_F_SSL_ADD_DIR_CERT_SUBJECTS_TO_STACK,SSL_R_PATH_TOO_LONG);
824 goto err; 815 goto err;
825 } 816 }
826 r = BIO_snprintf(buf,sizeof buf,"%s/%s",dir,filename); 817 r = BIO_snprintf(buf, sizeof buf, "%s/%s", dir, filename);
827 if (r <= 0 || r >= (int)sizeof(buf)) 818 if (r <= 0 || r >= (int)sizeof(buf))
828 goto err; 819 goto err;
829 if(!SSL_add_file_cert_subjects_to_stack(stack,buf)) 820 if (!SSL_add_file_cert_subjects_to_stack(stack, buf))
830 goto err; 821 goto err;
831 } 822 }
832 823
833 if (errno) 824 if (errno) {
834 {
835 SYSerr(SYS_F_OPENDIR, errno); 825 SYSerr(SYS_F_OPENDIR, errno);
836 ERR_add_error_data(3, "OPENSSL_DIR_read(&ctx, '", dir, "')"); 826 ERR_add_error_data(3, "OPENSSL_DIR_read(&ctx, '", dir, "')");
837 SSLerr(SSL_F_SSL_ADD_DIR_CERT_SUBJECTS_TO_STACK, ERR_R_SYS_LIB); 827 SSLerr(SSL_F_SSL_ADD_DIR_CERT_SUBJECTS_TO_STACK, ERR_R_SYS_LIB);
838 goto err; 828 goto err;
839 } 829 }
840 830
841 ret = 1; 831 ret = 1;
842 832
843err: 833err:
844 if (d) OPENSSL_DIR_end(&d); 834 if (d)
835 OPENSSL_DIR_end(&d);
845 CRYPTO_w_unlock(CRYPTO_LOCK_READDIR); 836 CRYPTO_w_unlock(CRYPTO_LOCK_READDIR);
846 return ret; 837 return ret;
847 } 838}
848 839
diff --git a/src/lib/libssl/ssl_ciph.c b/src/lib/libssl/ssl_ciph.c
index 0aba8e048c..f37c70cf91 100644
--- a/src/lib/libssl/ssl_ciph.c
+++ b/src/lib/libssl/ssl_ciph.c
@@ -167,15 +167,15 @@
167#define SSL_ENC_NUM_IDX 14 167#define SSL_ENC_NUM_IDX 14
168 168
169 169
170static const EVP_CIPHER *ssl_cipher_methods[SSL_ENC_NUM_IDX]={ 170static const EVP_CIPHER *ssl_cipher_methods[SSL_ENC_NUM_IDX] = {
171 NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL 171 NULL, NULL, NULL, NULL, NULL, NULL, NULL, NULL, NULL, NULL, NULL, NULL, NULL, NULL
172 }; 172};
173 173
174#define SSL_COMP_NULL_IDX 0 174#define SSL_COMP_NULL_IDX 0
175#define SSL_COMP_ZLIB_IDX 1 175#define SSL_COMP_ZLIB_IDX 1
176#define SSL_COMP_NUM_IDX 2 176#define SSL_COMP_NUM_IDX 2
177 177
178static STACK_OF(SSL_COMP) *ssl_comp_methods=NULL; 178static STACK_OF(SSL_COMP) *ssl_comp_methods = NULL;
179 179
180#define SSL_MD_MD5_IDX 0 180#define SSL_MD_MD5_IDX 0
181#define SSL_MD_SHA1_IDX 1 181#define SSL_MD_SHA1_IDX 1
@@ -187,27 +187,27 @@ static STACK_OF(SSL_COMP) *ssl_comp_methods=NULL;
187 * defined in the 187 * defined in the
188 * ssl_locl.h */ 188 * ssl_locl.h */
189#define SSL_MD_NUM_IDX SSL_MAX_DIGEST 189#define SSL_MD_NUM_IDX SSL_MAX_DIGEST
190static const EVP_MD *ssl_digest_methods[SSL_MD_NUM_IDX]={ 190static const EVP_MD *ssl_digest_methods[SSL_MD_NUM_IDX] = {
191 NULL,NULL,NULL,NULL,NULL,NULL 191 NULL, NULL, NULL, NULL, NULL, NULL
192 }; 192};
193/* PKEY_TYPE for GOST89MAC is known in advance, but, because 193/* PKEY_TYPE for GOST89MAC is known in advance, but, because
194 * implementation is engine-provided, we'll fill it only if 194 * implementation is engine-provided, we'll fill it only if
195 * corresponding EVP_PKEY_METHOD is found 195 * corresponding EVP_PKEY_METHOD is found
196 */ 196 */
197static int ssl_mac_pkey_id[SSL_MD_NUM_IDX]={ 197static int ssl_mac_pkey_id[SSL_MD_NUM_IDX] = {
198 EVP_PKEY_HMAC,EVP_PKEY_HMAC,EVP_PKEY_HMAC,NID_undef, 198 EVP_PKEY_HMAC, EVP_PKEY_HMAC, EVP_PKEY_HMAC, NID_undef,
199 EVP_PKEY_HMAC,EVP_PKEY_HMAC 199 EVP_PKEY_HMAC, EVP_PKEY_HMAC
200 }; 200};
201 201
202static int ssl_mac_secret_size[SSL_MD_NUM_IDX]={ 202static int ssl_mac_secret_size[SSL_MD_NUM_IDX] = {
203 0,0,0,0,0,0 203 0, 0, 0, 0, 0, 0
204 }; 204};
205 205
206static int ssl_handshake_digest_flag[SSL_MD_NUM_IDX]={ 206static int ssl_handshake_digest_flag[SSL_MD_NUM_IDX] = {
207 SSL_HANDSHAKE_MAC_MD5,SSL_HANDSHAKE_MAC_SHA, 207 SSL_HANDSHAKE_MAC_MD5, SSL_HANDSHAKE_MAC_SHA,
208 SSL_HANDSHAKE_MAC_GOST94, 0, SSL_HANDSHAKE_MAC_SHA256, 208 SSL_HANDSHAKE_MAC_GOST94, 0, SSL_HANDSHAKE_MAC_SHA256,
209 SSL_HANDSHAKE_MAC_SHA384 209 SSL_HANDSHAKE_MAC_SHA384
210 }; 210};
211 211
212#define CIPHER_ADD 1 212#define CIPHER_ADD 1
213#define CIPHER_KILL 2 213#define CIPHER_KILL 2
@@ -215,376 +215,371 @@ static int ssl_handshake_digest_flag[SSL_MD_NUM_IDX]={
215#define CIPHER_ORD 4 215#define CIPHER_ORD 4
216#define CIPHER_SPECIAL 5 216#define CIPHER_SPECIAL 5
217 217
218typedef struct cipher_order_st 218typedef struct cipher_order_st {
219 {
220 const SSL_CIPHER *cipher; 219 const SSL_CIPHER *cipher;
221 int active; 220 int active;
222 int dead; 221 int dead;
223 struct cipher_order_st *next,*prev; 222 struct cipher_order_st *next, *prev;
224 } CIPHER_ORDER; 223} CIPHER_ORDER;
225 224
226static const SSL_CIPHER cipher_aliases[]={ 225static const SSL_CIPHER cipher_aliases[] = {
227 /* "ALL" doesn't include eNULL (must be specifically enabled) */ 226 /* "ALL" doesn't include eNULL (must be specifically enabled) */
228 {0,SSL_TXT_ALL,0, 0,0,~SSL_eNULL,0,0,0,0,0,0}, 227 {0, SSL_TXT_ALL, 0, 0, 0,~SSL_eNULL, 0, 0, 0, 0, 0, 0},
229 /* "COMPLEMENTOFALL" */ 228 /* "COMPLEMENTOFALL" */
230 {0,SSL_TXT_CMPALL,0, 0,0,SSL_eNULL,0,0,0,0,0,0}, 229 {0, SSL_TXT_CMPALL, 0, 0, 0, SSL_eNULL, 0, 0, 0, 0, 0, 0},
231 230
232 /* "COMPLEMENTOFDEFAULT" (does *not* include ciphersuites not found in ALL!) */ 231 /* "COMPLEMENTOFDEFAULT" (does *not* include ciphersuites not found in ALL!) */
233 {0,SSL_TXT_CMPDEF,0, SSL_kEDH|SSL_kEECDH,SSL_aNULL,~SSL_eNULL,0,0,0,0,0,0}, 232 {0, SSL_TXT_CMPDEF, 0, SSL_kEDH|SSL_kEECDH, SSL_aNULL,~SSL_eNULL, 0, 0, 0, 0, 0, 0},
234 233
235 /* key exchange aliases 234 /* key exchange aliases
236 * (some of those using only a single bit here combine 235 * (some of those using only a single bit here combine
237 * multiple key exchange algs according to the RFCs, 236 * multiple key exchange algs according to the RFCs,
238 * e.g. kEDH combines DHE_DSS and DHE_RSA) */ 237 * e.g. kEDH combines DHE_DSS and DHE_RSA) */
239 {0,SSL_TXT_kRSA,0, SSL_kRSA, 0,0,0,0,0,0,0,0}, 238 {0, SSL_TXT_kRSA, 0, SSL_kRSA, 0, 0, 0, 0, 0, 0, 0, 0},
240 239
241 {0,SSL_TXT_kDHr,0, SSL_kDHr, 0,0,0,0,0,0,0,0}, /* no such ciphersuites supported! */ 240 {0,SSL_TXT_kDHr,0, SSL_kDHr, 0,0,0,0,0,0,0,0}, /* no such ciphersuites supported! */
242 {0,SSL_TXT_kDHd,0, SSL_kDHd, 0,0,0,0,0,0,0,0}, /* no such ciphersuites supported! */ 241 {0,SSL_TXT_kDHd,0, SSL_kDHd, 0,0,0,0,0,0,0,0}, /* no such ciphersuites supported! */
243 {0,SSL_TXT_kDH,0, SSL_kDHr|SSL_kDHd,0,0,0,0,0,0,0,0}, /* no such ciphersuites supported! */ 242 {0,SSL_TXT_kDH,0, SSL_kDHr|SSL_kDHd,0,0,0,0,0,0,0,0}, /* no such ciphersuites supported! */
244 {0,SSL_TXT_kEDH,0, SSL_kEDH, 0,0,0,0,0,0,0,0}, 243 {0, SSL_TXT_kEDH, 0, SSL_kEDH, 0, 0, 0, 0, 0, 0, 0, 0},
245 {0,SSL_TXT_DH,0, SSL_kDHr|SSL_kDHd|SSL_kEDH,0,0,0,0,0,0,0,0}, 244 {0, SSL_TXT_DH, 0, SSL_kDHr|SSL_kDHd|SSL_kEDH, 0, 0, 0, 0, 0, 0, 0, 0},
246 245
247 {0,SSL_TXT_kKRB5,0, SSL_kKRB5, 0,0,0,0,0,0,0,0}, 246 {0, SSL_TXT_kKRB5, 0, SSL_kKRB5, 0, 0, 0, 0, 0, 0, 0, 0},
248 247
249 {0,SSL_TXT_kECDHr,0, SSL_kECDHr,0,0,0,0,0,0,0,0}, 248 {0, SSL_TXT_kECDHr, 0, SSL_kECDHr, 0, 0, 0, 0, 0, 0, 0, 0},
250 {0,SSL_TXT_kECDHe,0, SSL_kECDHe,0,0,0,0,0,0,0,0}, 249 {0, SSL_TXT_kECDHe, 0, SSL_kECDHe, 0, 0, 0, 0, 0, 0, 0, 0},
251 {0,SSL_TXT_kECDH,0, SSL_kECDHr|SSL_kECDHe,0,0,0,0,0,0,0,0}, 250 {0, SSL_TXT_kECDH, 0, SSL_kECDHr|SSL_kECDHe, 0, 0, 0, 0, 0, 0, 0, 0},
252 {0,SSL_TXT_kEECDH,0, SSL_kEECDH,0,0,0,0,0,0,0,0}, 251 {0, SSL_TXT_kEECDH, 0, SSL_kEECDH, 0, 0, 0, 0, 0, 0, 0, 0},
253 {0,SSL_TXT_ECDH,0, SSL_kECDHr|SSL_kECDHe|SSL_kEECDH,0,0,0,0,0,0,0,0}, 252 {0, SSL_TXT_ECDH, 0, SSL_kECDHr|SSL_kECDHe|SSL_kEECDH, 0, 0, 0, 0, 0, 0, 0, 0},
254 253
255 {0,SSL_TXT_kPSK,0, SSL_kPSK, 0,0,0,0,0,0,0,0}, 254 {0, SSL_TXT_kPSK, 0, SSL_kPSK, 0, 0, 0, 0, 0, 0, 0, 0},
256 {0,SSL_TXT_kSRP,0, SSL_kSRP, 0,0,0,0,0,0,0,0}, 255 {0, SSL_TXT_kSRP, 0, SSL_kSRP, 0, 0, 0, 0, 0, 0, 0, 0},
257 {0,SSL_TXT_kGOST,0, SSL_kGOST,0,0,0,0,0,0,0,0}, 256 {0, SSL_TXT_kGOST, 0, SSL_kGOST, 0, 0, 0, 0, 0, 0, 0, 0},
258 257
259 /* server authentication aliases */ 258 /* server authentication aliases */
260 {0,SSL_TXT_aRSA,0, 0,SSL_aRSA, 0,0,0,0,0,0,0}, 259 {0, SSL_TXT_aRSA, 0, 0, SSL_aRSA, 0, 0, 0, 0, 0, 0, 0},
261 {0,SSL_TXT_aDSS,0, 0,SSL_aDSS, 0,0,0,0,0,0,0}, 260 {0, SSL_TXT_aDSS, 0, 0, SSL_aDSS, 0, 0, 0, 0, 0, 0, 0},
262 {0,SSL_TXT_DSS,0, 0,SSL_aDSS, 0,0,0,0,0,0,0}, 261 {0, SSL_TXT_DSS, 0, 0, SSL_aDSS, 0, 0, 0, 0, 0, 0, 0},
263 {0,SSL_TXT_aKRB5,0, 0,SSL_aKRB5, 0,0,0,0,0,0,0}, 262 {0, SSL_TXT_aKRB5, 0, 0, SSL_aKRB5, 0, 0, 0, 0, 0, 0, 0},
264 {0,SSL_TXT_aNULL,0, 0,SSL_aNULL, 0,0,0,0,0,0,0}, 263 {0, SSL_TXT_aNULL, 0, 0, SSL_aNULL, 0, 0, 0, 0, 0, 0, 0},
265 {0,SSL_TXT_aDH,0, 0,SSL_aDH, 0,0,0,0,0,0,0}, /* no such ciphersuites supported! */ 264 {0,SSL_TXT_aDH,0, 0,SSL_aDH, 0,0,0,0,0,0,0}, /* no such ciphersuites supported! */
266 {0,SSL_TXT_aECDH,0, 0,SSL_aECDH, 0,0,0,0,0,0,0}, 265 {0, SSL_TXT_aECDH, 0, 0, SSL_aECDH, 0, 0, 0, 0, 0, 0, 0},
267 {0,SSL_TXT_aECDSA,0, 0,SSL_aECDSA,0,0,0,0,0,0,0}, 266 {0, SSL_TXT_aECDSA, 0, 0, SSL_aECDSA, 0, 0, 0, 0, 0, 0, 0},
268 {0,SSL_TXT_ECDSA,0, 0,SSL_aECDSA, 0,0,0,0,0,0,0}, 267 {0, SSL_TXT_ECDSA, 0, 0, SSL_aECDSA, 0, 0, 0, 0, 0, 0, 0},
269 {0,SSL_TXT_aPSK,0, 0,SSL_aPSK, 0,0,0,0,0,0,0}, 268 {0, SSL_TXT_aPSK, 0, 0, SSL_aPSK, 0, 0, 0, 0, 0, 0, 0},
270 {0,SSL_TXT_aGOST94,0,0,SSL_aGOST94,0,0,0,0,0,0,0}, 269 {0, SSL_TXT_aGOST94, 0, 0, SSL_aGOST94, 0, 0, 0, 0, 0, 0, 0},
271 {0,SSL_TXT_aGOST01,0,0,SSL_aGOST01,0,0,0,0,0,0,0}, 270 {0, SSL_TXT_aGOST01, 0, 0, SSL_aGOST01, 0, 0, 0, 0, 0, 0, 0},
272 {0,SSL_TXT_aGOST,0,0,SSL_aGOST94|SSL_aGOST01,0,0,0,0,0,0,0}, 271 {0, SSL_TXT_aGOST, 0, 0, SSL_aGOST94|SSL_aGOST01, 0, 0, 0, 0, 0, 0, 0},
273 272
274 /* aliases combining key exchange and server authentication */ 273 /* aliases combining key exchange and server authentication */
275 {0,SSL_TXT_EDH,0, SSL_kEDH,~SSL_aNULL,0,0,0,0,0,0,0}, 274 {0, SSL_TXT_EDH, 0, SSL_kEDH,~SSL_aNULL, 0, 0, 0, 0, 0, 0, 0},
276 {0,SSL_TXT_EECDH,0, SSL_kEECDH,~SSL_aNULL,0,0,0,0,0,0,0}, 275 {0, SSL_TXT_EECDH, 0, SSL_kEECDH,~SSL_aNULL, 0, 0, 0, 0, 0, 0, 0},
277 {0,SSL_TXT_NULL,0, 0,0,SSL_eNULL, 0,0,0,0,0,0}, 276 {0, SSL_TXT_NULL, 0, 0, 0, SSL_eNULL, 0, 0, 0, 0, 0, 0},
278 {0,SSL_TXT_KRB5,0, SSL_kKRB5,SSL_aKRB5,0,0,0,0,0,0,0}, 277 {0, SSL_TXT_KRB5, 0, SSL_kKRB5, SSL_aKRB5, 0, 0, 0, 0, 0, 0, 0},
279 {0,SSL_TXT_RSA,0, SSL_kRSA,SSL_aRSA,0,0,0,0,0,0,0}, 278 {0, SSL_TXT_RSA, 0, SSL_kRSA, SSL_aRSA, 0, 0, 0, 0, 0, 0, 0},
280 {0,SSL_TXT_ADH,0, SSL_kEDH,SSL_aNULL,0,0,0,0,0,0,0}, 279 {0, SSL_TXT_ADH, 0, SSL_kEDH, SSL_aNULL, 0, 0, 0, 0, 0, 0, 0},
281 {0,SSL_TXT_AECDH,0, SSL_kEECDH,SSL_aNULL,0,0,0,0,0,0,0}, 280 {0, SSL_TXT_AECDH, 0, SSL_kEECDH, SSL_aNULL, 0, 0, 0, 0, 0, 0, 0},
282 {0,SSL_TXT_PSK,0, SSL_kPSK,SSL_aPSK,0,0,0,0,0,0,0}, 281 {0, SSL_TXT_PSK, 0, SSL_kPSK, SSL_aPSK, 0, 0, 0, 0, 0, 0, 0},
283 {0,SSL_TXT_SRP,0, SSL_kSRP,0,0,0,0,0,0,0,0}, 282 {0, SSL_TXT_SRP, 0, SSL_kSRP, 0, 0, 0, 0, 0, 0, 0, 0},
284 283
285 284
286 /* symmetric encryption aliases */ 285 /* symmetric encryption aliases */
287 {0,SSL_TXT_DES,0, 0,0,SSL_DES, 0,0,0,0,0,0}, 286 {0, SSL_TXT_DES, 0, 0, 0, SSL_DES, 0, 0, 0, 0, 0, 0},
288 {0,SSL_TXT_3DES,0, 0,0,SSL_3DES, 0,0,0,0,0,0}, 287 {0, SSL_TXT_3DES, 0, 0, 0, SSL_3DES, 0, 0, 0, 0, 0, 0},
289 {0,SSL_TXT_RC4,0, 0,0,SSL_RC4, 0,0,0,0,0,0}, 288 {0, SSL_TXT_RC4, 0, 0, 0, SSL_RC4, 0, 0, 0, 0, 0, 0},
290 {0,SSL_TXT_RC2,0, 0,0,SSL_RC2, 0,0,0,0,0,0}, 289 {0, SSL_TXT_RC2, 0, 0, 0, SSL_RC2, 0, 0, 0, 0, 0, 0},
291 {0,SSL_TXT_IDEA,0, 0,0,SSL_IDEA, 0,0,0,0,0,0}, 290 {0, SSL_TXT_IDEA, 0, 0, 0, SSL_IDEA, 0, 0, 0, 0, 0, 0},
292 {0,SSL_TXT_SEED,0, 0,0,SSL_SEED, 0,0,0,0,0,0}, 291 {0, SSL_TXT_SEED, 0, 0, 0, SSL_SEED, 0, 0, 0, 0, 0, 0},
293 {0,SSL_TXT_eNULL,0, 0,0,SSL_eNULL, 0,0,0,0,0,0}, 292 {0, SSL_TXT_eNULL, 0, 0, 0, SSL_eNULL, 0, 0, 0, 0, 0, 0},
294 {0,SSL_TXT_AES128,0, 0,0,SSL_AES128|SSL_AES128GCM,0,0,0,0,0,0}, 293 {0, SSL_TXT_AES128, 0, 0, 0, SSL_AES128|SSL_AES128GCM, 0, 0, 0, 0, 0, 0},
295 {0,SSL_TXT_AES256,0, 0,0,SSL_AES256|SSL_AES256GCM,0,0,0,0,0,0}, 294 {0, SSL_TXT_AES256, 0, 0, 0, SSL_AES256|SSL_AES256GCM, 0, 0, 0, 0, 0, 0},
296 {0,SSL_TXT_AES,0, 0,0,SSL_AES,0,0,0,0,0,0}, 295 {0, SSL_TXT_AES, 0, 0, 0, SSL_AES, 0, 0, 0, 0, 0, 0},
297 {0,SSL_TXT_AES_GCM,0, 0,0,SSL_AES128GCM|SSL_AES256GCM,0,0,0,0,0,0}, 296 {0, SSL_TXT_AES_GCM, 0, 0, 0, SSL_AES128GCM|SSL_AES256GCM, 0, 0, 0, 0, 0, 0},
298 {0,SSL_TXT_CAMELLIA128,0,0,0,SSL_CAMELLIA128,0,0,0,0,0,0}, 297 {0, SSL_TXT_CAMELLIA128, 0, 0, 0, SSL_CAMELLIA128, 0, 0, 0, 0, 0, 0},
299 {0,SSL_TXT_CAMELLIA256,0,0,0,SSL_CAMELLIA256,0,0,0,0,0,0}, 298 {0, SSL_TXT_CAMELLIA256, 0, 0, 0, SSL_CAMELLIA256, 0, 0, 0, 0, 0, 0},
300 {0,SSL_TXT_CAMELLIA ,0,0,0,SSL_CAMELLIA128|SSL_CAMELLIA256,0,0,0,0,0,0}, 299 {0, SSL_TXT_CAMELLIA , 0, 0, 0, SSL_CAMELLIA128|SSL_CAMELLIA256, 0, 0, 0, 0, 0, 0},
301 300
302 /* MAC aliases */ 301 /* MAC aliases */
303 {0,SSL_TXT_MD5,0, 0,0,0,SSL_MD5, 0,0,0,0,0}, 302 {0, SSL_TXT_MD5, 0, 0, 0, 0, SSL_MD5, 0, 0, 0, 0, 0},
304 {0,SSL_TXT_SHA1,0, 0,0,0,SSL_SHA1, 0,0,0,0,0}, 303 {0, SSL_TXT_SHA1, 0, 0, 0, 0, SSL_SHA1, 0, 0, 0, 0, 0},
305 {0,SSL_TXT_SHA,0, 0,0,0,SSL_SHA1, 0,0,0,0,0}, 304 {0, SSL_TXT_SHA, 0, 0, 0, 0, SSL_SHA1, 0, 0, 0, 0, 0},
306 {0,SSL_TXT_GOST94,0, 0,0,0,SSL_GOST94, 0,0,0,0,0}, 305 {0, SSL_TXT_GOST94, 0, 0, 0, 0, SSL_GOST94, 0, 0, 0, 0, 0},
307 {0,SSL_TXT_GOST89MAC,0, 0,0,0,SSL_GOST89MAC, 0,0,0,0,0}, 306 {0, SSL_TXT_GOST89MAC, 0, 0, 0, 0, SSL_GOST89MAC, 0, 0, 0, 0, 0},
308 {0,SSL_TXT_SHA256,0, 0,0,0,SSL_SHA256, 0,0,0,0,0}, 307 {0, SSL_TXT_SHA256, 0, 0, 0, 0, SSL_SHA256, 0, 0, 0, 0, 0},
309 {0,SSL_TXT_SHA384,0, 0,0,0,SSL_SHA384, 0,0,0,0,0}, 308 {0, SSL_TXT_SHA384, 0, 0, 0, 0, SSL_SHA384, 0, 0, 0, 0, 0},
310 309
311 /* protocol version aliases */ 310 /* protocol version aliases */
312 {0,SSL_TXT_SSLV2,0, 0,0,0,0,SSL_SSLV2, 0,0,0,0}, 311 {0, SSL_TXT_SSLV2, 0, 0, 0, 0, 0, SSL_SSLV2, 0, 0, 0, 0},
313 {0,SSL_TXT_SSLV3,0, 0,0,0,0,SSL_SSLV3, 0,0,0,0}, 312 {0, SSL_TXT_SSLV3, 0, 0, 0, 0, 0, SSL_SSLV3, 0, 0, 0, 0},
314 {0,SSL_TXT_TLSV1,0, 0,0,0,0,SSL_TLSV1, 0,0,0,0}, 313 {0, SSL_TXT_TLSV1, 0, 0, 0, 0, 0, SSL_TLSV1, 0, 0, 0, 0},
315 {0,SSL_TXT_TLSV1_2,0, 0,0,0,0,SSL_TLSV1_2, 0,0,0,0}, 314 {0, SSL_TXT_TLSV1_2, 0, 0, 0, 0, 0, SSL_TLSV1_2, 0, 0, 0, 0},
316 315
317 /* export flag */ 316 /* export flag */
318 {0,SSL_TXT_EXP,0, 0,0,0,0,0,SSL_EXPORT,0,0,0}, 317 {0, SSL_TXT_EXP, 0, 0, 0, 0, 0, 0, SSL_EXPORT, 0, 0, 0},
319 {0,SSL_TXT_EXPORT,0, 0,0,0,0,0,SSL_EXPORT,0,0,0}, 318 {0, SSL_TXT_EXPORT, 0, 0, 0, 0, 0, 0, SSL_EXPORT, 0, 0, 0},
320 319
321 /* strength classes */ 320 /* strength classes */
322 {0,SSL_TXT_EXP40,0, 0,0,0,0,0,SSL_EXP40, 0,0,0}, 321 {0, SSL_TXT_EXP40, 0, 0, 0, 0, 0, 0, SSL_EXP40, 0, 0, 0},
323 {0,SSL_TXT_EXP56,0, 0,0,0,0,0,SSL_EXP56, 0,0,0}, 322 {0, SSL_TXT_EXP56, 0, 0, 0, 0, 0, 0, SSL_EXP56, 0, 0, 0},
324 {0,SSL_TXT_LOW,0, 0,0,0,0,0,SSL_LOW, 0,0,0}, 323 {0, SSL_TXT_LOW, 0, 0, 0, 0, 0, 0, SSL_LOW, 0, 0, 0},
325 {0,SSL_TXT_MEDIUM,0, 0,0,0,0,0,SSL_MEDIUM,0,0,0}, 324 {0, SSL_TXT_MEDIUM, 0, 0, 0, 0, 0, 0, SSL_MEDIUM, 0, 0, 0},
326 {0,SSL_TXT_HIGH,0, 0,0,0,0,0,SSL_HIGH, 0,0,0}, 325 {0, SSL_TXT_HIGH, 0, 0, 0, 0, 0, 0, SSL_HIGH, 0, 0, 0},
327 /* FIPS 140-2 approved ciphersuite */ 326 /* FIPS 140-2 approved ciphersuite */
328 {0,SSL_TXT_FIPS,0, 0,0,~SSL_eNULL,0,0,SSL_FIPS, 0,0,0}, 327 {0, SSL_TXT_FIPS, 0, 0, 0,~SSL_eNULL, 0, 0, SSL_FIPS, 0, 0, 0},
329 }; 328};
330/* Search for public key algorithm with given name and 329/* Search for public key algorithm with given name and
331 * return its pkey_id if it is available. Otherwise return 0 330 * return its pkey_id if it is available. Otherwise return 0
332 */ 331 */
333#ifdef OPENSSL_NO_ENGINE 332#ifdef OPENSSL_NO_ENGINE
334 333
335static int get_optional_pkey_id(const char *pkey_name) 334static int
336 { 335get_optional_pkey_id(const char *pkey_name)
336{
337 const EVP_PKEY_ASN1_METHOD *ameth; 337 const EVP_PKEY_ASN1_METHOD *ameth;
338 int pkey_id=0; 338 int pkey_id = 0;
339 ameth = EVP_PKEY_asn1_find_str(NULL,pkey_name,-1); 339 ameth = EVP_PKEY_asn1_find_str(NULL, pkey_name, -1);
340 if (ameth) 340 if (ameth) {
341 { 341 EVP_PKEY_asn1_get0_info(&pkey_id, NULL, NULL, NULL, NULL, ameth);
342 EVP_PKEY_asn1_get0_info(&pkey_id, NULL,NULL,NULL,NULL,ameth);
343 }
344 return pkey_id;
345 } 342 }
343 return pkey_id;
344}
346 345
347#else 346#else
348 347
349static int get_optional_pkey_id(const char *pkey_name) 348static int
350 { 349get_optional_pkey_id(const char *pkey_name)
350{
351 const EVP_PKEY_ASN1_METHOD *ameth; 351 const EVP_PKEY_ASN1_METHOD *ameth;
352 ENGINE *tmpeng = NULL; 352 ENGINE *tmpeng = NULL;
353 int pkey_id=0; 353 int pkey_id = 0;
354 ameth = EVP_PKEY_asn1_find_str(&tmpeng,pkey_name,-1); 354 ameth = EVP_PKEY_asn1_find_str(&tmpeng, pkey_name, -1);
355 if (ameth) 355 if (ameth) {
356 { 356 EVP_PKEY_asn1_get0_info(&pkey_id, NULL, NULL, NULL, NULL, ameth);
357 EVP_PKEY_asn1_get0_info(&pkey_id, NULL,NULL,NULL,NULL,ameth);
358 }
359 if (tmpeng) ENGINE_finish(tmpeng);
360 return pkey_id;
361 } 357 }
358 if (tmpeng)
359 ENGINE_finish(tmpeng);
360 return pkey_id;
361}
362 362
363#endif 363#endif
364 364
365void ssl_load_ciphers(void) 365void
366 { 366ssl_load_ciphers(void)
367 ssl_cipher_methods[SSL_ENC_DES_IDX]= 367{
368 EVP_get_cipherbyname(SN_des_cbc); 368 ssl_cipher_methods[SSL_ENC_DES_IDX]=
369 EVP_get_cipherbyname(SN_des_cbc);
369 ssl_cipher_methods[SSL_ENC_3DES_IDX]= 370 ssl_cipher_methods[SSL_ENC_3DES_IDX]=
370 EVP_get_cipherbyname(SN_des_ede3_cbc); 371 EVP_get_cipherbyname(SN_des_ede3_cbc);
371 ssl_cipher_methods[SSL_ENC_RC4_IDX]= 372 ssl_cipher_methods[SSL_ENC_RC4_IDX]=
372 EVP_get_cipherbyname(SN_rc4); 373 EVP_get_cipherbyname(SN_rc4);
373 ssl_cipher_methods[SSL_ENC_RC2_IDX]= 374 ssl_cipher_methods[SSL_ENC_RC2_IDX]=
374 EVP_get_cipherbyname(SN_rc2_cbc); 375 EVP_get_cipherbyname(SN_rc2_cbc);
375#ifndef OPENSSL_NO_IDEA 376#ifndef OPENSSL_NO_IDEA
376 ssl_cipher_methods[SSL_ENC_IDEA_IDX]= 377 ssl_cipher_methods[SSL_ENC_IDEA_IDX]=
377 EVP_get_cipherbyname(SN_idea_cbc); 378 EVP_get_cipherbyname(SN_idea_cbc);
378#else 379#else
379 ssl_cipher_methods[SSL_ENC_IDEA_IDX]= NULL; 380 ssl_cipher_methods[SSL_ENC_IDEA_IDX] = NULL;
380#endif 381#endif
381 ssl_cipher_methods[SSL_ENC_AES128_IDX]= 382 ssl_cipher_methods[SSL_ENC_AES128_IDX]=
382 EVP_get_cipherbyname(SN_aes_128_cbc); 383 EVP_get_cipherbyname(SN_aes_128_cbc);
383 ssl_cipher_methods[SSL_ENC_AES256_IDX]= 384 ssl_cipher_methods[SSL_ENC_AES256_IDX]=
384 EVP_get_cipherbyname(SN_aes_256_cbc); 385 EVP_get_cipherbyname(SN_aes_256_cbc);
385 ssl_cipher_methods[SSL_ENC_CAMELLIA128_IDX]= 386 ssl_cipher_methods[SSL_ENC_CAMELLIA128_IDX]=
386 EVP_get_cipherbyname(SN_camellia_128_cbc); 387 EVP_get_cipherbyname(SN_camellia_128_cbc);
387 ssl_cipher_methods[SSL_ENC_CAMELLIA256_IDX]= 388 ssl_cipher_methods[SSL_ENC_CAMELLIA256_IDX]=
388 EVP_get_cipherbyname(SN_camellia_256_cbc); 389 EVP_get_cipherbyname(SN_camellia_256_cbc);
389 ssl_cipher_methods[SSL_ENC_GOST89_IDX]= 390 ssl_cipher_methods[SSL_ENC_GOST89_IDX]=
390 EVP_get_cipherbyname(SN_gost89_cnt); 391 EVP_get_cipherbyname(SN_gost89_cnt);
391 ssl_cipher_methods[SSL_ENC_SEED_IDX]= 392 ssl_cipher_methods[SSL_ENC_SEED_IDX]=
392 EVP_get_cipherbyname(SN_seed_cbc); 393 EVP_get_cipherbyname(SN_seed_cbc);
393 394
394 ssl_cipher_methods[SSL_ENC_AES128GCM_IDX]= 395 ssl_cipher_methods[SSL_ENC_AES128GCM_IDX]=
395 EVP_get_cipherbyname(SN_aes_128_gcm); 396 EVP_get_cipherbyname(SN_aes_128_gcm);
396 ssl_cipher_methods[SSL_ENC_AES256GCM_IDX]= 397 ssl_cipher_methods[SSL_ENC_AES256GCM_IDX]=
397 EVP_get_cipherbyname(SN_aes_256_gcm); 398 EVP_get_cipherbyname(SN_aes_256_gcm);
398 399
399 ssl_digest_methods[SSL_MD_MD5_IDX]= 400 ssl_digest_methods[SSL_MD_MD5_IDX]=
400 EVP_get_digestbyname(SN_md5); 401 EVP_get_digestbyname(SN_md5);
401 ssl_mac_secret_size[SSL_MD_MD5_IDX]= 402 ssl_mac_secret_size[SSL_MD_MD5_IDX]=
402 EVP_MD_size(ssl_digest_methods[SSL_MD_MD5_IDX]); 403 EVP_MD_size(ssl_digest_methods[SSL_MD_MD5_IDX]);
403 OPENSSL_assert(ssl_mac_secret_size[SSL_MD_MD5_IDX] >= 0); 404 OPENSSL_assert(ssl_mac_secret_size[SSL_MD_MD5_IDX] >= 0);
404 ssl_digest_methods[SSL_MD_SHA1_IDX]= 405 ssl_digest_methods[SSL_MD_SHA1_IDX]=
405 EVP_get_digestbyname(SN_sha1); 406 EVP_get_digestbyname(SN_sha1);
406 ssl_mac_secret_size[SSL_MD_SHA1_IDX]= 407 ssl_mac_secret_size[SSL_MD_SHA1_IDX]=
407 EVP_MD_size(ssl_digest_methods[SSL_MD_SHA1_IDX]); 408 EVP_MD_size(ssl_digest_methods[SSL_MD_SHA1_IDX]);
408 OPENSSL_assert(ssl_mac_secret_size[SSL_MD_SHA1_IDX] >= 0); 409 OPENSSL_assert(ssl_mac_secret_size[SSL_MD_SHA1_IDX] >= 0);
409 ssl_digest_methods[SSL_MD_GOST94_IDX]= 410 ssl_digest_methods[SSL_MD_GOST94_IDX]=
410 EVP_get_digestbyname(SN_id_GostR3411_94); 411 EVP_get_digestbyname(SN_id_GostR3411_94);
411 if (ssl_digest_methods[SSL_MD_GOST94_IDX]) 412 if (ssl_digest_methods[SSL_MD_GOST94_IDX]) {
412 {
413 ssl_mac_secret_size[SSL_MD_GOST94_IDX]= 413 ssl_mac_secret_size[SSL_MD_GOST94_IDX]=
414 EVP_MD_size(ssl_digest_methods[SSL_MD_GOST94_IDX]); 414 EVP_MD_size(ssl_digest_methods[SSL_MD_GOST94_IDX]);
415 OPENSSL_assert(ssl_mac_secret_size[SSL_MD_GOST94_IDX] >= 0); 415 OPENSSL_assert(ssl_mac_secret_size[SSL_MD_GOST94_IDX] >= 0);
416 } 416 }
417 ssl_digest_methods[SSL_MD_GOST89MAC_IDX]= 417 ssl_digest_methods[SSL_MD_GOST89MAC_IDX]=
418 EVP_get_digestbyname(SN_id_Gost28147_89_MAC); 418 EVP_get_digestbyname(SN_id_Gost28147_89_MAC);
419 ssl_mac_pkey_id[SSL_MD_GOST89MAC_IDX] = get_optional_pkey_id("gost-mac"); 419 ssl_mac_pkey_id[SSL_MD_GOST89MAC_IDX] = get_optional_pkey_id("gost-mac");
420 if (ssl_mac_pkey_id[SSL_MD_GOST89MAC_IDX]) { 420 if (ssl_mac_pkey_id[SSL_MD_GOST89MAC_IDX]) {
421 ssl_mac_secret_size[SSL_MD_GOST89MAC_IDX]=32; 421 ssl_mac_secret_size[SSL_MD_GOST89MAC_IDX] = 32;
422 } 422 }
423 423
424 ssl_digest_methods[SSL_MD_SHA256_IDX]= 424 ssl_digest_methods[SSL_MD_SHA256_IDX]=
425 EVP_get_digestbyname(SN_sha256); 425 EVP_get_digestbyname(SN_sha256);
426 ssl_mac_secret_size[SSL_MD_SHA256_IDX]= 426 ssl_mac_secret_size[SSL_MD_SHA256_IDX]=
427 EVP_MD_size(ssl_digest_methods[SSL_MD_SHA256_IDX]); 427 EVP_MD_size(ssl_digest_methods[SSL_MD_SHA256_IDX]);
428 ssl_digest_methods[SSL_MD_SHA384_IDX]= 428 ssl_digest_methods[SSL_MD_SHA384_IDX]=
429 EVP_get_digestbyname(SN_sha384); 429 EVP_get_digestbyname(SN_sha384);
430 ssl_mac_secret_size[SSL_MD_SHA384_IDX]= 430 ssl_mac_secret_size[SSL_MD_SHA384_IDX]=
431 EVP_MD_size(ssl_digest_methods[SSL_MD_SHA384_IDX]); 431 EVP_MD_size(ssl_digest_methods[SSL_MD_SHA384_IDX]);
432 } 432}
433#ifndef OPENSSL_NO_COMP 433#ifndef OPENSSL_NO_COMP
434 434
435static int sk_comp_cmp(const SSL_COMP * const *a, 435static int
436 const SSL_COMP * const *b) 436sk_comp_cmp(const SSL_COMP * const *a,
437 { 437 const SSL_COMP * const *b)
438 return((*a)->id-(*b)->id); 438{
439 } 439 return ((*a)->id - (*b)->id);
440}
440 441
441static void load_builtin_compressions(void) 442static void
442 { 443load_builtin_compressions(void)
444{
443 int got_write_lock = 0; 445 int got_write_lock = 0;
444 446
445 CRYPTO_r_lock(CRYPTO_LOCK_SSL); 447 CRYPTO_r_lock(CRYPTO_LOCK_SSL);
446 if (ssl_comp_methods == NULL) 448 if (ssl_comp_methods == NULL) {
447 {
448 CRYPTO_r_unlock(CRYPTO_LOCK_SSL); 449 CRYPTO_r_unlock(CRYPTO_LOCK_SSL);
449 CRYPTO_w_lock(CRYPTO_LOCK_SSL); 450 CRYPTO_w_lock(CRYPTO_LOCK_SSL);
450 got_write_lock = 1; 451 got_write_lock = 1;
451 452
452 if (ssl_comp_methods == NULL) 453 if (ssl_comp_methods == NULL) {
453 {
454 SSL_COMP *comp = NULL; 454 SSL_COMP *comp = NULL;
455 455
456 MemCheck_off(); 456 MemCheck_off();
457 ssl_comp_methods=sk_SSL_COMP_new(sk_comp_cmp); 457 ssl_comp_methods = sk_SSL_COMP_new(sk_comp_cmp);
458 if (ssl_comp_methods != NULL) 458 if (ssl_comp_methods != NULL) {
459 { 459 comp = (SSL_COMP *)OPENSSL_malloc(sizeof(SSL_COMP));
460 comp=(SSL_COMP *)OPENSSL_malloc(sizeof(SSL_COMP)); 460 if (comp != NULL) {
461 if (comp != NULL) 461 comp->method = COMP_zlib();
462 {
463 comp->method=COMP_zlib();
464 if (comp->method 462 if (comp->method
465 && comp->method->type == NID_undef) 463 && comp->method->type == NID_undef)
466 OPENSSL_free(comp); 464 OPENSSL_free(comp);
467 else 465 else {
468 { 466 comp->id = SSL_COMP_ZLIB_IDX;
469 comp->id=SSL_COMP_ZLIB_IDX; 467 comp->name = comp->method->name;
470 comp->name=comp->method->name; 468 sk_SSL_COMP_push(ssl_comp_methods, comp);
471 sk_SSL_COMP_push(ssl_comp_methods,comp);
472 }
473 } 469 }
474 sk_SSL_COMP_sort(ssl_comp_methods);
475 } 470 }
476 MemCheck_on(); 471 sk_SSL_COMP_sort(ssl_comp_methods);
477 } 472 }
473 MemCheck_on();
478 } 474 }
479 475 }
476
480 if (got_write_lock) 477 if (got_write_lock)
481 CRYPTO_w_unlock(CRYPTO_LOCK_SSL); 478 CRYPTO_w_unlock(CRYPTO_LOCK_SSL);
482 else 479 else
483 CRYPTO_r_unlock(CRYPTO_LOCK_SSL); 480 CRYPTO_r_unlock(CRYPTO_LOCK_SSL);
484 } 481}
485#endif 482#endif
486 483
487int ssl_cipher_get_evp(const SSL_SESSION *s, const EVP_CIPHER **enc, 484int
488 const EVP_MD **md, int *mac_pkey_type, int *mac_secret_size,SSL_COMP **comp) 485ssl_cipher_get_evp(const SSL_SESSION *s, const EVP_CIPHER **enc,
489 { 486 const EVP_MD **md, int *mac_pkey_type, int *mac_secret_size, SSL_COMP **comp)
487{
490 int i; 488 int i;
491 const SSL_CIPHER *c; 489 const SSL_CIPHER *c;
492 490
493 c=s->cipher; 491 c = s->cipher;
494 if (c == NULL) return(0); 492 if (c == NULL)
495 if (comp != NULL) 493 return (0);
496 { 494 if (comp != NULL) {
497 SSL_COMP ctmp; 495 SSL_COMP ctmp;
498#ifndef OPENSSL_NO_COMP 496#ifndef OPENSSL_NO_COMP
499 load_builtin_compressions(); 497 load_builtin_compressions();
500#endif 498#endif
501 499
502 *comp=NULL; 500 *comp = NULL;
503 ctmp.id=s->compress_meth; 501 ctmp.id = s->compress_meth;
504 if (ssl_comp_methods != NULL) 502 if (ssl_comp_methods != NULL) {
505 { 503 i = sk_SSL_COMP_find(ssl_comp_methods, &ctmp);
506 i=sk_SSL_COMP_find(ssl_comp_methods,&ctmp);
507 if (i >= 0) 504 if (i >= 0)
508 *comp=sk_SSL_COMP_value(ssl_comp_methods,i); 505 *comp = sk_SSL_COMP_value(ssl_comp_methods, i);
509 else 506 else
510 *comp=NULL; 507 *comp = NULL;
511 }
512 } 508 }
509 }
513 510
514 if ((enc == NULL) || (md == NULL)) return(0); 511 if ((enc == NULL)
512 || (md == NULL)) return (0);
515 513
516 switch (c->algorithm_enc) 514 switch (c->algorithm_enc) {
517 {
518 case SSL_DES: 515 case SSL_DES:
519 i=SSL_ENC_DES_IDX; 516 i = SSL_ENC_DES_IDX;
520 break; 517 break;
521 case SSL_3DES: 518 case SSL_3DES:
522 i=SSL_ENC_3DES_IDX; 519 i = SSL_ENC_3DES_IDX;
523 break; 520 break;
524 case SSL_RC4: 521 case SSL_RC4:
525 i=SSL_ENC_RC4_IDX; 522 i = SSL_ENC_RC4_IDX;
526 break; 523 break;
527 case SSL_RC2: 524 case SSL_RC2:
528 i=SSL_ENC_RC2_IDX; 525 i = SSL_ENC_RC2_IDX;
529 break; 526 break;
530 case SSL_IDEA: 527 case SSL_IDEA:
531 i=SSL_ENC_IDEA_IDX; 528 i = SSL_ENC_IDEA_IDX;
532 break; 529 break;
533 case SSL_eNULL: 530 case SSL_eNULL:
534 i=SSL_ENC_NULL_IDX; 531 i = SSL_ENC_NULL_IDX;
535 break; 532 break;
536 case SSL_AES128: 533 case SSL_AES128:
537 i=SSL_ENC_AES128_IDX; 534 i = SSL_ENC_AES128_IDX;
538 break; 535 break;
539 case SSL_AES256: 536 case SSL_AES256:
540 i=SSL_ENC_AES256_IDX; 537 i = SSL_ENC_AES256_IDX;
541 break; 538 break;
542 case SSL_CAMELLIA128: 539 case SSL_CAMELLIA128:
543 i=SSL_ENC_CAMELLIA128_IDX; 540 i = SSL_ENC_CAMELLIA128_IDX;
544 break; 541 break;
545 case SSL_CAMELLIA256: 542 case SSL_CAMELLIA256:
546 i=SSL_ENC_CAMELLIA256_IDX; 543 i = SSL_ENC_CAMELLIA256_IDX;
547 break; 544 break;
548 case SSL_eGOST2814789CNT: 545 case SSL_eGOST2814789CNT:
549 i=SSL_ENC_GOST89_IDX; 546 i = SSL_ENC_GOST89_IDX;
550 break; 547 break;
551 case SSL_SEED: 548 case SSL_SEED:
552 i=SSL_ENC_SEED_IDX; 549 i = SSL_ENC_SEED_IDX;
553 break; 550 break;
554 case SSL_AES128GCM: 551 case SSL_AES128GCM:
555 i=SSL_ENC_AES128GCM_IDX; 552 i = SSL_ENC_AES128GCM_IDX;
556 break; 553 break;
557 case SSL_AES256GCM: 554 case SSL_AES256GCM:
558 i=SSL_ENC_AES256GCM_IDX; 555 i = SSL_ENC_AES256GCM_IDX;
559 break; 556 break;
560 default: 557 default:
561 i= -1; 558 i = -1;
562 break; 559 break;
563 } 560 }
564 561
565 if ((i < 0) || (i > SSL_ENC_NUM_IDX)) 562 if ((i < 0) || (i > SSL_ENC_NUM_IDX))
566 *enc=NULL; 563 *enc = NULL;
567 else 564 else {
568 {
569 if (i == SSL_ENC_NULL_IDX) 565 if (i == SSL_ENC_NULL_IDX)
570 *enc=EVP_enc_null(); 566 *enc = EVP_enc_null();
571 else 567 else
572 *enc=ssl_cipher_methods[i]; 568 *enc = ssl_cipher_methods[i];
573 } 569 }
574 570
575 switch (c->algorithm_mac) 571 switch (c->algorithm_mac) {
576 {
577 case SSL_MD5: 572 case SSL_MD5:
578 i=SSL_MD_MD5_IDX; 573 i = SSL_MD_MD5_IDX;
579 break; 574 break;
580 case SSL_SHA1: 575 case SSL_SHA1:
581 i=SSL_MD_SHA1_IDX; 576 i = SSL_MD_SHA1_IDX;
582 break; 577 break;
583 case SSL_SHA256: 578 case SSL_SHA256:
584 i=SSL_MD_SHA256_IDX; 579 i = SSL_MD_SHA256_IDX;
585 break; 580 break;
586 case SSL_SHA384: 581 case SSL_SHA384:
587 i=SSL_MD_SHA384_IDX; 582 i = SSL_MD_SHA384_IDX;
588 break; 583 break;
589 case SSL_GOST94: 584 case SSL_GOST94:
590 i = SSL_MD_GOST94_IDX; 585 i = SSL_MD_GOST94_IDX;
@@ -593,63 +588,63 @@ int ssl_cipher_get_evp(const SSL_SESSION *s, const EVP_CIPHER **enc,
593 i = SSL_MD_GOST89MAC_IDX; 588 i = SSL_MD_GOST89MAC_IDX;
594 break; 589 break;
595 default: 590 default:
596 i= -1; 591 i = -1;
597 break; 592 break;
598 } 593 }
599 if ((i < 0) || (i > SSL_MD_NUM_IDX)) 594 if ((i < 0) || (i > SSL_MD_NUM_IDX)) {
600 { 595 *md = NULL;
601 *md=NULL; 596
602 if (mac_pkey_type!=NULL) *mac_pkey_type = NID_undef; 597 if (mac_pkey_type != NULL)
603 if (mac_secret_size!=NULL) *mac_secret_size = 0; 598 *mac_pkey_type = NID_undef;
599 if (mac_secret_size != NULL)
600 *mac_secret_size = 0;
604 if (c->algorithm_mac == SSL_AEAD) 601 if (c->algorithm_mac == SSL_AEAD)
605 mac_pkey_type = NULL; 602 mac_pkey_type = NULL;
606 } 603 } else {
607 else 604 *md = ssl_digest_methods[i];
608 { 605 if (mac_pkey_type != NULL)
609 *md=ssl_digest_methods[i]; 606 *mac_pkey_type = ssl_mac_pkey_id[i];
610 if (mac_pkey_type!=NULL) *mac_pkey_type = ssl_mac_pkey_id[i]; 607 if (mac_secret_size != NULL)
611 if (mac_secret_size!=NULL) *mac_secret_size = ssl_mac_secret_size[i]; 608 *mac_secret_size = ssl_mac_secret_size[i];
612 } 609 }
613 610
614 if ((*enc != NULL) && 611 if ((*enc != NULL) &&
615 (*md != NULL || (EVP_CIPHER_flags(*enc)&EVP_CIPH_FLAG_AEAD_CIPHER)) && 612 (*md != NULL || (EVP_CIPHER_flags(*enc)&EVP_CIPH_FLAG_AEAD_CIPHER)) &&
616 (!mac_pkey_type||*mac_pkey_type != NID_undef)) 613 (!mac_pkey_type || *mac_pkey_type != NID_undef)) {
617 {
618 const EVP_CIPHER *evp; 614 const EVP_CIPHER *evp;
619 615
620 if (s->ssl_version>>8 != TLS1_VERSION_MAJOR || 616 if (s->ssl_version >> 8 != TLS1_VERSION_MAJOR ||
621 s->ssl_version < TLS1_VERSION) 617 s->ssl_version < TLS1_VERSION)
622 return 1; 618 return 1;
623 619
624#ifdef OPENSSL_FIPS 620#ifdef OPENSSL_FIPS
625 if (FIPS_mode()) 621 if (FIPS_mode())
626 return 1; 622 return 1;
627#endif 623#endif
628 624
629 if (c->algorithm_enc == SSL_RC4 && 625 if (c->algorithm_enc == SSL_RC4 &&
630 c->algorithm_mac == SSL_MD5 && 626 c->algorithm_mac == SSL_MD5 &&
631 (evp=EVP_get_cipherbyname("RC4-HMAC-MD5"))) 627 (evp = EVP_get_cipherbyname("RC4-HMAC-MD5")))
632 *enc = evp, *md = NULL; 628 *enc = evp, *md = NULL;
633 else if (c->algorithm_enc == SSL_AES128 && 629 else if (c->algorithm_enc == SSL_AES128 &&
634 c->algorithm_mac == SSL_SHA1 && 630 c->algorithm_mac == SSL_SHA1 &&
635 (evp=EVP_get_cipherbyname("AES-128-CBC-HMAC-SHA1"))) 631 (evp = EVP_get_cipherbyname("AES-128-CBC-HMAC-SHA1")))
636 *enc = evp, *md = NULL; 632 *enc = evp, *md = NULL;
637 else if (c->algorithm_enc == SSL_AES256 && 633 else if (c->algorithm_enc == SSL_AES256 &&
638 c->algorithm_mac == SSL_SHA1 && 634 c->algorithm_mac == SSL_SHA1 &&
639 (evp=EVP_get_cipherbyname("AES-256-CBC-HMAC-SHA1"))) 635 (evp = EVP_get_cipherbyname("AES-256-CBC-HMAC-SHA1")))
640 *enc = evp, *md = NULL; 636 *enc = evp, *md = NULL;
641 return(1); 637 return (1);
642 } 638 } else
643 else 639 return (0);
644 return(0); 640}
645 }
646 641
647int ssl_get_handshake_digest(int idx, long *mask, const EVP_MD **md) 642int
643ssl_get_handshake_digest(int idx, long *mask, const EVP_MD **md)
648{ 644{
649 if (idx <0||idx>=SSL_MD_NUM_IDX) 645 if (idx < 0 || idx >= SSL_MD_NUM_IDX) {
650 {
651 return 0; 646 return 0;
652 } 647 }
653 *mask = ssl_handshake_digest_flag[idx]; 648 *mask = ssl_handshake_digest_flag[idx];
654 if (*mask) 649 if (*mask)
655 *md = ssl_digest_methods[idx]; 650 *md = ssl_digest_methods[idx];
@@ -661,40 +656,45 @@ int ssl_get_handshake_digest(int idx, long *mask, const EVP_MD **md)
661#define ITEM_SEP(a) \ 656#define ITEM_SEP(a) \
662 (((a) == ':') || ((a) == ' ') || ((a) == ';') || ((a) == ',')) 657 (((a) == ':') || ((a) == ' ') || ((a) == ';') || ((a) == ','))
663 658
664static void ll_append_tail(CIPHER_ORDER **head, CIPHER_ORDER *curr, 659static void
665 CIPHER_ORDER **tail) 660ll_append_tail(CIPHER_ORDER **head, CIPHER_ORDER *curr,
666 { 661 CIPHER_ORDER **tail)
667 if (curr == *tail) return; 662{
663 if (curr == *tail)
664 return;
668 if (curr == *head) 665 if (curr == *head)
669 *head=curr->next; 666 *head = curr->next;
670 if (curr->prev != NULL) 667 if (curr->prev != NULL)
671 curr->prev->next=curr->next; 668 curr->prev->next = curr->next;
672 if (curr->next != NULL) 669 if (curr->next != NULL)
673 curr->next->prev=curr->prev; 670 curr->next->prev = curr->prev;
674 (*tail)->next=curr; 671 (*tail)->next = curr;
675 curr->prev= *tail; 672 curr->prev= *tail;
676 curr->next=NULL; 673 curr->next = NULL;
677 *tail=curr; 674 *tail = curr;
678 } 675}
679 676
680static void ll_append_head(CIPHER_ORDER **head, CIPHER_ORDER *curr, 677static void
681 CIPHER_ORDER **tail) 678ll_append_head(CIPHER_ORDER **head, CIPHER_ORDER *curr,
682 { 679 CIPHER_ORDER **tail)
683 if (curr == *head) return; 680{
681 if (curr == *head)
682 return;
684 if (curr == *tail) 683 if (curr == *tail)
685 *tail=curr->prev; 684 *tail = curr->prev;
686 if (curr->next != NULL) 685 if (curr->next != NULL)
687 curr->next->prev=curr->prev; 686 curr->next->prev = curr->prev;
688 if (curr->prev != NULL) 687 if (curr->prev != NULL)
689 curr->prev->next=curr->next; 688 curr->prev->next = curr->next;
690 (*head)->prev=curr; 689 (*head)->prev = curr;
691 curr->next= *head; 690 curr->next= *head;
692 curr->prev=NULL; 691 curr->prev = NULL;
693 *head=curr; 692 *head = curr;
694 } 693}
695 694
696static void ssl_cipher_get_disabled(unsigned long *mkey, unsigned long *auth, unsigned long *enc, unsigned long *mac, unsigned long *ssl) 695static void
697 { 696ssl_cipher_get_disabled(unsigned long *mkey, unsigned long *auth, unsigned long *enc, unsigned long *mac, unsigned long *ssl)
697{
698 *mkey = 0; 698 *mkey = 0;
699 *auth = 0; 699 *auth = 0;
700 *enc = 0; 700 *enc = 0;
@@ -743,44 +743,45 @@ static void ssl_cipher_get_disabled(unsigned long *mkey, unsigned long *auth, un
743 /* Disable GOST key exchange if no GOST signature algs are available * */ 743 /* Disable GOST key exchange if no GOST signature algs are available * */
744 if ((*auth & (SSL_aGOST94|SSL_aGOST01)) == (SSL_aGOST94|SSL_aGOST01)) { 744 if ((*auth & (SSL_aGOST94|SSL_aGOST01)) == (SSL_aGOST94|SSL_aGOST01)) {
745 *mkey |= SSL_kGOST; 745 *mkey |= SSL_kGOST;
746 } 746 }
747#ifdef SSL_FORBID_ENULL 747#ifdef SSL_FORBID_ENULL
748 *enc |= SSL_eNULL; 748 *enc |= SSL_eNULL;
749#endif 749#endif
750
751
752
753 *enc |= (ssl_cipher_methods[SSL_ENC_DES_IDX ] == NULL) ? SSL_DES :0;
754 *enc |= (ssl_cipher_methods[SSL_ENC_3DES_IDX] == NULL) ? SSL_3DES:0;
755 *enc |= (ssl_cipher_methods[SSL_ENC_RC4_IDX ] == NULL) ? SSL_RC4 :0;
756 *enc |= (ssl_cipher_methods[SSL_ENC_RC2_IDX ] == NULL) ? SSL_RC2 :0;
757 *enc |= (ssl_cipher_methods[SSL_ENC_IDEA_IDX] == NULL) ? SSL_IDEA:0;
758 *enc |= (ssl_cipher_methods[SSL_ENC_AES128_IDX] == NULL) ? SSL_AES128:0;
759 *enc |= (ssl_cipher_methods[SSL_ENC_AES256_IDX] == NULL) ? SSL_AES256:0;
760 *enc |= (ssl_cipher_methods[SSL_ENC_AES128GCM_IDX] == NULL) ? SSL_AES128GCM:0;
761 *enc |= (ssl_cipher_methods[SSL_ENC_AES256GCM_IDX] == NULL) ? SSL_AES256GCM:0;
762 *enc |= (ssl_cipher_methods[SSL_ENC_CAMELLIA128_IDX] == NULL) ? SSL_CAMELLIA128:0;
763 *enc |= (ssl_cipher_methods[SSL_ENC_CAMELLIA256_IDX] == NULL) ? SSL_CAMELLIA256:0;
764 *enc |= (ssl_cipher_methods[SSL_ENC_GOST89_IDX] == NULL) ? SSL_eGOST2814789CNT:0;
765 *enc |= (ssl_cipher_methods[SSL_ENC_SEED_IDX] == NULL) ? SSL_SEED:0;
766
767 *mac |= (ssl_digest_methods[SSL_MD_MD5_IDX ] == NULL) ? SSL_MD5 :0;
768 *mac |= (ssl_digest_methods[SSL_MD_SHA1_IDX] == NULL) ? SSL_SHA1:0;
769 *mac |= (ssl_digest_methods[SSL_MD_SHA256_IDX] == NULL) ? SSL_SHA256:0;
770 *mac |= (ssl_digest_methods[SSL_MD_SHA384_IDX] == NULL) ? SSL_SHA384:0;
771 *mac |= (ssl_digest_methods[SSL_MD_GOST94_IDX] == NULL) ? SSL_GOST94:0;
772 *mac |= (ssl_digest_methods[SSL_MD_GOST89MAC_IDX] == NULL || ssl_mac_pkey_id[SSL_MD_GOST89MAC_IDX]==NID_undef)? SSL_GOST89MAC:0;
773 750
774 }
775 751
776static void ssl_cipher_collect_ciphers(const SSL_METHOD *ssl_method, 752
777 int num_of_ciphers, 753 *enc |= (ssl_cipher_methods[SSL_ENC_DES_IDX ] == NULL) ? SSL_DES : 0;
778 unsigned long disabled_mkey, unsigned long disabled_auth, 754 *enc |= (ssl_cipher_methods[SSL_ENC_3DES_IDX] == NULL) ? SSL_3DES : 0;
779 unsigned long disabled_enc, unsigned long disabled_mac, 755 *enc |= (ssl_cipher_methods[SSL_ENC_RC4_IDX ] == NULL) ? SSL_RC4 : 0;
780 unsigned long disabled_ssl, 756 *enc |= (ssl_cipher_methods[SSL_ENC_RC2_IDX ] == NULL) ? SSL_RC2 : 0;
781 CIPHER_ORDER *co_list, 757 *enc |= (ssl_cipher_methods[SSL_ENC_IDEA_IDX] == NULL) ? SSL_IDEA : 0;
782 CIPHER_ORDER **head_p, CIPHER_ORDER **tail_p) 758 *enc |= (ssl_cipher_methods[SSL_ENC_AES128_IDX] == NULL) ? SSL_AES128 : 0;
783 { 759 *enc |= (ssl_cipher_methods[SSL_ENC_AES256_IDX] == NULL) ? SSL_AES256 : 0;
760 *enc |= (ssl_cipher_methods[SSL_ENC_AES128GCM_IDX] == NULL) ? SSL_AES128GCM : 0;
761 *enc |= (ssl_cipher_methods[SSL_ENC_AES256GCM_IDX] == NULL) ? SSL_AES256GCM : 0;
762 *enc |= (ssl_cipher_methods[SSL_ENC_CAMELLIA128_IDX] == NULL) ? SSL_CAMELLIA128 : 0;
763 *enc |= (ssl_cipher_methods[SSL_ENC_CAMELLIA256_IDX] == NULL) ? SSL_CAMELLIA256 : 0;
764 *enc |= (ssl_cipher_methods[SSL_ENC_GOST89_IDX] == NULL) ? SSL_eGOST2814789CNT : 0;
765 *enc |= (ssl_cipher_methods[SSL_ENC_SEED_IDX] == NULL) ? SSL_SEED : 0;
766
767 *mac |= (ssl_digest_methods[SSL_MD_MD5_IDX ] == NULL) ? SSL_MD5 : 0;
768 *mac |= (ssl_digest_methods[SSL_MD_SHA1_IDX] == NULL) ? SSL_SHA1 : 0;
769 *mac |= (ssl_digest_methods[SSL_MD_SHA256_IDX] == NULL) ? SSL_SHA256 : 0;
770 *mac |= (ssl_digest_methods[SSL_MD_SHA384_IDX] == NULL) ? SSL_SHA384 : 0;
771 *mac |= (ssl_digest_methods[SSL_MD_GOST94_IDX] == NULL) ? SSL_GOST94 : 0;
772 *mac |= (ssl_digest_methods[SSL_MD_GOST89MAC_IDX] == NULL || ssl_mac_pkey_id[SSL_MD_GOST89MAC_IDX]==NID_undef) ? SSL_GOST89MAC : 0;
773
774}
775
776static void
777ssl_cipher_collect_ciphers(const SSL_METHOD *ssl_method,
778 int num_of_ciphers,
779unsigned long disabled_mkey, unsigned long disabled_auth,
780 unsigned long disabled_enc, unsigned long disabled_mac,
781unsigned long disabled_ssl,
782 CIPHER_ORDER *co_list,
783CIPHER_ORDER **head_p, CIPHER_ORDER **tail_p)
784{
784 int i, co_list_num; 785 int i, co_list_num;
785 const SSL_CIPHER *c; 786 const SSL_CIPHER *c;
786 787
@@ -793,68 +794,64 @@ static void ssl_cipher_collect_ciphers(const SSL_METHOD *ssl_method,
793 794
794 /* Get the initial list of ciphers */ 795 /* Get the initial list of ciphers */
795 co_list_num = 0; /* actual count of ciphers */ 796 co_list_num = 0; /* actual count of ciphers */
796 for (i = 0; i < num_of_ciphers; i++) 797 for (i = 0; i < num_of_ciphers; i++) {
797 {
798 c = ssl_method->get_cipher(i); 798 c = ssl_method->get_cipher(i);
799 /* drop those that use any of that is not available */ 799 /* drop those that use any of that is not available */
800 if ((c != NULL) && c->valid && 800 if ((c != NULL) && c->valid &&
801#ifdef OPENSSL_FIPS 801#ifdef OPENSSL_FIPS
802 (!FIPS_mode() || (c->algo_strength & SSL_FIPS)) && 802 (!FIPS_mode() || (c->algo_strength & SSL_FIPS)) &&
803#endif 803#endif
804 !(c->algorithm_mkey & disabled_mkey) && 804 !(c->algorithm_mkey & disabled_mkey) &&
805 !(c->algorithm_auth & disabled_auth) && 805 !(c->algorithm_auth & disabled_auth) &&
806 !(c->algorithm_enc & disabled_enc) && 806 !(c->algorithm_enc & disabled_enc) &&
807 !(c->algorithm_mac & disabled_mac) && 807 !(c->algorithm_mac & disabled_mac) &&
808 !(c->algorithm_ssl & disabled_ssl)) 808 !(c->algorithm_ssl & disabled_ssl)) {
809 {
810 co_list[co_list_num].cipher = c; 809 co_list[co_list_num].cipher = c;
811 co_list[co_list_num].next = NULL; 810 co_list[co_list_num].next = NULL;
812 co_list[co_list_num].prev = NULL; 811 co_list[co_list_num].prev = NULL;
813 co_list[co_list_num].active = 0; 812 co_list[co_list_num].active = 0;
814 co_list_num++; 813 co_list_num++;
815#ifdef KSSL_DEBUG 814#ifdef KSSL_DEBUG
816 printf("\t%d: %s %lx %lx %lx\n",i,c->name,c->id,c->algorithm_mkey,c->algorithm_auth); 815 printf("\t%d: %s %lx %lx %lx\n", i, c->name, c->id, c->algorithm_mkey, c->algorithm_auth);
817#endif /* KSSL_DEBUG */ 816#endif /* KSSL_DEBUG */
818 /* 817 /*
819 if (!sk_push(ca_list,(char *)c)) goto err; 818 if (!sk_push(ca_list,(char *)c)) goto err;
820 */ 819 */
821 }
822 } 820 }
821 }
823 822
824 /* 823 /*
825 * Prepare linked list from list entries 824 * Prepare linked list from list entries
826 */ 825 */
827 if (co_list_num > 0) 826 if (co_list_num > 0) {
828 {
829 co_list[0].prev = NULL; 827 co_list[0].prev = NULL;
830 828
831 if (co_list_num > 1) 829 if (co_list_num > 1) {
832 {
833 co_list[0].next = &co_list[1]; 830 co_list[0].next = &co_list[1];
834 831
835 for (i = 1; i < co_list_num - 1; i++) 832 for (i = 1; i < co_list_num - 1; i++) {
836 {
837 co_list[i].prev = &co_list[i - 1]; 833 co_list[i].prev = &co_list[i - 1];
838 co_list[i].next = &co_list[i + 1]; 834 co_list[i].next = &co_list[i + 1];
839 } 835 }
840 836
841 co_list[co_list_num - 1].prev = &co_list[co_list_num - 2]; 837 co_list[co_list_num - 1].prev = &co_list[co_list_num - 2];
842 } 838 }
843 839
844 co_list[co_list_num - 1].next = NULL; 840 co_list[co_list_num - 1].next = NULL;
845 841
846 *head_p = &co_list[0]; 842 *head_p = &co_list[0];
847 *tail_p = &co_list[co_list_num - 1]; 843 *tail_p = &co_list[co_list_num - 1];
848 }
849 } 844 }
845}
850 846
851static void ssl_cipher_collect_aliases(const SSL_CIPHER **ca_list, 847static void
852 int num_of_group_aliases, 848ssl_cipher_collect_aliases(const SSL_CIPHER **ca_list,
853 unsigned long disabled_mkey, unsigned long disabled_auth, 849 int num_of_group_aliases,
854 unsigned long disabled_enc, unsigned long disabled_mac, 850unsigned long disabled_mkey, unsigned long disabled_auth,
855 unsigned long disabled_ssl, 851 unsigned long disabled_enc, unsigned long disabled_mac,
856 CIPHER_ORDER *head) 852unsigned long disabled_ssl,
857 { 853 CIPHER_ORDER *head)
854{
858 CIPHER_ORDER *ciph_curr; 855 CIPHER_ORDER *ciph_curr;
859 const SSL_CIPHER **ca_curr; 856 const SSL_CIPHER **ca_curr;
860 int i; 857 int i;
@@ -869,12 +866,11 @@ static void ssl_cipher_collect_aliases(const SSL_CIPHER **ca_list,
869 */ 866 */
870 ciph_curr = head; 867 ciph_curr = head;
871 ca_curr = ca_list; 868 ca_curr = ca_list;
872 while (ciph_curr != NULL) 869 while (ciph_curr != NULL) {
873 {
874 *ca_curr = ciph_curr->cipher; 870 *ca_curr = ciph_curr->cipher;
875 ca_curr++; 871 ca_curr++;
876 ciph_curr = ciph_curr->next; 872 ciph_curr = ciph_curr->next;
877 } 873 }
878 874
879 /* 875 /*
880 * Now we add the available ones from the cipher_aliases[] table. 876 * Now we add the available ones from the cipher_aliases[] table.
@@ -882,8 +878,7 @@ static void ssl_cipher_collect_aliases(const SSL_CIPHER **ca_list,
882 * in any affected category must be supported (set in enabled_mask), 878 * in any affected category must be supported (set in enabled_mask),
883 * or represent a cipher strength value (will be added in any case because algorithms=0). 879 * or represent a cipher strength value (will be added in any case because algorithms=0).
884 */ 880 */
885 for (i = 0; i < num_of_group_aliases; i++) 881 for (i = 0; i < num_of_group_aliases; i++) {
886 {
887 unsigned long algorithm_mkey = cipher_aliases[i].algorithm_mkey; 882 unsigned long algorithm_mkey = cipher_aliases[i].algorithm_mkey;
888 unsigned long algorithm_auth = cipher_aliases[i].algorithm_auth; 883 unsigned long algorithm_auth = cipher_aliases[i].algorithm_auth;
889 unsigned long algorithm_enc = cipher_aliases[i].algorithm_enc; 884 unsigned long algorithm_enc = cipher_aliases[i].algorithm_enc;
@@ -893,45 +888,46 @@ static void ssl_cipher_collect_aliases(const SSL_CIPHER **ca_list,
893 if (algorithm_mkey) 888 if (algorithm_mkey)
894 if ((algorithm_mkey & mask_mkey) == 0) 889 if ((algorithm_mkey & mask_mkey) == 0)
895 continue; 890 continue;
896 891
897 if (algorithm_auth) 892 if (algorithm_auth)
898 if ((algorithm_auth & mask_auth) == 0) 893 if ((algorithm_auth & mask_auth) == 0)
899 continue; 894 continue;
900 895
901 if (algorithm_enc) 896 if (algorithm_enc)
902 if ((algorithm_enc & mask_enc) == 0) 897 if ((algorithm_enc & mask_enc) == 0)
903 continue; 898 continue;
904 899
905 if (algorithm_mac) 900 if (algorithm_mac)
906 if ((algorithm_mac & mask_mac) == 0) 901 if ((algorithm_mac & mask_mac) == 0)
907 continue; 902 continue;
908 903
909 if (algorithm_ssl) 904 if (algorithm_ssl)
910 if ((algorithm_ssl & mask_ssl) == 0) 905 if ((algorithm_ssl & mask_ssl) == 0)
911 continue; 906 continue;
912 907
913 *ca_curr = (SSL_CIPHER *)(cipher_aliases + i); 908 *ca_curr = (SSL_CIPHER *)(cipher_aliases + i);
914 ca_curr++; 909 ca_curr++;
915 } 910 }
916 911
917 *ca_curr = NULL; /* end of list */ 912 *ca_curr = NULL; /* end of list */
918 } 913}
919 914
920static void ssl_cipher_apply_rule(unsigned long cipher_id, 915static void
921 unsigned long alg_mkey, unsigned long alg_auth, 916ssl_cipher_apply_rule(unsigned long cipher_id,
922 unsigned long alg_enc, unsigned long alg_mac, 917 unsigned long alg_mkey, unsigned long alg_auth,
923 unsigned long alg_ssl, 918unsigned long alg_enc, unsigned long alg_mac,
924 unsigned long algo_strength, 919 unsigned long alg_ssl,
925 int rule, int strength_bits, 920unsigned long algo_strength,
926 CIPHER_ORDER **head_p, CIPHER_ORDER **tail_p) 921 int rule, int strength_bits,
927 { 922CIPHER_ORDER **head_p, CIPHER_ORDER **tail_p)
923{
928 CIPHER_ORDER *head, *tail, *curr, *curr2, *last; 924 CIPHER_ORDER *head, *tail, *curr, *curr2, *last;
929 const SSL_CIPHER *cp; 925 const SSL_CIPHER *cp;
930 int reverse = 0; 926 int reverse = 0;
931 927
932#ifdef CIPHER_DEBUG 928#ifdef CIPHER_DEBUG
933 printf("Applying rule %d with %08lx/%08lx/%08lx/%08lx/%08lx %08lx (%d)\n", 929 printf("Applying rule %d with %08lx/%08lx/%08lx/%08lx/%08lx %08lx (%d)\n",
934 rule, alg_mkey, alg_auth, alg_enc, alg_mac, alg_ssl, algo_strength, strength_bits); 930 rule, alg_mkey, alg_auth, alg_enc, alg_mac, alg_ssl, algo_strength, strength_bits);
935#endif 931#endif
936 932
937 if (rule == CIPHER_DEL) 933 if (rule == CIPHER_DEL)
@@ -940,21 +936,18 @@ static void ssl_cipher_apply_rule(unsigned long cipher_id,
940 head = *head_p; 936 head = *head_p;
941 tail = *tail_p; 937 tail = *tail_p;
942 938
943 if (reverse) 939 if (reverse) {
944 {
945 curr = tail; 940 curr = tail;
946 last = head; 941 last = head;
947 } 942 } else {
948 else
949 {
950 curr = head; 943 curr = head;
951 last = tail; 944 last = tail;
952 } 945 }
953 946
954 curr2 = curr; 947 curr2 = curr;
955 for (;;) 948 for (;;) {
956 { 949 if ((curr == NULL)
957 if ((curr == NULL) || (curr == last)) break; 950 || (curr == last)) break;
958 curr = curr2; 951 curr = curr2;
959 curr2 = reverse ? curr->prev : curr->next; 952 curr2 = reverse ? curr->prev : curr->next;
960 953
@@ -964,13 +957,10 @@ static void ssl_cipher_apply_rule(unsigned long cipher_id,
964 * Selection criteria is either the value of strength_bits 957 * Selection criteria is either the value of strength_bits
965 * or the algorithms used. 958 * or the algorithms used.
966 */ 959 */
967 if (strength_bits >= 0) 960 if (strength_bits >= 0) {
968 {
969 if (strength_bits != cp->strength_bits) 961 if (strength_bits != cp->strength_bits)
970 continue; 962 continue;
971 } 963 } else {
972 else
973 {
974#ifdef CIPHER_DEBUG 964#ifdef CIPHER_DEBUG
975 printf("\nName: %s:\nAlgo = %08lx/%08lx/%08lx/%08lx/%08lx Algo_strength = %08lx\n", cp->name, cp->algorithm_mkey, cp->algorithm_auth, cp->algorithm_enc, cp->algorithm_mac, cp->algorithm_ssl, cp->algo_strength); 965 printf("\nName: %s:\nAlgo = %08lx/%08lx/%08lx/%08lx/%08lx Algo_strength = %08lx\n", cp->name, cp->algorithm_mkey, cp->algorithm_auth, cp->algorithm_enc, cp->algorithm_mac, cp->algorithm_ssl, cp->algo_strength);
976#endif 966#endif
@@ -989,45 +979,36 @@ static void ssl_cipher_apply_rule(unsigned long cipher_id,
989 continue; 979 continue;
990 if ((algo_strength & SSL_STRONG_MASK) && !(algo_strength & SSL_STRONG_MASK & cp->algo_strength)) 980 if ((algo_strength & SSL_STRONG_MASK) && !(algo_strength & SSL_STRONG_MASK & cp->algo_strength))
991 continue; 981 continue;
992 } 982 }
993 983
994#ifdef CIPHER_DEBUG 984#ifdef CIPHER_DEBUG
995 printf("Action = %d\n", rule); 985 printf("Action = %d\n", rule);
996#endif 986#endif
997 987
998 /* add the cipher if it has not been added yet. */ 988 /* add the cipher if it has not been added yet. */
999 if (rule == CIPHER_ADD) 989 if (rule == CIPHER_ADD) {
1000 {
1001 /* reverse == 0 */ 990 /* reverse == 0 */
1002 if (!curr->active) 991 if (!curr->active) {
1003 {
1004 ll_append_tail(&head, curr, &tail); 992 ll_append_tail(&head, curr, &tail);
1005 curr->active = 1; 993 curr->active = 1;
1006 }
1007 } 994 }
995 }
1008 /* Move the added cipher to this location */ 996 /* Move the added cipher to this location */
1009 else if (rule == CIPHER_ORD) 997 else if (rule == CIPHER_ORD) {
1010 {
1011 /* reverse == 0 */ 998 /* reverse == 0 */
1012 if (curr->active) 999 if (curr->active) {
1013 {
1014 ll_append_tail(&head, curr, &tail); 1000 ll_append_tail(&head, curr, &tail);
1015 }
1016 } 1001 }
1017 else if (rule == CIPHER_DEL) 1002 } else if (rule == CIPHER_DEL) {
1018 {
1019 /* reverse == 1 */ 1003 /* reverse == 1 */
1020 if (curr->active) 1004 if (curr->active) {
1021 {
1022 /* most recently deleted ciphersuites get best positions 1005 /* most recently deleted ciphersuites get best positions
1023 * for any future CIPHER_ADD (note that the CIPHER_DEL loop 1006 * for any future CIPHER_ADD (note that the CIPHER_DEL loop
1024 * works in reverse to maintain the order) */ 1007 * works in reverse to maintain the order) */
1025 ll_append_head(&head, curr, &tail); 1008 ll_append_head(&head, curr, &tail);
1026 curr->active = 0; 1009 curr->active = 0;
1027 }
1028 } 1010 }
1029 else if (rule == CIPHER_KILL) 1011 } else if (rule == CIPHER_KILL) {
1030 {
1031 /* reverse == 0 */ 1012 /* reverse == 0 */
1032 if (head == curr) 1013 if (head == curr)
1033 head = curr->next; 1014 head = curr->next;
@@ -1042,16 +1023,17 @@ static void ssl_cipher_apply_rule(unsigned long cipher_id,
1042 curr->prev->next = curr->next; 1023 curr->prev->next = curr->next;
1043 curr->next = NULL; 1024 curr->next = NULL;
1044 curr->prev = NULL; 1025 curr->prev = NULL;
1045 }
1046 } 1026 }
1027 }
1047 1028
1048 *head_p = head; 1029 *head_p = head;
1049 *tail_p = tail; 1030 *tail_p = tail;
1050 } 1031}
1051 1032
1052static int ssl_cipher_strength_sort(CIPHER_ORDER **head_p, 1033static int
1053 CIPHER_ORDER **tail_p) 1034ssl_cipher_strength_sort(CIPHER_ORDER **head_p,
1054 { 1035 CIPHER_ORDER **tail_p)
1036{
1055 int max_strength_bits, i, *number_uses; 1037 int max_strength_bits, i, *number_uses;
1056 CIPHER_ORDER *curr; 1038 CIPHER_ORDER *curr;
1057 1039
@@ -1062,32 +1044,29 @@ static int ssl_cipher_strength_sort(CIPHER_ORDER **head_p,
1062 */ 1044 */
1063 max_strength_bits = 0; 1045 max_strength_bits = 0;
1064 curr = *head_p; 1046 curr = *head_p;
1065 while (curr != NULL) 1047 while (curr != NULL) {
1066 {
1067 if (curr->active && 1048 if (curr->active &&
1068 (curr->cipher->strength_bits > max_strength_bits)) 1049 (curr->cipher->strength_bits > max_strength_bits))
1069 max_strength_bits = curr->cipher->strength_bits; 1050 max_strength_bits = curr->cipher->strength_bits;
1070 curr = curr->next; 1051 curr = curr->next;
1071 } 1052 }
1072 1053
1073 number_uses = OPENSSL_malloc((max_strength_bits + 1) * sizeof(int)); 1054 number_uses = OPENSSL_malloc((max_strength_bits + 1) * sizeof(int));
1074 if (!number_uses) 1055 if (!number_uses) {
1075 { 1056 SSLerr(SSL_F_SSL_CIPHER_STRENGTH_SORT, ERR_R_MALLOC_FAILURE);
1076 SSLerr(SSL_F_SSL_CIPHER_STRENGTH_SORT,ERR_R_MALLOC_FAILURE); 1057 return (0);
1077 return(0); 1058 }
1078 }
1079 memset(number_uses, 0, (max_strength_bits + 1) * sizeof(int)); 1059 memset(number_uses, 0, (max_strength_bits + 1) * sizeof(int));
1080 1060
1081 /* 1061 /*
1082 * Now find the strength_bits values actually used 1062 * Now find the strength_bits values actually used
1083 */ 1063 */
1084 curr = *head_p; 1064 curr = *head_p;
1085 while (curr != NULL) 1065 while (curr != NULL) {
1086 {
1087 if (curr->active) 1066 if (curr->active)
1088 number_uses[curr->cipher->strength_bits]++; 1067 number_uses[curr->cipher->strength_bits]++;
1089 curr = curr->next; 1068 curr = curr->next;
1090 } 1069 }
1091 /* 1070 /*
1092 * Go through the list of used strength_bits values in descending 1071 * Go through the list of used strength_bits values in descending
1093 * order. 1072 * order.
@@ -1097,13 +1076,14 @@ static int ssl_cipher_strength_sort(CIPHER_ORDER **head_p,
1097 ssl_cipher_apply_rule(0, 0, 0, 0, 0, 0, 0, CIPHER_ORD, i, head_p, tail_p); 1076 ssl_cipher_apply_rule(0, 0, 0, 0, 0, 0, 0, CIPHER_ORD, i, head_p, tail_p);
1098 1077
1099 OPENSSL_free(number_uses); 1078 OPENSSL_free(number_uses);
1100 return(1); 1079 return (1);
1101 } 1080}
1102 1081
1103static int ssl_cipher_process_rulestr(const char *rule_str, 1082static int
1104 CIPHER_ORDER **head_p, CIPHER_ORDER **tail_p, 1083ssl_cipher_process_rulestr(const char *rule_str,
1105 const SSL_CIPHER **ca_list) 1084 CIPHER_ORDER **head_p, CIPHER_ORDER **tail_p,
1106 { 1085const SSL_CIPHER **ca_list)
1086{
1107 unsigned long alg_mkey, alg_auth, alg_enc, alg_mac, alg_ssl, algo_strength; 1087 unsigned long alg_mkey, alg_auth, alg_enc, alg_mac, alg_ssl, algo_strength;
1108 const char *l, *buf; 1088 const char *l, *buf;
1109 int j, multi, found, rule, retval, ok, buflen; 1089 int j, multi, found, rule, retval, ok, buflen;
@@ -1112,28 +1092,32 @@ static int ssl_cipher_process_rulestr(const char *rule_str,
1112 1092
1113 retval = 1; 1093 retval = 1;
1114 l = rule_str; 1094 l = rule_str;
1115 for (;;) 1095 for (;;) {
1116 {
1117 ch = *l; 1096 ch = *l;
1118 1097
1119 if (ch == '\0') 1098 if (ch == '\0')
1120 break; /* done */ 1099 break;
1100 /* done */
1121 if (ch == '-') 1101 if (ch == '-')
1122 { rule = CIPHER_DEL; l++; } 1102 { rule = CIPHER_DEL;
1123 else if (ch == '+') 1103 l++;
1124 { rule = CIPHER_ORD; l++; } 1104 } else if (ch == '+')
1125 else if (ch == '!') 1105 { rule = CIPHER_ORD;
1126 { rule = CIPHER_KILL; l++; } 1106 l++;
1127 else if (ch == '@') 1107 } else if (ch == '!')
1128 { rule = CIPHER_SPECIAL; l++; } 1108 { rule = CIPHER_KILL;
1129 else 1109 l++;
1130 { rule = CIPHER_ADD; } 1110 } else if (ch == '@')
1111 { rule = CIPHER_SPECIAL;
1112 l++;
1113 } else
1114 { rule = CIPHER_ADD;
1115 }
1131 1116
1132 if (ITEM_SEP(ch)) 1117 if (ITEM_SEP(ch)) {
1133 {
1134 l++; 1118 l++;
1135 continue; 1119 continue;
1136 } 1120 }
1137 1121
1138 alg_mkey = 0; 1122 alg_mkey = 0;
1139 alg_auth = 0; 1123 alg_auth = 0;
@@ -1142,52 +1126,47 @@ static int ssl_cipher_process_rulestr(const char *rule_str,
1142 alg_ssl = 0; 1126 alg_ssl = 0;
1143 algo_strength = 0; 1127 algo_strength = 0;
1144 1128
1145 for (;;) 1129 for (;;) {
1146 {
1147 ch = *l; 1130 ch = *l;
1148 buf = l; 1131 buf = l;
1149 buflen = 0; 1132 buflen = 0;
1150#ifndef CHARSET_EBCDIC 1133#ifndef CHARSET_EBCDIC
1151 while ( ((ch >= 'A') && (ch <= 'Z')) || 1134 while (((ch >= 'A') && (ch <= 'Z')) ||
1152 ((ch >= '0') && (ch <= '9')) || 1135 ((ch >= '0') && (ch <= '9')) ||
1153 ((ch >= 'a') && (ch <= 'z')) || 1136 ((ch >= 'a') && (ch <= 'z')) ||
1154 (ch == '-') || (ch == '.')) 1137 (ch == '-') || (ch == '.'))
1155#else 1138#else
1156 while ( isalnum(ch) || (ch == '-') || (ch == '.')) 1139 while (isalnum(ch) || (ch == '-') || (ch == '.'))
1157#endif 1140#endif
1158 { 1141 {
1159 ch = *(++l); 1142 ch = *(++l);
1160 buflen++; 1143 buflen++;
1161 } 1144 }
1162 1145
1163 if (buflen == 0) 1146 if (buflen == 0) {
1164 {
1165 /* 1147 /*
1166 * We hit something we cannot deal with, 1148 * We hit something we cannot deal with,
1167 * it is no command or separator nor 1149 * it is no command or separator nor
1168 * alphanumeric, so we call this an error. 1150 * alphanumeric, so we call this an error.
1169 */ 1151 */
1170 SSLerr(SSL_F_SSL_CIPHER_PROCESS_RULESTR, 1152 SSLerr(SSL_F_SSL_CIPHER_PROCESS_RULESTR,
1171 SSL_R_INVALID_COMMAND); 1153 SSL_R_INVALID_COMMAND);
1172 retval = found = 0; 1154 retval = found = 0;
1173 l++; 1155 l++;
1174 break; 1156 break;
1175 } 1157 }
1176 1158
1177 if (rule == CIPHER_SPECIAL) 1159 if (rule == CIPHER_SPECIAL) {
1178 {
1179 found = 0; /* unused -- avoid compiler warning */ 1160 found = 0; /* unused -- avoid compiler warning */
1180 break; /* special treatment */ 1161 break; /* special treatment */
1181 } 1162 }
1182 1163
1183 /* check for multi-part specification */ 1164 /* check for multi-part specification */
1184 if (ch == '+') 1165 if (ch == '+') {
1185 { 1166 multi = 1;
1186 multi=1;
1187 l++; 1167 l++;
1188 } 1168 } else
1189 else 1169 multi = 0;
1190 multi=0;
1191 1170
1192 /* 1171 /*
1193 * Now search for the cipher alias in the ca_list. Be careful 1172 * Now search for the cipher alias in the ca_list. Be careful
@@ -1202,126 +1181,121 @@ static int ssl_cipher_process_rulestr(const char *rule_str,
1202 */ 1181 */
1203 j = found = 0; 1182 j = found = 0;
1204 cipher_id = 0; 1183 cipher_id = 0;
1205 while (ca_list[j]) 1184 while (ca_list[j]) {
1206 {
1207 if (!strncmp(buf, ca_list[j]->name, buflen) && 1185 if (!strncmp(buf, ca_list[j]->name, buflen) &&
1208 (ca_list[j]->name[buflen] == '\0')) 1186 (ca_list[j]->name[buflen] == '\0')) {
1209 {
1210 found = 1; 1187 found = 1;
1211 break; 1188 break;
1212 } 1189 } else
1213 else
1214 j++; 1190 j++;
1215 } 1191 }
1216 1192
1217 if (!found) 1193 if (!found)
1218 break; /* ignore this entry */ 1194 break; /* ignore this entry */
1219 1195
1220 if (ca_list[j]->algorithm_mkey) 1196 if (ca_list[j]->algorithm_mkey) {
1221 { 1197 if (alg_mkey) {
1222 if (alg_mkey)
1223 {
1224 alg_mkey &= ca_list[j]->algorithm_mkey; 1198 alg_mkey &= ca_list[j]->algorithm_mkey;
1225 if (!alg_mkey) { found = 0; break; } 1199 if (!alg_mkey) {
1200 found = 0;
1201 break;
1226 } 1202 }
1227 else 1203 } else
1228 alg_mkey = ca_list[j]->algorithm_mkey; 1204 alg_mkey = ca_list[j]->algorithm_mkey;
1229 } 1205 }
1230 1206
1231 if (ca_list[j]->algorithm_auth) 1207 if (ca_list[j]->algorithm_auth) {
1232 { 1208 if (alg_auth) {
1233 if (alg_auth)
1234 {
1235 alg_auth &= ca_list[j]->algorithm_auth; 1209 alg_auth &= ca_list[j]->algorithm_auth;
1236 if (!alg_auth) { found = 0; break; } 1210 if (!alg_auth) {
1211 found = 0;
1212 break;
1237 } 1213 }
1238 else 1214 } else
1239 alg_auth = ca_list[j]->algorithm_auth; 1215 alg_auth = ca_list[j]->algorithm_auth;
1240 } 1216 }
1241 1217
1242 if (ca_list[j]->algorithm_enc) 1218 if (ca_list[j]->algorithm_enc) {
1243 { 1219 if (alg_enc) {
1244 if (alg_enc)
1245 {
1246 alg_enc &= ca_list[j]->algorithm_enc; 1220 alg_enc &= ca_list[j]->algorithm_enc;
1247 if (!alg_enc) { found = 0; break; } 1221 if (!alg_enc) {
1222 found = 0;
1223 break;
1248 } 1224 }
1249 else 1225 } else
1250 alg_enc = ca_list[j]->algorithm_enc; 1226 alg_enc = ca_list[j]->algorithm_enc;
1251 } 1227 }
1252 1228
1253 if (ca_list[j]->algorithm_mac) 1229 if (ca_list[j]->algorithm_mac) {
1254 { 1230 if (alg_mac) {
1255 if (alg_mac)
1256 {
1257 alg_mac &= ca_list[j]->algorithm_mac; 1231 alg_mac &= ca_list[j]->algorithm_mac;
1258 if (!alg_mac) { found = 0; break; } 1232 if (!alg_mac) {
1233 found = 0;
1234 break;
1259 } 1235 }
1260 else 1236 } else
1261 alg_mac = ca_list[j]->algorithm_mac; 1237 alg_mac = ca_list[j]->algorithm_mac;
1262 } 1238 }
1263 1239
1264 if (ca_list[j]->algo_strength & SSL_EXP_MASK) 1240 if (ca_list[j]->algo_strength & SSL_EXP_MASK) {
1265 { 1241 if (algo_strength & SSL_EXP_MASK) {
1266 if (algo_strength & SSL_EXP_MASK)
1267 {
1268 algo_strength &= (ca_list[j]->algo_strength & SSL_EXP_MASK) | ~SSL_EXP_MASK; 1242 algo_strength &= (ca_list[j]->algo_strength & SSL_EXP_MASK) | ~SSL_EXP_MASK;
1269 if (!(algo_strength & SSL_EXP_MASK)) { found = 0; break; } 1243 if (!(algo_strength & SSL_EXP_MASK)) {
1244 found = 0;
1245 break;
1270 } 1246 }
1271 else 1247 } else
1272 algo_strength |= ca_list[j]->algo_strength & SSL_EXP_MASK; 1248 algo_strength |= ca_list[j]->algo_strength & SSL_EXP_MASK;
1273 } 1249 }
1274 1250
1275 if (ca_list[j]->algo_strength & SSL_STRONG_MASK) 1251 if (ca_list[j]->algo_strength & SSL_STRONG_MASK) {
1276 { 1252 if (algo_strength & SSL_STRONG_MASK) {
1277 if (algo_strength & SSL_STRONG_MASK)
1278 {
1279 algo_strength &= (ca_list[j]->algo_strength & SSL_STRONG_MASK) | ~SSL_STRONG_MASK; 1253 algo_strength &= (ca_list[j]->algo_strength & SSL_STRONG_MASK) | ~SSL_STRONG_MASK;
1280 if (!(algo_strength & SSL_STRONG_MASK)) { found = 0; break; } 1254 if (!(algo_strength & SSL_STRONG_MASK)) {
1255 found = 0;
1256 break;
1281 } 1257 }
1282 else 1258 } else
1283 algo_strength |= ca_list[j]->algo_strength & SSL_STRONG_MASK; 1259 algo_strength |= ca_list[j]->algo_strength & SSL_STRONG_MASK;
1284 } 1260 }
1285 1261
1286 if (ca_list[j]->valid) 1262 if (ca_list[j]->valid) {
1287 {
1288 /* explicit ciphersuite found; its protocol version 1263 /* explicit ciphersuite found; its protocol version
1289 * does not become part of the search pattern!*/ 1264 * does not become part of the search pattern!*/
1290 1265
1291 cipher_id = ca_list[j]->id; 1266 cipher_id = ca_list[j]->id;
1292 } 1267 } else {
1293 else
1294 {
1295 /* not an explicit ciphersuite; only in this case, the 1268 /* not an explicit ciphersuite; only in this case, the
1296 * protocol version is considered part of the search pattern */ 1269 * protocol version is considered part of the search pattern */
1297 1270
1298 if (ca_list[j]->algorithm_ssl) 1271 if (ca_list[j]->algorithm_ssl) {
1299 { 1272 if (alg_ssl) {
1300 if (alg_ssl)
1301 {
1302 alg_ssl &= ca_list[j]->algorithm_ssl; 1273 alg_ssl &= ca_list[j]->algorithm_ssl;
1303 if (!alg_ssl) { found = 0; break; } 1274 if (!alg_ssl) {
1275 found = 0;
1276 break;
1304 } 1277 }
1305 else 1278 } else
1306 alg_ssl = ca_list[j]->algorithm_ssl; 1279 alg_ssl = ca_list[j]->algorithm_ssl;
1307 }
1308 } 1280 }
1309
1310 if (!multi) break;
1311 } 1281 }
1312 1282
1283 if (!multi)
1284 break;
1285 }
1286
1313 /* 1287 /*
1314 * Ok, we have the rule, now apply it 1288 * Ok, we have the rule, now apply it
1315 */ 1289 */
1316 if (rule == CIPHER_SPECIAL) 1290 if (rule == CIPHER_SPECIAL)
1317 { /* special command */ 1291 { /* special command */
1318 ok = 0; 1292 ok = 0;
1319 if ((buflen == 8) && 1293 if ((buflen == 8) &&
1320 !strncmp(buf, "STRENGTH", 8)) 1294 !strncmp(buf, "STRENGTH", 8))
1321 ok = ssl_cipher_strength_sort(head_p, tail_p); 1295 ok = ssl_cipher_strength_sort(head_p, tail_p);
1322 else 1296 else
1323 SSLerr(SSL_F_SSL_CIPHER_PROCESS_RULESTR, 1297 SSLerr(SSL_F_SSL_CIPHER_PROCESS_RULESTR,
1324 SSL_R_INVALID_COMMAND); 1298 SSL_R_INVALID_COMMAND);
1325 if (ok == 0) 1299 if (ok == 0)
1326 retval = 0; 1300 retval = 0;
1327 /* 1301 /*
@@ -1331,30 +1305,27 @@ static int ssl_cipher_process_rulestr(const char *rule_str,
1331 * end or ':' is found. 1305 * end or ':' is found.
1332 */ 1306 */
1333 while ((*l != '\0') && !ITEM_SEP(*l)) 1307 while ((*l != '\0') && !ITEM_SEP(*l))
1334 l++; 1308 l++;
1335 } 1309 } else if (found) {
1336 else if (found)
1337 {
1338 ssl_cipher_apply_rule(cipher_id, 1310 ssl_cipher_apply_rule(cipher_id,
1339 alg_mkey, alg_auth, alg_enc, alg_mac, alg_ssl, algo_strength, 1311 alg_mkey, alg_auth, alg_enc, alg_mac, alg_ssl, algo_strength,
1340 rule, -1, head_p, tail_p); 1312 rule, -1, head_p, tail_p);
1341 } 1313 } else {
1342 else
1343 {
1344 while ((*l != '\0') && !ITEM_SEP(*l)) 1314 while ((*l != '\0') && !ITEM_SEP(*l))
1345 l++; 1315 l++;
1346 } 1316 }
1347 if (*l == '\0') break; /* done */ 1317 if (*l == '\0') break; /* done */
1348 } 1318 }
1349 1319
1350 return(retval); 1320 return (retval);
1351 } 1321}
1352 1322
1353STACK_OF(SSL_CIPHER) *ssl_create_cipher_list(const SSL_METHOD *ssl_method, 1323STACK_OF(SSL_CIPHER)
1354 STACK_OF(SSL_CIPHER) **cipher_list, 1324*ssl_create_cipher_list(const SSL_METHOD *ssl_method,
1355 STACK_OF(SSL_CIPHER) **cipher_list_by_id, 1325STACK_OF(SSL_CIPHER) **cipher_list,
1356 const char *rule_str) 1326 STACK_OF(SSL_CIPHER) **cipher_list_by_id,
1357 { 1327const char *rule_str)
1328{
1358 int ok, num_of_ciphers, num_of_alias_max, num_of_group_aliases; 1329 int ok, num_of_ciphers, num_of_alias_max, num_of_group_aliases;
1359 unsigned long disabled_mkey, disabled_auth, disabled_enc, disabled_mac, disabled_ssl; 1330 unsigned long disabled_mkey, disabled_auth, disabled_enc, disabled_mac, disabled_ssl;
1360 STACK_OF(SSL_CIPHER) *cipherstack, *tmp_cipher_list; 1331 STACK_OF(SSL_CIPHER) *cipherstack, *tmp_cipher_list;
@@ -1384,15 +1355,14 @@ STACK_OF(SSL_CIPHER) *ssl_create_cipher_list(const SSL_METHOD *ssl_method,
1384 printf("ssl_create_cipher_list() for %d ciphers\n", num_of_ciphers); 1355 printf("ssl_create_cipher_list() for %d ciphers\n", num_of_ciphers);
1385#endif /* KSSL_DEBUG */ 1356#endif /* KSSL_DEBUG */
1386 co_list = (CIPHER_ORDER *)OPENSSL_malloc(sizeof(CIPHER_ORDER) * num_of_ciphers); 1357 co_list = (CIPHER_ORDER *)OPENSSL_malloc(sizeof(CIPHER_ORDER) * num_of_ciphers);
1387 if (co_list == NULL) 1358 if (co_list == NULL) {
1388 { 1359 SSLerr(SSL_F_SSL_CREATE_CIPHER_LIST, ERR_R_MALLOC_FAILURE);
1389 SSLerr(SSL_F_SSL_CREATE_CIPHER_LIST,ERR_R_MALLOC_FAILURE);
1390 return(NULL); /* Failure */ 1360 return(NULL); /* Failure */
1391 } 1361 }
1392 1362
1393 ssl_cipher_collect_ciphers(ssl_method, num_of_ciphers, 1363 ssl_cipher_collect_ciphers(ssl_method, num_of_ciphers,
1394 disabled_mkey, disabled_auth, disabled_enc, disabled_mac, disabled_ssl, 1364 disabled_mkey, disabled_auth, disabled_enc, disabled_mac, disabled_ssl,
1395 co_list, &head, &tail); 1365 co_list, &head, &tail);
1396 1366
1397 1367
1398 /* Now arrange all ciphers by preference: */ 1368 /* Now arrange all ciphers by preference: */
@@ -1419,19 +1389,18 @@ STACK_OF(SSL_CIPHER) *ssl_create_cipher_list(const SSL_METHOD *ssl_method,
1419 ssl_cipher_apply_rule(0, 0, SSL_aECDH, 0, 0, 0, 0, CIPHER_ORD, -1, &head, &tail); 1389 ssl_cipher_apply_rule(0, 0, SSL_aECDH, 0, 0, 0, 0, CIPHER_ORD, -1, &head, &tail);
1420 /* ssl_cipher_apply_rule(0, 0, SSL_aDH, 0, 0, 0, 0, CIPHER_ORD, -1, &head, &tail); */ 1390 /* ssl_cipher_apply_rule(0, 0, SSL_aDH, 0, 0, 0, 0, CIPHER_ORD, -1, &head, &tail); */
1421 ssl_cipher_apply_rule(0, SSL_kRSA, 0, 0, 0, 0, 0, CIPHER_ORD, -1, &head, &tail); 1391 ssl_cipher_apply_rule(0, SSL_kRSA, 0, 0, 0, 0, 0, CIPHER_ORD, -1, &head, &tail);
1422 ssl_cipher_apply_rule(0, SSL_kPSK, 0,0, 0, 0, 0, CIPHER_ORD, -1, &head, &tail); 1392 ssl_cipher_apply_rule(0, SSL_kPSK, 0, 0, 0, 0, 0, CIPHER_ORD, -1, &head, &tail);
1423 ssl_cipher_apply_rule(0, SSL_kKRB5, 0,0, 0, 0, 0, CIPHER_ORD, -1, &head, &tail); 1393 ssl_cipher_apply_rule(0, SSL_kKRB5, 0, 0, 0, 0, 0, CIPHER_ORD, -1, &head, &tail);
1424 1394
1425 /* RC4 is sort-of broken -- move the the end */ 1395 /* RC4 is sort-of broken -- move the the end */
1426 ssl_cipher_apply_rule(0, 0, 0, SSL_RC4, 0, 0, 0, CIPHER_ORD, -1, &head, &tail); 1396 ssl_cipher_apply_rule(0, 0, 0, SSL_RC4, 0, 0, 0, CIPHER_ORD, -1, &head, &tail);
1427 1397
1428 /* Now sort by symmetric encryption strength. The above ordering remains 1398 /* Now sort by symmetric encryption strength. The above ordering remains
1429 * in force within each class */ 1399 * in force within each class */
1430 if (!ssl_cipher_strength_sort(&head, &tail)) 1400 if (!ssl_cipher_strength_sort(&head, &tail)) {
1431 {
1432 OPENSSL_free(co_list); 1401 OPENSSL_free(co_list);
1433 return NULL; 1402 return NULL;
1434 } 1403 }
1435 1404
1436 /* Now disable everything (maintaining the ordering!) */ 1405 /* Now disable everything (maintaining the ordering!) */
1437 ssl_cipher_apply_rule(0, 0, 0, 0, 0, 0, 0, CIPHER_DEL, -1, &head, &tail); 1406 ssl_cipher_apply_rule(0, 0, 0, 0, 0, 0, 0, CIPHER_DEL, -1, &head, &tail);
@@ -1448,15 +1417,14 @@ STACK_OF(SSL_CIPHER) *ssl_create_cipher_list(const SSL_METHOD *ssl_method,
1448 num_of_group_aliases = sizeof(cipher_aliases) / sizeof(SSL_CIPHER); 1417 num_of_group_aliases = sizeof(cipher_aliases) / sizeof(SSL_CIPHER);
1449 num_of_alias_max = num_of_ciphers + num_of_group_aliases + 1; 1418 num_of_alias_max = num_of_ciphers + num_of_group_aliases + 1;
1450 ca_list = OPENSSL_malloc(sizeof(SSL_CIPHER *) * num_of_alias_max); 1419 ca_list = OPENSSL_malloc(sizeof(SSL_CIPHER *) * num_of_alias_max);
1451 if (ca_list == NULL) 1420 if (ca_list == NULL) {
1452 {
1453 OPENSSL_free(co_list); 1421 OPENSSL_free(co_list);
1454 SSLerr(SSL_F_SSL_CREATE_CIPHER_LIST,ERR_R_MALLOC_FAILURE); 1422 SSLerr(SSL_F_SSL_CREATE_CIPHER_LIST, ERR_R_MALLOC_FAILURE);
1455 return(NULL); /* Failure */ 1423 return(NULL); /* Failure */
1456 } 1424 }
1457 ssl_cipher_collect_aliases(ca_list, num_of_group_aliases, 1425 ssl_cipher_collect_aliases(ca_list, num_of_group_aliases,
1458 disabled_mkey, disabled_auth, disabled_enc, 1426 disabled_mkey, disabled_auth, disabled_enc,
1459 disabled_mac, disabled_ssl, head); 1427 disabled_mac, disabled_ssl, head);
1460 1428
1461 /* 1429 /*
1462 * If the rule_string begins with DEFAULT, apply the default rule 1430 * If the rule_string begins with DEFAULT, apply the default rule
@@ -1464,14 +1432,13 @@ STACK_OF(SSL_CIPHER) *ssl_create_cipher_list(const SSL_METHOD *ssl_method,
1464 */ 1432 */
1465 ok = 1; 1433 ok = 1;
1466 rule_p = rule_str; 1434 rule_p = rule_str;
1467 if (strncmp(rule_str,"DEFAULT",7) == 0) 1435 if (strncmp(rule_str, "DEFAULT", 7) == 0) {
1468 {
1469 ok = ssl_cipher_process_rulestr(SSL_DEFAULT_CIPHER_LIST, 1436 ok = ssl_cipher_process_rulestr(SSL_DEFAULT_CIPHER_LIST,
1470 &head, &tail, ca_list); 1437 &head, &tail, ca_list);
1471 rule_p += 7; 1438 rule_p += 7;
1472 if (*rule_p == ':') 1439 if (*rule_p == ':')
1473 rule_p++; 1440 rule_p++;
1474 } 1441 }
1475 1442
1476 if (ok && (strlen(rule_p) > 0)) 1443 if (ok && (strlen(rule_p) > 0))
1477 ok = ssl_cipher_process_rulestr(rule_p, &head, &tail, ca_list); 1444 ok = ssl_cipher_process_rulestr(rule_p, &head, &tail, ca_list);
@@ -1479,65 +1446,63 @@ STACK_OF(SSL_CIPHER) *ssl_create_cipher_list(const SSL_METHOD *ssl_method,
1479 OPENSSL_free((void *)ca_list); /* Not needed anymore */ 1446 OPENSSL_free((void *)ca_list); /* Not needed anymore */
1480 1447
1481 if (!ok) 1448 if (!ok)
1482 { /* Rule processing failure */ 1449 { /* Rule processing failure */
1483 OPENSSL_free(co_list); 1450 OPENSSL_free(co_list);
1484 return(NULL); 1451 return (NULL);
1485 } 1452 }
1486 1453
1487 /* 1454 /*
1488 * Allocate new "cipherstack" for the result, return with error 1455 * Allocate new "cipherstack" for the result, return with error
1489 * if we cannot get one. 1456 * if we cannot get one.
1490 */ 1457 */
1491 if ((cipherstack = sk_SSL_CIPHER_new_null()) == NULL) 1458 if ((cipherstack = sk_SSL_CIPHER_new_null()) == NULL) {
1492 {
1493 OPENSSL_free(co_list); 1459 OPENSSL_free(co_list);
1494 return(NULL); 1460 return (NULL);
1495 } 1461 }
1496 1462
1497 /* 1463 /*
1498 * The cipher selection for the list is done. The ciphers are added 1464 * The cipher selection for the list is done. The ciphers are added
1499 * to the resulting precedence to the STACK_OF(SSL_CIPHER). 1465 * to the resulting precedence to the STACK_OF(SSL_CIPHER).
1500 */ 1466 */
1501 for (curr = head; curr != NULL; curr = curr->next) 1467 for (curr = head; curr != NULL; curr = curr->next) {
1502 {
1503#ifdef OPENSSL_FIPS 1468#ifdef OPENSSL_FIPS
1504 if (curr->active && (!FIPS_mode() || curr->cipher->algo_strength & SSL_FIPS)) 1469 if (curr->active && (!FIPS_mode() || curr->cipher->algo_strength & SSL_FIPS))
1505#else 1470#else
1506 if (curr->active) 1471 if (curr->active)
1507#endif 1472#endif
1508 { 1473 {
1509 sk_SSL_CIPHER_push(cipherstack, curr->cipher); 1474 sk_SSL_CIPHER_push(cipherstack, curr->cipher);
1510#ifdef CIPHER_DEBUG 1475#ifdef CIPHER_DEBUG
1511 printf("<%s>\n",curr->cipher->name); 1476 printf("<%s>\n", curr->cipher->name);
1512#endif 1477#endif
1513 }
1514 } 1478 }
1479 }
1515 OPENSSL_free(co_list); /* Not needed any longer */ 1480 OPENSSL_free(co_list); /* Not needed any longer */
1516 1481
1517 tmp_cipher_list = sk_SSL_CIPHER_dup(cipherstack); 1482 tmp_cipher_list = sk_SSL_CIPHER_dup(cipherstack);
1518 if (tmp_cipher_list == NULL) 1483 if (tmp_cipher_list == NULL) {
1519 {
1520 sk_SSL_CIPHER_free(cipherstack); 1484 sk_SSL_CIPHER_free(cipherstack);
1521 return NULL; 1485 return NULL;
1522 } 1486 }
1523 if (*cipher_list != NULL) 1487 if (*cipher_list != NULL)
1524 sk_SSL_CIPHER_free(*cipher_list); 1488 sk_SSL_CIPHER_free(*cipher_list);
1525 *cipher_list = cipherstack; 1489 *cipher_list = cipherstack;
1526 if (*cipher_list_by_id != NULL) 1490 if (*cipher_list_by_id != NULL)
1527 sk_SSL_CIPHER_free(*cipher_list_by_id); 1491 sk_SSL_CIPHER_free(*cipher_list_by_id);
1528 *cipher_list_by_id = tmp_cipher_list; 1492 *cipher_list_by_id = tmp_cipher_list;
1529 (void)sk_SSL_CIPHER_set_cmp_func(*cipher_list_by_id,ssl_cipher_ptr_id_cmp); 1493 (void)sk_SSL_CIPHER_set_cmp_func(*cipher_list_by_id, ssl_cipher_ptr_id_cmp);
1530 1494
1531 sk_SSL_CIPHER_sort(*cipher_list_by_id); 1495 sk_SSL_CIPHER_sort(*cipher_list_by_id);
1532 return(cipherstack); 1496 return (cipherstack);
1533 } 1497}
1534 1498
1535char *SSL_CIPHER_description(const SSL_CIPHER *cipher, char *buf, int len) 1499char
1536 { 1500*SSL_CIPHER_description(const SSL_CIPHER *cipher, char *buf, int len)
1537 int is_export,pkl,kl; 1501{
1538 const char *ver,*exp_str; 1502 int is_export, pkl, kl;
1539 const char *kx,*au,*enc,*mac; 1503 const char *ver, *exp_str;
1540 unsigned long alg_mkey,alg_auth,alg_enc,alg_mac,alg_ssl,alg2; 1504 const char *kx, *au, *enc, *mac;
1505 unsigned long alg_mkey, alg_auth, alg_enc, alg_mac, alg_ssl, alg2;
1541#ifdef KSSL_DEBUG 1506#ifdef KSSL_DEBUG
1542 static const char *format="%-23s %s Kx=%-8s Au=%-4s Enc=%-9s Mac=%-4s%s AL=%lx/%lx/%lx/%lx/%lx\n"; 1507 static const char *format="%-23s %s Kx=%-8s Au=%-4s Enc=%-9s Mac=%-4s%s AL=%lx/%lx/%lx/%lx/%lx\n";
1543#else 1508#else
@@ -1550,13 +1515,13 @@ char *SSL_CIPHER_description(const SSL_CIPHER *cipher, char *buf, int len)
1550 alg_mac = cipher->algorithm_mac; 1515 alg_mac = cipher->algorithm_mac;
1551 alg_ssl = cipher->algorithm_ssl; 1516 alg_ssl = cipher->algorithm_ssl;
1552 1517
1553 alg2=cipher->algorithm2; 1518 alg2 = cipher->algorithm2;
1519
1520 is_export = SSL_C_IS_EXPORT(cipher);
1521 pkl = SSL_C_EXPORT_PKEYLENGTH(cipher);
1522 kl = SSL_C_EXPORT_KEYLENGTH(cipher);
1523 exp_str = is_export?" export":"";
1554 1524
1555 is_export=SSL_C_IS_EXPORT(cipher);
1556 pkl=SSL_C_EXPORT_PKEYLENGTH(cipher);
1557 kl=SSL_C_EXPORT_KEYLENGTH(cipher);
1558 exp_str=is_export?" export":"";
1559
1560 if (alg_ssl & SSL_SSLV2) 1525 if (alg_ssl & SSL_SSLV2)
1561 ver="SSLv2"; 1526 ver="SSLv2";
1562 else if (alg_ssl & SSL_SSLV3) 1527 else if (alg_ssl & SSL_SSLV3)
@@ -1566,10 +1531,9 @@ char *SSL_CIPHER_description(const SSL_CIPHER *cipher, char *buf, int len)
1566 else 1531 else
1567 ver="unknown"; 1532 ver="unknown";
1568 1533
1569 switch (alg_mkey) 1534 switch (alg_mkey) {
1570 {
1571 case SSL_kRSA: 1535 case SSL_kRSA:
1572 kx=is_export?(pkl == 512 ? "RSA(512)" : "RSA(1024)"):"RSA"; 1536 kx = is_export?(pkl == 512 ? "RSA(512)" : "RSA(1024)"):"RSA";
1573 break; 1537 break;
1574 case SSL_kDHr: 1538 case SSL_kDHr:
1575 kx="DH/RSA"; 1539 kx="DH/RSA";
@@ -1577,11 +1541,11 @@ char *SSL_CIPHER_description(const SSL_CIPHER *cipher, char *buf, int len)
1577 case SSL_kDHd: 1541 case SSL_kDHd:
1578 kx="DH/DSS"; 1542 kx="DH/DSS";
1579 break; 1543 break;
1580 case SSL_kKRB5: 1544 case SSL_kKRB5:
1581 kx="KRB5"; 1545 kx="KRB5";
1582 break; 1546 break;
1583 case SSL_kEDH: 1547 case SSL_kEDH:
1584 kx=is_export?(pkl == 512 ? "DH(512)" : "DH(1024)"):"DH"; 1548 kx = is_export?(pkl == 512 ? "DH(512)" : "DH(1024)"):"DH";
1585 break; 1549 break;
1586 case SSL_kECDHr: 1550 case SSL_kECDHr:
1587 kx="ECDH/RSA"; 1551 kx="ECDH/RSA";
@@ -1600,10 +1564,9 @@ char *SSL_CIPHER_description(const SSL_CIPHER *cipher, char *buf, int len)
1600 break; 1564 break;
1601 default: 1565 default:
1602 kx="unknown"; 1566 kx="unknown";
1603 } 1567 }
1604 1568
1605 switch (alg_auth) 1569 switch (alg_auth) {
1606 {
1607 case SSL_aRSA: 1570 case SSL_aRSA:
1608 au="RSA"; 1571 au="RSA";
1609 break; 1572 break;
@@ -1613,10 +1576,10 @@ char *SSL_CIPHER_description(const SSL_CIPHER *cipher, char *buf, int len)
1613 case SSL_aDH: 1576 case SSL_aDH:
1614 au="DH"; 1577 au="DH";
1615 break; 1578 break;
1616 case SSL_aKRB5: 1579 case SSL_aKRB5:
1617 au="KRB5"; 1580 au="KRB5";
1618 break; 1581 break;
1619 case SSL_aECDH: 1582 case SSL_aECDH:
1620 au="ECDH"; 1583 au="ECDH";
1621 break; 1584 break;
1622 case SSL_aNULL: 1585 case SSL_aNULL:
@@ -1631,22 +1594,21 @@ char *SSL_CIPHER_description(const SSL_CIPHER *cipher, char *buf, int len)
1631 default: 1594 default:
1632 au="unknown"; 1595 au="unknown";
1633 break; 1596 break;
1634 } 1597 }
1635 1598
1636 switch (alg_enc) 1599 switch (alg_enc) {
1637 {
1638 case SSL_DES: 1600 case SSL_DES:
1639 enc=(is_export && kl == 5)?"DES(40)":"DES(56)"; 1601 enc = (is_export && kl == 5)?"DES(40)":"DES(56)";
1640 break; 1602 break;
1641 case SSL_3DES: 1603 case SSL_3DES:
1642 enc="3DES(168)"; 1604 enc="3DES(168)";
1643 break; 1605 break;
1644 case SSL_RC4: 1606 case SSL_RC4:
1645 enc=is_export?(kl == 5 ? "RC4(40)" : "RC4(56)") 1607 enc = is_export?(kl == 5 ? "RC4(40)" : "RC4(56)")
1646 :((alg2&SSL2_CF_8_BYTE_ENC)?"RC4(64)":"RC4(128)"); 1608 :((alg2&SSL2_CF_8_BYTE_ENC)?"RC4(64)":"RC4(128)");
1647 break; 1609 break;
1648 case SSL_RC2: 1610 case SSL_RC2:
1649 enc=is_export?(kl == 5 ? "RC2(40)" : "RC2(56)"):"RC2(128)"; 1611 enc = is_export?(kl == 5 ? "RC2(40)" : "RC2(56)"):"RC2(128)";
1650 break; 1612 break;
1651 case SSL_IDEA: 1613 case SSL_IDEA:
1652 enc="IDEA(128)"; 1614 enc="IDEA(128)";
@@ -1678,10 +1640,9 @@ char *SSL_CIPHER_description(const SSL_CIPHER *cipher, char *buf, int len)
1678 default: 1640 default:
1679 enc="unknown"; 1641 enc="unknown";
1680 break; 1642 break;
1681 } 1643 }
1682 1644
1683 switch (alg_mac) 1645 switch (alg_mac) {
1684 {
1685 case SSL_MD5: 1646 case SSL_MD5:
1686 mac="MD5"; 1647 mac="MD5";
1687 break; 1648 break;
@@ -1700,108 +1661,119 @@ char *SSL_CIPHER_description(const SSL_CIPHER *cipher, char *buf, int len)
1700 default: 1661 default:
1701 mac="unknown"; 1662 mac="unknown";
1702 break; 1663 break;
1703 } 1664 }
1704 1665
1705 if (buf == NULL) 1666 if (buf == NULL) {
1706 { 1667 len = 128;
1707 len=128; 1668 buf = OPENSSL_malloc(len);
1708 buf=OPENSSL_malloc(len); 1669 if (buf == NULL)
1709 if (buf == NULL) return("OPENSSL_malloc Error"); 1670 return("OPENSSL_malloc Error");
1710 } 1671 } else if (len < 128)
1711 else if (len < 128) 1672 return("Buffer too small");
1712 return("Buffer too small");
1713 1673
1714#ifdef KSSL_DEBUG 1674#ifdef KSSL_DEBUG
1715 BIO_snprintf(buf,len,format,cipher->name,ver,kx,au,enc,mac,exp_str,alg_mkey,alg_auth,alg_enc,alg_mac,alg_ssl); 1675 BIO_snprintf(buf, len, format, cipher->name, ver, kx, au, enc, mac, exp_str, alg_mkey, alg_auth, alg_enc, alg_mac, alg_ssl);
1716#else 1676#else
1717 BIO_snprintf(buf,len,format,cipher->name,ver,kx,au,enc,mac,exp_str); 1677 BIO_snprintf(buf, len, format, cipher->name, ver, kx, au, enc, mac, exp_str);
1718#endif /* KSSL_DEBUG */ 1678#endif /* KSSL_DEBUG */
1719 return(buf); 1679 return (buf);
1720 } 1680}
1721 1681
1722char *SSL_CIPHER_get_version(const SSL_CIPHER *c) 1682char
1723 { 1683*SSL_CIPHER_get_version(const SSL_CIPHER *c)
1684{
1724 int i; 1685 int i;
1725 1686
1726 if (c == NULL) return("(NONE)"); 1687 if (c == NULL)
1727 i=(int)(c->id>>24L); 1688 return("(NONE)");
1689 i = (int)(c->id >> 24L);
1728 if (i == 3) 1690 if (i == 3)
1729 return("TLSv1/SSLv3"); 1691 return("TLSv1/SSLv3");
1730 else if (i == 2) 1692 else if (i == 2)
1731 return("SSLv2"); 1693 return("SSLv2");
1732 else 1694 else
1733 return("unknown"); 1695 return("unknown");
1734 } 1696}
1735 1697
1736/* return the actual cipher being used */ 1698/* return the actual cipher being used */
1737const char *SSL_CIPHER_get_name(const SSL_CIPHER *c) 1699const char
1738 { 1700*SSL_CIPHER_get_name(const SSL_CIPHER *c)
1701{
1739 if (c != NULL) 1702 if (c != NULL)
1740 return(c->name); 1703 return (c->name);
1741 return("(NONE)"); 1704 return("(NONE)");
1742 } 1705}
1743 1706
1744/* number of bits for symmetric cipher */ 1707/* number of bits for symmetric cipher */
1745int SSL_CIPHER_get_bits(const SSL_CIPHER *c, int *alg_bits) 1708int
1746 { 1709SSL_CIPHER_get_bits(const SSL_CIPHER *c, int *alg_bits)
1747 int ret=0; 1710{
1711 int ret = 0;
1748 1712
1749 if (c != NULL) 1713 if (c != NULL) {
1750 { 1714 if (alg_bits != NULL)
1751 if (alg_bits != NULL) *alg_bits = c->alg_bits; 1715 *alg_bits = c->alg_bits;
1752 ret = c->strength_bits; 1716 ret = c->strength_bits;
1753 }
1754 return(ret);
1755 } 1717 }
1718 return (ret);
1719}
1756 1720
1757unsigned long SSL_CIPHER_get_id(const SSL_CIPHER *c) 1721unsigned long
1758 { 1722SSL_CIPHER_get_id(const SSL_CIPHER *c)
1723{
1759 return c->id; 1724 return c->id;
1760 } 1725}
1761 1726
1762SSL_COMP *ssl3_comp_find(STACK_OF(SSL_COMP) *sk, int n) 1727SSL_COMP
1763 { 1728*ssl3_comp_find(STACK_OF(SSL_COMP) *sk, int n)
1729{
1764 SSL_COMP *ctmp; 1730 SSL_COMP *ctmp;
1765 int i,nn; 1731 int i, nn;
1766 1732
1767 if ((n == 0) || (sk == NULL)) return(NULL); 1733 if ((n == 0)
1768 nn=sk_SSL_COMP_num(sk); 1734 || (sk == NULL)) return (NULL);
1769 for (i=0; i<nn; i++) 1735 nn = sk_SSL_COMP_num(sk);
1770 { 1736 for (i = 0; i < nn; i++) {
1771 ctmp=sk_SSL_COMP_value(sk,i); 1737 ctmp = sk_SSL_COMP_value(sk, i);
1772 if (ctmp->id == n) 1738 if (ctmp->id == n)
1773 return(ctmp); 1739 return (ctmp);
1774 }
1775 return(NULL);
1776 } 1740 }
1741 return (NULL);
1742}
1777 1743
1778#ifdef OPENSSL_NO_COMP 1744#ifdef OPENSSL_NO_COMP
1779void *SSL_COMP_get_compression_methods(void) 1745void
1780 { 1746*SSL_COMP_get_compression_methods(void)
1747{
1781 return NULL; 1748 return NULL;
1782 } 1749}
1783int SSL_COMP_add_compression_method(int id, void *cm) 1750
1784 { 1751int
1752SSL_COMP_add_compression_method(int id, void *cm)
1753{
1785 return 1; 1754 return 1;
1786 } 1755}
1787 1756
1788const char *SSL_COMP_get_name(const void *comp) 1757const char
1789 { 1758*SSL_COMP_get_name(const void *comp)
1759{
1790 return NULL; 1760 return NULL;
1791 } 1761}
1792#else 1762#else
1793STACK_OF(SSL_COMP) *SSL_COMP_get_compression_methods(void) 1763STACK_OF(SSL_COMP)
1794 { 1764*SSL_COMP_get_compression_methods(void)
1765{
1795 load_builtin_compressions(); 1766 load_builtin_compressions();
1796 return(ssl_comp_methods); 1767 return (ssl_comp_methods);
1797 } 1768}
1798 1769
1799int SSL_COMP_add_compression_method(int id, COMP_METHOD *cm) 1770int
1800 { 1771SSL_COMP_add_compression_method(int id, COMP_METHOD *cm)
1772{
1801 SSL_COMP *comp; 1773 SSL_COMP *comp;
1802 1774
1803 if (cm == NULL || cm->type == NID_undef) 1775 if (cm == NULL || cm->type == NID_undef)
1804 return 1; 1776 return 1;
1805 1777
1806 /* According to draft-ietf-tls-compression-04.txt, the 1778 /* According to draft-ietf-tls-compression-04.txt, the
1807 compression number ranges should be the following: 1779 compression number ranges should be the following:
@@ -1809,45 +1781,40 @@ int SSL_COMP_add_compression_method(int id, COMP_METHOD *cm)
1809 0 to 63: methods defined by the IETF 1781 0 to 63: methods defined by the IETF
1810 64 to 192: external party methods assigned by IANA 1782 64 to 192: external party methods assigned by IANA
1811 193 to 255: reserved for private use */ 1783 193 to 255: reserved for private use */
1812 if (id < 193 || id > 255) 1784 if (id < 193 || id > 255) {
1813 { 1785 SSLerr(SSL_F_SSL_COMP_ADD_COMPRESSION_METHOD, SSL_R_COMPRESSION_ID_NOT_WITHIN_PRIVATE_RANGE);
1814 SSLerr(SSL_F_SSL_COMP_ADD_COMPRESSION_METHOD,SSL_R_COMPRESSION_ID_NOT_WITHIN_PRIVATE_RANGE);
1815 return 0; 1786 return 0;
1816 } 1787 }
1817 1788
1818 MemCheck_off(); 1789 MemCheck_off();
1819 comp=(SSL_COMP *)OPENSSL_malloc(sizeof(SSL_COMP)); 1790 comp = (SSL_COMP *)OPENSSL_malloc(sizeof(SSL_COMP));
1820 comp->id=id; 1791 comp->id = id;
1821 comp->method=cm; 1792 comp->method = cm;
1822 load_builtin_compressions(); 1793 load_builtin_compressions();
1823 if (ssl_comp_methods 1794 if (ssl_comp_methods
1824 && sk_SSL_COMP_find(ssl_comp_methods,comp) >= 0) 1795 && sk_SSL_COMP_find(ssl_comp_methods, comp) >= 0) {
1825 {
1826 OPENSSL_free(comp); 1796 OPENSSL_free(comp);
1827 MemCheck_on(); 1797 MemCheck_on();
1828 SSLerr(SSL_F_SSL_COMP_ADD_COMPRESSION_METHOD,SSL_R_DUPLICATE_COMPRESSION_ID); 1798 SSLerr(SSL_F_SSL_COMP_ADD_COMPRESSION_METHOD, SSL_R_DUPLICATE_COMPRESSION_ID);
1829 return(1); 1799 return (1);
1830 } 1800 } else if ((ssl_comp_methods == NULL)
1831 else if ((ssl_comp_methods == NULL) 1801 || !sk_SSL_COMP_push(ssl_comp_methods, comp)) {
1832 || !sk_SSL_COMP_push(ssl_comp_methods,comp))
1833 {
1834 OPENSSL_free(comp); 1802 OPENSSL_free(comp);
1835 MemCheck_on(); 1803 MemCheck_on();
1836 SSLerr(SSL_F_SSL_COMP_ADD_COMPRESSION_METHOD,ERR_R_MALLOC_FAILURE); 1804 SSLerr(SSL_F_SSL_COMP_ADD_COMPRESSION_METHOD, ERR_R_MALLOC_FAILURE);
1837 return(1); 1805 return (1);
1838 } 1806 } else {
1839 else
1840 {
1841 MemCheck_on(); 1807 MemCheck_on();
1842 return(0); 1808 return (0);
1843 }
1844 } 1809 }
1810}
1845 1811
1846const char *SSL_COMP_get_name(const COMP_METHOD *comp) 1812const char
1847 { 1813*SSL_COMP_get_name(const COMP_METHOD *comp)
1814{
1848 if (comp) 1815 if (comp)
1849 return comp->name; 1816 return comp->name;
1850 return NULL; 1817 return NULL;
1851 } 1818}
1852 1819
1853#endif 1820#endif
diff --git a/src/lib/libssl/ssl_err.c b/src/lib/libssl/ssl_err.c
index 370fb57e3b..67ba3c7699 100644
--- a/src/lib/libssl/ssl_err.c
+++ b/src/lib/libssl/ssl_err.c
@@ -68,543 +68,541 @@
68#define ERR_FUNC(func) ERR_PACK(ERR_LIB_SSL,func,0) 68#define ERR_FUNC(func) ERR_PACK(ERR_LIB_SSL,func,0)
69#define ERR_REASON(reason) ERR_PACK(ERR_LIB_SSL,0,reason) 69#define ERR_REASON(reason) ERR_PACK(ERR_LIB_SSL,0,reason)
70 70
71static ERR_STRING_DATA SSL_str_functs[]= 71static ERR_STRING_DATA SSL_str_functs[]= {
72 { 72 {ERR_FUNC(SSL_F_CLIENT_CERTIFICATE), "CLIENT_CERTIFICATE"},
73{ERR_FUNC(SSL_F_CLIENT_CERTIFICATE), "CLIENT_CERTIFICATE"}, 73 {ERR_FUNC(SSL_F_CLIENT_FINISHED), "CLIENT_FINISHED"},
74{ERR_FUNC(SSL_F_CLIENT_FINISHED), "CLIENT_FINISHED"}, 74 {ERR_FUNC(SSL_F_CLIENT_HELLO), "CLIENT_HELLO"},
75{ERR_FUNC(SSL_F_CLIENT_HELLO), "CLIENT_HELLO"}, 75 {ERR_FUNC(SSL_F_CLIENT_MASTER_KEY), "CLIENT_MASTER_KEY"},
76{ERR_FUNC(SSL_F_CLIENT_MASTER_KEY), "CLIENT_MASTER_KEY"}, 76 {ERR_FUNC(SSL_F_D2I_SSL_SESSION), "d2i_SSL_SESSION"},
77{ERR_FUNC(SSL_F_D2I_SSL_SESSION), "d2i_SSL_SESSION"}, 77 {ERR_FUNC(SSL_F_DO_DTLS1_WRITE), "DO_DTLS1_WRITE"},
78{ERR_FUNC(SSL_F_DO_DTLS1_WRITE), "DO_DTLS1_WRITE"}, 78 {ERR_FUNC(SSL_F_DO_SSL3_WRITE), "DO_SSL3_WRITE"},
79{ERR_FUNC(SSL_F_DO_SSL3_WRITE), "DO_SSL3_WRITE"}, 79 {ERR_FUNC(SSL_F_DTLS1_ACCEPT), "DTLS1_ACCEPT"},
80{ERR_FUNC(SSL_F_DTLS1_ACCEPT), "DTLS1_ACCEPT"}, 80 {ERR_FUNC(SSL_F_DTLS1_ADD_CERT_TO_BUF), "DTLS1_ADD_CERT_TO_BUF"},
81{ERR_FUNC(SSL_F_DTLS1_ADD_CERT_TO_BUF), "DTLS1_ADD_CERT_TO_BUF"}, 81 {ERR_FUNC(SSL_F_DTLS1_BUFFER_RECORD), "DTLS1_BUFFER_RECORD"},
82{ERR_FUNC(SSL_F_DTLS1_BUFFER_RECORD), "DTLS1_BUFFER_RECORD"}, 82 {ERR_FUNC(SSL_F_DTLS1_CHECK_TIMEOUT_NUM), "DTLS1_CHECK_TIMEOUT_NUM"},
83{ERR_FUNC(SSL_F_DTLS1_CHECK_TIMEOUT_NUM), "DTLS1_CHECK_TIMEOUT_NUM"}, 83 {ERR_FUNC(SSL_F_DTLS1_CLIENT_HELLO), "DTLS1_CLIENT_HELLO"},
84{ERR_FUNC(SSL_F_DTLS1_CLIENT_HELLO), "DTLS1_CLIENT_HELLO"}, 84 {ERR_FUNC(SSL_F_DTLS1_CONNECT), "DTLS1_CONNECT"},
85{ERR_FUNC(SSL_F_DTLS1_CONNECT), "DTLS1_CONNECT"}, 85 {ERR_FUNC(SSL_F_DTLS1_ENC), "DTLS1_ENC"},
86{ERR_FUNC(SSL_F_DTLS1_ENC), "DTLS1_ENC"}, 86 {ERR_FUNC(SSL_F_DTLS1_GET_HELLO_VERIFY), "DTLS1_GET_HELLO_VERIFY"},
87{ERR_FUNC(SSL_F_DTLS1_GET_HELLO_VERIFY), "DTLS1_GET_HELLO_VERIFY"}, 87 {ERR_FUNC(SSL_F_DTLS1_GET_MESSAGE), "DTLS1_GET_MESSAGE"},
88{ERR_FUNC(SSL_F_DTLS1_GET_MESSAGE), "DTLS1_GET_MESSAGE"}, 88 {ERR_FUNC(SSL_F_DTLS1_GET_MESSAGE_FRAGMENT), "DTLS1_GET_MESSAGE_FRAGMENT"},
89{ERR_FUNC(SSL_F_DTLS1_GET_MESSAGE_FRAGMENT), "DTLS1_GET_MESSAGE_FRAGMENT"}, 89 {ERR_FUNC(SSL_F_DTLS1_GET_RECORD), "DTLS1_GET_RECORD"},
90{ERR_FUNC(SSL_F_DTLS1_GET_RECORD), "DTLS1_GET_RECORD"}, 90 {ERR_FUNC(SSL_F_DTLS1_HANDLE_TIMEOUT), "DTLS1_HANDLE_TIMEOUT"},
91{ERR_FUNC(SSL_F_DTLS1_HANDLE_TIMEOUT), "DTLS1_HANDLE_TIMEOUT"}, 91 {ERR_FUNC(SSL_F_DTLS1_HEARTBEAT), "DTLS1_HEARTBEAT"},
92{ERR_FUNC(SSL_F_DTLS1_HEARTBEAT), "DTLS1_HEARTBEAT"}, 92 {ERR_FUNC(SSL_F_DTLS1_OUTPUT_CERT_CHAIN), "DTLS1_OUTPUT_CERT_CHAIN"},
93{ERR_FUNC(SSL_F_DTLS1_OUTPUT_CERT_CHAIN), "DTLS1_OUTPUT_CERT_CHAIN"}, 93 {ERR_FUNC(SSL_F_DTLS1_PREPROCESS_FRAGMENT), "DTLS1_PREPROCESS_FRAGMENT"},
94{ERR_FUNC(SSL_F_DTLS1_PREPROCESS_FRAGMENT), "DTLS1_PREPROCESS_FRAGMENT"}, 94 {ERR_FUNC(SSL_F_DTLS1_PROCESS_OUT_OF_SEQ_MESSAGE), "DTLS1_PROCESS_OUT_OF_SEQ_MESSAGE"},
95{ERR_FUNC(SSL_F_DTLS1_PROCESS_OUT_OF_SEQ_MESSAGE), "DTLS1_PROCESS_OUT_OF_SEQ_MESSAGE"}, 95 {ERR_FUNC(SSL_F_DTLS1_PROCESS_RECORD), "DTLS1_PROCESS_RECORD"},
96{ERR_FUNC(SSL_F_DTLS1_PROCESS_RECORD), "DTLS1_PROCESS_RECORD"}, 96 {ERR_FUNC(SSL_F_DTLS1_READ_BYTES), "DTLS1_READ_BYTES"},
97{ERR_FUNC(SSL_F_DTLS1_READ_BYTES), "DTLS1_READ_BYTES"}, 97 {ERR_FUNC(SSL_F_DTLS1_READ_FAILED), "DTLS1_READ_FAILED"},
98{ERR_FUNC(SSL_F_DTLS1_READ_FAILED), "DTLS1_READ_FAILED"}, 98 {ERR_FUNC(SSL_F_DTLS1_SEND_CERTIFICATE_REQUEST), "DTLS1_SEND_CERTIFICATE_REQUEST"},
99{ERR_FUNC(SSL_F_DTLS1_SEND_CERTIFICATE_REQUEST), "DTLS1_SEND_CERTIFICATE_REQUEST"}, 99 {ERR_FUNC(SSL_F_DTLS1_SEND_CLIENT_CERTIFICATE), "DTLS1_SEND_CLIENT_CERTIFICATE"},
100{ERR_FUNC(SSL_F_DTLS1_SEND_CLIENT_CERTIFICATE), "DTLS1_SEND_CLIENT_CERTIFICATE"}, 100 {ERR_FUNC(SSL_F_DTLS1_SEND_CLIENT_KEY_EXCHANGE), "DTLS1_SEND_CLIENT_KEY_EXCHANGE"},
101{ERR_FUNC(SSL_F_DTLS1_SEND_CLIENT_KEY_EXCHANGE), "DTLS1_SEND_CLIENT_KEY_EXCHANGE"}, 101 {ERR_FUNC(SSL_F_DTLS1_SEND_CLIENT_VERIFY), "DTLS1_SEND_CLIENT_VERIFY"},
102{ERR_FUNC(SSL_F_DTLS1_SEND_CLIENT_VERIFY), "DTLS1_SEND_CLIENT_VERIFY"}, 102 {ERR_FUNC(SSL_F_DTLS1_SEND_HELLO_VERIFY_REQUEST), "DTLS1_SEND_HELLO_VERIFY_REQUEST"},
103{ERR_FUNC(SSL_F_DTLS1_SEND_HELLO_VERIFY_REQUEST), "DTLS1_SEND_HELLO_VERIFY_REQUEST"}, 103 {ERR_FUNC(SSL_F_DTLS1_SEND_SERVER_CERTIFICATE), "DTLS1_SEND_SERVER_CERTIFICATE"},
104{ERR_FUNC(SSL_F_DTLS1_SEND_SERVER_CERTIFICATE), "DTLS1_SEND_SERVER_CERTIFICATE"}, 104 {ERR_FUNC(SSL_F_DTLS1_SEND_SERVER_HELLO), "DTLS1_SEND_SERVER_HELLO"},
105{ERR_FUNC(SSL_F_DTLS1_SEND_SERVER_HELLO), "DTLS1_SEND_SERVER_HELLO"}, 105 {ERR_FUNC(SSL_F_DTLS1_SEND_SERVER_KEY_EXCHANGE), "DTLS1_SEND_SERVER_KEY_EXCHANGE"},
106{ERR_FUNC(SSL_F_DTLS1_SEND_SERVER_KEY_EXCHANGE), "DTLS1_SEND_SERVER_KEY_EXCHANGE"}, 106 {ERR_FUNC(SSL_F_DTLS1_WRITE_APP_DATA_BYTES), "DTLS1_WRITE_APP_DATA_BYTES"},
107{ERR_FUNC(SSL_F_DTLS1_WRITE_APP_DATA_BYTES), "DTLS1_WRITE_APP_DATA_BYTES"}, 107 {ERR_FUNC(SSL_F_GET_CLIENT_FINISHED), "GET_CLIENT_FINISHED"},
108{ERR_FUNC(SSL_F_GET_CLIENT_FINISHED), "GET_CLIENT_FINISHED"}, 108 {ERR_FUNC(SSL_F_GET_CLIENT_HELLO), "GET_CLIENT_HELLO"},
109{ERR_FUNC(SSL_F_GET_CLIENT_HELLO), "GET_CLIENT_HELLO"}, 109 {ERR_FUNC(SSL_F_GET_CLIENT_MASTER_KEY), "GET_CLIENT_MASTER_KEY"},
110{ERR_FUNC(SSL_F_GET_CLIENT_MASTER_KEY), "GET_CLIENT_MASTER_KEY"}, 110 {ERR_FUNC(SSL_F_GET_SERVER_FINISHED), "GET_SERVER_FINISHED"},
111{ERR_FUNC(SSL_F_GET_SERVER_FINISHED), "GET_SERVER_FINISHED"}, 111 {ERR_FUNC(SSL_F_GET_SERVER_HELLO), "GET_SERVER_HELLO"},
112{ERR_FUNC(SSL_F_GET_SERVER_HELLO), "GET_SERVER_HELLO"}, 112 {ERR_FUNC(SSL_F_GET_SERVER_VERIFY), "GET_SERVER_VERIFY"},
113{ERR_FUNC(SSL_F_GET_SERVER_VERIFY), "GET_SERVER_VERIFY"}, 113 {ERR_FUNC(SSL_F_I2D_SSL_SESSION), "i2d_SSL_SESSION"},
114{ERR_FUNC(SSL_F_I2D_SSL_SESSION), "i2d_SSL_SESSION"}, 114 {ERR_FUNC(SSL_F_READ_N), "READ_N"},
115{ERR_FUNC(SSL_F_READ_N), "READ_N"}, 115 {ERR_FUNC(SSL_F_REQUEST_CERTIFICATE), "REQUEST_CERTIFICATE"},
116{ERR_FUNC(SSL_F_REQUEST_CERTIFICATE), "REQUEST_CERTIFICATE"}, 116 {ERR_FUNC(SSL_F_SERVER_FINISH), "SERVER_FINISH"},
117{ERR_FUNC(SSL_F_SERVER_FINISH), "SERVER_FINISH"}, 117 {ERR_FUNC(SSL_F_SERVER_HELLO), "SERVER_HELLO"},
118{ERR_FUNC(SSL_F_SERVER_HELLO), "SERVER_HELLO"}, 118 {ERR_FUNC(SSL_F_SERVER_VERIFY), "SERVER_VERIFY"},
119{ERR_FUNC(SSL_F_SERVER_VERIFY), "SERVER_VERIFY"}, 119 {ERR_FUNC(SSL_F_SSL23_ACCEPT), "SSL23_ACCEPT"},
120{ERR_FUNC(SSL_F_SSL23_ACCEPT), "SSL23_ACCEPT"}, 120 {ERR_FUNC(SSL_F_SSL23_CLIENT_HELLO), "SSL23_CLIENT_HELLO"},
121{ERR_FUNC(SSL_F_SSL23_CLIENT_HELLO), "SSL23_CLIENT_HELLO"}, 121 {ERR_FUNC(SSL_F_SSL23_CONNECT), "SSL23_CONNECT"},
122{ERR_FUNC(SSL_F_SSL23_CONNECT), "SSL23_CONNECT"}, 122 {ERR_FUNC(SSL_F_SSL23_GET_CLIENT_HELLO), "SSL23_GET_CLIENT_HELLO"},
123{ERR_FUNC(SSL_F_SSL23_GET_CLIENT_HELLO), "SSL23_GET_CLIENT_HELLO"}, 123 {ERR_FUNC(SSL_F_SSL23_GET_SERVER_HELLO), "SSL23_GET_SERVER_HELLO"},
124{ERR_FUNC(SSL_F_SSL23_GET_SERVER_HELLO), "SSL23_GET_SERVER_HELLO"}, 124 {ERR_FUNC(SSL_F_SSL23_PEEK), "SSL23_PEEK"},
125{ERR_FUNC(SSL_F_SSL23_PEEK), "SSL23_PEEK"}, 125 {ERR_FUNC(SSL_F_SSL23_READ), "SSL23_READ"},
126{ERR_FUNC(SSL_F_SSL23_READ), "SSL23_READ"}, 126 {ERR_FUNC(SSL_F_SSL23_WRITE), "SSL23_WRITE"},
127{ERR_FUNC(SSL_F_SSL23_WRITE), "SSL23_WRITE"}, 127 {ERR_FUNC(SSL_F_SSL2_ACCEPT), "SSL2_ACCEPT"},
128{ERR_FUNC(SSL_F_SSL2_ACCEPT), "SSL2_ACCEPT"}, 128 {ERR_FUNC(SSL_F_SSL2_CONNECT), "SSL2_CONNECT"},
129{ERR_FUNC(SSL_F_SSL2_CONNECT), "SSL2_CONNECT"}, 129 {ERR_FUNC(SSL_F_SSL2_ENC_INIT), "SSL2_ENC_INIT"},
130{ERR_FUNC(SSL_F_SSL2_ENC_INIT), "SSL2_ENC_INIT"}, 130 {ERR_FUNC(SSL_F_SSL2_GENERATE_KEY_MATERIAL), "SSL2_GENERATE_KEY_MATERIAL"},
131{ERR_FUNC(SSL_F_SSL2_GENERATE_KEY_MATERIAL), "SSL2_GENERATE_KEY_MATERIAL"}, 131 {ERR_FUNC(SSL_F_SSL2_PEEK), "SSL2_PEEK"},
132{ERR_FUNC(SSL_F_SSL2_PEEK), "SSL2_PEEK"}, 132 {ERR_FUNC(SSL_F_SSL2_READ), "SSL2_READ"},
133{ERR_FUNC(SSL_F_SSL2_READ), "SSL2_READ"}, 133 {ERR_FUNC(SSL_F_SSL2_READ_INTERNAL), "SSL2_READ_INTERNAL"},
134{ERR_FUNC(SSL_F_SSL2_READ_INTERNAL), "SSL2_READ_INTERNAL"}, 134 {ERR_FUNC(SSL_F_SSL2_SET_CERTIFICATE), "SSL2_SET_CERTIFICATE"},
135{ERR_FUNC(SSL_F_SSL2_SET_CERTIFICATE), "SSL2_SET_CERTIFICATE"}, 135 {ERR_FUNC(SSL_F_SSL2_WRITE), "SSL2_WRITE"},
136{ERR_FUNC(SSL_F_SSL2_WRITE), "SSL2_WRITE"}, 136 {ERR_FUNC(SSL_F_SSL3_ACCEPT), "SSL3_ACCEPT"},
137{ERR_FUNC(SSL_F_SSL3_ACCEPT), "SSL3_ACCEPT"}, 137 {ERR_FUNC(SSL_F_SSL3_ADD_CERT_TO_BUF), "SSL3_ADD_CERT_TO_BUF"},
138{ERR_FUNC(SSL_F_SSL3_ADD_CERT_TO_BUF), "SSL3_ADD_CERT_TO_BUF"}, 138 {ERR_FUNC(SSL_F_SSL3_CALLBACK_CTRL), "SSL3_CALLBACK_CTRL"},
139{ERR_FUNC(SSL_F_SSL3_CALLBACK_CTRL), "SSL3_CALLBACK_CTRL"}, 139 {ERR_FUNC(SSL_F_SSL3_CHANGE_CIPHER_STATE), "SSL3_CHANGE_CIPHER_STATE"},
140{ERR_FUNC(SSL_F_SSL3_CHANGE_CIPHER_STATE), "SSL3_CHANGE_CIPHER_STATE"}, 140 {ERR_FUNC(SSL_F_SSL3_CHECK_CERT_AND_ALGORITHM), "SSL3_CHECK_CERT_AND_ALGORITHM"},
141{ERR_FUNC(SSL_F_SSL3_CHECK_CERT_AND_ALGORITHM), "SSL3_CHECK_CERT_AND_ALGORITHM"}, 141 {ERR_FUNC(SSL_F_SSL3_CHECK_CLIENT_HELLO), "SSL3_CHECK_CLIENT_HELLO"},
142{ERR_FUNC(SSL_F_SSL3_CHECK_CLIENT_HELLO), "SSL3_CHECK_CLIENT_HELLO"}, 142 {ERR_FUNC(SSL_F_SSL3_CLIENT_HELLO), "SSL3_CLIENT_HELLO"},
143{ERR_FUNC(SSL_F_SSL3_CLIENT_HELLO), "SSL3_CLIENT_HELLO"}, 143 {ERR_FUNC(SSL_F_SSL3_CONNECT), "SSL3_CONNECT"},
144{ERR_FUNC(SSL_F_SSL3_CONNECT), "SSL3_CONNECT"}, 144 {ERR_FUNC(SSL_F_SSL3_CTRL), "SSL3_CTRL"},
145{ERR_FUNC(SSL_F_SSL3_CTRL), "SSL3_CTRL"}, 145 {ERR_FUNC(SSL_F_SSL3_CTX_CTRL), "SSL3_CTX_CTRL"},
146{ERR_FUNC(SSL_F_SSL3_CTX_CTRL), "SSL3_CTX_CTRL"}, 146 {ERR_FUNC(SSL_F_SSL3_DIGEST_CACHED_RECORDS), "SSL3_DIGEST_CACHED_RECORDS"},
147{ERR_FUNC(SSL_F_SSL3_DIGEST_CACHED_RECORDS), "SSL3_DIGEST_CACHED_RECORDS"}, 147 {ERR_FUNC(SSL_F_SSL3_DO_CHANGE_CIPHER_SPEC), "SSL3_DO_CHANGE_CIPHER_SPEC"},
148{ERR_FUNC(SSL_F_SSL3_DO_CHANGE_CIPHER_SPEC), "SSL3_DO_CHANGE_CIPHER_SPEC"}, 148 {ERR_FUNC(SSL_F_SSL3_ENC), "SSL3_ENC"},
149{ERR_FUNC(SSL_F_SSL3_ENC), "SSL3_ENC"}, 149 {ERR_FUNC(SSL_F_SSL3_GENERATE_KEY_BLOCK), "SSL3_GENERATE_KEY_BLOCK"},
150{ERR_FUNC(SSL_F_SSL3_GENERATE_KEY_BLOCK), "SSL3_GENERATE_KEY_BLOCK"}, 150 {ERR_FUNC(SSL_F_SSL3_GET_CERTIFICATE_REQUEST), "SSL3_GET_CERTIFICATE_REQUEST"},
151{ERR_FUNC(SSL_F_SSL3_GET_CERTIFICATE_REQUEST), "SSL3_GET_CERTIFICATE_REQUEST"}, 151 {ERR_FUNC(SSL_F_SSL3_GET_CERT_STATUS), "SSL3_GET_CERT_STATUS"},
152{ERR_FUNC(SSL_F_SSL3_GET_CERT_STATUS), "SSL3_GET_CERT_STATUS"}, 152 {ERR_FUNC(SSL_F_SSL3_GET_CERT_VERIFY), "SSL3_GET_CERT_VERIFY"},
153{ERR_FUNC(SSL_F_SSL3_GET_CERT_VERIFY), "SSL3_GET_CERT_VERIFY"}, 153 {ERR_FUNC(SSL_F_SSL3_GET_CLIENT_CERTIFICATE), "SSL3_GET_CLIENT_CERTIFICATE"},
154{ERR_FUNC(SSL_F_SSL3_GET_CLIENT_CERTIFICATE), "SSL3_GET_CLIENT_CERTIFICATE"}, 154 {ERR_FUNC(SSL_F_SSL3_GET_CLIENT_HELLO), "SSL3_GET_CLIENT_HELLO"},
155{ERR_FUNC(SSL_F_SSL3_GET_CLIENT_HELLO), "SSL3_GET_CLIENT_HELLO"}, 155 {ERR_FUNC(SSL_F_SSL3_GET_CLIENT_KEY_EXCHANGE), "SSL3_GET_CLIENT_KEY_EXCHANGE"},
156{ERR_FUNC(SSL_F_SSL3_GET_CLIENT_KEY_EXCHANGE), "SSL3_GET_CLIENT_KEY_EXCHANGE"}, 156 {ERR_FUNC(SSL_F_SSL3_GET_FINISHED), "SSL3_GET_FINISHED"},
157{ERR_FUNC(SSL_F_SSL3_GET_FINISHED), "SSL3_GET_FINISHED"}, 157 {ERR_FUNC(SSL_F_SSL3_GET_KEY_EXCHANGE), "SSL3_GET_KEY_EXCHANGE"},
158{ERR_FUNC(SSL_F_SSL3_GET_KEY_EXCHANGE), "SSL3_GET_KEY_EXCHANGE"}, 158 {ERR_FUNC(SSL_F_SSL3_GET_MESSAGE), "SSL3_GET_MESSAGE"},
159{ERR_FUNC(SSL_F_SSL3_GET_MESSAGE), "SSL3_GET_MESSAGE"}, 159 {ERR_FUNC(SSL_F_SSL3_GET_NEW_SESSION_TICKET), "SSL3_GET_NEW_SESSION_TICKET"},
160{ERR_FUNC(SSL_F_SSL3_GET_NEW_SESSION_TICKET), "SSL3_GET_NEW_SESSION_TICKET"}, 160 {ERR_FUNC(SSL_F_SSL3_GET_NEXT_PROTO), "SSL3_GET_NEXT_PROTO"},
161{ERR_FUNC(SSL_F_SSL3_GET_NEXT_PROTO), "SSL3_GET_NEXT_PROTO"}, 161 {ERR_FUNC(SSL_F_SSL3_GET_RECORD), "SSL3_GET_RECORD"},
162{ERR_FUNC(SSL_F_SSL3_GET_RECORD), "SSL3_GET_RECORD"}, 162 {ERR_FUNC(SSL_F_SSL3_GET_SERVER_CERTIFICATE), "SSL3_GET_SERVER_CERTIFICATE"},
163{ERR_FUNC(SSL_F_SSL3_GET_SERVER_CERTIFICATE), "SSL3_GET_SERVER_CERTIFICATE"}, 163 {ERR_FUNC(SSL_F_SSL3_GET_SERVER_DONE), "SSL3_GET_SERVER_DONE"},
164{ERR_FUNC(SSL_F_SSL3_GET_SERVER_DONE), "SSL3_GET_SERVER_DONE"}, 164 {ERR_FUNC(SSL_F_SSL3_GET_SERVER_HELLO), "SSL3_GET_SERVER_HELLO"},
165{ERR_FUNC(SSL_F_SSL3_GET_SERVER_HELLO), "SSL3_GET_SERVER_HELLO"}, 165 {ERR_FUNC(SSL_F_SSL3_HANDSHAKE_MAC), "ssl3_handshake_mac"},
166{ERR_FUNC(SSL_F_SSL3_HANDSHAKE_MAC), "ssl3_handshake_mac"}, 166 {ERR_FUNC(SSL_F_SSL3_NEW_SESSION_TICKET), "SSL3_NEW_SESSION_TICKET"},
167{ERR_FUNC(SSL_F_SSL3_NEW_SESSION_TICKET), "SSL3_NEW_SESSION_TICKET"}, 167 {ERR_FUNC(SSL_F_SSL3_OUTPUT_CERT_CHAIN), "SSL3_OUTPUT_CERT_CHAIN"},
168{ERR_FUNC(SSL_F_SSL3_OUTPUT_CERT_CHAIN), "SSL3_OUTPUT_CERT_CHAIN"}, 168 {ERR_FUNC(SSL_F_SSL3_PEEK), "SSL3_PEEK"},
169{ERR_FUNC(SSL_F_SSL3_PEEK), "SSL3_PEEK"}, 169 {ERR_FUNC(SSL_F_SSL3_READ_BYTES), "SSL3_READ_BYTES"},
170{ERR_FUNC(SSL_F_SSL3_READ_BYTES), "SSL3_READ_BYTES"}, 170 {ERR_FUNC(SSL_F_SSL3_READ_N), "SSL3_READ_N"},
171{ERR_FUNC(SSL_F_SSL3_READ_N), "SSL3_READ_N"}, 171 {ERR_FUNC(SSL_F_SSL3_SEND_CERTIFICATE_REQUEST), "SSL3_SEND_CERTIFICATE_REQUEST"},
172{ERR_FUNC(SSL_F_SSL3_SEND_CERTIFICATE_REQUEST), "SSL3_SEND_CERTIFICATE_REQUEST"}, 172 {ERR_FUNC(SSL_F_SSL3_SEND_CLIENT_CERTIFICATE), "SSL3_SEND_CLIENT_CERTIFICATE"},
173{ERR_FUNC(SSL_F_SSL3_SEND_CLIENT_CERTIFICATE), "SSL3_SEND_CLIENT_CERTIFICATE"}, 173 {ERR_FUNC(SSL_F_SSL3_SEND_CLIENT_KEY_EXCHANGE), "SSL3_SEND_CLIENT_KEY_EXCHANGE"},
174{ERR_FUNC(SSL_F_SSL3_SEND_CLIENT_KEY_EXCHANGE), "SSL3_SEND_CLIENT_KEY_EXCHANGE"}, 174 {ERR_FUNC(SSL_F_SSL3_SEND_CLIENT_VERIFY), "SSL3_SEND_CLIENT_VERIFY"},
175{ERR_FUNC(SSL_F_SSL3_SEND_CLIENT_VERIFY), "SSL3_SEND_CLIENT_VERIFY"}, 175 {ERR_FUNC(SSL_F_SSL3_SEND_SERVER_CERTIFICATE), "SSL3_SEND_SERVER_CERTIFICATE"},
176{ERR_FUNC(SSL_F_SSL3_SEND_SERVER_CERTIFICATE), "SSL3_SEND_SERVER_CERTIFICATE"}, 176 {ERR_FUNC(SSL_F_SSL3_SEND_SERVER_HELLO), "SSL3_SEND_SERVER_HELLO"},
177{ERR_FUNC(SSL_F_SSL3_SEND_SERVER_HELLO), "SSL3_SEND_SERVER_HELLO"}, 177 {ERR_FUNC(SSL_F_SSL3_SEND_SERVER_KEY_EXCHANGE), "SSL3_SEND_SERVER_KEY_EXCHANGE"},
178{ERR_FUNC(SSL_F_SSL3_SEND_SERVER_KEY_EXCHANGE), "SSL3_SEND_SERVER_KEY_EXCHANGE"}, 178 {ERR_FUNC(SSL_F_SSL3_SETUP_KEY_BLOCK), "SSL3_SETUP_KEY_BLOCK"},
179{ERR_FUNC(SSL_F_SSL3_SETUP_KEY_BLOCK), "SSL3_SETUP_KEY_BLOCK"}, 179 {ERR_FUNC(SSL_F_SSL3_SETUP_READ_BUFFER), "SSL3_SETUP_READ_BUFFER"},
180{ERR_FUNC(SSL_F_SSL3_SETUP_READ_BUFFER), "SSL3_SETUP_READ_BUFFER"}, 180 {ERR_FUNC(SSL_F_SSL3_SETUP_WRITE_BUFFER), "SSL3_SETUP_WRITE_BUFFER"},
181{ERR_FUNC(SSL_F_SSL3_SETUP_WRITE_BUFFER), "SSL3_SETUP_WRITE_BUFFER"}, 181 {ERR_FUNC(SSL_F_SSL3_WRITE_BYTES), "SSL3_WRITE_BYTES"},
182{ERR_FUNC(SSL_F_SSL3_WRITE_BYTES), "SSL3_WRITE_BYTES"}, 182 {ERR_FUNC(SSL_F_SSL3_WRITE_PENDING), "SSL3_WRITE_PENDING"},
183{ERR_FUNC(SSL_F_SSL3_WRITE_PENDING), "SSL3_WRITE_PENDING"}, 183 {ERR_FUNC(SSL_F_SSL_ADD_CLIENTHELLO_RENEGOTIATE_EXT), "SSL_ADD_CLIENTHELLO_RENEGOTIATE_EXT"},
184{ERR_FUNC(SSL_F_SSL_ADD_CLIENTHELLO_RENEGOTIATE_EXT), "SSL_ADD_CLIENTHELLO_RENEGOTIATE_EXT"}, 184 {ERR_FUNC(SSL_F_SSL_ADD_CLIENTHELLO_TLSEXT), "SSL_ADD_CLIENTHELLO_TLSEXT"},
185{ERR_FUNC(SSL_F_SSL_ADD_CLIENTHELLO_TLSEXT), "SSL_ADD_CLIENTHELLO_TLSEXT"}, 185 {ERR_FUNC(SSL_F_SSL_ADD_CLIENTHELLO_USE_SRTP_EXT), "SSL_ADD_CLIENTHELLO_USE_SRTP_EXT"},
186{ERR_FUNC(SSL_F_SSL_ADD_CLIENTHELLO_USE_SRTP_EXT), "SSL_ADD_CLIENTHELLO_USE_SRTP_EXT"}, 186 {ERR_FUNC(SSL_F_SSL_ADD_DIR_CERT_SUBJECTS_TO_STACK), "SSL_add_dir_cert_subjects_to_stack"},
187{ERR_FUNC(SSL_F_SSL_ADD_DIR_CERT_SUBJECTS_TO_STACK), "SSL_add_dir_cert_subjects_to_stack"}, 187 {ERR_FUNC(SSL_F_SSL_ADD_FILE_CERT_SUBJECTS_TO_STACK), "SSL_add_file_cert_subjects_to_stack"},
188{ERR_FUNC(SSL_F_SSL_ADD_FILE_CERT_SUBJECTS_TO_STACK), "SSL_add_file_cert_subjects_to_stack"}, 188 {ERR_FUNC(SSL_F_SSL_ADD_SERVERHELLO_RENEGOTIATE_EXT), "SSL_ADD_SERVERHELLO_RENEGOTIATE_EXT"},
189{ERR_FUNC(SSL_F_SSL_ADD_SERVERHELLO_RENEGOTIATE_EXT), "SSL_ADD_SERVERHELLO_RENEGOTIATE_EXT"}, 189 {ERR_FUNC(SSL_F_SSL_ADD_SERVERHELLO_TLSEXT), "SSL_ADD_SERVERHELLO_TLSEXT"},
190{ERR_FUNC(SSL_F_SSL_ADD_SERVERHELLO_TLSEXT), "SSL_ADD_SERVERHELLO_TLSEXT"}, 190 {ERR_FUNC(SSL_F_SSL_ADD_SERVERHELLO_USE_SRTP_EXT), "SSL_ADD_SERVERHELLO_USE_SRTP_EXT"},
191{ERR_FUNC(SSL_F_SSL_ADD_SERVERHELLO_USE_SRTP_EXT), "SSL_ADD_SERVERHELLO_USE_SRTP_EXT"}, 191 {ERR_FUNC(SSL_F_SSL_BAD_METHOD), "SSL_BAD_METHOD"},
192{ERR_FUNC(SSL_F_SSL_BAD_METHOD), "SSL_BAD_METHOD"}, 192 {ERR_FUNC(SSL_F_SSL_BYTES_TO_CIPHER_LIST), "SSL_BYTES_TO_CIPHER_LIST"},
193{ERR_FUNC(SSL_F_SSL_BYTES_TO_CIPHER_LIST), "SSL_BYTES_TO_CIPHER_LIST"}, 193 {ERR_FUNC(SSL_F_SSL_CERT_DUP), "SSL_CERT_DUP"},
194{ERR_FUNC(SSL_F_SSL_CERT_DUP), "SSL_CERT_DUP"}, 194 {ERR_FUNC(SSL_F_SSL_CERT_INST), "SSL_CERT_INST"},
195{ERR_FUNC(SSL_F_SSL_CERT_INST), "SSL_CERT_INST"}, 195 {ERR_FUNC(SSL_F_SSL_CERT_INSTANTIATE), "SSL_CERT_INSTANTIATE"},
196{ERR_FUNC(SSL_F_SSL_CERT_INSTANTIATE), "SSL_CERT_INSTANTIATE"}, 196 {ERR_FUNC(SSL_F_SSL_CERT_NEW), "SSL_CERT_NEW"},
197{ERR_FUNC(SSL_F_SSL_CERT_NEW), "SSL_CERT_NEW"}, 197 {ERR_FUNC(SSL_F_SSL_CHECK_PRIVATE_KEY), "SSL_check_private_key"},
198{ERR_FUNC(SSL_F_SSL_CHECK_PRIVATE_KEY), "SSL_check_private_key"}, 198 {ERR_FUNC(SSL_F_SSL_CHECK_SERVERHELLO_TLSEXT), "SSL_CHECK_SERVERHELLO_TLSEXT"},
199{ERR_FUNC(SSL_F_SSL_CHECK_SERVERHELLO_TLSEXT), "SSL_CHECK_SERVERHELLO_TLSEXT"}, 199 {ERR_FUNC(SSL_F_SSL_CHECK_SRVR_ECC_CERT_AND_ALG), "SSL_CHECK_SRVR_ECC_CERT_AND_ALG"},
200{ERR_FUNC(SSL_F_SSL_CHECK_SRVR_ECC_CERT_AND_ALG), "SSL_CHECK_SRVR_ECC_CERT_AND_ALG"}, 200 {ERR_FUNC(SSL_F_SSL_CIPHER_PROCESS_RULESTR), "SSL_CIPHER_PROCESS_RULESTR"},
201{ERR_FUNC(SSL_F_SSL_CIPHER_PROCESS_RULESTR), "SSL_CIPHER_PROCESS_RULESTR"}, 201 {ERR_FUNC(SSL_F_SSL_CIPHER_STRENGTH_SORT), "SSL_CIPHER_STRENGTH_SORT"},
202{ERR_FUNC(SSL_F_SSL_CIPHER_STRENGTH_SORT), "SSL_CIPHER_STRENGTH_SORT"}, 202 {ERR_FUNC(SSL_F_SSL_CLEAR), "SSL_clear"},
203{ERR_FUNC(SSL_F_SSL_CLEAR), "SSL_clear"}, 203 {ERR_FUNC(SSL_F_SSL_COMP_ADD_COMPRESSION_METHOD), "SSL_COMP_add_compression_method"},
204{ERR_FUNC(SSL_F_SSL_COMP_ADD_COMPRESSION_METHOD), "SSL_COMP_add_compression_method"}, 204 {ERR_FUNC(SSL_F_SSL_CREATE_CIPHER_LIST), "SSL_CREATE_CIPHER_LIST"},
205{ERR_FUNC(SSL_F_SSL_CREATE_CIPHER_LIST), "SSL_CREATE_CIPHER_LIST"}, 205 {ERR_FUNC(SSL_F_SSL_CTRL), "SSL_ctrl"},
206{ERR_FUNC(SSL_F_SSL_CTRL), "SSL_ctrl"}, 206 {ERR_FUNC(SSL_F_SSL_CTX_CHECK_PRIVATE_KEY), "SSL_CTX_check_private_key"},
207{ERR_FUNC(SSL_F_SSL_CTX_CHECK_PRIVATE_KEY), "SSL_CTX_check_private_key"}, 207 {ERR_FUNC(SSL_F_SSL_CTX_MAKE_PROFILES), "SSL_CTX_MAKE_PROFILES"},
208{ERR_FUNC(SSL_F_SSL_CTX_MAKE_PROFILES), "SSL_CTX_MAKE_PROFILES"}, 208 {ERR_FUNC(SSL_F_SSL_CTX_NEW), "SSL_CTX_new"},
209{ERR_FUNC(SSL_F_SSL_CTX_NEW), "SSL_CTX_new"}, 209 {ERR_FUNC(SSL_F_SSL_CTX_SET_CIPHER_LIST), "SSL_CTX_set_cipher_list"},
210{ERR_FUNC(SSL_F_SSL_CTX_SET_CIPHER_LIST), "SSL_CTX_set_cipher_list"}, 210 {ERR_FUNC(SSL_F_SSL_CTX_SET_CLIENT_CERT_ENGINE), "SSL_CTX_set_client_cert_engine"},
211{ERR_FUNC(SSL_F_SSL_CTX_SET_CLIENT_CERT_ENGINE), "SSL_CTX_set_client_cert_engine"}, 211 {ERR_FUNC(SSL_F_SSL_CTX_SET_PURPOSE), "SSL_CTX_set_purpose"},
212{ERR_FUNC(SSL_F_SSL_CTX_SET_PURPOSE), "SSL_CTX_set_purpose"}, 212 {ERR_FUNC(SSL_F_SSL_CTX_SET_SESSION_ID_CONTEXT), "SSL_CTX_set_session_id_context"},
213{ERR_FUNC(SSL_F_SSL_CTX_SET_SESSION_ID_CONTEXT), "SSL_CTX_set_session_id_context"}, 213 {ERR_FUNC(SSL_F_SSL_CTX_SET_SSL_VERSION), "SSL_CTX_set_ssl_version"},
214{ERR_FUNC(SSL_F_SSL_CTX_SET_SSL_VERSION), "SSL_CTX_set_ssl_version"}, 214 {ERR_FUNC(SSL_F_SSL_CTX_SET_TRUST), "SSL_CTX_set_trust"},
215{ERR_FUNC(SSL_F_SSL_CTX_SET_TRUST), "SSL_CTX_set_trust"}, 215 {ERR_FUNC(SSL_F_SSL_CTX_USE_CERTIFICATE), "SSL_CTX_use_certificate"},
216{ERR_FUNC(SSL_F_SSL_CTX_USE_CERTIFICATE), "SSL_CTX_use_certificate"}, 216 {ERR_FUNC(SSL_F_SSL_CTX_USE_CERTIFICATE_ASN1), "SSL_CTX_use_certificate_ASN1"},
217{ERR_FUNC(SSL_F_SSL_CTX_USE_CERTIFICATE_ASN1), "SSL_CTX_use_certificate_ASN1"}, 217 {ERR_FUNC(SSL_F_SSL_CTX_USE_CERTIFICATE_CHAIN_FILE), "SSL_CTX_use_certificate_chain_file"},
218{ERR_FUNC(SSL_F_SSL_CTX_USE_CERTIFICATE_CHAIN_FILE), "SSL_CTX_use_certificate_chain_file"}, 218 {ERR_FUNC(SSL_F_SSL_CTX_USE_CERTIFICATE_FILE), "SSL_CTX_use_certificate_file"},
219{ERR_FUNC(SSL_F_SSL_CTX_USE_CERTIFICATE_FILE), "SSL_CTX_use_certificate_file"}, 219 {ERR_FUNC(SSL_F_SSL_CTX_USE_PRIVATEKEY), "SSL_CTX_use_PrivateKey"},
220{ERR_FUNC(SSL_F_SSL_CTX_USE_PRIVATEKEY), "SSL_CTX_use_PrivateKey"}, 220 {ERR_FUNC(SSL_F_SSL_CTX_USE_PRIVATEKEY_ASN1), "SSL_CTX_use_PrivateKey_ASN1"},
221{ERR_FUNC(SSL_F_SSL_CTX_USE_PRIVATEKEY_ASN1), "SSL_CTX_use_PrivateKey_ASN1"}, 221 {ERR_FUNC(SSL_F_SSL_CTX_USE_PRIVATEKEY_FILE), "SSL_CTX_use_PrivateKey_file"},
222{ERR_FUNC(SSL_F_SSL_CTX_USE_PRIVATEKEY_FILE), "SSL_CTX_use_PrivateKey_file"}, 222 {ERR_FUNC(SSL_F_SSL_CTX_USE_PSK_IDENTITY_HINT), "SSL_CTX_use_psk_identity_hint"},
223{ERR_FUNC(SSL_F_SSL_CTX_USE_PSK_IDENTITY_HINT), "SSL_CTX_use_psk_identity_hint"}, 223 {ERR_FUNC(SSL_F_SSL_CTX_USE_RSAPRIVATEKEY), "SSL_CTX_use_RSAPrivateKey"},
224{ERR_FUNC(SSL_F_SSL_CTX_USE_RSAPRIVATEKEY), "SSL_CTX_use_RSAPrivateKey"}, 224 {ERR_FUNC(SSL_F_SSL_CTX_USE_RSAPRIVATEKEY_ASN1), "SSL_CTX_use_RSAPrivateKey_ASN1"},
225{ERR_FUNC(SSL_F_SSL_CTX_USE_RSAPRIVATEKEY_ASN1), "SSL_CTX_use_RSAPrivateKey_ASN1"}, 225 {ERR_FUNC(SSL_F_SSL_CTX_USE_RSAPRIVATEKEY_FILE), "SSL_CTX_use_RSAPrivateKey_file"},
226{ERR_FUNC(SSL_F_SSL_CTX_USE_RSAPRIVATEKEY_FILE), "SSL_CTX_use_RSAPrivateKey_file"}, 226 {ERR_FUNC(SSL_F_SSL_DO_HANDSHAKE), "SSL_do_handshake"},
227{ERR_FUNC(SSL_F_SSL_DO_HANDSHAKE), "SSL_do_handshake"}, 227 {ERR_FUNC(SSL_F_SSL_GET_NEW_SESSION), "SSL_GET_NEW_SESSION"},
228{ERR_FUNC(SSL_F_SSL_GET_NEW_SESSION), "SSL_GET_NEW_SESSION"}, 228 {ERR_FUNC(SSL_F_SSL_GET_PREV_SESSION), "SSL_GET_PREV_SESSION"},
229{ERR_FUNC(SSL_F_SSL_GET_PREV_SESSION), "SSL_GET_PREV_SESSION"}, 229 {ERR_FUNC(SSL_F_SSL_GET_SERVER_SEND_CERT), "SSL_GET_SERVER_SEND_CERT"},
230{ERR_FUNC(SSL_F_SSL_GET_SERVER_SEND_CERT), "SSL_GET_SERVER_SEND_CERT"}, 230 {ERR_FUNC(SSL_F_SSL_GET_SERVER_SEND_PKEY), "SSL_GET_SERVER_SEND_PKEY"},
231{ERR_FUNC(SSL_F_SSL_GET_SERVER_SEND_PKEY), "SSL_GET_SERVER_SEND_PKEY"}, 231 {ERR_FUNC(SSL_F_SSL_GET_SIGN_PKEY), "SSL_GET_SIGN_PKEY"},
232{ERR_FUNC(SSL_F_SSL_GET_SIGN_PKEY), "SSL_GET_SIGN_PKEY"}, 232 {ERR_FUNC(SSL_F_SSL_INIT_WBIO_BUFFER), "SSL_INIT_WBIO_BUFFER"},
233{ERR_FUNC(SSL_F_SSL_INIT_WBIO_BUFFER), "SSL_INIT_WBIO_BUFFER"}, 233 {ERR_FUNC(SSL_F_SSL_LOAD_CLIENT_CA_FILE), "SSL_load_client_CA_file"},
234{ERR_FUNC(SSL_F_SSL_LOAD_CLIENT_CA_FILE), "SSL_load_client_CA_file"}, 234 {ERR_FUNC(SSL_F_SSL_NEW), "SSL_new"},
235{ERR_FUNC(SSL_F_SSL_NEW), "SSL_new"}, 235 {ERR_FUNC(SSL_F_SSL_PARSE_CLIENTHELLO_RENEGOTIATE_EXT), "SSL_PARSE_CLIENTHELLO_RENEGOTIATE_EXT"},
236{ERR_FUNC(SSL_F_SSL_PARSE_CLIENTHELLO_RENEGOTIATE_EXT), "SSL_PARSE_CLIENTHELLO_RENEGOTIATE_EXT"}, 236 {ERR_FUNC(SSL_F_SSL_PARSE_CLIENTHELLO_TLSEXT), "SSL_PARSE_CLIENTHELLO_TLSEXT"},
237{ERR_FUNC(SSL_F_SSL_PARSE_CLIENTHELLO_TLSEXT), "SSL_PARSE_CLIENTHELLO_TLSEXT"}, 237 {ERR_FUNC(SSL_F_SSL_PARSE_CLIENTHELLO_USE_SRTP_EXT), "SSL_PARSE_CLIENTHELLO_USE_SRTP_EXT"},
238{ERR_FUNC(SSL_F_SSL_PARSE_CLIENTHELLO_USE_SRTP_EXT), "SSL_PARSE_CLIENTHELLO_USE_SRTP_EXT"}, 238 {ERR_FUNC(SSL_F_SSL_PARSE_SERVERHELLO_RENEGOTIATE_EXT), "SSL_PARSE_SERVERHELLO_RENEGOTIATE_EXT"},
239{ERR_FUNC(SSL_F_SSL_PARSE_SERVERHELLO_RENEGOTIATE_EXT), "SSL_PARSE_SERVERHELLO_RENEGOTIATE_EXT"}, 239 {ERR_FUNC(SSL_F_SSL_PARSE_SERVERHELLO_TLSEXT), "SSL_PARSE_SERVERHELLO_TLSEXT"},
240{ERR_FUNC(SSL_F_SSL_PARSE_SERVERHELLO_TLSEXT), "SSL_PARSE_SERVERHELLO_TLSEXT"}, 240 {ERR_FUNC(SSL_F_SSL_PARSE_SERVERHELLO_USE_SRTP_EXT), "SSL_PARSE_SERVERHELLO_USE_SRTP_EXT"},
241{ERR_FUNC(SSL_F_SSL_PARSE_SERVERHELLO_USE_SRTP_EXT), "SSL_PARSE_SERVERHELLO_USE_SRTP_EXT"}, 241 {ERR_FUNC(SSL_F_SSL_PEEK), "SSL_peek"},
242{ERR_FUNC(SSL_F_SSL_PEEK), "SSL_peek"}, 242 {ERR_FUNC(SSL_F_SSL_PREPARE_CLIENTHELLO_TLSEXT), "SSL_PREPARE_CLIENTHELLO_TLSEXT"},
243{ERR_FUNC(SSL_F_SSL_PREPARE_CLIENTHELLO_TLSEXT), "SSL_PREPARE_CLIENTHELLO_TLSEXT"}, 243 {ERR_FUNC(SSL_F_SSL_PREPARE_SERVERHELLO_TLSEXT), "SSL_PREPARE_SERVERHELLO_TLSEXT"},
244{ERR_FUNC(SSL_F_SSL_PREPARE_SERVERHELLO_TLSEXT), "SSL_PREPARE_SERVERHELLO_TLSEXT"}, 244 {ERR_FUNC(SSL_F_SSL_READ), "SSL_read"},
245{ERR_FUNC(SSL_F_SSL_READ), "SSL_read"}, 245 {ERR_FUNC(SSL_F_SSL_RSA_PRIVATE_DECRYPT), "SSL_RSA_PRIVATE_DECRYPT"},
246{ERR_FUNC(SSL_F_SSL_RSA_PRIVATE_DECRYPT), "SSL_RSA_PRIVATE_DECRYPT"}, 246 {ERR_FUNC(SSL_F_SSL_RSA_PUBLIC_ENCRYPT), "SSL_RSA_PUBLIC_ENCRYPT"},
247{ERR_FUNC(SSL_F_SSL_RSA_PUBLIC_ENCRYPT), "SSL_RSA_PUBLIC_ENCRYPT"}, 247 {ERR_FUNC(SSL_F_SSL_SESSION_NEW), "SSL_SESSION_new"},
248{ERR_FUNC(SSL_F_SSL_SESSION_NEW), "SSL_SESSION_new"}, 248 {ERR_FUNC(SSL_F_SSL_SESSION_PRINT_FP), "SSL_SESSION_print_fp"},
249{ERR_FUNC(SSL_F_SSL_SESSION_PRINT_FP), "SSL_SESSION_print_fp"}, 249 {ERR_FUNC(SSL_F_SSL_SESSION_SET1_ID_CONTEXT), "SSL_SESSION_set1_id_context"},
250{ERR_FUNC(SSL_F_SSL_SESSION_SET1_ID_CONTEXT), "SSL_SESSION_set1_id_context"}, 250 {ERR_FUNC(SSL_F_SSL_SESS_CERT_NEW), "SSL_SESS_CERT_NEW"},
251{ERR_FUNC(SSL_F_SSL_SESS_CERT_NEW), "SSL_SESS_CERT_NEW"}, 251 {ERR_FUNC(SSL_F_SSL_SET_CERT), "SSL_SET_CERT"},
252{ERR_FUNC(SSL_F_SSL_SET_CERT), "SSL_SET_CERT"}, 252 {ERR_FUNC(SSL_F_SSL_SET_CIPHER_LIST), "SSL_set_cipher_list"},
253{ERR_FUNC(SSL_F_SSL_SET_CIPHER_LIST), "SSL_set_cipher_list"}, 253 {ERR_FUNC(SSL_F_SSL_SET_FD), "SSL_set_fd"},
254{ERR_FUNC(SSL_F_SSL_SET_FD), "SSL_set_fd"}, 254 {ERR_FUNC(SSL_F_SSL_SET_PKEY), "SSL_SET_PKEY"},
255{ERR_FUNC(SSL_F_SSL_SET_PKEY), "SSL_SET_PKEY"}, 255 {ERR_FUNC(SSL_F_SSL_SET_PURPOSE), "SSL_set_purpose"},
256{ERR_FUNC(SSL_F_SSL_SET_PURPOSE), "SSL_set_purpose"}, 256 {ERR_FUNC(SSL_F_SSL_SET_RFD), "SSL_set_rfd"},
257{ERR_FUNC(SSL_F_SSL_SET_RFD), "SSL_set_rfd"}, 257 {ERR_FUNC(SSL_F_SSL_SET_SESSION), "SSL_set_session"},
258{ERR_FUNC(SSL_F_SSL_SET_SESSION), "SSL_set_session"}, 258 {ERR_FUNC(SSL_F_SSL_SET_SESSION_ID_CONTEXT), "SSL_set_session_id_context"},
259{ERR_FUNC(SSL_F_SSL_SET_SESSION_ID_CONTEXT), "SSL_set_session_id_context"}, 259 {ERR_FUNC(SSL_F_SSL_SET_SESSION_TICKET_EXT), "SSL_set_session_ticket_ext"},
260{ERR_FUNC(SSL_F_SSL_SET_SESSION_TICKET_EXT), "SSL_set_session_ticket_ext"}, 260 {ERR_FUNC(SSL_F_SSL_SET_TRUST), "SSL_set_trust"},
261{ERR_FUNC(SSL_F_SSL_SET_TRUST), "SSL_set_trust"}, 261 {ERR_FUNC(SSL_F_SSL_SET_WFD), "SSL_set_wfd"},
262{ERR_FUNC(SSL_F_SSL_SET_WFD), "SSL_set_wfd"}, 262 {ERR_FUNC(SSL_F_SSL_SHUTDOWN), "SSL_shutdown"},
263{ERR_FUNC(SSL_F_SSL_SHUTDOWN), "SSL_shutdown"}, 263 {ERR_FUNC(SSL_F_SSL_SRP_CTX_INIT), "SSL_SRP_CTX_init"},
264{ERR_FUNC(SSL_F_SSL_SRP_CTX_INIT), "SSL_SRP_CTX_init"}, 264 {ERR_FUNC(SSL_F_SSL_UNDEFINED_CONST_FUNCTION), "SSL_UNDEFINED_CONST_FUNCTION"},
265{ERR_FUNC(SSL_F_SSL_UNDEFINED_CONST_FUNCTION), "SSL_UNDEFINED_CONST_FUNCTION"}, 265 {ERR_FUNC(SSL_F_SSL_UNDEFINED_FUNCTION), "SSL_UNDEFINED_FUNCTION"},
266{ERR_FUNC(SSL_F_SSL_UNDEFINED_FUNCTION), "SSL_UNDEFINED_FUNCTION"}, 266 {ERR_FUNC(SSL_F_SSL_UNDEFINED_VOID_FUNCTION), "SSL_UNDEFINED_VOID_FUNCTION"},
267{ERR_FUNC(SSL_F_SSL_UNDEFINED_VOID_FUNCTION), "SSL_UNDEFINED_VOID_FUNCTION"}, 267 {ERR_FUNC(SSL_F_SSL_USE_CERTIFICATE), "SSL_use_certificate"},
268{ERR_FUNC(SSL_F_SSL_USE_CERTIFICATE), "SSL_use_certificate"}, 268 {ERR_FUNC(SSL_F_SSL_USE_CERTIFICATE_ASN1), "SSL_use_certificate_ASN1"},
269{ERR_FUNC(SSL_F_SSL_USE_CERTIFICATE_ASN1), "SSL_use_certificate_ASN1"}, 269 {ERR_FUNC(SSL_F_SSL_USE_CERTIFICATE_FILE), "SSL_use_certificate_file"},
270{ERR_FUNC(SSL_F_SSL_USE_CERTIFICATE_FILE), "SSL_use_certificate_file"}, 270 {ERR_FUNC(SSL_F_SSL_USE_PRIVATEKEY), "SSL_use_PrivateKey"},
271{ERR_FUNC(SSL_F_SSL_USE_PRIVATEKEY), "SSL_use_PrivateKey"}, 271 {ERR_FUNC(SSL_F_SSL_USE_PRIVATEKEY_ASN1), "SSL_use_PrivateKey_ASN1"},
272{ERR_FUNC(SSL_F_SSL_USE_PRIVATEKEY_ASN1), "SSL_use_PrivateKey_ASN1"}, 272 {ERR_FUNC(SSL_F_SSL_USE_PRIVATEKEY_FILE), "SSL_use_PrivateKey_file"},
273{ERR_FUNC(SSL_F_SSL_USE_PRIVATEKEY_FILE), "SSL_use_PrivateKey_file"}, 273 {ERR_FUNC(SSL_F_SSL_USE_PSK_IDENTITY_HINT), "SSL_use_psk_identity_hint"},
274{ERR_FUNC(SSL_F_SSL_USE_PSK_IDENTITY_HINT), "SSL_use_psk_identity_hint"}, 274 {ERR_FUNC(SSL_F_SSL_USE_RSAPRIVATEKEY), "SSL_use_RSAPrivateKey"},
275{ERR_FUNC(SSL_F_SSL_USE_RSAPRIVATEKEY), "SSL_use_RSAPrivateKey"}, 275 {ERR_FUNC(SSL_F_SSL_USE_RSAPRIVATEKEY_ASN1), "SSL_use_RSAPrivateKey_ASN1"},
276{ERR_FUNC(SSL_F_SSL_USE_RSAPRIVATEKEY_ASN1), "SSL_use_RSAPrivateKey_ASN1"}, 276 {ERR_FUNC(SSL_F_SSL_USE_RSAPRIVATEKEY_FILE), "SSL_use_RSAPrivateKey_file"},
277{ERR_FUNC(SSL_F_SSL_USE_RSAPRIVATEKEY_FILE), "SSL_use_RSAPrivateKey_file"}, 277 {ERR_FUNC(SSL_F_SSL_VERIFY_CERT_CHAIN), "SSL_VERIFY_CERT_CHAIN"},
278{ERR_FUNC(SSL_F_SSL_VERIFY_CERT_CHAIN), "SSL_VERIFY_CERT_CHAIN"}, 278 {ERR_FUNC(SSL_F_SSL_WRITE), "SSL_write"},
279{ERR_FUNC(SSL_F_SSL_WRITE), "SSL_write"}, 279 {ERR_FUNC(SSL_F_TLS1_CERT_VERIFY_MAC), "tls1_cert_verify_mac"},
280{ERR_FUNC(SSL_F_TLS1_CERT_VERIFY_MAC), "tls1_cert_verify_mac"}, 280 {ERR_FUNC(SSL_F_TLS1_CHANGE_CIPHER_STATE), "TLS1_CHANGE_CIPHER_STATE"},
281{ERR_FUNC(SSL_F_TLS1_CHANGE_CIPHER_STATE), "TLS1_CHANGE_CIPHER_STATE"}, 281 {ERR_FUNC(SSL_F_TLS1_CHECK_SERVERHELLO_TLSEXT), "TLS1_CHECK_SERVERHELLO_TLSEXT"},
282{ERR_FUNC(SSL_F_TLS1_CHECK_SERVERHELLO_TLSEXT), "TLS1_CHECK_SERVERHELLO_TLSEXT"}, 282 {ERR_FUNC(SSL_F_TLS1_ENC), "TLS1_ENC"},
283{ERR_FUNC(SSL_F_TLS1_ENC), "TLS1_ENC"}, 283 {ERR_FUNC(SSL_F_TLS1_EXPORT_KEYING_MATERIAL), "TLS1_EXPORT_KEYING_MATERIAL"},
284{ERR_FUNC(SSL_F_TLS1_EXPORT_KEYING_MATERIAL), "TLS1_EXPORT_KEYING_MATERIAL"}, 284 {ERR_FUNC(SSL_F_TLS1_HEARTBEAT), "SSL_F_TLS1_HEARTBEAT"},
285{ERR_FUNC(SSL_F_TLS1_HEARTBEAT), "SSL_F_TLS1_HEARTBEAT"}, 285 {ERR_FUNC(SSL_F_TLS1_PREPARE_CLIENTHELLO_TLSEXT), "TLS1_PREPARE_CLIENTHELLO_TLSEXT"},
286{ERR_FUNC(SSL_F_TLS1_PREPARE_CLIENTHELLO_TLSEXT), "TLS1_PREPARE_CLIENTHELLO_TLSEXT"}, 286 {ERR_FUNC(SSL_F_TLS1_PREPARE_SERVERHELLO_TLSEXT), "TLS1_PREPARE_SERVERHELLO_TLSEXT"},
287{ERR_FUNC(SSL_F_TLS1_PREPARE_SERVERHELLO_TLSEXT), "TLS1_PREPARE_SERVERHELLO_TLSEXT"}, 287 {ERR_FUNC(SSL_F_TLS1_PRF), "tls1_prf"},
288{ERR_FUNC(SSL_F_TLS1_PRF), "tls1_prf"}, 288 {ERR_FUNC(SSL_F_TLS1_SETUP_KEY_BLOCK), "TLS1_SETUP_KEY_BLOCK"},
289{ERR_FUNC(SSL_F_TLS1_SETUP_KEY_BLOCK), "TLS1_SETUP_KEY_BLOCK"}, 289 {ERR_FUNC(SSL_F_WRITE_PENDING), "WRITE_PENDING"},
290{ERR_FUNC(SSL_F_WRITE_PENDING), "WRITE_PENDING"}, 290 {0, NULL}
291{0,NULL} 291};
292 };
293 292
294static ERR_STRING_DATA SSL_str_reasons[]= 293static ERR_STRING_DATA SSL_str_reasons[]= {
295 { 294 {ERR_REASON(SSL_R_APP_DATA_IN_HANDSHAKE) , "app data in handshake"},
296{ERR_REASON(SSL_R_APP_DATA_IN_HANDSHAKE) ,"app data in handshake"}, 295 {ERR_REASON(SSL_R_ATTEMPT_TO_REUSE_SESSION_IN_DIFFERENT_CONTEXT), "attempt to reuse session in different context"},
297{ERR_REASON(SSL_R_ATTEMPT_TO_REUSE_SESSION_IN_DIFFERENT_CONTEXT),"attempt to reuse session in different context"}, 296 {ERR_REASON(SSL_R_BAD_ALERT_RECORD) , "bad alert record"},
298{ERR_REASON(SSL_R_BAD_ALERT_RECORD) ,"bad alert record"}, 297 {ERR_REASON(SSL_R_BAD_AUTHENTICATION_TYPE), "bad authentication type"},
299{ERR_REASON(SSL_R_BAD_AUTHENTICATION_TYPE),"bad authentication type"}, 298 {ERR_REASON(SSL_R_BAD_CHANGE_CIPHER_SPEC), "bad change cipher spec"},
300{ERR_REASON(SSL_R_BAD_CHANGE_CIPHER_SPEC),"bad change cipher spec"}, 299 {ERR_REASON(SSL_R_BAD_CHECKSUM) , "bad checksum"},
301{ERR_REASON(SSL_R_BAD_CHECKSUM) ,"bad checksum"}, 300 {ERR_REASON(SSL_R_BAD_DATA_RETURNED_BY_CALLBACK), "bad data returned by callback"},
302{ERR_REASON(SSL_R_BAD_DATA_RETURNED_BY_CALLBACK),"bad data returned by callback"}, 301 {ERR_REASON(SSL_R_BAD_DECOMPRESSION) , "bad decompression"},
303{ERR_REASON(SSL_R_BAD_DECOMPRESSION) ,"bad decompression"}, 302 {ERR_REASON(SSL_R_BAD_DH_G_LENGTH) , "bad dh g length"},
304{ERR_REASON(SSL_R_BAD_DH_G_LENGTH) ,"bad dh g length"}, 303 {ERR_REASON(SSL_R_BAD_DH_PUB_KEY_LENGTH) , "bad dh pub key length"},
305{ERR_REASON(SSL_R_BAD_DH_PUB_KEY_LENGTH) ,"bad dh pub key length"}, 304 {ERR_REASON(SSL_R_BAD_DH_P_LENGTH) , "bad dh p length"},
306{ERR_REASON(SSL_R_BAD_DH_P_LENGTH) ,"bad dh p length"}, 305 {ERR_REASON(SSL_R_BAD_DIGEST_LENGTH) , "bad digest length"},
307{ERR_REASON(SSL_R_BAD_DIGEST_LENGTH) ,"bad digest length"}, 306 {ERR_REASON(SSL_R_BAD_DSA_SIGNATURE) , "bad dsa signature"},
308{ERR_REASON(SSL_R_BAD_DSA_SIGNATURE) ,"bad dsa signature"}, 307 {ERR_REASON(SSL_R_BAD_ECC_CERT) , "bad ecc cert"},
309{ERR_REASON(SSL_R_BAD_ECC_CERT) ,"bad ecc cert"}, 308 {ERR_REASON(SSL_R_BAD_ECDSA_SIGNATURE) , "bad ecdsa signature"},
310{ERR_REASON(SSL_R_BAD_ECDSA_SIGNATURE) ,"bad ecdsa signature"}, 309 {ERR_REASON(SSL_R_BAD_ECPOINT) , "bad ecpoint"},
311{ERR_REASON(SSL_R_BAD_ECPOINT) ,"bad ecpoint"}, 310 {ERR_REASON(SSL_R_BAD_HANDSHAKE_LENGTH) , "bad handshake length"},
312{ERR_REASON(SSL_R_BAD_HANDSHAKE_LENGTH) ,"bad handshake length"}, 311 {ERR_REASON(SSL_R_BAD_HELLO_REQUEST) , "bad hello request"},
313{ERR_REASON(SSL_R_BAD_HELLO_REQUEST) ,"bad hello request"}, 312 {ERR_REASON(SSL_R_BAD_LENGTH) , "bad length"},
314{ERR_REASON(SSL_R_BAD_LENGTH) ,"bad length"}, 313 {ERR_REASON(SSL_R_BAD_MAC_DECODE) , "bad mac decode"},
315{ERR_REASON(SSL_R_BAD_MAC_DECODE) ,"bad mac decode"}, 314 {ERR_REASON(SSL_R_BAD_MAC_LENGTH) , "bad mac length"},
316{ERR_REASON(SSL_R_BAD_MAC_LENGTH) ,"bad mac length"}, 315 {ERR_REASON(SSL_R_BAD_MESSAGE_TYPE) , "bad message type"},
317{ERR_REASON(SSL_R_BAD_MESSAGE_TYPE) ,"bad message type"}, 316 {ERR_REASON(SSL_R_BAD_PACKET_LENGTH) , "bad packet length"},
318{ERR_REASON(SSL_R_BAD_PACKET_LENGTH) ,"bad packet length"}, 317 {ERR_REASON(SSL_R_BAD_PROTOCOL_VERSION_NUMBER), "bad protocol version number"},
319{ERR_REASON(SSL_R_BAD_PROTOCOL_VERSION_NUMBER),"bad protocol version number"}, 318 {ERR_REASON(SSL_R_BAD_PSK_IDENTITY_HINT_LENGTH), "bad psk identity hint length"},
320{ERR_REASON(SSL_R_BAD_PSK_IDENTITY_HINT_LENGTH),"bad psk identity hint length"}, 319 {ERR_REASON(SSL_R_BAD_RESPONSE_ARGUMENT) , "bad response argument"},
321{ERR_REASON(SSL_R_BAD_RESPONSE_ARGUMENT) ,"bad response argument"}, 320 {ERR_REASON(SSL_R_BAD_RSA_DECRYPT) , "bad rsa decrypt"},
322{ERR_REASON(SSL_R_BAD_RSA_DECRYPT) ,"bad rsa decrypt"}, 321 {ERR_REASON(SSL_R_BAD_RSA_ENCRYPT) , "bad rsa encrypt"},
323{ERR_REASON(SSL_R_BAD_RSA_ENCRYPT) ,"bad rsa encrypt"}, 322 {ERR_REASON(SSL_R_BAD_RSA_E_LENGTH) , "bad rsa e length"},
324{ERR_REASON(SSL_R_BAD_RSA_E_LENGTH) ,"bad rsa e length"}, 323 {ERR_REASON(SSL_R_BAD_RSA_MODULUS_LENGTH), "bad rsa modulus length"},
325{ERR_REASON(SSL_R_BAD_RSA_MODULUS_LENGTH),"bad rsa modulus length"}, 324 {ERR_REASON(SSL_R_BAD_RSA_SIGNATURE) , "bad rsa signature"},
326{ERR_REASON(SSL_R_BAD_RSA_SIGNATURE) ,"bad rsa signature"}, 325 {ERR_REASON(SSL_R_BAD_SIGNATURE) , "bad signature"},
327{ERR_REASON(SSL_R_BAD_SIGNATURE) ,"bad signature"}, 326 {ERR_REASON(SSL_R_BAD_SRP_A_LENGTH) , "bad srp a length"},
328{ERR_REASON(SSL_R_BAD_SRP_A_LENGTH) ,"bad srp a length"}, 327 {ERR_REASON(SSL_R_BAD_SRP_B_LENGTH) , "bad srp b length"},
329{ERR_REASON(SSL_R_BAD_SRP_B_LENGTH) ,"bad srp b length"}, 328 {ERR_REASON(SSL_R_BAD_SRP_G_LENGTH) , "bad srp g length"},
330{ERR_REASON(SSL_R_BAD_SRP_G_LENGTH) ,"bad srp g length"}, 329 {ERR_REASON(SSL_R_BAD_SRP_N_LENGTH) , "bad srp n length"},
331{ERR_REASON(SSL_R_BAD_SRP_N_LENGTH) ,"bad srp n length"}, 330 {ERR_REASON(SSL_R_BAD_SRP_S_LENGTH) , "bad srp s length"},
332{ERR_REASON(SSL_R_BAD_SRP_S_LENGTH) ,"bad srp s length"}, 331 {ERR_REASON(SSL_R_BAD_SRTP_MKI_VALUE) , "bad srtp mki value"},
333{ERR_REASON(SSL_R_BAD_SRTP_MKI_VALUE) ,"bad srtp mki value"}, 332 {ERR_REASON(SSL_R_BAD_SRTP_PROTECTION_PROFILE_LIST), "bad srtp protection profile list"},
334{ERR_REASON(SSL_R_BAD_SRTP_PROTECTION_PROFILE_LIST),"bad srtp protection profile list"}, 333 {ERR_REASON(SSL_R_BAD_SSL_FILETYPE) , "bad ssl filetype"},
335{ERR_REASON(SSL_R_BAD_SSL_FILETYPE) ,"bad ssl filetype"}, 334 {ERR_REASON(SSL_R_BAD_SSL_SESSION_ID_LENGTH), "bad ssl session id length"},
336{ERR_REASON(SSL_R_BAD_SSL_SESSION_ID_LENGTH),"bad ssl session id length"}, 335 {ERR_REASON(SSL_R_BAD_STATE) , "bad state"},
337{ERR_REASON(SSL_R_BAD_STATE) ,"bad state"}, 336 {ERR_REASON(SSL_R_BAD_WRITE_RETRY) , "bad write retry"},
338{ERR_REASON(SSL_R_BAD_WRITE_RETRY) ,"bad write retry"}, 337 {ERR_REASON(SSL_R_BIO_NOT_SET) , "bio not set"},
339{ERR_REASON(SSL_R_BIO_NOT_SET) ,"bio not set"}, 338 {ERR_REASON(SSL_R_BLOCK_CIPHER_PAD_IS_WRONG), "block cipher pad is wrong"},
340{ERR_REASON(SSL_R_BLOCK_CIPHER_PAD_IS_WRONG),"block cipher pad is wrong"}, 339 {ERR_REASON(SSL_R_BN_LIB) , "bn lib"},
341{ERR_REASON(SSL_R_BN_LIB) ,"bn lib"}, 340 {ERR_REASON(SSL_R_CA_DN_LENGTH_MISMATCH) , "ca dn length mismatch"},
342{ERR_REASON(SSL_R_CA_DN_LENGTH_MISMATCH) ,"ca dn length mismatch"}, 341 {ERR_REASON(SSL_R_CA_DN_TOO_LONG) , "ca dn too long"},
343{ERR_REASON(SSL_R_CA_DN_TOO_LONG) ,"ca dn too long"}, 342 {ERR_REASON(SSL_R_CCS_RECEIVED_EARLY) , "ccs received early"},
344{ERR_REASON(SSL_R_CCS_RECEIVED_EARLY) ,"ccs received early"}, 343 {ERR_REASON(SSL_R_CERTIFICATE_VERIFY_FAILED), "certificate verify failed"},
345{ERR_REASON(SSL_R_CERTIFICATE_VERIFY_FAILED),"certificate verify failed"}, 344 {ERR_REASON(SSL_R_CERT_LENGTH_MISMATCH) , "cert length mismatch"},
346{ERR_REASON(SSL_R_CERT_LENGTH_MISMATCH) ,"cert length mismatch"}, 345 {ERR_REASON(SSL_R_CHALLENGE_IS_DIFFERENT), "challenge is different"},
347{ERR_REASON(SSL_R_CHALLENGE_IS_DIFFERENT),"challenge is different"}, 346 {ERR_REASON(SSL_R_CIPHER_CODE_WRONG_LENGTH), "cipher code wrong length"},
348{ERR_REASON(SSL_R_CIPHER_CODE_WRONG_LENGTH),"cipher code wrong length"}, 347 {ERR_REASON(SSL_R_CIPHER_OR_HASH_UNAVAILABLE), "cipher or hash unavailable"},
349{ERR_REASON(SSL_R_CIPHER_OR_HASH_UNAVAILABLE),"cipher or hash unavailable"}, 348 {ERR_REASON(SSL_R_CIPHER_TABLE_SRC_ERROR), "cipher table src error"},
350{ERR_REASON(SSL_R_CIPHER_TABLE_SRC_ERROR),"cipher table src error"}, 349 {ERR_REASON(SSL_R_CLIENTHELLO_TLSEXT) , "clienthello tlsext"},
351{ERR_REASON(SSL_R_CLIENTHELLO_TLSEXT) ,"clienthello tlsext"}, 350 {ERR_REASON(SSL_R_COMPRESSED_LENGTH_TOO_LONG), "compressed length too long"},
352{ERR_REASON(SSL_R_COMPRESSED_LENGTH_TOO_LONG),"compressed length too long"}, 351 {ERR_REASON(SSL_R_COMPRESSION_DISABLED) , "compression disabled"},
353{ERR_REASON(SSL_R_COMPRESSION_DISABLED) ,"compression disabled"}, 352 {ERR_REASON(SSL_R_COMPRESSION_FAILURE) , "compression failure"},
354{ERR_REASON(SSL_R_COMPRESSION_FAILURE) ,"compression failure"}, 353 {ERR_REASON(SSL_R_COMPRESSION_ID_NOT_WITHIN_PRIVATE_RANGE), "compression id not within private range"},
355{ERR_REASON(SSL_R_COMPRESSION_ID_NOT_WITHIN_PRIVATE_RANGE),"compression id not within private range"}, 354 {ERR_REASON(SSL_R_COMPRESSION_LIBRARY_ERROR), "compression library error"},
356{ERR_REASON(SSL_R_COMPRESSION_LIBRARY_ERROR),"compression library error"}, 355 {ERR_REASON(SSL_R_CONNECTION_ID_IS_DIFFERENT), "connection id is different"},
357{ERR_REASON(SSL_R_CONNECTION_ID_IS_DIFFERENT),"connection id is different"}, 356 {ERR_REASON(SSL_R_CONNECTION_TYPE_NOT_SET), "connection type not set"},
358{ERR_REASON(SSL_R_CONNECTION_TYPE_NOT_SET),"connection type not set"}, 357 {ERR_REASON(SSL_R_COOKIE_MISMATCH) , "cookie mismatch"},
359{ERR_REASON(SSL_R_COOKIE_MISMATCH) ,"cookie mismatch"}, 358 {ERR_REASON(SSL_R_DATA_BETWEEN_CCS_AND_FINISHED), "data between ccs and finished"},
360{ERR_REASON(SSL_R_DATA_BETWEEN_CCS_AND_FINISHED),"data between ccs and finished"}, 359 {ERR_REASON(SSL_R_DATA_LENGTH_TOO_LONG) , "data length too long"},
361{ERR_REASON(SSL_R_DATA_LENGTH_TOO_LONG) ,"data length too long"}, 360 {ERR_REASON(SSL_R_DECRYPTION_FAILED) , "decryption failed"},
362{ERR_REASON(SSL_R_DECRYPTION_FAILED) ,"decryption failed"}, 361 {ERR_REASON(SSL_R_DECRYPTION_FAILED_OR_BAD_RECORD_MAC), "decryption failed or bad record mac"},
363{ERR_REASON(SSL_R_DECRYPTION_FAILED_OR_BAD_RECORD_MAC),"decryption failed or bad record mac"}, 362 {ERR_REASON(SSL_R_DH_PUBLIC_VALUE_LENGTH_IS_WRONG), "dh public value length is wrong"},
364{ERR_REASON(SSL_R_DH_PUBLIC_VALUE_LENGTH_IS_WRONG),"dh public value length is wrong"}, 363 {ERR_REASON(SSL_R_DIGEST_CHECK_FAILED) , "digest check failed"},
365{ERR_REASON(SSL_R_DIGEST_CHECK_FAILED) ,"digest check failed"}, 364 {ERR_REASON(SSL_R_DTLS_MESSAGE_TOO_BIG) , "dtls message too big"},
366{ERR_REASON(SSL_R_DTLS_MESSAGE_TOO_BIG) ,"dtls message too big"}, 365 {ERR_REASON(SSL_R_DUPLICATE_COMPRESSION_ID), "duplicate compression id"},
367{ERR_REASON(SSL_R_DUPLICATE_COMPRESSION_ID),"duplicate compression id"}, 366 {ERR_REASON(SSL_R_ECC_CERT_NOT_FOR_KEY_AGREEMENT), "ecc cert not for key agreement"},
368{ERR_REASON(SSL_R_ECC_CERT_NOT_FOR_KEY_AGREEMENT),"ecc cert not for key agreement"}, 367 {ERR_REASON(SSL_R_ECC_CERT_NOT_FOR_SIGNING), "ecc cert not for signing"},
369{ERR_REASON(SSL_R_ECC_CERT_NOT_FOR_SIGNING),"ecc cert not for signing"}, 368 {ERR_REASON(SSL_R_ECC_CERT_SHOULD_HAVE_RSA_SIGNATURE), "ecc cert should have rsa signature"},
370{ERR_REASON(SSL_R_ECC_CERT_SHOULD_HAVE_RSA_SIGNATURE),"ecc cert should have rsa signature"}, 369 {ERR_REASON(SSL_R_ECC_CERT_SHOULD_HAVE_SHA1_SIGNATURE), "ecc cert should have sha1 signature"},
371{ERR_REASON(SSL_R_ECC_CERT_SHOULD_HAVE_SHA1_SIGNATURE),"ecc cert should have sha1 signature"}, 370 {ERR_REASON(SSL_R_ECGROUP_TOO_LARGE_FOR_CIPHER), "ecgroup too large for cipher"},
372{ERR_REASON(SSL_R_ECGROUP_TOO_LARGE_FOR_CIPHER),"ecgroup too large for cipher"}, 371 {ERR_REASON(SSL_R_EMPTY_SRTP_PROTECTION_PROFILE_LIST), "empty srtp protection profile list"},
373{ERR_REASON(SSL_R_EMPTY_SRTP_PROTECTION_PROFILE_LIST),"empty srtp protection profile list"}, 372 {ERR_REASON(SSL_R_ENCRYPTED_LENGTH_TOO_LONG), "encrypted length too long"},
374{ERR_REASON(SSL_R_ENCRYPTED_LENGTH_TOO_LONG),"encrypted length too long"}, 373 {ERR_REASON(SSL_R_ERROR_GENERATING_TMP_RSA_KEY), "error generating tmp rsa key"},
375{ERR_REASON(SSL_R_ERROR_GENERATING_TMP_RSA_KEY),"error generating tmp rsa key"}, 374 {ERR_REASON(SSL_R_ERROR_IN_RECEIVED_CIPHER_LIST), "error in received cipher list"},
376{ERR_REASON(SSL_R_ERROR_IN_RECEIVED_CIPHER_LIST),"error in received cipher list"}, 375 {ERR_REASON(SSL_R_EXCESSIVE_MESSAGE_SIZE), "excessive message size"},
377{ERR_REASON(SSL_R_EXCESSIVE_MESSAGE_SIZE),"excessive message size"}, 376 {ERR_REASON(SSL_R_EXTRA_DATA_IN_MESSAGE) , "extra data in message"},
378{ERR_REASON(SSL_R_EXTRA_DATA_IN_MESSAGE) ,"extra data in message"}, 377 {ERR_REASON(SSL_R_GOT_A_FIN_BEFORE_A_CCS), "got a fin before a ccs"},
379{ERR_REASON(SSL_R_GOT_A_FIN_BEFORE_A_CCS),"got a fin before a ccs"}, 378 {ERR_REASON(SSL_R_GOT_NEXT_PROTO_BEFORE_A_CCS), "got next proto before a ccs"},
380{ERR_REASON(SSL_R_GOT_NEXT_PROTO_BEFORE_A_CCS),"got next proto before a ccs"}, 379 {ERR_REASON(SSL_R_GOT_NEXT_PROTO_WITHOUT_EXTENSION), "got next proto without seeing extension"},
381{ERR_REASON(SSL_R_GOT_NEXT_PROTO_WITHOUT_EXTENSION),"got next proto without seeing extension"}, 380 {ERR_REASON(SSL_R_HTTPS_PROXY_REQUEST) , "https proxy request"},
382{ERR_REASON(SSL_R_HTTPS_PROXY_REQUEST) ,"https proxy request"}, 381 {ERR_REASON(SSL_R_HTTP_REQUEST) , "http request"},
383{ERR_REASON(SSL_R_HTTP_REQUEST) ,"http request"}, 382 {ERR_REASON(SSL_R_ILLEGAL_PADDING) , "illegal padding"},
384{ERR_REASON(SSL_R_ILLEGAL_PADDING) ,"illegal padding"}, 383 {ERR_REASON(SSL_R_INCONSISTENT_COMPRESSION), "inconsistent compression"},
385{ERR_REASON(SSL_R_INCONSISTENT_COMPRESSION),"inconsistent compression"}, 384 {ERR_REASON(SSL_R_INVALID_CHALLENGE_LENGTH), "invalid challenge length"},
386{ERR_REASON(SSL_R_INVALID_CHALLENGE_LENGTH),"invalid challenge length"}, 385 {ERR_REASON(SSL_R_INVALID_COMMAND) , "invalid command"},
387{ERR_REASON(SSL_R_INVALID_COMMAND) ,"invalid command"}, 386 {ERR_REASON(SSL_R_INVALID_COMPRESSION_ALGORITHM), "invalid compression algorithm"},
388{ERR_REASON(SSL_R_INVALID_COMPRESSION_ALGORITHM),"invalid compression algorithm"}, 387 {ERR_REASON(SSL_R_INVALID_PURPOSE) , "invalid purpose"},
389{ERR_REASON(SSL_R_INVALID_PURPOSE) ,"invalid purpose"}, 388 {ERR_REASON(SSL_R_INVALID_SRP_USERNAME) , "invalid srp username"},
390{ERR_REASON(SSL_R_INVALID_SRP_USERNAME) ,"invalid srp username"}, 389 {ERR_REASON(SSL_R_INVALID_STATUS_RESPONSE), "invalid status response"},
391{ERR_REASON(SSL_R_INVALID_STATUS_RESPONSE),"invalid status response"}, 390 {ERR_REASON(SSL_R_INVALID_TICKET_KEYS_LENGTH), "invalid ticket keys length"},
392{ERR_REASON(SSL_R_INVALID_TICKET_KEYS_LENGTH),"invalid ticket keys length"}, 391 {ERR_REASON(SSL_R_INVALID_TRUST) , "invalid trust"},
393{ERR_REASON(SSL_R_INVALID_TRUST) ,"invalid trust"}, 392 {ERR_REASON(SSL_R_KEY_ARG_TOO_LONG) , "key arg too long"},
394{ERR_REASON(SSL_R_KEY_ARG_TOO_LONG) ,"key arg too long"}, 393 {ERR_REASON(SSL_R_KRB5) , "krb5"},
395{ERR_REASON(SSL_R_KRB5) ,"krb5"}, 394 {ERR_REASON(SSL_R_KRB5_C_CC_PRINC) , "krb5 client cc principal (no tkt?)"},
396{ERR_REASON(SSL_R_KRB5_C_CC_PRINC) ,"krb5 client cc principal (no tkt?)"}, 395 {ERR_REASON(SSL_R_KRB5_C_GET_CRED) , "krb5 client get cred"},
397{ERR_REASON(SSL_R_KRB5_C_GET_CRED) ,"krb5 client get cred"}, 396 {ERR_REASON(SSL_R_KRB5_C_INIT) , "krb5 client init"},
398{ERR_REASON(SSL_R_KRB5_C_INIT) ,"krb5 client init"}, 397 {ERR_REASON(SSL_R_KRB5_C_MK_REQ) , "krb5 client mk_req (expired tkt?)"},
399{ERR_REASON(SSL_R_KRB5_C_MK_REQ) ,"krb5 client mk_req (expired tkt?)"}, 398 {ERR_REASON(SSL_R_KRB5_S_BAD_TICKET) , "krb5 server bad ticket"},
400{ERR_REASON(SSL_R_KRB5_S_BAD_TICKET) ,"krb5 server bad ticket"}, 399 {ERR_REASON(SSL_R_KRB5_S_INIT) , "krb5 server init"},
401{ERR_REASON(SSL_R_KRB5_S_INIT) ,"krb5 server init"}, 400 {ERR_REASON(SSL_R_KRB5_S_RD_REQ) , "krb5 server rd_req (keytab perms?)"},
402{ERR_REASON(SSL_R_KRB5_S_RD_REQ) ,"krb5 server rd_req (keytab perms?)"}, 401 {ERR_REASON(SSL_R_KRB5_S_TKT_EXPIRED) , "krb5 server tkt expired"},
403{ERR_REASON(SSL_R_KRB5_S_TKT_EXPIRED) ,"krb5 server tkt expired"}, 402 {ERR_REASON(SSL_R_KRB5_S_TKT_NYV) , "krb5 server tkt not yet valid"},
404{ERR_REASON(SSL_R_KRB5_S_TKT_NYV) ,"krb5 server tkt not yet valid"}, 403 {ERR_REASON(SSL_R_KRB5_S_TKT_SKEW) , "krb5 server tkt skew"},
405{ERR_REASON(SSL_R_KRB5_S_TKT_SKEW) ,"krb5 server tkt skew"}, 404 {ERR_REASON(SSL_R_LENGTH_MISMATCH) , "length mismatch"},
406{ERR_REASON(SSL_R_LENGTH_MISMATCH) ,"length mismatch"}, 405 {ERR_REASON(SSL_R_LENGTH_TOO_SHORT) , "length too short"},
407{ERR_REASON(SSL_R_LENGTH_TOO_SHORT) ,"length too short"}, 406 {ERR_REASON(SSL_R_LIBRARY_BUG) , "library bug"},
408{ERR_REASON(SSL_R_LIBRARY_BUG) ,"library bug"}, 407 {ERR_REASON(SSL_R_LIBRARY_HAS_NO_CIPHERS), "library has no ciphers"},
409{ERR_REASON(SSL_R_LIBRARY_HAS_NO_CIPHERS),"library has no ciphers"}, 408 {ERR_REASON(SSL_R_MESSAGE_TOO_LONG) , "message too long"},
410{ERR_REASON(SSL_R_MESSAGE_TOO_LONG) ,"message too long"}, 409 {ERR_REASON(SSL_R_MISSING_DH_DSA_CERT) , "missing dh dsa cert"},
411{ERR_REASON(SSL_R_MISSING_DH_DSA_CERT) ,"missing dh dsa cert"}, 410 {ERR_REASON(SSL_R_MISSING_DH_KEY) , "missing dh key"},
412{ERR_REASON(SSL_R_MISSING_DH_KEY) ,"missing dh key"}, 411 {ERR_REASON(SSL_R_MISSING_DH_RSA_CERT) , "missing dh rsa cert"},
413{ERR_REASON(SSL_R_MISSING_DH_RSA_CERT) ,"missing dh rsa cert"}, 412 {ERR_REASON(SSL_R_MISSING_DSA_SIGNING_CERT), "missing dsa signing cert"},
414{ERR_REASON(SSL_R_MISSING_DSA_SIGNING_CERT),"missing dsa signing cert"}, 413 {ERR_REASON(SSL_R_MISSING_EXPORT_TMP_DH_KEY), "missing export tmp dh key"},
415{ERR_REASON(SSL_R_MISSING_EXPORT_TMP_DH_KEY),"missing export tmp dh key"}, 414 {ERR_REASON(SSL_R_MISSING_EXPORT_TMP_RSA_KEY), "missing export tmp rsa key"},
416{ERR_REASON(SSL_R_MISSING_EXPORT_TMP_RSA_KEY),"missing export tmp rsa key"}, 415 {ERR_REASON(SSL_R_MISSING_RSA_CERTIFICATE), "missing rsa certificate"},
417{ERR_REASON(SSL_R_MISSING_RSA_CERTIFICATE),"missing rsa certificate"}, 416 {ERR_REASON(SSL_R_MISSING_RSA_ENCRYPTING_CERT), "missing rsa encrypting cert"},
418{ERR_REASON(SSL_R_MISSING_RSA_ENCRYPTING_CERT),"missing rsa encrypting cert"}, 417 {ERR_REASON(SSL_R_MISSING_RSA_SIGNING_CERT), "missing rsa signing cert"},
419{ERR_REASON(SSL_R_MISSING_RSA_SIGNING_CERT),"missing rsa signing cert"}, 418 {ERR_REASON(SSL_R_MISSING_SRP_PARAM) , "can't find SRP server param"},
420{ERR_REASON(SSL_R_MISSING_SRP_PARAM) ,"can't find SRP server param"}, 419 {ERR_REASON(SSL_R_MISSING_TMP_DH_KEY) , "missing tmp dh key"},
421{ERR_REASON(SSL_R_MISSING_TMP_DH_KEY) ,"missing tmp dh key"}, 420 {ERR_REASON(SSL_R_MISSING_TMP_ECDH_KEY) , "missing tmp ecdh key"},
422{ERR_REASON(SSL_R_MISSING_TMP_ECDH_KEY) ,"missing tmp ecdh key"}, 421 {ERR_REASON(SSL_R_MISSING_TMP_RSA_KEY) , "missing tmp rsa key"},
423{ERR_REASON(SSL_R_MISSING_TMP_RSA_KEY) ,"missing tmp rsa key"}, 422 {ERR_REASON(SSL_R_MISSING_TMP_RSA_PKEY) , "missing tmp rsa pkey"},
424{ERR_REASON(SSL_R_MISSING_TMP_RSA_PKEY) ,"missing tmp rsa pkey"}, 423 {ERR_REASON(SSL_R_MISSING_VERIFY_MESSAGE), "missing verify message"},
425{ERR_REASON(SSL_R_MISSING_VERIFY_MESSAGE),"missing verify message"}, 424 {ERR_REASON(SSL_R_MULTIPLE_SGC_RESTARTS) , "multiple sgc restarts"},
426{ERR_REASON(SSL_R_MULTIPLE_SGC_RESTARTS) ,"multiple sgc restarts"}, 425 {ERR_REASON(SSL_R_NON_SSLV2_INITIAL_PACKET), "non sslv2 initial packet"},
427{ERR_REASON(SSL_R_NON_SSLV2_INITIAL_PACKET),"non sslv2 initial packet"}, 426 {ERR_REASON(SSL_R_NO_CERTIFICATES_RETURNED), "no certificates returned"},
428{ERR_REASON(SSL_R_NO_CERTIFICATES_RETURNED),"no certificates returned"}, 427 {ERR_REASON(SSL_R_NO_CERTIFICATE_ASSIGNED), "no certificate assigned"},
429{ERR_REASON(SSL_R_NO_CERTIFICATE_ASSIGNED),"no certificate assigned"}, 428 {ERR_REASON(SSL_R_NO_CERTIFICATE_RETURNED), "no certificate returned"},
430{ERR_REASON(SSL_R_NO_CERTIFICATE_RETURNED),"no certificate returned"}, 429 {ERR_REASON(SSL_R_NO_CERTIFICATE_SET) , "no certificate set"},
431{ERR_REASON(SSL_R_NO_CERTIFICATE_SET) ,"no certificate set"}, 430 {ERR_REASON(SSL_R_NO_CERTIFICATE_SPECIFIED), "no certificate specified"},
432{ERR_REASON(SSL_R_NO_CERTIFICATE_SPECIFIED),"no certificate specified"}, 431 {ERR_REASON(SSL_R_NO_CIPHERS_AVAILABLE) , "no ciphers available"},
433{ERR_REASON(SSL_R_NO_CIPHERS_AVAILABLE) ,"no ciphers available"}, 432 {ERR_REASON(SSL_R_NO_CIPHERS_PASSED) , "no ciphers passed"},
434{ERR_REASON(SSL_R_NO_CIPHERS_PASSED) ,"no ciphers passed"}, 433 {ERR_REASON(SSL_R_NO_CIPHERS_SPECIFIED) , "no ciphers specified"},
435{ERR_REASON(SSL_R_NO_CIPHERS_SPECIFIED) ,"no ciphers specified"}, 434 {ERR_REASON(SSL_R_NO_CIPHER_LIST) , "no cipher list"},
436{ERR_REASON(SSL_R_NO_CIPHER_LIST) ,"no cipher list"}, 435 {ERR_REASON(SSL_R_NO_CIPHER_MATCH) , "no cipher match"},
437{ERR_REASON(SSL_R_NO_CIPHER_MATCH) ,"no cipher match"}, 436 {ERR_REASON(SSL_R_NO_CLIENT_CERT_METHOD) , "no client cert method"},
438{ERR_REASON(SSL_R_NO_CLIENT_CERT_METHOD) ,"no client cert method"}, 437 {ERR_REASON(SSL_R_NO_CLIENT_CERT_RECEIVED), "no client cert received"},
439{ERR_REASON(SSL_R_NO_CLIENT_CERT_RECEIVED),"no client cert received"}, 438 {ERR_REASON(SSL_R_NO_COMPRESSION_SPECIFIED), "no compression specified"},
440{ERR_REASON(SSL_R_NO_COMPRESSION_SPECIFIED),"no compression specified"}, 439 {ERR_REASON(SSL_R_NO_GOST_CERTIFICATE_SENT_BY_PEER), "Peer haven't sent GOST certificate, required for selected ciphersuite"},
441{ERR_REASON(SSL_R_NO_GOST_CERTIFICATE_SENT_BY_PEER),"Peer haven't sent GOST certificate, required for selected ciphersuite"}, 440 {ERR_REASON(SSL_R_NO_METHOD_SPECIFIED) , "no method specified"},
442{ERR_REASON(SSL_R_NO_METHOD_SPECIFIED) ,"no method specified"}, 441 {ERR_REASON(SSL_R_NO_PRIVATEKEY) , "no privatekey"},
443{ERR_REASON(SSL_R_NO_PRIVATEKEY) ,"no privatekey"}, 442 {ERR_REASON(SSL_R_NO_PRIVATE_KEY_ASSIGNED), "no private key assigned"},
444{ERR_REASON(SSL_R_NO_PRIVATE_KEY_ASSIGNED),"no private key assigned"}, 443 {ERR_REASON(SSL_R_NO_PROTOCOLS_AVAILABLE), "no protocols available"},
445{ERR_REASON(SSL_R_NO_PROTOCOLS_AVAILABLE),"no protocols available"}, 444 {ERR_REASON(SSL_R_NO_PUBLICKEY) , "no publickey"},
446{ERR_REASON(SSL_R_NO_PUBLICKEY) ,"no publickey"}, 445 {ERR_REASON(SSL_R_NO_RENEGOTIATION) , "no renegotiation"},
447{ERR_REASON(SSL_R_NO_RENEGOTIATION) ,"no renegotiation"}, 446 {ERR_REASON(SSL_R_NO_REQUIRED_DIGEST) , "digest requred for handshake isn't computed"},
448{ERR_REASON(SSL_R_NO_REQUIRED_DIGEST) ,"digest requred for handshake isn't computed"}, 447 {ERR_REASON(SSL_R_NO_SHARED_CIPHER) , "no shared cipher"},
449{ERR_REASON(SSL_R_NO_SHARED_CIPHER) ,"no shared cipher"}, 448 {ERR_REASON(SSL_R_NO_SRTP_PROFILES) , "no srtp profiles"},
450{ERR_REASON(SSL_R_NO_SRTP_PROFILES) ,"no srtp profiles"}, 449 {ERR_REASON(SSL_R_NO_VERIFY_CALLBACK) , "no verify callback"},
451{ERR_REASON(SSL_R_NO_VERIFY_CALLBACK) ,"no verify callback"}, 450 {ERR_REASON(SSL_R_NULL_SSL_CTX) , "null ssl ctx"},
452{ERR_REASON(SSL_R_NULL_SSL_CTX) ,"null ssl ctx"}, 451 {ERR_REASON(SSL_R_NULL_SSL_METHOD_PASSED), "null ssl method passed"},
453{ERR_REASON(SSL_R_NULL_SSL_METHOD_PASSED),"null ssl method passed"}, 452 {ERR_REASON(SSL_R_OLD_SESSION_CIPHER_NOT_RETURNED), "old session cipher not returned"},
454{ERR_REASON(SSL_R_OLD_SESSION_CIPHER_NOT_RETURNED),"old session cipher not returned"}, 453 {ERR_REASON(SSL_R_OLD_SESSION_COMPRESSION_ALGORITHM_NOT_RETURNED), "old session compression algorithm not returned"},
455{ERR_REASON(SSL_R_OLD_SESSION_COMPRESSION_ALGORITHM_NOT_RETURNED),"old session compression algorithm not returned"}, 454 {ERR_REASON(SSL_R_ONLY_TLS_ALLOWED_IN_FIPS_MODE), "only tls allowed in fips mode"},
456{ERR_REASON(SSL_R_ONLY_TLS_ALLOWED_IN_FIPS_MODE),"only tls allowed in fips mode"}, 455 {ERR_REASON(SSL_R_OPAQUE_PRF_INPUT_TOO_LONG), "opaque PRF input too long"},
457{ERR_REASON(SSL_R_OPAQUE_PRF_INPUT_TOO_LONG),"opaque PRF input too long"}, 456 {ERR_REASON(SSL_R_PACKET_LENGTH_TOO_LONG), "packet length too long"},
458{ERR_REASON(SSL_R_PACKET_LENGTH_TOO_LONG),"packet length too long"}, 457 {ERR_REASON(SSL_R_PARSE_TLSEXT) , "parse tlsext"},
459{ERR_REASON(SSL_R_PARSE_TLSEXT) ,"parse tlsext"}, 458 {ERR_REASON(SSL_R_PATH_TOO_LONG) , "path too long"},
460{ERR_REASON(SSL_R_PATH_TOO_LONG) ,"path too long"}, 459 {ERR_REASON(SSL_R_PEER_DID_NOT_RETURN_A_CERTIFICATE), "peer did not return a certificate"},
461{ERR_REASON(SSL_R_PEER_DID_NOT_RETURN_A_CERTIFICATE),"peer did not return a certificate"}, 460 {ERR_REASON(SSL_R_PEER_ERROR) , "peer error"},
462{ERR_REASON(SSL_R_PEER_ERROR) ,"peer error"}, 461 {ERR_REASON(SSL_R_PEER_ERROR_CERTIFICATE), "peer error certificate"},
463{ERR_REASON(SSL_R_PEER_ERROR_CERTIFICATE),"peer error certificate"}, 462 {ERR_REASON(SSL_R_PEER_ERROR_NO_CERTIFICATE), "peer error no certificate"},
464{ERR_REASON(SSL_R_PEER_ERROR_NO_CERTIFICATE),"peer error no certificate"}, 463 {ERR_REASON(SSL_R_PEER_ERROR_NO_CIPHER) , "peer error no cipher"},
465{ERR_REASON(SSL_R_PEER_ERROR_NO_CIPHER) ,"peer error no cipher"}, 464 {ERR_REASON(SSL_R_PEER_ERROR_UNSUPPORTED_CERTIFICATE_TYPE), "peer error unsupported certificate type"},
466{ERR_REASON(SSL_R_PEER_ERROR_UNSUPPORTED_CERTIFICATE_TYPE),"peer error unsupported certificate type"}, 465 {ERR_REASON(SSL_R_PRE_MAC_LENGTH_TOO_LONG), "pre mac length too long"},
467{ERR_REASON(SSL_R_PRE_MAC_LENGTH_TOO_LONG),"pre mac length too long"}, 466 {ERR_REASON(SSL_R_PROBLEMS_MAPPING_CIPHER_FUNCTIONS), "problems mapping cipher functions"},
468{ERR_REASON(SSL_R_PROBLEMS_MAPPING_CIPHER_FUNCTIONS),"problems mapping cipher functions"}, 467 {ERR_REASON(SSL_R_PROTOCOL_IS_SHUTDOWN) , "protocol is shutdown"},
469{ERR_REASON(SSL_R_PROTOCOL_IS_SHUTDOWN) ,"protocol is shutdown"}, 468 {ERR_REASON(SSL_R_PSK_IDENTITY_NOT_FOUND), "psk identity not found"},
470{ERR_REASON(SSL_R_PSK_IDENTITY_NOT_FOUND),"psk identity not found"}, 469 {ERR_REASON(SSL_R_PSK_NO_CLIENT_CB) , "psk no client cb"},
471{ERR_REASON(SSL_R_PSK_NO_CLIENT_CB) ,"psk no client cb"}, 470 {ERR_REASON(SSL_R_PSK_NO_SERVER_CB) , "psk no server cb"},
472{ERR_REASON(SSL_R_PSK_NO_SERVER_CB) ,"psk no server cb"}, 471 {ERR_REASON(SSL_R_PUBLIC_KEY_ENCRYPT_ERROR), "public key encrypt error"},
473{ERR_REASON(SSL_R_PUBLIC_KEY_ENCRYPT_ERROR),"public key encrypt error"}, 472 {ERR_REASON(SSL_R_PUBLIC_KEY_IS_NOT_RSA) , "public key is not rsa"},
474{ERR_REASON(SSL_R_PUBLIC_KEY_IS_NOT_RSA) ,"public key is not rsa"}, 473 {ERR_REASON(SSL_R_PUBLIC_KEY_NOT_RSA) , "public key not rsa"},
475{ERR_REASON(SSL_R_PUBLIC_KEY_NOT_RSA) ,"public key not rsa"}, 474 {ERR_REASON(SSL_R_READ_BIO_NOT_SET) , "read bio not set"},
476{ERR_REASON(SSL_R_READ_BIO_NOT_SET) ,"read bio not set"}, 475 {ERR_REASON(SSL_R_READ_TIMEOUT_EXPIRED) , "read timeout expired"},
477{ERR_REASON(SSL_R_READ_TIMEOUT_EXPIRED) ,"read timeout expired"}, 476 {ERR_REASON(SSL_R_READ_WRONG_PACKET_TYPE), "read wrong packet type"},
478{ERR_REASON(SSL_R_READ_WRONG_PACKET_TYPE),"read wrong packet type"}, 477 {ERR_REASON(SSL_R_RECORD_LENGTH_MISMATCH), "record length mismatch"},
479{ERR_REASON(SSL_R_RECORD_LENGTH_MISMATCH),"record length mismatch"}, 478 {ERR_REASON(SSL_R_RECORD_TOO_LARGE) , "record too large"},
480{ERR_REASON(SSL_R_RECORD_TOO_LARGE) ,"record too large"}, 479 {ERR_REASON(SSL_R_RECORD_TOO_SMALL) , "record too small"},
481{ERR_REASON(SSL_R_RECORD_TOO_SMALL) ,"record too small"}, 480 {ERR_REASON(SSL_R_RENEGOTIATE_EXT_TOO_LONG), "renegotiate ext too long"},
482{ERR_REASON(SSL_R_RENEGOTIATE_EXT_TOO_LONG),"renegotiate ext too long"}, 481 {ERR_REASON(SSL_R_RENEGOTIATION_ENCODING_ERR), "renegotiation encoding err"},
483{ERR_REASON(SSL_R_RENEGOTIATION_ENCODING_ERR),"renegotiation encoding err"}, 482 {ERR_REASON(SSL_R_RENEGOTIATION_MISMATCH), "renegotiation mismatch"},
484{ERR_REASON(SSL_R_RENEGOTIATION_MISMATCH),"renegotiation mismatch"}, 483 {ERR_REASON(SSL_R_REQUIRED_CIPHER_MISSING), "required cipher missing"},
485{ERR_REASON(SSL_R_REQUIRED_CIPHER_MISSING),"required cipher missing"}, 484 {ERR_REASON(SSL_R_REQUIRED_COMPRESSSION_ALGORITHM_MISSING), "required compresssion algorithm missing"},
486{ERR_REASON(SSL_R_REQUIRED_COMPRESSSION_ALGORITHM_MISSING),"required compresssion algorithm missing"}, 485 {ERR_REASON(SSL_R_REUSE_CERT_LENGTH_NOT_ZERO), "reuse cert length not zero"},
487{ERR_REASON(SSL_R_REUSE_CERT_LENGTH_NOT_ZERO),"reuse cert length not zero"}, 486 {ERR_REASON(SSL_R_REUSE_CERT_TYPE_NOT_ZERO), "reuse cert type not zero"},
488{ERR_REASON(SSL_R_REUSE_CERT_TYPE_NOT_ZERO),"reuse cert type not zero"}, 487 {ERR_REASON(SSL_R_REUSE_CIPHER_LIST_NOT_ZERO), "reuse cipher list not zero"},
489{ERR_REASON(SSL_R_REUSE_CIPHER_LIST_NOT_ZERO),"reuse cipher list not zero"}, 488 {ERR_REASON(SSL_R_SCSV_RECEIVED_WHEN_RENEGOTIATING), "scsv received when renegotiating"},
490{ERR_REASON(SSL_R_SCSV_RECEIVED_WHEN_RENEGOTIATING),"scsv received when renegotiating"}, 489 {ERR_REASON(SSL_R_SERVERHELLO_TLSEXT) , "serverhello tlsext"},
491{ERR_REASON(SSL_R_SERVERHELLO_TLSEXT) ,"serverhello tlsext"}, 490 {ERR_REASON(SSL_R_SESSION_ID_CONTEXT_UNINITIALIZED), "session id context uninitialized"},
492{ERR_REASON(SSL_R_SESSION_ID_CONTEXT_UNINITIALIZED),"session id context uninitialized"}, 491 {ERR_REASON(SSL_R_SHORT_READ) , "short read"},
493{ERR_REASON(SSL_R_SHORT_READ) ,"short read"}, 492 {ERR_REASON(SSL_R_SIGNATURE_ALGORITHMS_ERROR), "signature algorithms error"},
494{ERR_REASON(SSL_R_SIGNATURE_ALGORITHMS_ERROR),"signature algorithms error"}, 493 {ERR_REASON(SSL_R_SIGNATURE_FOR_NON_SIGNING_CERTIFICATE), "signature for non signing certificate"},
495{ERR_REASON(SSL_R_SIGNATURE_FOR_NON_SIGNING_CERTIFICATE),"signature for non signing certificate"}, 494 {ERR_REASON(SSL_R_SRP_A_CALC) , "error with the srp params"},
496{ERR_REASON(SSL_R_SRP_A_CALC) ,"error with the srp params"}, 495 {ERR_REASON(SSL_R_SRTP_COULD_NOT_ALLOCATE_PROFILES), "srtp could not allocate profiles"},
497{ERR_REASON(SSL_R_SRTP_COULD_NOT_ALLOCATE_PROFILES),"srtp could not allocate profiles"}, 496 {ERR_REASON(SSL_R_SRTP_PROTECTION_PROFILE_LIST_TOO_LONG), "srtp protection profile list too long"},
498{ERR_REASON(SSL_R_SRTP_PROTECTION_PROFILE_LIST_TOO_LONG),"srtp protection profile list too long"}, 497 {ERR_REASON(SSL_R_SRTP_UNKNOWN_PROTECTION_PROFILE), "srtp unknown protection profile"},
499{ERR_REASON(SSL_R_SRTP_UNKNOWN_PROTECTION_PROFILE),"srtp unknown protection profile"}, 498 {ERR_REASON(SSL_R_SSL23_DOING_SESSION_ID_REUSE), "ssl23 doing session id reuse"},
500{ERR_REASON(SSL_R_SSL23_DOING_SESSION_ID_REUSE),"ssl23 doing session id reuse"}, 499 {ERR_REASON(SSL_R_SSL2_CONNECTION_ID_TOO_LONG), "ssl2 connection id too long"},
501{ERR_REASON(SSL_R_SSL2_CONNECTION_ID_TOO_LONG),"ssl2 connection id too long"}, 500 {ERR_REASON(SSL_R_SSL3_EXT_INVALID_ECPOINTFORMAT), "ssl3 ext invalid ecpointformat"},
502{ERR_REASON(SSL_R_SSL3_EXT_INVALID_ECPOINTFORMAT),"ssl3 ext invalid ecpointformat"}, 501 {ERR_REASON(SSL_R_SSL3_EXT_INVALID_SERVERNAME), "ssl3 ext invalid servername"},
503{ERR_REASON(SSL_R_SSL3_EXT_INVALID_SERVERNAME),"ssl3 ext invalid servername"}, 502 {ERR_REASON(SSL_R_SSL3_EXT_INVALID_SERVERNAME_TYPE), "ssl3 ext invalid servername type"},
504{ERR_REASON(SSL_R_SSL3_EXT_INVALID_SERVERNAME_TYPE),"ssl3 ext invalid servername type"}, 503 {ERR_REASON(SSL_R_SSL3_SESSION_ID_TOO_LONG), "ssl3 session id too long"},
505{ERR_REASON(SSL_R_SSL3_SESSION_ID_TOO_LONG),"ssl3 session id too long"}, 504 {ERR_REASON(SSL_R_SSL3_SESSION_ID_TOO_SHORT), "ssl3 session id too short"},
506{ERR_REASON(SSL_R_SSL3_SESSION_ID_TOO_SHORT),"ssl3 session id too short"}, 505 {ERR_REASON(SSL_R_SSLV3_ALERT_BAD_CERTIFICATE), "sslv3 alert bad certificate"},
507{ERR_REASON(SSL_R_SSLV3_ALERT_BAD_CERTIFICATE),"sslv3 alert bad certificate"}, 506 {ERR_REASON(SSL_R_SSLV3_ALERT_BAD_RECORD_MAC), "sslv3 alert bad record mac"},
508{ERR_REASON(SSL_R_SSLV3_ALERT_BAD_RECORD_MAC),"sslv3 alert bad record mac"}, 507 {ERR_REASON(SSL_R_SSLV3_ALERT_CERTIFICATE_EXPIRED), "sslv3 alert certificate expired"},
509{ERR_REASON(SSL_R_SSLV3_ALERT_CERTIFICATE_EXPIRED),"sslv3 alert certificate expired"}, 508 {ERR_REASON(SSL_R_SSLV3_ALERT_CERTIFICATE_REVOKED), "sslv3 alert certificate revoked"},
510{ERR_REASON(SSL_R_SSLV3_ALERT_CERTIFICATE_REVOKED),"sslv3 alert certificate revoked"}, 509 {ERR_REASON(SSL_R_SSLV3_ALERT_CERTIFICATE_UNKNOWN), "sslv3 alert certificate unknown"},
511{ERR_REASON(SSL_R_SSLV3_ALERT_CERTIFICATE_UNKNOWN),"sslv3 alert certificate unknown"}, 510 {ERR_REASON(SSL_R_SSLV3_ALERT_DECOMPRESSION_FAILURE), "sslv3 alert decompression failure"},
512{ERR_REASON(SSL_R_SSLV3_ALERT_DECOMPRESSION_FAILURE),"sslv3 alert decompression failure"}, 511 {ERR_REASON(SSL_R_SSLV3_ALERT_HANDSHAKE_FAILURE), "sslv3 alert handshake failure"},
513{ERR_REASON(SSL_R_SSLV3_ALERT_HANDSHAKE_FAILURE),"sslv3 alert handshake failure"}, 512 {ERR_REASON(SSL_R_SSLV3_ALERT_ILLEGAL_PARAMETER), "sslv3 alert illegal parameter"},
514{ERR_REASON(SSL_R_SSLV3_ALERT_ILLEGAL_PARAMETER),"sslv3 alert illegal parameter"}, 513 {ERR_REASON(SSL_R_SSLV3_ALERT_NO_CERTIFICATE), "sslv3 alert no certificate"},
515{ERR_REASON(SSL_R_SSLV3_ALERT_NO_CERTIFICATE),"sslv3 alert no certificate"}, 514 {ERR_REASON(SSL_R_SSLV3_ALERT_UNEXPECTED_MESSAGE), "sslv3 alert unexpected message"},
516{ERR_REASON(SSL_R_SSLV3_ALERT_UNEXPECTED_MESSAGE),"sslv3 alert unexpected message"}, 515 {ERR_REASON(SSL_R_SSLV3_ALERT_UNSUPPORTED_CERTIFICATE), "sslv3 alert unsupported certificate"},
517{ERR_REASON(SSL_R_SSLV3_ALERT_UNSUPPORTED_CERTIFICATE),"sslv3 alert unsupported certificate"}, 516 {ERR_REASON(SSL_R_SSL_CTX_HAS_NO_DEFAULT_SSL_VERSION), "ssl ctx has no default ssl version"},
518{ERR_REASON(SSL_R_SSL_CTX_HAS_NO_DEFAULT_SSL_VERSION),"ssl ctx has no default ssl version"}, 517 {ERR_REASON(SSL_R_SSL_HANDSHAKE_FAILURE) , "ssl handshake failure"},
519{ERR_REASON(SSL_R_SSL_HANDSHAKE_FAILURE) ,"ssl handshake failure"}, 518 {ERR_REASON(SSL_R_SSL_LIBRARY_HAS_NO_CIPHERS), "ssl library has no ciphers"},
520{ERR_REASON(SSL_R_SSL_LIBRARY_HAS_NO_CIPHERS),"ssl library has no ciphers"}, 519 {ERR_REASON(SSL_R_SSL_SESSION_ID_CALLBACK_FAILED), "ssl session id callback failed"},
521{ERR_REASON(SSL_R_SSL_SESSION_ID_CALLBACK_FAILED),"ssl session id callback failed"}, 520 {ERR_REASON(SSL_R_SSL_SESSION_ID_CONFLICT), "ssl session id conflict"},
522{ERR_REASON(SSL_R_SSL_SESSION_ID_CONFLICT),"ssl session id conflict"}, 521 {ERR_REASON(SSL_R_SSL_SESSION_ID_CONTEXT_TOO_LONG), "ssl session id context too long"},
523{ERR_REASON(SSL_R_SSL_SESSION_ID_CONTEXT_TOO_LONG),"ssl session id context too long"}, 522 {ERR_REASON(SSL_R_SSL_SESSION_ID_HAS_BAD_LENGTH), "ssl session id has bad length"},
524{ERR_REASON(SSL_R_SSL_SESSION_ID_HAS_BAD_LENGTH),"ssl session id has bad length"}, 523 {ERR_REASON(SSL_R_SSL_SESSION_ID_IS_DIFFERENT), "ssl session id is different"},
525{ERR_REASON(SSL_R_SSL_SESSION_ID_IS_DIFFERENT),"ssl session id is different"}, 524 {ERR_REASON(SSL_R_TLSV1_ALERT_ACCESS_DENIED), "tlsv1 alert access denied"},
526{ERR_REASON(SSL_R_TLSV1_ALERT_ACCESS_DENIED),"tlsv1 alert access denied"}, 525 {ERR_REASON(SSL_R_TLSV1_ALERT_DECODE_ERROR), "tlsv1 alert decode error"},
527{ERR_REASON(SSL_R_TLSV1_ALERT_DECODE_ERROR),"tlsv1 alert decode error"}, 526 {ERR_REASON(SSL_R_TLSV1_ALERT_DECRYPTION_FAILED), "tlsv1 alert decryption failed"},
528{ERR_REASON(SSL_R_TLSV1_ALERT_DECRYPTION_FAILED),"tlsv1 alert decryption failed"}, 527 {ERR_REASON(SSL_R_TLSV1_ALERT_DECRYPT_ERROR), "tlsv1 alert decrypt error"},
529{ERR_REASON(SSL_R_TLSV1_ALERT_DECRYPT_ERROR),"tlsv1 alert decrypt error"}, 528 {ERR_REASON(SSL_R_TLSV1_ALERT_EXPORT_RESTRICTION), "tlsv1 alert export restriction"},
530{ERR_REASON(SSL_R_TLSV1_ALERT_EXPORT_RESTRICTION),"tlsv1 alert export restriction"}, 529 {ERR_REASON(SSL_R_TLSV1_ALERT_INSUFFICIENT_SECURITY), "tlsv1 alert insufficient security"},
531{ERR_REASON(SSL_R_TLSV1_ALERT_INSUFFICIENT_SECURITY),"tlsv1 alert insufficient security"}, 530 {ERR_REASON(SSL_R_TLSV1_ALERT_INTERNAL_ERROR), "tlsv1 alert internal error"},
532{ERR_REASON(SSL_R_TLSV1_ALERT_INTERNAL_ERROR),"tlsv1 alert internal error"}, 531 {ERR_REASON(SSL_R_TLSV1_ALERT_NO_RENEGOTIATION), "tlsv1 alert no renegotiation"},
533{ERR_REASON(SSL_R_TLSV1_ALERT_NO_RENEGOTIATION),"tlsv1 alert no renegotiation"}, 532 {ERR_REASON(SSL_R_TLSV1_ALERT_PROTOCOL_VERSION), "tlsv1 alert protocol version"},
534{ERR_REASON(SSL_R_TLSV1_ALERT_PROTOCOL_VERSION),"tlsv1 alert protocol version"}, 533 {ERR_REASON(SSL_R_TLSV1_ALERT_RECORD_OVERFLOW), "tlsv1 alert record overflow"},
535{ERR_REASON(SSL_R_TLSV1_ALERT_RECORD_OVERFLOW),"tlsv1 alert record overflow"}, 534 {ERR_REASON(SSL_R_TLSV1_ALERT_UNKNOWN_CA), "tlsv1 alert unknown ca"},
536{ERR_REASON(SSL_R_TLSV1_ALERT_UNKNOWN_CA),"tlsv1 alert unknown ca"}, 535 {ERR_REASON(SSL_R_TLSV1_ALERT_USER_CANCELLED), "tlsv1 alert user cancelled"},
537{ERR_REASON(SSL_R_TLSV1_ALERT_USER_CANCELLED),"tlsv1 alert user cancelled"}, 536 {ERR_REASON(SSL_R_TLSV1_BAD_CERTIFICATE_HASH_VALUE), "tlsv1 bad certificate hash value"},
538{ERR_REASON(SSL_R_TLSV1_BAD_CERTIFICATE_HASH_VALUE),"tlsv1 bad certificate hash value"}, 537 {ERR_REASON(SSL_R_TLSV1_BAD_CERTIFICATE_STATUS_RESPONSE), "tlsv1 bad certificate status response"},
539{ERR_REASON(SSL_R_TLSV1_BAD_CERTIFICATE_STATUS_RESPONSE),"tlsv1 bad certificate status response"}, 538 {ERR_REASON(SSL_R_TLSV1_CERTIFICATE_UNOBTAINABLE), "tlsv1 certificate unobtainable"},
540{ERR_REASON(SSL_R_TLSV1_CERTIFICATE_UNOBTAINABLE),"tlsv1 certificate unobtainable"}, 539 {ERR_REASON(SSL_R_TLSV1_UNRECOGNIZED_NAME), "tlsv1 unrecognized name"},
541{ERR_REASON(SSL_R_TLSV1_UNRECOGNIZED_NAME),"tlsv1 unrecognized name"}, 540 {ERR_REASON(SSL_R_TLSV1_UNSUPPORTED_EXTENSION), "tlsv1 unsupported extension"},
542{ERR_REASON(SSL_R_TLSV1_UNSUPPORTED_EXTENSION),"tlsv1 unsupported extension"}, 541 {ERR_REASON(SSL_R_TLS_CLIENT_CERT_REQ_WITH_ANON_CIPHER), "tls client cert req with anon cipher"},
543{ERR_REASON(SSL_R_TLS_CLIENT_CERT_REQ_WITH_ANON_CIPHER),"tls client cert req with anon cipher"}, 542 {ERR_REASON(SSL_R_TLS_HEARTBEAT_PEER_DOESNT_ACCEPT), "peer does not accept heartbearts"},
544{ERR_REASON(SSL_R_TLS_HEARTBEAT_PEER_DOESNT_ACCEPT),"peer does not accept heartbearts"}, 543 {ERR_REASON(SSL_R_TLS_HEARTBEAT_PENDING) , "heartbeat request already pending"},
545{ERR_REASON(SSL_R_TLS_HEARTBEAT_PENDING) ,"heartbeat request already pending"}, 544 {ERR_REASON(SSL_R_TLS_ILLEGAL_EXPORTER_LABEL), "tls illegal exporter label"},
546{ERR_REASON(SSL_R_TLS_ILLEGAL_EXPORTER_LABEL),"tls illegal exporter label"}, 545 {ERR_REASON(SSL_R_TLS_INVALID_ECPOINTFORMAT_LIST), "tls invalid ecpointformat list"},
547{ERR_REASON(SSL_R_TLS_INVALID_ECPOINTFORMAT_LIST),"tls invalid ecpointformat list"}, 546 {ERR_REASON(SSL_R_TLS_PEER_DID_NOT_RESPOND_WITH_CERTIFICATE_LIST), "tls peer did not respond with certificate list"},
548{ERR_REASON(SSL_R_TLS_PEER_DID_NOT_RESPOND_WITH_CERTIFICATE_LIST),"tls peer did not respond with certificate list"}, 547 {ERR_REASON(SSL_R_TLS_RSA_ENCRYPTED_VALUE_LENGTH_IS_WRONG), "tls rsa encrypted value length is wrong"},
549{ERR_REASON(SSL_R_TLS_RSA_ENCRYPTED_VALUE_LENGTH_IS_WRONG),"tls rsa encrypted value length is wrong"}, 548 {ERR_REASON(SSL_R_TRIED_TO_USE_UNSUPPORTED_CIPHER), "tried to use unsupported cipher"},
550{ERR_REASON(SSL_R_TRIED_TO_USE_UNSUPPORTED_CIPHER),"tried to use unsupported cipher"}, 549 {ERR_REASON(SSL_R_UNABLE_TO_DECODE_DH_CERTS), "unable to decode dh certs"},
551{ERR_REASON(SSL_R_UNABLE_TO_DECODE_DH_CERTS),"unable to decode dh certs"}, 550 {ERR_REASON(SSL_R_UNABLE_TO_DECODE_ECDH_CERTS), "unable to decode ecdh certs"},
552{ERR_REASON(SSL_R_UNABLE_TO_DECODE_ECDH_CERTS),"unable to decode ecdh certs"}, 551 {ERR_REASON(SSL_R_UNABLE_TO_EXTRACT_PUBLIC_KEY), "unable to extract public key"},
553{ERR_REASON(SSL_R_UNABLE_TO_EXTRACT_PUBLIC_KEY),"unable to extract public key"}, 552 {ERR_REASON(SSL_R_UNABLE_TO_FIND_DH_PARAMETERS), "unable to find dh parameters"},
554{ERR_REASON(SSL_R_UNABLE_TO_FIND_DH_PARAMETERS),"unable to find dh parameters"}, 553 {ERR_REASON(SSL_R_UNABLE_TO_FIND_ECDH_PARAMETERS), "unable to find ecdh parameters"},
555{ERR_REASON(SSL_R_UNABLE_TO_FIND_ECDH_PARAMETERS),"unable to find ecdh parameters"}, 554 {ERR_REASON(SSL_R_UNABLE_TO_FIND_PUBLIC_KEY_PARAMETERS), "unable to find public key parameters"},
556{ERR_REASON(SSL_R_UNABLE_TO_FIND_PUBLIC_KEY_PARAMETERS),"unable to find public key parameters"}, 555 {ERR_REASON(SSL_R_UNABLE_TO_FIND_SSL_METHOD), "unable to find ssl method"},
557{ERR_REASON(SSL_R_UNABLE_TO_FIND_SSL_METHOD),"unable to find ssl method"}, 556 {ERR_REASON(SSL_R_UNABLE_TO_LOAD_SSL2_MD5_ROUTINES), "unable to load ssl2 md5 routines"},
558{ERR_REASON(SSL_R_UNABLE_TO_LOAD_SSL2_MD5_ROUTINES),"unable to load ssl2 md5 routines"}, 557 {ERR_REASON(SSL_R_UNABLE_TO_LOAD_SSL3_MD5_ROUTINES), "unable to load ssl3 md5 routines"},
559{ERR_REASON(SSL_R_UNABLE_TO_LOAD_SSL3_MD5_ROUTINES),"unable to load ssl3 md5 routines"}, 558 {ERR_REASON(SSL_R_UNABLE_TO_LOAD_SSL3_SHA1_ROUTINES), "unable to load ssl3 sha1 routines"},
560{ERR_REASON(SSL_R_UNABLE_TO_LOAD_SSL3_SHA1_ROUTINES),"unable to load ssl3 sha1 routines"}, 559 {ERR_REASON(SSL_R_UNEXPECTED_MESSAGE) , "unexpected message"},
561{ERR_REASON(SSL_R_UNEXPECTED_MESSAGE) ,"unexpected message"}, 560 {ERR_REASON(SSL_R_UNEXPECTED_RECORD) , "unexpected record"},
562{ERR_REASON(SSL_R_UNEXPECTED_RECORD) ,"unexpected record"}, 561 {ERR_REASON(SSL_R_UNINITIALIZED) , "uninitialized"},
563{ERR_REASON(SSL_R_UNINITIALIZED) ,"uninitialized"}, 562 {ERR_REASON(SSL_R_UNKNOWN_ALERT_TYPE) , "unknown alert type"},
564{ERR_REASON(SSL_R_UNKNOWN_ALERT_TYPE) ,"unknown alert type"}, 563 {ERR_REASON(SSL_R_UNKNOWN_CERTIFICATE_TYPE), "unknown certificate type"},
565{ERR_REASON(SSL_R_UNKNOWN_CERTIFICATE_TYPE),"unknown certificate type"}, 564 {ERR_REASON(SSL_R_UNKNOWN_CIPHER_RETURNED), "unknown cipher returned"},
566{ERR_REASON(SSL_R_UNKNOWN_CIPHER_RETURNED),"unknown cipher returned"}, 565 {ERR_REASON(SSL_R_UNKNOWN_CIPHER_TYPE) , "unknown cipher type"},
567{ERR_REASON(SSL_R_UNKNOWN_CIPHER_TYPE) ,"unknown cipher type"}, 566 {ERR_REASON(SSL_R_UNKNOWN_DIGEST) , "unknown digest"},
568{ERR_REASON(SSL_R_UNKNOWN_DIGEST) ,"unknown digest"}, 567 {ERR_REASON(SSL_R_UNKNOWN_KEY_EXCHANGE_TYPE), "unknown key exchange type"},
569{ERR_REASON(SSL_R_UNKNOWN_KEY_EXCHANGE_TYPE),"unknown key exchange type"}, 568 {ERR_REASON(SSL_R_UNKNOWN_PKEY_TYPE) , "unknown pkey type"},
570{ERR_REASON(SSL_R_UNKNOWN_PKEY_TYPE) ,"unknown pkey type"}, 569 {ERR_REASON(SSL_R_UNKNOWN_PROTOCOL) , "unknown protocol"},
571{ERR_REASON(SSL_R_UNKNOWN_PROTOCOL) ,"unknown protocol"}, 570 {ERR_REASON(SSL_R_UNKNOWN_REMOTE_ERROR_TYPE), "unknown remote error type"},
572{ERR_REASON(SSL_R_UNKNOWN_REMOTE_ERROR_TYPE),"unknown remote error type"}, 571 {ERR_REASON(SSL_R_UNKNOWN_SSL_VERSION) , "unknown ssl version"},
573{ERR_REASON(SSL_R_UNKNOWN_SSL_VERSION) ,"unknown ssl version"}, 572 {ERR_REASON(SSL_R_UNKNOWN_STATE) , "unknown state"},
574{ERR_REASON(SSL_R_UNKNOWN_STATE) ,"unknown state"}, 573 {ERR_REASON(SSL_R_UNSAFE_LEGACY_RENEGOTIATION_DISABLED), "unsafe legacy renegotiation disabled"},
575{ERR_REASON(SSL_R_UNSAFE_LEGACY_RENEGOTIATION_DISABLED),"unsafe legacy renegotiation disabled"}, 574 {ERR_REASON(SSL_R_UNSUPPORTED_CIPHER) , "unsupported cipher"},
576{ERR_REASON(SSL_R_UNSUPPORTED_CIPHER) ,"unsupported cipher"}, 575 {ERR_REASON(SSL_R_UNSUPPORTED_COMPRESSION_ALGORITHM), "unsupported compression algorithm"},
577{ERR_REASON(SSL_R_UNSUPPORTED_COMPRESSION_ALGORITHM),"unsupported compression algorithm"}, 576 {ERR_REASON(SSL_R_UNSUPPORTED_DIGEST_TYPE), "unsupported digest type"},
578{ERR_REASON(SSL_R_UNSUPPORTED_DIGEST_TYPE),"unsupported digest type"}, 577 {ERR_REASON(SSL_R_UNSUPPORTED_ELLIPTIC_CURVE), "unsupported elliptic curve"},
579{ERR_REASON(SSL_R_UNSUPPORTED_ELLIPTIC_CURVE),"unsupported elliptic curve"}, 578 {ERR_REASON(SSL_R_UNSUPPORTED_PROTOCOL) , "unsupported protocol"},
580{ERR_REASON(SSL_R_UNSUPPORTED_PROTOCOL) ,"unsupported protocol"}, 579 {ERR_REASON(SSL_R_UNSUPPORTED_SSL_VERSION), "unsupported ssl version"},
581{ERR_REASON(SSL_R_UNSUPPORTED_SSL_VERSION),"unsupported ssl version"}, 580 {ERR_REASON(SSL_R_UNSUPPORTED_STATUS_TYPE), "unsupported status type"},
582{ERR_REASON(SSL_R_UNSUPPORTED_STATUS_TYPE),"unsupported status type"}, 581 {ERR_REASON(SSL_R_USE_SRTP_NOT_NEGOTIATED), "use srtp not negotiated"},
583{ERR_REASON(SSL_R_USE_SRTP_NOT_NEGOTIATED),"use srtp not negotiated"}, 582 {ERR_REASON(SSL_R_WRITE_BIO_NOT_SET) , "write bio not set"},
584{ERR_REASON(SSL_R_WRITE_BIO_NOT_SET) ,"write bio not set"}, 583 {ERR_REASON(SSL_R_WRONG_CIPHER_RETURNED) , "wrong cipher returned"},
585{ERR_REASON(SSL_R_WRONG_CIPHER_RETURNED) ,"wrong cipher returned"}, 584 {ERR_REASON(SSL_R_WRONG_MESSAGE_TYPE) , "wrong message type"},
586{ERR_REASON(SSL_R_WRONG_MESSAGE_TYPE) ,"wrong message type"}, 585 {ERR_REASON(SSL_R_WRONG_NUMBER_OF_KEY_BITS), "wrong number of key bits"},
587{ERR_REASON(SSL_R_WRONG_NUMBER_OF_KEY_BITS),"wrong number of key bits"}, 586 {ERR_REASON(SSL_R_WRONG_SIGNATURE_LENGTH), "wrong signature length"},
588{ERR_REASON(SSL_R_WRONG_SIGNATURE_LENGTH),"wrong signature length"}, 587 {ERR_REASON(SSL_R_WRONG_SIGNATURE_SIZE) , "wrong signature size"},
589{ERR_REASON(SSL_R_WRONG_SIGNATURE_SIZE) ,"wrong signature size"}, 588 {ERR_REASON(SSL_R_WRONG_SIGNATURE_TYPE) , "wrong signature type"},
590{ERR_REASON(SSL_R_WRONG_SIGNATURE_TYPE) ,"wrong signature type"}, 589 {ERR_REASON(SSL_R_WRONG_SSL_VERSION) , "wrong ssl version"},
591{ERR_REASON(SSL_R_WRONG_SSL_VERSION) ,"wrong ssl version"}, 590 {ERR_REASON(SSL_R_WRONG_VERSION_NUMBER) , "wrong version number"},
592{ERR_REASON(SSL_R_WRONG_VERSION_NUMBER) ,"wrong version number"}, 591 {ERR_REASON(SSL_R_X509_LIB) , "x509 lib"},
593{ERR_REASON(SSL_R_X509_LIB) ,"x509 lib"}, 592 {ERR_REASON(SSL_R_X509_VERIFICATION_SETUP_PROBLEMS), "x509 verification setup problems"},
594{ERR_REASON(SSL_R_X509_VERIFICATION_SETUP_PROBLEMS),"x509 verification setup problems"}, 593 {0, NULL}
595{0,NULL} 594};
596 };
597 595
598#endif 596#endif
599 597
600void ERR_load_SSL_strings(void) 598void
601 { 599ERR_load_SSL_strings(void)
600{
602#ifndef OPENSSL_NO_ERR 601#ifndef OPENSSL_NO_ERR
603 602
604 if (ERR_func_error_string(SSL_str_functs[0].error) == NULL) 603 if (ERR_func_error_string(SSL_str_functs[0].error) == NULL) {
605 { 604 ERR_load_strings(0, SSL_str_functs);
606 ERR_load_strings(0,SSL_str_functs); 605 ERR_load_strings(0, SSL_str_reasons);
607 ERR_load_strings(0,SSL_str_reasons);
608 }
609#endif
610 } 606 }
607#endif
608}
diff --git a/src/lib/libssl/ssl_err2.c b/src/lib/libssl/ssl_err2.c
index ea95a5f983..cd781d38aa 100644
--- a/src/lib/libssl/ssl_err2.c
+++ b/src/lib/libssl/ssl_err2.c
@@ -60,11 +60,12 @@
60#include <openssl/err.h> 60#include <openssl/err.h>
61#include <openssl/ssl.h> 61#include <openssl/ssl.h>
62 62
63void SSL_load_error_strings(void) 63void
64 { 64SSL_load_error_strings(void)
65{
65#ifndef OPENSSL_NO_ERR 66#ifndef OPENSSL_NO_ERR
66 ERR_load_crypto_strings(); 67 ERR_load_crypto_strings();
67 ERR_load_SSL_strings(); 68 ERR_load_SSL_strings();
68#endif 69#endif
69 } 70}
70 71
diff --git a/src/lib/libssl/ssl_lib.c b/src/lib/libssl/ssl_lib.c
index d9a728493e..98764b82aa 100644
--- a/src/lib/libssl/ssl_lib.c
+++ b/src/lib/libssl/ssl_lib.c
@@ -160,11 +160,11 @@
160#include <openssl/engine.h> 160#include <openssl/engine.h>
161#endif 161#endif
162 162
163const char *SSL_version_str=OPENSSL_VERSION_TEXT; 163const char *SSL_version_str = OPENSSL_VERSION_TEXT;
164 164
165SSL3_ENC_METHOD ssl3_undef_enc_method={ 165SSL3_ENC_METHOD ssl3_undef_enc_method = {
166 /* evil casts, but these functions are only called if there's a library bug */ 166 /* evil casts, but these functions are only called if there's a library bug */
167 (int (*)(SSL *,int))ssl_undefined_function, 167 (int (*)(SSL *, int))ssl_undefined_function,
168 (int (*)(SSL *, unsigned char *, int))ssl_undefined_function, 168 (int (*)(SSL *, unsigned char *, int))ssl_undefined_function,
169 ssl_undefined_function, 169 ssl_undefined_function,
170 (int (*)(SSL *, unsigned char *, unsigned char *, int))ssl_undefined_function, 170 (int (*)(SSL *, unsigned char *, unsigned char *, int))ssl_undefined_function,
@@ -178,129 +178,124 @@ SSL3_ENC_METHOD ssl3_undef_enc_method={
178 0, /* server_finished_label_len */ 178 0, /* server_finished_label_len */
179 (int (*)(int))ssl_undefined_function, 179 (int (*)(int))ssl_undefined_function,
180 (int (*)(SSL *, unsigned char *, size_t, const char *, 180 (int (*)(SSL *, unsigned char *, size_t, const char *,
181 size_t, const unsigned char *, size_t, 181 size_t, const unsigned char *, size_t,
182 int use_context)) ssl_undefined_function, 182 int use_context)) ssl_undefined_function,
183 }; 183};
184 184
185int SSL_clear(SSL *s) 185int
186 { 186SSL_clear(SSL *s)
187{
187 188
188 if (s->method == NULL) 189 if (s->method == NULL) {
189 { 190 SSLerr(SSL_F_SSL_CLEAR, SSL_R_NO_METHOD_SPECIFIED);
190 SSLerr(SSL_F_SSL_CLEAR,SSL_R_NO_METHOD_SPECIFIED); 191 return (0);
191 return(0); 192 }
192 }
193 193
194 if (ssl_clear_bad_session(s)) 194 if (ssl_clear_bad_session(s)) {
195 {
196 SSL_SESSION_free(s->session); 195 SSL_SESSION_free(s->session);
197 s->session=NULL; 196 s->session = NULL;
198 } 197 }
199 198
200 s->error=0; 199 s->error = 0;
201 s->hit=0; 200 s->hit = 0;
202 s->shutdown=0; 201 s->shutdown = 0;
203 202
204#if 0 /* Disabled since version 1.10 of this file (early return not 203#if 0 /* Disabled since version 1.10 of this file (early return not
205 * needed because SSL_clear is not called when doing renegotiation) */ 204 * needed because SSL_clear is not called when doing renegotiation) */
206 /* This is set if we are doing dynamic renegotiation so keep 205 /* This is set if we are doing dynamic renegotiation so keep
207 * the old cipher. It is sort of a SSL_clear_lite :-) */ 206 * the old cipher. It is sort of a SSL_clear_lite :-) */
208 if (s->renegotiate) return(1);
209#else
210 if (s->renegotiate) 207 if (s->renegotiate)
211 { 208 return (1);
212 SSLerr(SSL_F_SSL_CLEAR,ERR_R_INTERNAL_ERROR); 209#else
210 if (s->renegotiate) {
211 SSLerr(SSL_F_SSL_CLEAR, ERR_R_INTERNAL_ERROR);
213 return 0; 212 return 0;
214 } 213 }
215#endif 214#endif
216 215
217 s->type=0; 216 s->type = 0;
218 217
219 s->state=SSL_ST_BEFORE|((s->server)?SSL_ST_ACCEPT:SSL_ST_CONNECT); 218 s->state = SSL_ST_BEFORE|((s->server) ? SSL_ST_ACCEPT : SSL_ST_CONNECT);
220 219
221 s->version=s->method->version; 220 s->version = s->method->version;
222 s->client_version=s->version; 221 s->client_version = s->version;
223 s->rwstate=SSL_NOTHING; 222 s->rwstate = SSL_NOTHING;
224 s->rstate=SSL_ST_READ_HEADER; 223 s->rstate = SSL_ST_READ_HEADER;
225#if 0 224#if 0
226 s->read_ahead=s->ctx->read_ahead; 225 s->read_ahead = s->ctx->read_ahead;
227#endif 226#endif
228 227
229 if (s->init_buf != NULL) 228 if (s->init_buf != NULL) {
230 {
231 BUF_MEM_free(s->init_buf); 229 BUF_MEM_free(s->init_buf);
232 s->init_buf=NULL; 230 s->init_buf = NULL;
233 } 231 }
234 232
235 ssl_clear_cipher_ctx(s); 233 ssl_clear_cipher_ctx(s);
236 ssl_clear_hash_ctx(&s->read_hash); 234 ssl_clear_hash_ctx(&s->read_hash);
237 ssl_clear_hash_ctx(&s->write_hash); 235 ssl_clear_hash_ctx(&s->write_hash);
238 236
239 s->first_packet=0; 237 s->first_packet = 0;
240 238
241#if 1 239#if 1
242 /* Check to see if we were changed into a different method, if 240 /* Check to see if we were changed into a different method, if
243 * so, revert back if we are not doing session-id reuse. */ 241 * so, revert back if we are not doing session-id reuse. */
244 if (!s->in_handshake && (s->session == NULL) && (s->method != s->ctx->method)) 242 if (!s->in_handshake && (s->session == NULL) && (s->method != s->ctx->method)) {
245 {
246 s->method->ssl_free(s); 243 s->method->ssl_free(s);
247 s->method=s->ctx->method; 244 s->method = s->ctx->method;
248 if (!s->method->ssl_new(s)) 245 if (!s->method->ssl_new(s))
249 return(0); 246 return (0);
250 } 247 } else
251 else
252#endif 248#endif
253 s->method->ssl_clear(s); 249 s->method->ssl_clear(s);
254 return(1); 250 return (1);
255 } 251}
256 252
257/** Used to change an SSL_CTXs default SSL method type */ 253/** Used to change an SSL_CTXs default SSL method type */
258int SSL_CTX_set_ssl_version(SSL_CTX *ctx,const SSL_METHOD *meth) 254int
259 { 255SSL_CTX_set_ssl_version(SSL_CTX *ctx, const SSL_METHOD *meth)
256{
260 STACK_OF(SSL_CIPHER) *sk; 257 STACK_OF(SSL_CIPHER) *sk;
261 258
262 ctx->method=meth; 259 ctx->method = meth;
263 260
264 sk=ssl_create_cipher_list(ctx->method,&(ctx->cipher_list), 261 sk = ssl_create_cipher_list(ctx->method, &(ctx->cipher_list),
265 &(ctx->cipher_list_by_id), 262 &(ctx->cipher_list_by_id),
266 meth->version == SSL2_VERSION ? "SSLv2" : SSL_DEFAULT_CIPHER_LIST); 263 meth->version == SSL2_VERSION ? "SSLv2" : SSL_DEFAULT_CIPHER_LIST);
267 if ((sk == NULL) || (sk_SSL_CIPHER_num(sk) <= 0)) 264 if ((sk == NULL) || (sk_SSL_CIPHER_num(sk) <= 0)) {
268 { 265 SSLerr(SSL_F_SSL_CTX_SET_SSL_VERSION, SSL_R_SSL_LIBRARY_HAS_NO_CIPHERS);
269 SSLerr(SSL_F_SSL_CTX_SET_SSL_VERSION,SSL_R_SSL_LIBRARY_HAS_NO_CIPHERS); 266 return (0);
270 return(0);
271 }
272 return(1);
273 } 267 }
268 return (1);
269}
274 270
275SSL *SSL_new(SSL_CTX *ctx) 271SSL
276 { 272*SSL_new(SSL_CTX *ctx)
273{
277 SSL *s; 274 SSL *s;
278 275
279 if (ctx == NULL) 276 if (ctx == NULL) {
280 { 277 SSLerr(SSL_F_SSL_NEW, SSL_R_NULL_SSL_CTX);
281 SSLerr(SSL_F_SSL_NEW,SSL_R_NULL_SSL_CTX); 278 return (NULL);
282 return(NULL); 279 }
283 } 280 if (ctx->method == NULL) {
284 if (ctx->method == NULL) 281 SSLerr(SSL_F_SSL_NEW, SSL_R_SSL_CTX_HAS_NO_DEFAULT_SSL_VERSION);
285 { 282 return (NULL);
286 SSLerr(SSL_F_SSL_NEW,SSL_R_SSL_CTX_HAS_NO_DEFAULT_SSL_VERSION); 283 }
287 return(NULL);
288 }
289 284
290 s=(SSL *)OPENSSL_malloc(sizeof(SSL)); 285 s = (SSL *)OPENSSL_malloc(sizeof(SSL));
291 if (s == NULL) goto err; 286 if (s == NULL)
292 memset(s,0,sizeof(SSL)); 287 goto err;
288 memset(s, 0, sizeof(SSL));
293 289
294#ifndef OPENSSL_NO_KRB5 290#ifndef OPENSSL_NO_KRB5
295 s->kssl_ctx = kssl_ctx_new(); 291 s->kssl_ctx = kssl_ctx_new();
296#endif /* OPENSSL_NO_KRB5 */ 292#endif /* OPENSSL_NO_KRB5 */
297 293
298 s->options=ctx->options; 294 s->options = ctx->options;
299 s->mode=ctx->mode; 295 s->mode = ctx->mode;
300 s->max_cert_list=ctx->max_cert_list; 296 s->max_cert_list = ctx->max_cert_list;
301 297
302 if (ctx->cert != NULL) 298 if (ctx->cert != NULL) {
303 {
304 /* Earlier library versions used to copy the pointer to 299 /* Earlier library versions used to copy the pointer to
305 * the CERT, not its contents; only when setting new 300 * the CERT, not its contents; only when setting new
306 * parameters for the per-SSL copy, ssl_cert_new would be 301 * parameters for the per-SSL copy, ssl_cert_new would be
@@ -314,22 +309,21 @@ SSL *SSL_new(SSL_CTX *ctx)
314 s->cert = ssl_cert_dup(ctx->cert); 309 s->cert = ssl_cert_dup(ctx->cert);
315 if (s->cert == NULL) 310 if (s->cert == NULL)
316 goto err; 311 goto err;
317 } 312 } else
318 else
319 s->cert=NULL; /* Cannot really happen (see SSL_CTX_new) */ 313 s->cert=NULL; /* Cannot really happen (see SSL_CTX_new) */
320 314
321 s->read_ahead=ctx->read_ahead; 315 s->read_ahead = ctx->read_ahead;
322 s->msg_callback=ctx->msg_callback; 316 s->msg_callback = ctx->msg_callback;
323 s->msg_callback_arg=ctx->msg_callback_arg; 317 s->msg_callback_arg = ctx->msg_callback_arg;
324 s->verify_mode=ctx->verify_mode; 318 s->verify_mode = ctx->verify_mode;
325#if 0 319#if 0
326 s->verify_depth=ctx->verify_depth; 320 s->verify_depth = ctx->verify_depth;
327#endif 321#endif
328 s->sid_ctx_length=ctx->sid_ctx_length; 322 s->sid_ctx_length = ctx->sid_ctx_length;
329 OPENSSL_assert(s->sid_ctx_length <= sizeof s->sid_ctx); 323 OPENSSL_assert(s->sid_ctx_length <= sizeof s->sid_ctx);
330 memcpy(&s->sid_ctx,&ctx->sid_ctx,sizeof(s->sid_ctx)); 324 memcpy(&s->sid_ctx, &ctx->sid_ctx, sizeof(s->sid_ctx));
331 s->verify_callback=ctx->default_verify_callback; 325 s->verify_callback = ctx->default_verify_callback;
332 s->generate_session_id=ctx->generate_session_id; 326 s->generate_session_id = ctx->generate_session_id;
333 327
334 s->param = X509_VERIFY_PARAM_new(); 328 s->param = X509_VERIFY_PARAM_new();
335 if (!s->param) 329 if (!s->param)
@@ -339,11 +333,11 @@ SSL *SSL_new(SSL_CTX *ctx)
339 s->purpose = ctx->purpose; 333 s->purpose = ctx->purpose;
340 s->trust = ctx->trust; 334 s->trust = ctx->trust;
341#endif 335#endif
342 s->quiet_shutdown=ctx->quiet_shutdown; 336 s->quiet_shutdown = ctx->quiet_shutdown;
343 s->max_send_fragment = ctx->max_send_fragment; 337 s->max_send_fragment = ctx->max_send_fragment;
344 338
345 CRYPTO_add(&ctx->references,1,CRYPTO_LOCK_SSL_CTX); 339 CRYPTO_add(&ctx->references, 1, CRYPTO_LOCK_SSL_CTX);
346 s->ctx=ctx; 340 s->ctx = ctx;
347#ifndef OPENSSL_NO_TLSEXT 341#ifndef OPENSSL_NO_TLSEXT
348 s->tlsext_debug_cb = 0; 342 s->tlsext_debug_cb = 0;
349 s->tlsext_debug_arg = NULL; 343 s->tlsext_debug_arg = NULL;
@@ -354,93 +348,95 @@ SSL *SSL_new(SSL_CTX *ctx)
354 s->tlsext_ocsp_exts = NULL; 348 s->tlsext_ocsp_exts = NULL;
355 s->tlsext_ocsp_resp = NULL; 349 s->tlsext_ocsp_resp = NULL;
356 s->tlsext_ocsp_resplen = -1; 350 s->tlsext_ocsp_resplen = -1;
357 CRYPTO_add(&ctx->references,1,CRYPTO_LOCK_SSL_CTX); 351 CRYPTO_add(&ctx->references, 1, CRYPTO_LOCK_SSL_CTX);
358 s->initial_ctx=ctx; 352 s->initial_ctx = ctx;
359# ifndef OPENSSL_NO_NEXTPROTONEG 353# ifndef OPENSSL_NO_NEXTPROTONEG
360 s->next_proto_negotiated = NULL; 354 s->next_proto_negotiated = NULL;
361# endif 355# endif
362#endif 356#endif
363 357
364 s->verify_result=X509_V_OK; 358 s->verify_result = X509_V_OK;
365 359
366 s->method=ctx->method; 360 s->method = ctx->method;
367 361
368 if (!s->method->ssl_new(s)) 362 if (!s->method->ssl_new(s))
369 goto err; 363 goto err;
370 364
371 s->references=1; 365 s->references = 1;
372 s->server=(ctx->method->ssl_accept == ssl_undefined_function)?0:1; 366 s->server = (ctx->method->ssl_accept == ssl_undefined_function) ? 0 : 1;
373 367
374 SSL_clear(s); 368 SSL_clear(s);
375 369
376 CRYPTO_new_ex_data(CRYPTO_EX_INDEX_SSL, s, &s->ex_data); 370 CRYPTO_new_ex_data(CRYPTO_EX_INDEX_SSL, s, &s->ex_data);
377 371
378#ifndef OPENSSL_NO_PSK 372#ifndef OPENSSL_NO_PSK
379 s->psk_client_callback=ctx->psk_client_callback; 373 s->psk_client_callback = ctx->psk_client_callback;
380 s->psk_server_callback=ctx->psk_server_callback; 374 s->psk_server_callback = ctx->psk_server_callback;
381#endif 375#endif
382 376
383 return(s); 377 return (s);
384err: 378err:
385 if (s != NULL) 379 if (s != NULL) {
386 {
387 if (s->cert != NULL) 380 if (s->cert != NULL)
388 ssl_cert_free(s->cert); 381 ssl_cert_free(s->cert);
389 if (s->ctx != NULL) 382 if (s->ctx != NULL)
390 SSL_CTX_free(s->ctx); /* decrement reference count */ 383 SSL_CTX_free(s->ctx); /* decrement reference count */
391 OPENSSL_free(s); 384 OPENSSL_free(s);
392 }
393 SSLerr(SSL_F_SSL_NEW,ERR_R_MALLOC_FAILURE);
394 return(NULL);
395 } 385 }
386 SSLerr(SSL_F_SSL_NEW, ERR_R_MALLOC_FAILURE);
387 return (NULL);
388}
396 389
397int SSL_CTX_set_session_id_context(SSL_CTX *ctx,const unsigned char *sid_ctx, 390int
398 unsigned int sid_ctx_len) 391SSL_CTX_set_session_id_context(SSL_CTX *ctx, const unsigned char *sid_ctx,
399 { 392 unsigned int sid_ctx_len)
400 if(sid_ctx_len > sizeof ctx->sid_ctx) 393{
401 { 394 if (sid_ctx_len > sizeof ctx->sid_ctx) {
402 SSLerr(SSL_F_SSL_CTX_SET_SESSION_ID_CONTEXT,SSL_R_SSL_SESSION_ID_CONTEXT_TOO_LONG); 395 SSLerr(SSL_F_SSL_CTX_SET_SESSION_ID_CONTEXT, SSL_R_SSL_SESSION_ID_CONTEXT_TOO_LONG);
403 return 0; 396 return 0;
404 } 397 }
405 ctx->sid_ctx_length=sid_ctx_len; 398 ctx->sid_ctx_length = sid_ctx_len;
406 memcpy(ctx->sid_ctx,sid_ctx,sid_ctx_len); 399 memcpy(ctx->sid_ctx, sid_ctx, sid_ctx_len);
407 400
408 return 1; 401 return 1;
409 } 402}
410 403
411int SSL_set_session_id_context(SSL *ssl,const unsigned char *sid_ctx, 404int
412 unsigned int sid_ctx_len) 405SSL_set_session_id_context(SSL *ssl, const unsigned char *sid_ctx,
413 { 406 unsigned int sid_ctx_len)
414 if(sid_ctx_len > SSL_MAX_SID_CTX_LENGTH) 407{
415 { 408 if (sid_ctx_len > SSL_MAX_SID_CTX_LENGTH) {
416 SSLerr(SSL_F_SSL_SET_SESSION_ID_CONTEXT,SSL_R_SSL_SESSION_ID_CONTEXT_TOO_LONG); 409 SSLerr(SSL_F_SSL_SET_SESSION_ID_CONTEXT, SSL_R_SSL_SESSION_ID_CONTEXT_TOO_LONG);
417 return 0; 410 return 0;
418 } 411 }
419 ssl->sid_ctx_length=sid_ctx_len; 412 ssl->sid_ctx_length = sid_ctx_len;
420 memcpy(ssl->sid_ctx,sid_ctx,sid_ctx_len); 413 memcpy(ssl->sid_ctx, sid_ctx, sid_ctx_len);
421 414
422 return 1; 415 return 1;
423 } 416}
424 417
425int SSL_CTX_set_generate_session_id(SSL_CTX *ctx, GEN_SESSION_CB cb) 418int
426 { 419SSL_CTX_set_generate_session_id(SSL_CTX *ctx, GEN_SESSION_CB cb)
420{
427 CRYPTO_w_lock(CRYPTO_LOCK_SSL_CTX); 421 CRYPTO_w_lock(CRYPTO_LOCK_SSL_CTX);
428 ctx->generate_session_id = cb; 422 ctx->generate_session_id = cb;
429 CRYPTO_w_unlock(CRYPTO_LOCK_SSL_CTX); 423 CRYPTO_w_unlock(CRYPTO_LOCK_SSL_CTX);
430 return 1; 424 return 1;
431 } 425}
432 426
433int SSL_set_generate_session_id(SSL *ssl, GEN_SESSION_CB cb) 427int
434 { 428SSL_set_generate_session_id(SSL *ssl, GEN_SESSION_CB cb)
429{
435 CRYPTO_w_lock(CRYPTO_LOCK_SSL); 430 CRYPTO_w_lock(CRYPTO_LOCK_SSL);
436 ssl->generate_session_id = cb; 431 ssl->generate_session_id = cb;
437 CRYPTO_w_unlock(CRYPTO_LOCK_SSL); 432 CRYPTO_w_unlock(CRYPTO_LOCK_SSL);
438 return 1; 433 return 1;
439 } 434}
440 435
441int SSL_has_matching_session_id(const SSL *ssl, const unsigned char *id, 436int
442 unsigned int id_len) 437SSL_has_matching_session_id(const SSL *ssl, const unsigned char *id,
443 { 438 unsigned int id_len)
439{
444 /* A quick examination of SSL_SESSION_hash and SSL_SESSION_cmp shows how 440 /* A quick examination of SSL_SESSION_hash and SSL_SESSION_cmp shows how
445 * we can "construct" a session to give us the desired check - ie. to 441 * we can "construct" a session to give us the desired check - ie. to
446 * find if there's a session in the hash table that would conflict with 442 * find if there's a session in the hash table that would conflict with
@@ -448,7 +444,7 @@ int SSL_has_matching_session_id(const SSL *ssl, const unsigned char *id,
448 * use by this SSL. */ 444 * use by this SSL. */
449 SSL_SESSION r, *p; 445 SSL_SESSION r, *p;
450 446
451 if(id_len > sizeof r.session_id) 447 if (id_len > sizeof r.session_id)
452 return 0; 448 return 0;
453 449
454 r.ssl_version = ssl->version; 450 r.ssl_version = ssl->version;
@@ -458,68 +454,74 @@ int SSL_has_matching_session_id(const SSL *ssl, const unsigned char *id,
458 * callback is calling us to check the uniqueness of a shorter ID, it 454 * callback is calling us to check the uniqueness of a shorter ID, it
459 * must be compared as a padded-out ID because that is what it will be 455 * must be compared as a padded-out ID because that is what it will be
460 * converted to when the callback has finished choosing it. */ 456 * converted to when the callback has finished choosing it. */
461 if((r.ssl_version == SSL2_VERSION) && 457 if ((r.ssl_version == SSL2_VERSION) &&
462 (id_len < SSL2_SSL_SESSION_ID_LENGTH)) 458 (id_len < SSL2_SSL_SESSION_ID_LENGTH)) {
463 {
464 memset(r.session_id + id_len, 0, 459 memset(r.session_id + id_len, 0,
465 SSL2_SSL_SESSION_ID_LENGTH - id_len); 460 SSL2_SSL_SESSION_ID_LENGTH - id_len);
466 r.session_id_length = SSL2_SSL_SESSION_ID_LENGTH; 461 r.session_id_length = SSL2_SSL_SESSION_ID_LENGTH;
467 } 462 }
468 463
469 CRYPTO_r_lock(CRYPTO_LOCK_SSL_CTX); 464 CRYPTO_r_lock(CRYPTO_LOCK_SSL_CTX);
470 p = lh_SSL_SESSION_retrieve(ssl->ctx->sessions, &r); 465 p = lh_SSL_SESSION_retrieve(ssl->ctx->sessions, &r);
471 CRYPTO_r_unlock(CRYPTO_LOCK_SSL_CTX); 466 CRYPTO_r_unlock(CRYPTO_LOCK_SSL_CTX);
472 return (p != NULL); 467 return (p != NULL);
473 } 468}
474 469
475int SSL_CTX_set_purpose(SSL_CTX *s, int purpose) 470int
476 { 471SSL_CTX_set_purpose(SSL_CTX *s, int purpose)
472{
477 return X509_VERIFY_PARAM_set_purpose(s->param, purpose); 473 return X509_VERIFY_PARAM_set_purpose(s->param, purpose);
478 } 474}
479 475
480int SSL_set_purpose(SSL *s, int purpose) 476int
481 { 477SSL_set_purpose(SSL *s, int purpose)
478{
482 return X509_VERIFY_PARAM_set_purpose(s->param, purpose); 479 return X509_VERIFY_PARAM_set_purpose(s->param, purpose);
483 } 480}
484 481
485int SSL_CTX_set_trust(SSL_CTX *s, int trust) 482int
486 { 483SSL_CTX_set_trust(SSL_CTX *s, int trust)
484{
487 return X509_VERIFY_PARAM_set_trust(s->param, trust); 485 return X509_VERIFY_PARAM_set_trust(s->param, trust);
488 } 486}
489 487
490int SSL_set_trust(SSL *s, int trust) 488int
491 { 489SSL_set_trust(SSL *s, int trust)
490{
492 return X509_VERIFY_PARAM_set_trust(s->param, trust); 491 return X509_VERIFY_PARAM_set_trust(s->param, trust);
493 } 492}
494 493
495int SSL_CTX_set1_param(SSL_CTX *ctx, X509_VERIFY_PARAM *vpm) 494int
496 { 495SSL_CTX_set1_param(SSL_CTX *ctx, X509_VERIFY_PARAM *vpm)
496{
497 return X509_VERIFY_PARAM_set1(ctx->param, vpm); 497 return X509_VERIFY_PARAM_set1(ctx->param, vpm);
498 } 498}
499 499
500int SSL_set1_param(SSL *ssl, X509_VERIFY_PARAM *vpm) 500int
501 { 501SSL_set1_param(SSL *ssl, X509_VERIFY_PARAM *vpm)
502{
502 return X509_VERIFY_PARAM_set1(ssl->param, vpm); 503 return X509_VERIFY_PARAM_set1(ssl->param, vpm);
503 } 504}
504 505
505void SSL_free(SSL *s) 506void
506 { 507SSL_free(SSL *s)
508{
507 int i; 509 int i;
508 510
509 if(s == NULL) 511 if (s == NULL)
510 return; 512 return;
511 513
512 i=CRYPTO_add(&s->references,-1,CRYPTO_LOCK_SSL); 514 i = CRYPTO_add(&s->references, -1, CRYPTO_LOCK_SSL);
513#ifdef REF_PRINT 515#ifdef REF_PRINT
514 REF_PRINT("SSL",s); 516 REF_PRINT("SSL", s);
515#endif 517#endif
516 if (i > 0) return; 518 if (i > 0)
519 return;
517#ifdef REF_CHECK 520#ifdef REF_CHECK
518 if (i < 0) 521 if (i < 0) {
519 { 522 fprintf(stderr, "SSL_free, bad reference count\n");
520 fprintf(stderr,"SSL_free, bad reference count\n");
521 abort(); /* ok */ 523 abort(); /* ok */
522 } 524 }
523#endif 525#endif
524 526
525 if (s->param) 527 if (s->param)
@@ -527,53 +529,58 @@ void SSL_free(SSL *s)
527 529
528 CRYPTO_free_ex_data(CRYPTO_EX_INDEX_SSL, s, &s->ex_data); 530 CRYPTO_free_ex_data(CRYPTO_EX_INDEX_SSL, s, &s->ex_data);
529 531
530 if (s->bbio != NULL) 532 if (s->bbio != NULL) {
531 {
532 /* If the buffering BIO is in place, pop it off */ 533 /* If the buffering BIO is in place, pop it off */
533 if (s->bbio == s->wbio) 534 if (s->bbio == s->wbio) {
534 { 535 s->wbio = BIO_pop(s->wbio);
535 s->wbio=BIO_pop(s->wbio);
536 }
537 BIO_free(s->bbio);
538 s->bbio=NULL;
539 } 536 }
537 BIO_free(s->bbio);
538 s->bbio = NULL;
539 }
540 if (s->rbio != NULL) 540 if (s->rbio != NULL)
541 BIO_free_all(s->rbio); 541 BIO_free_all(s->rbio);
542 if ((s->wbio != NULL) && (s->wbio != s->rbio)) 542 if ((s->wbio != NULL) && (s->wbio != s->rbio))
543 BIO_free_all(s->wbio); 543 BIO_free_all(s->wbio);
544 544
545 if (s->init_buf != NULL) BUF_MEM_free(s->init_buf); 545 if (s->init_buf != NULL)
546 BUF_MEM_free(s->init_buf);
546 547
547 /* add extra stuff */ 548 /* add extra stuff */
548 if (s->cipher_list != NULL) sk_SSL_CIPHER_free(s->cipher_list); 549 if (s->cipher_list != NULL)
549 if (s->cipher_list_by_id != NULL) sk_SSL_CIPHER_free(s->cipher_list_by_id); 550 sk_SSL_CIPHER_free(s->cipher_list);
551 if (s->cipher_list_by_id != NULL)
552 sk_SSL_CIPHER_free(s->cipher_list_by_id);
550 553
551 /* Make the next call work :-) */ 554 /* Make the next call work :-) */
552 if (s->session != NULL) 555 if (s->session != NULL) {
553 {
554 ssl_clear_bad_session(s); 556 ssl_clear_bad_session(s);
555 SSL_SESSION_free(s->session); 557 SSL_SESSION_free(s->session);
556 } 558 }
557 559
558 ssl_clear_cipher_ctx(s); 560 ssl_clear_cipher_ctx(s);
559 ssl_clear_hash_ctx(&s->read_hash); 561 ssl_clear_hash_ctx(&s->read_hash);
560 ssl_clear_hash_ctx(&s->write_hash); 562 ssl_clear_hash_ctx(&s->write_hash);
561 563
562 if (s->cert != NULL) ssl_cert_free(s->cert); 564 if (s->cert != NULL)
565 ssl_cert_free(s->cert);
563 /* Free up if allocated */ 566 /* Free up if allocated */
564 567
565#ifndef OPENSSL_NO_TLSEXT 568#ifndef OPENSSL_NO_TLSEXT
566 if (s->tlsext_hostname) 569 if (s->tlsext_hostname)
567 OPENSSL_free(s->tlsext_hostname); 570 OPENSSL_free(s->tlsext_hostname);
568 if (s->initial_ctx) SSL_CTX_free(s->initial_ctx); 571 if (s->initial_ctx)
572 SSL_CTX_free(s->initial_ctx);
569#ifndef OPENSSL_NO_EC 573#ifndef OPENSSL_NO_EC
570 if (s->tlsext_ecpointformatlist) OPENSSL_free(s->tlsext_ecpointformatlist); 574 if (s->tlsext_ecpointformatlist)
571 if (s->tlsext_ellipticcurvelist) OPENSSL_free(s->tlsext_ellipticcurvelist); 575 OPENSSL_free(s->tlsext_ecpointformatlist);
576 if (s->tlsext_ellipticcurvelist)
577 OPENSSL_free(s->tlsext_ellipticcurvelist);
572#endif /* OPENSSL_NO_EC */ 578#endif /* OPENSSL_NO_EC */
573 if (s->tlsext_opaque_prf_input) OPENSSL_free(s->tlsext_opaque_prf_input); 579 if (s->tlsext_opaque_prf_input)
580 OPENSSL_free(s->tlsext_opaque_prf_input);
574 if (s->tlsext_ocsp_exts) 581 if (s->tlsext_ocsp_exts)
575 sk_X509_EXTENSION_pop_free(s->tlsext_ocsp_exts, 582 sk_X509_EXTENSION_pop_free(s->tlsext_ocsp_exts,
576 X509_EXTENSION_free); 583 X509_EXTENSION_free);
577 if (s->tlsext_ocsp_ids) 584 if (s->tlsext_ocsp_ids)
578 sk_OCSP_RESPID_pop_free(s->tlsext_ocsp_ids, OCSP_RESPID_free); 585 sk_OCSP_RESPID_pop_free(s->tlsext_ocsp_ids, OCSP_RESPID_free);
579 if (s->tlsext_ocsp_resp) 586 if (s->tlsext_ocsp_resp)
@@ -581,11 +588,13 @@ void SSL_free(SSL *s)
581#endif 588#endif
582 589
583 if (s->client_CA != NULL) 590 if (s->client_CA != NULL)
584 sk_X509_NAME_pop_free(s->client_CA,X509_NAME_free); 591 sk_X509_NAME_pop_free(s->client_CA, X509_NAME_free);
585 592
586 if (s->method != NULL) s->method->ssl_free(s); 593 if (s->method != NULL)
594 s->method->ssl_free(s);
587 595
588 if (s->ctx) SSL_CTX_free(s->ctx); 596 if (s->ctx)
597 SSL_CTX_free(s->ctx);
589 598
590#ifndef OPENSSL_NO_KRB5 599#ifndef OPENSSL_NO_KRB5
591 if (s->kssl_ctx != NULL) 600 if (s->kssl_ctx != NULL)
@@ -598,223 +607,237 @@ void SSL_free(SSL *s)
598#endif 607#endif
599 608
600#ifndef OPENSSL_NO_SRTP 609#ifndef OPENSSL_NO_SRTP
601 if (s->srtp_profiles) 610 if (s->srtp_profiles)
602 sk_SRTP_PROTECTION_PROFILE_free(s->srtp_profiles); 611 sk_SRTP_PROTECTION_PROFILE_free(s->srtp_profiles);
603#endif 612#endif
604 613
605 OPENSSL_free(s); 614 OPENSSL_free(s);
606 } 615}
607 616
608void SSL_set_bio(SSL *s,BIO *rbio,BIO *wbio) 617void
609 { 618SSL_set_bio(SSL *s, BIO *rbio, BIO *wbio)
619{
610 /* If the output buffering BIO is still in place, remove it 620 /* If the output buffering BIO is still in place, remove it
611 */ 621 */
612 if (s->bbio != NULL) 622 if (s->bbio != NULL) {
613 { 623 if (s->wbio == s->bbio) {
614 if (s->wbio == s->bbio) 624 s->wbio = s->wbio->next_bio;
615 { 625 s->bbio->next_bio = NULL;
616 s->wbio=s->wbio->next_bio;
617 s->bbio->next_bio=NULL;
618 }
619 } 626 }
627 }
620 if ((s->rbio != NULL) && (s->rbio != rbio)) 628 if ((s->rbio != NULL) && (s->rbio != rbio))
621 BIO_free_all(s->rbio); 629 BIO_free_all(s->rbio);
622 if ((s->wbio != NULL) && (s->wbio != wbio) && (s->rbio != s->wbio)) 630 if ((s->wbio != NULL) && (s->wbio != wbio) && (s->rbio != s->wbio))
623 BIO_free_all(s->wbio); 631 BIO_free_all(s->wbio);
624 s->rbio=rbio; 632 s->rbio = rbio;
625 s->wbio=wbio; 633 s->wbio = wbio;
626 } 634}
627 635
628BIO *SSL_get_rbio(const SSL *s) 636BIO
629 { return(s->rbio); } 637*SSL_get_rbio(const SSL *s)
638 { return (s->rbio);
639}
630 640
631BIO *SSL_get_wbio(const SSL *s) 641BIO
632 { return(s->wbio); } 642*SSL_get_wbio(const SSL *s)
643 { return (s->wbio);
644}
633 645
634int SSL_get_fd(const SSL *s) 646int
635 { 647SSL_get_fd(const SSL *s)
636 return(SSL_get_rfd(s)); 648{
637 } 649 return (SSL_get_rfd(s));
650}
638 651
639int SSL_get_rfd(const SSL *s) 652int
640 { 653SSL_get_rfd(const SSL *s)
641 int ret= -1; 654{
642 BIO *b,*r; 655 int ret = -1;
656 BIO *b, *r;
643 657
644 b=SSL_get_rbio(s); 658 b = SSL_get_rbio(s);
645 r=BIO_find_type(b,BIO_TYPE_DESCRIPTOR); 659 r = BIO_find_type(b, BIO_TYPE_DESCRIPTOR);
646 if (r != NULL) 660 if (r != NULL)
647 BIO_get_fd(r,&ret); 661 BIO_get_fd(r, &ret);
648 return(ret); 662 return (ret);
649 } 663}
650 664
651int SSL_get_wfd(const SSL *s) 665int
652 { 666SSL_get_wfd(const SSL *s)
653 int ret= -1; 667{
654 BIO *b,*r; 668 int ret = -1;
669 BIO *b, *r;
655 670
656 b=SSL_get_wbio(s); 671 b = SSL_get_wbio(s);
657 r=BIO_find_type(b,BIO_TYPE_DESCRIPTOR); 672 r = BIO_find_type(b, BIO_TYPE_DESCRIPTOR);
658 if (r != NULL) 673 if (r != NULL)
659 BIO_get_fd(r,&ret); 674 BIO_get_fd(r, &ret);
660 return(ret); 675 return (ret);
661 } 676}
662 677
663#ifndef OPENSSL_NO_SOCK 678#ifndef OPENSSL_NO_SOCK
664int SSL_set_fd(SSL *s,int fd) 679int
665 { 680SSL_set_fd(SSL *s, int fd)
666 int ret=0; 681{
667 BIO *bio=NULL; 682 int ret = 0;
683 BIO *bio = NULL;
668 684
669 bio=BIO_new(BIO_s_socket()); 685 bio = BIO_new(BIO_s_socket());
670 686
671 if (bio == NULL) 687 if (bio == NULL) {
672 { 688 SSLerr(SSL_F_SSL_SET_FD, ERR_R_BUF_LIB);
673 SSLerr(SSL_F_SSL_SET_FD,ERR_R_BUF_LIB);
674 goto err; 689 goto err;
675 }
676 BIO_set_fd(bio,fd,BIO_NOCLOSE);
677 SSL_set_bio(s,bio,bio);
678 ret=1;
679err:
680 return(ret);
681 } 690 }
691 BIO_set_fd(bio, fd, BIO_NOCLOSE);
692 SSL_set_bio(s, bio, bio);
693 ret = 1;
694err:
695 return (ret);
696}
682 697
683int SSL_set_wfd(SSL *s,int fd) 698int
684 { 699SSL_set_wfd(SSL *s, int fd)
685 int ret=0; 700{
686 BIO *bio=NULL; 701 int ret = 0;
702 BIO *bio = NULL;
687 703
688 if ((s->rbio == NULL) || (BIO_method_type(s->rbio) != BIO_TYPE_SOCKET) 704 if ((s->rbio == NULL) || (BIO_method_type(s->rbio) != BIO_TYPE_SOCKET)
689 || ((int)BIO_get_fd(s->rbio,NULL) != fd)) 705 || ((int)BIO_get_fd(s->rbio, NULL) != fd)) {
690 { 706 bio = BIO_new(BIO_s_socket());
691 bio=BIO_new(BIO_s_socket());
692 707
693 if (bio == NULL) 708 if (bio == NULL)
694 { SSLerr(SSL_F_SSL_SET_WFD,ERR_R_BUF_LIB); goto err; } 709 { SSLerr(SSL_F_SSL_SET_WFD, ERR_R_BUF_LIB);
695 BIO_set_fd(bio,fd,BIO_NOCLOSE); 710 goto err;
696 SSL_set_bio(s,SSL_get_rbio(s),bio);
697 } 711 }
698 else 712 BIO_set_fd(bio, fd, BIO_NOCLOSE);
699 SSL_set_bio(s,SSL_get_rbio(s),SSL_get_rbio(s)); 713 SSL_set_bio(s, SSL_get_rbio(s), bio);
700 ret=1; 714 } else
715 SSL_set_bio(s, SSL_get_rbio(s), SSL_get_rbio(s));
716 ret = 1;
701err: 717err:
702 return(ret); 718 return (ret);
703 } 719}
704 720
705int SSL_set_rfd(SSL *s,int fd) 721int
706 { 722SSL_set_rfd(SSL *s, int fd)
707 int ret=0; 723{
708 BIO *bio=NULL; 724 int ret = 0;
725 BIO *bio = NULL;
709 726
710 if ((s->wbio == NULL) || (BIO_method_type(s->wbio) != BIO_TYPE_SOCKET) 727 if ((s->wbio == NULL) || (BIO_method_type(s->wbio) != BIO_TYPE_SOCKET)
711 || ((int)BIO_get_fd(s->wbio,NULL) != fd)) 728 || ((int)BIO_get_fd(s->wbio, NULL) != fd)) {
712 { 729 bio = BIO_new(BIO_s_socket());
713 bio=BIO_new(BIO_s_socket());
714 730
715 if (bio == NULL) 731 if (bio == NULL) {
716 { 732 SSLerr(SSL_F_SSL_SET_RFD, ERR_R_BUF_LIB);
717 SSLerr(SSL_F_SSL_SET_RFD,ERR_R_BUF_LIB);
718 goto err; 733 goto err;
719 }
720 BIO_set_fd(bio,fd,BIO_NOCLOSE);
721 SSL_set_bio(s,bio,SSL_get_wbio(s));
722 } 734 }
723 else 735 BIO_set_fd(bio, fd, BIO_NOCLOSE);
724 SSL_set_bio(s,SSL_get_wbio(s),SSL_get_wbio(s)); 736 SSL_set_bio(s, bio, SSL_get_wbio(s));
725 ret=1; 737 } else
738 SSL_set_bio(s, SSL_get_wbio(s), SSL_get_wbio(s));
739 ret = 1;
726err: 740err:
727 return(ret); 741 return (ret);
728 } 742}
729#endif 743#endif
730 744
731 745
732/* return length of latest Finished message we sent, copy to 'buf' */ 746/* return length of latest Finished message we sent, copy to 'buf' */
733size_t SSL_get_finished(const SSL *s, void *buf, size_t count) 747size_t
734 { 748SSL_get_finished(const SSL *s, void *buf, size_t count)
749{
735 size_t ret = 0; 750 size_t ret = 0;
736 751
737 if (s->s3 != NULL) 752 if (s->s3 != NULL) {
738 {
739 ret = s->s3->tmp.finish_md_len; 753 ret = s->s3->tmp.finish_md_len;
740 if (count > ret) 754 if (count > ret)
741 count = ret; 755 count = ret;
742 memcpy(buf, s->s3->tmp.finish_md, count); 756 memcpy(buf, s->s3->tmp.finish_md, count);
743 }
744 return ret;
745 } 757 }
758 return ret;
759}
746 760
747/* return length of latest Finished message we expected, copy to 'buf' */ 761/* return length of latest Finished message we expected, copy to 'buf' */
748size_t SSL_get_peer_finished(const SSL *s, void *buf, size_t count) 762size_t
749 { 763SSL_get_peer_finished(const SSL *s, void *buf, size_t count)
764{
750 size_t ret = 0; 765 size_t ret = 0;
751 766
752 if (s->s3 != NULL) 767 if (s->s3 != NULL) {
753 {
754 ret = s->s3->tmp.peer_finish_md_len; 768 ret = s->s3->tmp.peer_finish_md_len;
755 if (count > ret) 769 if (count > ret)
756 count = ret; 770 count = ret;
757 memcpy(buf, s->s3->tmp.peer_finish_md, count); 771 memcpy(buf, s->s3->tmp.peer_finish_md, count);
758 }
759 return ret;
760 } 772 }
773 return ret;
774}
761 775
762 776
763int SSL_get_verify_mode(const SSL *s) 777int
764 { 778SSL_get_verify_mode(const SSL *s)
765 return(s->verify_mode); 779{
766 } 780 return (s->verify_mode);
781}
767 782
768int SSL_get_verify_depth(const SSL *s) 783int
769 { 784SSL_get_verify_depth(const SSL *s)
785{
770 return X509_VERIFY_PARAM_get_depth(s->param); 786 return X509_VERIFY_PARAM_get_depth(s->param);
771 } 787}
772 788
773int (*SSL_get_verify_callback(const SSL *s))(int,X509_STORE_CTX *) 789int (*SSL_get_verify_callback(const SSL *s))(int, X509_STORE_CTX *)
774 { 790{
775 return(s->verify_callback); 791 return (s->verify_callback);
776 } 792}
777 793
778int SSL_CTX_get_verify_mode(const SSL_CTX *ctx) 794int
779 { 795SSL_CTX_get_verify_mode(const SSL_CTX *ctx)
780 return(ctx->verify_mode); 796{
781 } 797 return (ctx->verify_mode);
798}
782 799
783int SSL_CTX_get_verify_depth(const SSL_CTX *ctx) 800int
784 { 801SSL_CTX_get_verify_depth(const SSL_CTX *ctx)
802{
785 return X509_VERIFY_PARAM_get_depth(ctx->param); 803 return X509_VERIFY_PARAM_get_depth(ctx->param);
786 } 804}
787 805
788int (*SSL_CTX_get_verify_callback(const SSL_CTX *ctx))(int,X509_STORE_CTX *) 806int (*SSL_CTX_get_verify_callback(const SSL_CTX *ctx))(int, X509_STORE_CTX *)
789 { 807{
790 return(ctx->default_verify_callback); 808 return (ctx->default_verify_callback);
791 } 809}
792 810
793void SSL_set_verify(SSL *s,int mode, 811void
794 int (*callback)(int ok,X509_STORE_CTX *ctx)) 812SSL_set_verify(SSL *s, int mode,
795 { 813 int (*callback)(int ok, X509_STORE_CTX *ctx))
796 s->verify_mode=mode; 814{
815 s->verify_mode = mode;
797 if (callback != NULL) 816 if (callback != NULL)
798 s->verify_callback=callback; 817 s->verify_callback = callback;
799 } 818}
800 819
801void SSL_set_verify_depth(SSL *s,int depth) 820void
802 { 821SSL_set_verify_depth(SSL *s, int depth)
822{
803 X509_VERIFY_PARAM_set_depth(s->param, depth); 823 X509_VERIFY_PARAM_set_depth(s->param, depth);
804 } 824}
805 825
806void SSL_set_read_ahead(SSL *s,int yes) 826void
807 { 827SSL_set_read_ahead(SSL *s, int yes)
808 s->read_ahead=yes; 828{
809 } 829 s->read_ahead = yes;
830}
810 831
811int SSL_get_read_ahead(const SSL *s) 832int
812 { 833SSL_get_read_ahead(const SSL *s)
813 return(s->read_ahead); 834{
814 } 835 return (s->read_ahead);
836}
815 837
816int SSL_pending(const SSL *s) 838int
817 { 839SSL_pending(const SSL *s)
840{
818 /* SSL_pending cannot work properly if read-ahead is enabled 841 /* SSL_pending cannot work properly if read-ahead is enabled
819 * (SSL_[CTX_]ctrl(..., SSL_CTRL_SET_READ_AHEAD, 1, NULL)), 842 * (SSL_[CTX_]ctrl(..., SSL_CTRL_SET_READ_AHEAD, 1, NULL)),
820 * and it is impossible to fix since SSL_pending cannot report 843 * and it is impossible to fix since SSL_pending cannot report
@@ -822,264 +845,266 @@ int SSL_pending(const SSL *s)
822 * (Note that SSL_pending() is often used as a boolean value, 845 * (Note that SSL_pending() is often used as a boolean value,
823 * so we'd better not return -1.) 846 * so we'd better not return -1.)
824 */ 847 */
825 return(s->method->ssl_pending(s)); 848 return (s->method->ssl_pending(s));
826 } 849}
827 850
828X509 *SSL_get_peer_certificate(const SSL *s) 851X509
829 { 852*SSL_get_peer_certificate(const SSL *s)
853{
830 X509 *r; 854 X509 *r;
831 855
832 if ((s == NULL) || (s->session == NULL)) 856 if ((s == NULL) || (s->session == NULL))
833 r=NULL; 857 r = NULL;
834 else 858 else
835 r=s->session->peer; 859 r = s->session->peer;
836 860
837 if (r == NULL) return(r); 861 if (r == NULL)
862 return (r);
838 863
839 CRYPTO_add(&r->references,1,CRYPTO_LOCK_X509); 864 CRYPTO_add(&r->references, 1, CRYPTO_LOCK_X509);
840 865
841 return(r); 866 return (r);
842 } 867}
843 868
844STACK_OF(X509) *SSL_get_peer_cert_chain(const SSL *s) 869STACK_OF(X509)
845 { 870*SSL_get_peer_cert_chain(const SSL *s)
871{
846 STACK_OF(X509) *r; 872 STACK_OF(X509) *r;
847 873
848 if ((s == NULL) || (s->session == NULL) || (s->session->sess_cert == NULL)) 874 if ((s == NULL) || (s->session == NULL) || (s->session->sess_cert == NULL))
849 r=NULL; 875 r = NULL;
850 else 876 else
851 r=s->session->sess_cert->cert_chain; 877 r = s->session->sess_cert->cert_chain;
852 878
853 /* If we are a client, cert_chain includes the peer's own 879 /* If we are a client, cert_chain includes the peer's own
854 * certificate; if we are a server, it does not. */ 880 * certificate;
855 881if we are a server, it does not. */
856 return(r); 882
857 } 883 return (r);
884}
858 885
859/* Now in theory, since the calling process own 't' it should be safe to 886/* Now in theory, since the calling process own 't' it should be safe to
860 * modify. We need to be able to read f without being hassled */ 887 * modify. We need to be able to read f without being hassled */
861void SSL_copy_session_id(SSL *t,const SSL *f) 888void
862 { 889SSL_copy_session_id(SSL *t, const SSL *f)
890{
863 CERT *tmp; 891 CERT *tmp;
864 892
865 /* Do we need to to SSL locking? */ 893 /* Do we need to to SSL locking? */
866 SSL_set_session(t,SSL_get_session(f)); 894 SSL_set_session(t, SSL_get_session(f));
867 895
868 /* what if we are setup as SSLv2 but want to talk SSLv3 or 896 /* what if we are setup as SSLv2 but want to talk SSLv3 or
869 * vice-versa */ 897 * vice-versa */
870 if (t->method != f->method) 898 if (t->method != f->method) {
871 {
872 t->method->ssl_free(t); /* cleanup current */ 899 t->method->ssl_free(t); /* cleanup current */
873 t->method=f->method; /* change method */ 900 t->method=f->method; /* change method */
874 t->method->ssl_new(t); /* setup new */ 901 t->method->ssl_new(t); /* setup new */
875 }
876
877 tmp=t->cert;
878 if (f->cert != NULL)
879 {
880 CRYPTO_add(&f->cert->references,1,CRYPTO_LOCK_SSL_CERT);
881 t->cert=f->cert;
882 }
883 else
884 t->cert=NULL;
885 if (tmp != NULL) ssl_cert_free(tmp);
886 SSL_set_session_id_context(t,f->sid_ctx,f->sid_ctx_length);
887 } 902 }
888 903
904 tmp = t->cert;
905 if (f->cert != NULL) {
906 CRYPTO_add(&f->cert->references, 1, CRYPTO_LOCK_SSL_CERT);
907 t->cert = f->cert;
908 } else
909 t->cert = NULL;
910 if (tmp != NULL)
911 ssl_cert_free(tmp);
912 SSL_set_session_id_context(t, f->sid_ctx, f->sid_ctx_length);
913}
914
889/* Fix this so it checks all the valid key/cert options */ 915/* Fix this so it checks all the valid key/cert options */
890int SSL_CTX_check_private_key(const SSL_CTX *ctx) 916int
891 { 917SSL_CTX_check_private_key(const SSL_CTX *ctx)
892 if ( (ctx == NULL) || 918{
919 if ((ctx == NULL) ||
893 (ctx->cert == NULL) || 920 (ctx->cert == NULL) ||
894 (ctx->cert->key->x509 == NULL)) 921 (ctx->cert->key->x509 == NULL)) {
895 { 922 SSLerr(SSL_F_SSL_CTX_CHECK_PRIVATE_KEY, SSL_R_NO_CERTIFICATE_ASSIGNED);
896 SSLerr(SSL_F_SSL_CTX_CHECK_PRIVATE_KEY,SSL_R_NO_CERTIFICATE_ASSIGNED); 923 return (0);
897 return(0); 924 }
898 } 925 if (ctx->cert->key->privatekey == NULL) {
899 if (ctx->cert->key->privatekey == NULL) 926 SSLerr(SSL_F_SSL_CTX_CHECK_PRIVATE_KEY, SSL_R_NO_PRIVATE_KEY_ASSIGNED);
900 { 927 return (0);
901 SSLerr(SSL_F_SSL_CTX_CHECK_PRIVATE_KEY,SSL_R_NO_PRIVATE_KEY_ASSIGNED);
902 return(0);
903 }
904 return(X509_check_private_key(ctx->cert->key->x509, ctx->cert->key->privatekey));
905 } 928 }
929 return (X509_check_private_key(ctx->cert->key->x509, ctx->cert->key->privatekey));
930}
906 931
907/* Fix this function so that it takes an optional type parameter */ 932/* Fix this function so that it takes an optional type parameter */
908int SSL_check_private_key(const SSL *ssl) 933int
909 { 934SSL_check_private_key(const SSL *ssl)
910 if (ssl == NULL) 935{
911 { 936 if (ssl == NULL) {
912 SSLerr(SSL_F_SSL_CHECK_PRIVATE_KEY,ERR_R_PASSED_NULL_PARAMETER); 937 SSLerr(SSL_F_SSL_CHECK_PRIVATE_KEY, ERR_R_PASSED_NULL_PARAMETER);
913 return(0); 938 return (0);
914 } 939 }
915 if (ssl->cert == NULL) 940 if (ssl->cert == NULL) {
916 { 941 SSLerr(SSL_F_SSL_CHECK_PRIVATE_KEY, SSL_R_NO_CERTIFICATE_ASSIGNED);
917 SSLerr(SSL_F_SSL_CHECK_PRIVATE_KEY,SSL_R_NO_CERTIFICATE_ASSIGNED);
918 return 0; 942 return 0;
919 }
920 if (ssl->cert->key->x509 == NULL)
921 {
922 SSLerr(SSL_F_SSL_CHECK_PRIVATE_KEY,SSL_R_NO_CERTIFICATE_ASSIGNED);
923 return(0);
924 }
925 if (ssl->cert->key->privatekey == NULL)
926 {
927 SSLerr(SSL_F_SSL_CHECK_PRIVATE_KEY,SSL_R_NO_PRIVATE_KEY_ASSIGNED);
928 return(0);
929 }
930 return(X509_check_private_key(ssl->cert->key->x509,
931 ssl->cert->key->privatekey));
932 } 943 }
944 if (ssl->cert->key->x509 == NULL) {
945 SSLerr(SSL_F_SSL_CHECK_PRIVATE_KEY, SSL_R_NO_CERTIFICATE_ASSIGNED);
946 return (0);
947 }
948 if (ssl->cert->key->privatekey == NULL) {
949 SSLerr(SSL_F_SSL_CHECK_PRIVATE_KEY, SSL_R_NO_PRIVATE_KEY_ASSIGNED);
950 return (0);
951 }
952 return(X509_check_private_key(ssl->cert->key->x509,
953 ssl->cert->key->privatekey));
954}
933 955
934int SSL_accept(SSL *s) 956int
935 { 957SSL_accept(SSL *s)
958{
936 if (s->handshake_func == 0) 959 if (s->handshake_func == 0)
937 /* Not properly initialized yet */ 960 /* Not properly initialized yet */
938 SSL_set_accept_state(s); 961 SSL_set_accept_state(s);
939 962
940 return(s->method->ssl_accept(s)); 963 return (s->method->ssl_accept(s));
941 } 964}
942 965
943int SSL_connect(SSL *s) 966int
944 { 967SSL_connect(SSL *s)
968{
945 if (s->handshake_func == 0) 969 if (s->handshake_func == 0)
946 /* Not properly initialized yet */ 970 /* Not properly initialized yet */
947 SSL_set_connect_state(s); 971 SSL_set_connect_state(s);
948 972
949 return(s->method->ssl_connect(s)); 973 return (s->method->ssl_connect(s));
950 } 974}
951 975
952long SSL_get_default_timeout(const SSL *s) 976long
953 { 977SSL_get_default_timeout(const SSL *s)
954 return(s->method->get_timeout()); 978{
955 } 979 return (s->method->get_timeout());
980}
956 981
957int SSL_read(SSL *s,void *buf,int num) 982int
958 { 983SSL_read(SSL *s, void *buf, int num)
959 if (s->handshake_func == 0) 984{
960 { 985 if (s->handshake_func == 0) {
961 SSLerr(SSL_F_SSL_READ, SSL_R_UNINITIALIZED); 986 SSLerr(SSL_F_SSL_READ, SSL_R_UNINITIALIZED);
962 return -1; 987 return -1;
963 } 988 }
964 989
965 if (s->shutdown & SSL_RECEIVED_SHUTDOWN) 990 if (s->shutdown & SSL_RECEIVED_SHUTDOWN) {
966 { 991 s->rwstate = SSL_NOTHING;
967 s->rwstate=SSL_NOTHING; 992 return (0);
968 return(0);
969 }
970 return(s->method->ssl_read(s,buf,num));
971 } 993 }
994 return (s->method->ssl_read(s, buf, num));
995}
972 996
973int SSL_peek(SSL *s,void *buf,int num) 997int
974 { 998SSL_peek(SSL *s, void *buf, int num)
975 if (s->handshake_func == 0) 999{
976 { 1000 if (s->handshake_func == 0) {
977 SSLerr(SSL_F_SSL_PEEK, SSL_R_UNINITIALIZED); 1001 SSLerr(SSL_F_SSL_PEEK, SSL_R_UNINITIALIZED);
978 return -1; 1002 return -1;
979 } 1003 }
980 1004
981 if (s->shutdown & SSL_RECEIVED_SHUTDOWN) 1005 if (s->shutdown & SSL_RECEIVED_SHUTDOWN) {
982 { 1006 return (0);
983 return(0);
984 }
985 return(s->method->ssl_peek(s,buf,num));
986 } 1007 }
1008 return (s->method->ssl_peek(s, buf, num));
1009}
987 1010
988int SSL_write(SSL *s,const void *buf,int num) 1011int
989 { 1012SSL_write(SSL *s, const void *buf, int num)
990 if (s->handshake_func == 0) 1013{
991 { 1014 if (s->handshake_func == 0) {
992 SSLerr(SSL_F_SSL_WRITE, SSL_R_UNINITIALIZED); 1015 SSLerr(SSL_F_SSL_WRITE, SSL_R_UNINITIALIZED);
993 return -1; 1016 return -1;
994 } 1017 }
995 1018
996 if (s->shutdown & SSL_SENT_SHUTDOWN) 1019 if (s->shutdown & SSL_SENT_SHUTDOWN) {
997 { 1020 s->rwstate = SSL_NOTHING;
998 s->rwstate=SSL_NOTHING; 1021 SSLerr(SSL_F_SSL_WRITE, SSL_R_PROTOCOL_IS_SHUTDOWN);
999 SSLerr(SSL_F_SSL_WRITE,SSL_R_PROTOCOL_IS_SHUTDOWN); 1022 return (-1);
1000 return(-1);
1001 }
1002 return(s->method->ssl_write(s,buf,num));
1003 } 1023 }
1024 return (s->method->ssl_write(s, buf, num));
1025}
1004 1026
1005int SSL_shutdown(SSL *s) 1027int
1006 { 1028SSL_shutdown(SSL *s)
1029{
1007 /* Note that this function behaves differently from what one might 1030 /* Note that this function behaves differently from what one might
1008 * expect. Return values are 0 for no success (yet), 1031 * expect. Return values are 0 for no success (yet),
1009 * 1 for success; but calling it once is usually not enough, 1032 * 1 for success; but calling it once is usually not enough,
1010 * even if blocking I/O is used (see ssl3_shutdown). 1033 * even if blocking I/O is used (see ssl3_shutdown).
1011 */ 1034 */
1012 1035
1013 if (s->handshake_func == 0) 1036 if (s->handshake_func == 0) {
1014 {
1015 SSLerr(SSL_F_SSL_SHUTDOWN, SSL_R_UNINITIALIZED); 1037 SSLerr(SSL_F_SSL_SHUTDOWN, SSL_R_UNINITIALIZED);
1016 return -1; 1038 return -1;
1017 } 1039 }
1018 1040
1019 if ((s != NULL) && !SSL_in_init(s)) 1041 if ((s != NULL) && !SSL_in_init(s))
1020 return(s->method->ssl_shutdown(s)); 1042 return (s->method->ssl_shutdown(s));
1021 else 1043 else
1022 return(1); 1044 return (1);
1023 } 1045}
1024 1046
1025int SSL_renegotiate(SSL *s) 1047int
1026 { 1048SSL_renegotiate(SSL *s)
1049{
1027 if (s->renegotiate == 0) 1050 if (s->renegotiate == 0)
1028 s->renegotiate=1; 1051 s->renegotiate = 1;
1029 1052
1030 s->new_session=1; 1053 s->new_session = 1;
1031 1054
1032 return(s->method->ssl_renegotiate(s)); 1055 return (s->method->ssl_renegotiate(s));
1033 } 1056}
1034 1057
1035int SSL_renegotiate_abbreviated(SSL *s) 1058int
1036 { 1059SSL_renegotiate_abbreviated(SSL *s)
1060{
1037 if (s->renegotiate == 0) 1061 if (s->renegotiate == 0)
1038 s->renegotiate=1; 1062 s->renegotiate = 1;
1039 1063
1040 s->new_session=0; 1064 s->new_session = 0;
1041 1065
1042 return(s->method->ssl_renegotiate(s)); 1066 return (s->method->ssl_renegotiate(s));
1043 } 1067}
1044 1068
1045int SSL_renegotiate_pending(SSL *s) 1069int
1046 { 1070SSL_renegotiate_pending(SSL *s)
1071{
1047 /* becomes true when negotiation is requested; 1072 /* becomes true when negotiation is requested;
1048 * false again once a handshake has finished */ 1073 * false again once a handshake has finished */
1049 return (s->renegotiate != 0); 1074 return (s->renegotiate != 0);
1050 } 1075}
1051 1076
1052long SSL_ctrl(SSL *s,int cmd,long larg,void *parg) 1077long
1053 { 1078SSL_ctrl(SSL *s, int cmd, long larg, void *parg)
1079{
1054 long l; 1080 long l;
1055 1081
1056 switch (cmd) 1082 switch (cmd) {
1057 {
1058 case SSL_CTRL_GET_READ_AHEAD: 1083 case SSL_CTRL_GET_READ_AHEAD:
1059 return(s->read_ahead); 1084 return (s->read_ahead);
1060 case SSL_CTRL_SET_READ_AHEAD: 1085 case SSL_CTRL_SET_READ_AHEAD:
1061 l=s->read_ahead; 1086 l = s->read_ahead;
1062 s->read_ahead=larg; 1087 s->read_ahead = larg;
1063 return(l); 1088 return (l);
1064 1089
1065 case SSL_CTRL_SET_MSG_CALLBACK_ARG: 1090 case SSL_CTRL_SET_MSG_CALLBACK_ARG:
1066 s->msg_callback_arg = parg; 1091 s->msg_callback_arg = parg;
1067 return 1; 1092 return 1;
1068 1093
1069 case SSL_CTRL_OPTIONS: 1094 case SSL_CTRL_OPTIONS:
1070 return(s->options|=larg); 1095 return (s->options|=larg);
1071 case SSL_CTRL_CLEAR_OPTIONS: 1096 case SSL_CTRL_CLEAR_OPTIONS:
1072 return(s->options&=~larg); 1097 return (s->options&=~larg);
1073 case SSL_CTRL_MODE: 1098 case SSL_CTRL_MODE:
1074 return(s->mode|=larg); 1099 return (s->mode|=larg);
1075 case SSL_CTRL_CLEAR_MODE: 1100 case SSL_CTRL_CLEAR_MODE:
1076 return(s->mode &=~larg); 1101 return (s->mode &=~larg);
1077 case SSL_CTRL_GET_MAX_CERT_LIST: 1102 case SSL_CTRL_GET_MAX_CERT_LIST:
1078 return(s->max_cert_list); 1103 return (s->max_cert_list);
1079 case SSL_CTRL_SET_MAX_CERT_LIST: 1104 case SSL_CTRL_SET_MAX_CERT_LIST:
1080 l=s->max_cert_list; 1105 l = s->max_cert_list;
1081 s->max_cert_list=larg; 1106 s->max_cert_list = larg;
1082 return(l); 1107 return (l);
1083 case SSL_CTRL_SET_MTU: 1108 case SSL_CTRL_SET_MTU:
1084#ifndef OPENSSL_NO_DTLS1 1109#ifndef OPENSSL_NO_DTLS1
1085 if (larg < (long)dtls1_min_mtu()) 1110 if (larg < (long)dtls1_min_mtu())
@@ -1087,11 +1112,10 @@ long SSL_ctrl(SSL *s,int cmd,long larg,void *parg)
1087#endif 1112#endif
1088 1113
1089 if (SSL_version(s) == DTLS1_VERSION || 1114 if (SSL_version(s) == DTLS1_VERSION ||
1090 SSL_version(s) == DTLS1_BAD_VER) 1115 SSL_version(s) == DTLS1_BAD_VER) {
1091 {
1092 s->d1->mtu = larg; 1116 s->d1->mtu = larg;
1093 return larg; 1117 return larg;
1094 } 1118 }
1095 return 0; 1119 return 0;
1096 case SSL_CTRL_SET_MAX_SEND_FRAGMENT: 1120 case SSL_CTRL_SET_MAX_SEND_FRAGMENT:
1097 if (larg < 512 || larg > SSL3_RT_MAX_PLAIN_LENGTH) 1121 if (larg < 512 || larg > SSL3_RT_MAX_PLAIN_LENGTH)
@@ -1103,203 +1127,204 @@ long SSL_ctrl(SSL *s,int cmd,long larg,void *parg)
1103 return s->s3->send_connection_binding; 1127 return s->s3->send_connection_binding;
1104 else return 0; 1128 else return 0;
1105 default: 1129 default:
1106 return(s->method->ssl_ctrl(s,cmd,larg,parg)); 1130 return (s->method->ssl_ctrl(s, cmd, larg, parg));
1107 }
1108 } 1131 }
1132}
1109 1133
1110long SSL_callback_ctrl(SSL *s, int cmd, void (*fp)(void)) 1134long
1111 { 1135SSL_callback_ctrl(SSL *s, int cmd, void (*fp)(void))
1112 switch(cmd) 1136{
1113 { 1137 switch (cmd) {
1114 case SSL_CTRL_SET_MSG_CALLBACK: 1138 case SSL_CTRL_SET_MSG_CALLBACK:
1115 s->msg_callback = (void (*)(int write_p, int version, int content_type, const void *buf, size_t len, SSL *ssl, void *arg))(fp); 1139 s->msg_callback = (void (*)(int write_p, int version, int content_type, const void *buf, size_t len, SSL *ssl, void *arg))(fp);
1116 return 1; 1140 return 1;
1117 1141
1118 default: 1142 default:
1119 return(s->method->ssl_callback_ctrl(s,cmd,fp)); 1143 return (s->method->ssl_callback_ctrl(s, cmd, fp));
1120 }
1121 } 1144 }
1145}
1122 1146
1123LHASH_OF(SSL_SESSION) *SSL_CTX_sessions(SSL_CTX *ctx) 1147LHASH_OF(SSL_SESSION)
1124 { 1148*SSL_CTX_sessions(SSL_CTX *ctx)
1149{
1125 return ctx->sessions; 1150 return ctx->sessions;
1126 } 1151}
1127 1152
1128long SSL_CTX_ctrl(SSL_CTX *ctx,int cmd,long larg,void *parg) 1153long
1129 { 1154SSL_CTX_ctrl(SSL_CTX *ctx, int cmd, long larg, void *parg)
1155{
1130 long l; 1156 long l;
1131 1157
1132 switch (cmd) 1158 switch (cmd) {
1133 {
1134 case SSL_CTRL_GET_READ_AHEAD: 1159 case SSL_CTRL_GET_READ_AHEAD:
1135 return(ctx->read_ahead); 1160 return (ctx->read_ahead);
1136 case SSL_CTRL_SET_READ_AHEAD: 1161 case SSL_CTRL_SET_READ_AHEAD:
1137 l=ctx->read_ahead; 1162 l = ctx->read_ahead;
1138 ctx->read_ahead=larg; 1163 ctx->read_ahead = larg;
1139 return(l); 1164 return (l);
1140 1165
1141 case SSL_CTRL_SET_MSG_CALLBACK_ARG: 1166 case SSL_CTRL_SET_MSG_CALLBACK_ARG:
1142 ctx->msg_callback_arg = parg; 1167 ctx->msg_callback_arg = parg;
1143 return 1; 1168 return 1;
1144 1169
1145 case SSL_CTRL_GET_MAX_CERT_LIST: 1170 case SSL_CTRL_GET_MAX_CERT_LIST:
1146 return(ctx->max_cert_list); 1171 return (ctx->max_cert_list);
1147 case SSL_CTRL_SET_MAX_CERT_LIST: 1172 case SSL_CTRL_SET_MAX_CERT_LIST:
1148 l=ctx->max_cert_list; 1173 l = ctx->max_cert_list;
1149 ctx->max_cert_list=larg; 1174 ctx->max_cert_list = larg;
1150 return(l); 1175 return (l);
1151 1176
1152 case SSL_CTRL_SET_SESS_CACHE_SIZE: 1177 case SSL_CTRL_SET_SESS_CACHE_SIZE:
1153 l=ctx->session_cache_size; 1178 l = ctx->session_cache_size;
1154 ctx->session_cache_size=larg; 1179 ctx->session_cache_size = larg;
1155 return(l); 1180 return (l);
1156 case SSL_CTRL_GET_SESS_CACHE_SIZE: 1181 case SSL_CTRL_GET_SESS_CACHE_SIZE:
1157 return(ctx->session_cache_size); 1182 return (ctx->session_cache_size);
1158 case SSL_CTRL_SET_SESS_CACHE_MODE: 1183 case SSL_CTRL_SET_SESS_CACHE_MODE:
1159 l=ctx->session_cache_mode; 1184 l = ctx->session_cache_mode;
1160 ctx->session_cache_mode=larg; 1185 ctx->session_cache_mode = larg;
1161 return(l); 1186 return (l);
1162 case SSL_CTRL_GET_SESS_CACHE_MODE: 1187 case SSL_CTRL_GET_SESS_CACHE_MODE:
1163 return(ctx->session_cache_mode); 1188 return (ctx->session_cache_mode);
1164 1189
1165 case SSL_CTRL_SESS_NUMBER: 1190 case SSL_CTRL_SESS_NUMBER:
1166 return(lh_SSL_SESSION_num_items(ctx->sessions)); 1191 return (lh_SSL_SESSION_num_items(ctx->sessions));
1167 case SSL_CTRL_SESS_CONNECT: 1192 case SSL_CTRL_SESS_CONNECT:
1168 return(ctx->stats.sess_connect); 1193 return (ctx->stats.sess_connect);
1169 case SSL_CTRL_SESS_CONNECT_GOOD: 1194 case SSL_CTRL_SESS_CONNECT_GOOD:
1170 return(ctx->stats.sess_connect_good); 1195 return (ctx->stats.sess_connect_good);
1171 case SSL_CTRL_SESS_CONNECT_RENEGOTIATE: 1196 case SSL_CTRL_SESS_CONNECT_RENEGOTIATE:
1172 return(ctx->stats.sess_connect_renegotiate); 1197 return (ctx->stats.sess_connect_renegotiate);
1173 case SSL_CTRL_SESS_ACCEPT: 1198 case SSL_CTRL_SESS_ACCEPT:
1174 return(ctx->stats.sess_accept); 1199 return (ctx->stats.sess_accept);
1175 case SSL_CTRL_SESS_ACCEPT_GOOD: 1200 case SSL_CTRL_SESS_ACCEPT_GOOD:
1176 return(ctx->stats.sess_accept_good); 1201 return (ctx->stats.sess_accept_good);
1177 case SSL_CTRL_SESS_ACCEPT_RENEGOTIATE: 1202 case SSL_CTRL_SESS_ACCEPT_RENEGOTIATE:
1178 return(ctx->stats.sess_accept_renegotiate); 1203 return (ctx->stats.sess_accept_renegotiate);
1179 case SSL_CTRL_SESS_HIT: 1204 case SSL_CTRL_SESS_HIT:
1180 return(ctx->stats.sess_hit); 1205 return (ctx->stats.sess_hit);
1181 case SSL_CTRL_SESS_CB_HIT: 1206 case SSL_CTRL_SESS_CB_HIT:
1182 return(ctx->stats.sess_cb_hit); 1207 return (ctx->stats.sess_cb_hit);
1183 case SSL_CTRL_SESS_MISSES: 1208 case SSL_CTRL_SESS_MISSES:
1184 return(ctx->stats.sess_miss); 1209 return (ctx->stats.sess_miss);
1185 case SSL_CTRL_SESS_TIMEOUTS: 1210 case SSL_CTRL_SESS_TIMEOUTS:
1186 return(ctx->stats.sess_timeout); 1211 return (ctx->stats.sess_timeout);
1187 case SSL_CTRL_SESS_CACHE_FULL: 1212 case SSL_CTRL_SESS_CACHE_FULL:
1188 return(ctx->stats.sess_cache_full); 1213 return (ctx->stats.sess_cache_full);
1189 case SSL_CTRL_OPTIONS: 1214 case SSL_CTRL_OPTIONS:
1190 return(ctx->options|=larg); 1215 return (ctx->options|=larg);
1191 case SSL_CTRL_CLEAR_OPTIONS: 1216 case SSL_CTRL_CLEAR_OPTIONS:
1192 return(ctx->options&=~larg); 1217 return (ctx->options&=~larg);
1193 case SSL_CTRL_MODE: 1218 case SSL_CTRL_MODE:
1194 return(ctx->mode|=larg); 1219 return (ctx->mode|=larg);
1195 case SSL_CTRL_CLEAR_MODE: 1220 case SSL_CTRL_CLEAR_MODE:
1196 return(ctx->mode&=~larg); 1221 return (ctx->mode&=~larg);
1197 case SSL_CTRL_SET_MAX_SEND_FRAGMENT: 1222 case SSL_CTRL_SET_MAX_SEND_FRAGMENT:
1198 if (larg < 512 || larg > SSL3_RT_MAX_PLAIN_LENGTH) 1223 if (larg < 512 || larg > SSL3_RT_MAX_PLAIN_LENGTH)
1199 return 0; 1224 return 0;
1200 ctx->max_send_fragment = larg; 1225 ctx->max_send_fragment = larg;
1201 return 1; 1226 return 1;
1202 default: 1227 default:
1203 return(ctx->method->ssl_ctx_ctrl(ctx,cmd,larg,parg)); 1228 return (ctx->method->ssl_ctx_ctrl(ctx, cmd, larg, parg));
1204 }
1205 } 1229 }
1230}
1206 1231
1207long SSL_CTX_callback_ctrl(SSL_CTX *ctx, int cmd, void (*fp)(void)) 1232long
1208 { 1233SSL_CTX_callback_ctrl(SSL_CTX *ctx, int cmd, void (*fp)(void))
1209 switch(cmd) 1234{
1210 { 1235 switch (cmd) {
1211 case SSL_CTRL_SET_MSG_CALLBACK: 1236 case SSL_CTRL_SET_MSG_CALLBACK:
1212 ctx->msg_callback = (void (*)(int write_p, int version, int content_type, const void *buf, size_t len, SSL *ssl, void *arg))(fp); 1237 ctx->msg_callback = (void (*)(int write_p, int version, int content_type, const void *buf, size_t len, SSL *ssl, void *arg))(fp);
1213 return 1; 1238 return 1;
1214 1239
1215 default: 1240 default:
1216 return(ctx->method->ssl_ctx_callback_ctrl(ctx,cmd,fp)); 1241 return (ctx->method->ssl_ctx_callback_ctrl(ctx, cmd, fp));
1217 }
1218 } 1242 }
1243}
1219 1244
1220int ssl_cipher_id_cmp(const SSL_CIPHER *a, const SSL_CIPHER *b) 1245int
1221 { 1246ssl_cipher_id_cmp(const SSL_CIPHER *a, const SSL_CIPHER *b)
1247{
1222 long l; 1248 long l;
1223 1249
1224 l=a->id-b->id; 1250 l = a->id - b->id;
1225 if (l == 0L) 1251 if (l == 0L)
1226 return(0); 1252 return (0);
1227 else 1253 else
1228 return((l > 0)?1:-1); 1254 return ((l > 0) ? 1:-1);
1229 } 1255}
1230 1256
1231int ssl_cipher_ptr_id_cmp(const SSL_CIPHER * const *ap, 1257int
1232 const SSL_CIPHER * const *bp) 1258ssl_cipher_ptr_id_cmp(const SSL_CIPHER * const *ap,
1233 { 1259 const SSL_CIPHER * const *bp)
1260{
1234 long l; 1261 long l;
1235 1262
1236 l=(*ap)->id-(*bp)->id; 1263 l = (*ap)->id - (*bp)->id;
1237 if (l == 0L) 1264 if (l == 0L)
1238 return(0); 1265 return (0);
1239 else 1266 else
1240 return((l > 0)?1:-1); 1267 return ((l > 0) ? 1:-1);
1241 } 1268}
1242 1269
1243/** return a STACK of the ciphers available for the SSL and in order of 1270/** return a STACK of the ciphers available for the SSL and in order of
1244 * preference */ 1271 * preference */
1245STACK_OF(SSL_CIPHER) *SSL_get_ciphers(const SSL *s) 1272STACK_OF(SSL_CIPHER)
1246 { 1273*SSL_get_ciphers(const SSL *s)
1247 if (s != NULL) 1274{
1248 { 1275 if (s != NULL) {
1249 if (s->cipher_list != NULL) 1276 if (s->cipher_list != NULL) {
1250 { 1277 return (s->cipher_list);
1251 return(s->cipher_list); 1278 } else if ((s->ctx != NULL) &&
1252 } 1279 (s->ctx->cipher_list != NULL)) {
1253 else if ((s->ctx != NULL) && 1280 return (s->ctx->cipher_list);
1254 (s->ctx->cipher_list != NULL))
1255 {
1256 return(s->ctx->cipher_list);
1257 }
1258 } 1281 }
1259 return(NULL);
1260 } 1282 }
1283 return (NULL);
1284}
1261 1285
1262/** return a STACK of the ciphers available for the SSL and in order of 1286/** return a STACK of the ciphers available for the SSL and in order of
1263 * algorithm id */ 1287 * algorithm id */
1264STACK_OF(SSL_CIPHER) *ssl_get_ciphers_by_id(SSL *s) 1288STACK_OF(SSL_CIPHER)
1265 { 1289*ssl_get_ciphers_by_id(SSL *s)
1266 if (s != NULL) 1290{
1267 { 1291 if (s != NULL) {
1268 if (s->cipher_list_by_id != NULL) 1292 if (s->cipher_list_by_id != NULL) {
1269 { 1293 return (s->cipher_list_by_id);
1270 return(s->cipher_list_by_id); 1294 } else if ((s->ctx != NULL) &&
1271 } 1295 (s->ctx->cipher_list_by_id != NULL)) {
1272 else if ((s->ctx != NULL) && 1296 return (s->ctx->cipher_list_by_id);
1273 (s->ctx->cipher_list_by_id != NULL))
1274 {
1275 return(s->ctx->cipher_list_by_id);
1276 }
1277 } 1297 }
1278 return(NULL);
1279 } 1298 }
1299 return (NULL);
1300}
1280 1301
1281/** The old interface to get the same thing as SSL_get_ciphers() */ 1302/** The old interface to get the same thing as SSL_get_ciphers() */
1282const char *SSL_get_cipher_list(const SSL *s,int n) 1303const char
1283 { 1304*SSL_get_cipher_list(const SSL *s, int n)
1305{
1284 SSL_CIPHER *c; 1306 SSL_CIPHER *c;
1285 STACK_OF(SSL_CIPHER) *sk; 1307 STACK_OF(SSL_CIPHER) *sk;
1286 1308
1287 if (s == NULL) return(NULL); 1309 if (s == NULL)
1288 sk=SSL_get_ciphers(s); 1310 return (NULL);
1311 sk = SSL_get_ciphers(s);
1289 if ((sk == NULL) || (sk_SSL_CIPHER_num(sk) <= n)) 1312 if ((sk == NULL) || (sk_SSL_CIPHER_num(sk) <= n))
1290 return(NULL); 1313 return (NULL);
1291 c=sk_SSL_CIPHER_value(sk,n); 1314 c = sk_SSL_CIPHER_value(sk, n);
1292 if (c == NULL) return(NULL); 1315 if (c == NULL)
1293 return(c->name); 1316 return (NULL);
1294 } 1317 return (c->name);
1318}
1295 1319
1296/** specify the ciphers to be used by default by the SSL_CTX */ 1320/** specify the ciphers to be used by default by the SSL_CTX */
1297int SSL_CTX_set_cipher_list(SSL_CTX *ctx, const char *str) 1321int
1298 { 1322SSL_CTX_set_cipher_list(SSL_CTX *ctx, const char *str)
1323{
1299 STACK_OF(SSL_CIPHER) *sk; 1324 STACK_OF(SSL_CIPHER) *sk;
1300 1325
1301 sk=ssl_create_cipher_list(ctx->method,&ctx->cipher_list, 1326 sk = ssl_create_cipher_list(ctx->method, &ctx->cipher_list,
1302 &ctx->cipher_list_by_id,str); 1327 &ctx->cipher_list_by_id, str);
1303 /* ssl_create_cipher_list may return an empty stack if it 1328 /* ssl_create_cipher_list may return an empty stack if it
1304 * was unable to find a cipher matching the given rule string 1329 * was unable to find a cipher matching the given rule string
1305 * (for example if the rule string specifies a cipher which 1330 * (for example if the rule string specifies a cipher which
@@ -1309,35 +1334,35 @@ int SSL_CTX_set_cipher_list(SSL_CTX *ctx, const char *str)
1309 * updated. */ 1334 * updated. */
1310 if (sk == NULL) 1335 if (sk == NULL)
1311 return 0; 1336 return 0;
1312 else if (sk_SSL_CIPHER_num(sk) == 0) 1337 else if (sk_SSL_CIPHER_num(sk) == 0) {
1313 {
1314 SSLerr(SSL_F_SSL_CTX_SET_CIPHER_LIST, SSL_R_NO_CIPHER_MATCH); 1338 SSLerr(SSL_F_SSL_CTX_SET_CIPHER_LIST, SSL_R_NO_CIPHER_MATCH);
1315 return 0; 1339 return 0;
1316 }
1317 return 1;
1318 } 1340 }
1341 return 1;
1342}
1319 1343
1320/** specify the ciphers to be used by the SSL */ 1344/** specify the ciphers to be used by the SSL */
1321int SSL_set_cipher_list(SSL *s,const char *str) 1345int
1322 { 1346SSL_set_cipher_list(SSL *s, const char *str)
1347{
1323 STACK_OF(SSL_CIPHER) *sk; 1348 STACK_OF(SSL_CIPHER) *sk;
1324 1349
1325 sk=ssl_create_cipher_list(s->ctx->method,&s->cipher_list, 1350 sk = ssl_create_cipher_list(s->ctx->method, &s->cipher_list,
1326 &s->cipher_list_by_id,str); 1351 &s->cipher_list_by_id, str);
1327 /* see comment in SSL_CTX_set_cipher_list */ 1352 /* see comment in SSL_CTX_set_cipher_list */
1328 if (sk == NULL) 1353 if (sk == NULL)
1329 return 0; 1354 return 0;
1330 else if (sk_SSL_CIPHER_num(sk) == 0) 1355 else if (sk_SSL_CIPHER_num(sk) == 0) {
1331 {
1332 SSLerr(SSL_F_SSL_SET_CIPHER_LIST, SSL_R_NO_CIPHER_MATCH); 1356 SSLerr(SSL_F_SSL_SET_CIPHER_LIST, SSL_R_NO_CIPHER_MATCH);
1333 return 0; 1357 return 0;
1334 }
1335 return 1;
1336 } 1358 }
1359 return 1;
1360}
1337 1361
1338/* works well for SSLv2, not so good for SSLv3 */ 1362/* works well for SSLv2, not so good for SSLv3 */
1339char *SSL_get_shared_ciphers(const SSL *s,char *buf,int len) 1363char
1340 { 1364*SSL_get_shared_ciphers(const SSL *s, char *buf, int len)
1365{
1341 char *end; 1366 char *end;
1342 STACK_OF(SSL_CIPHER) *sk; 1367 STACK_OF(SSL_CIPHER) *sk;
1343 SSL_CIPHER *c; 1368 SSL_CIPHER *c;
@@ -1346,146 +1371,138 @@ char *SSL_get_shared_ciphers(const SSL *s,char *buf,int len)
1346 1371
1347 if ((s->session == NULL) || (s->session->ciphers == NULL) || 1372 if ((s->session == NULL) || (s->session->ciphers == NULL) ||
1348 (len < 2)) 1373 (len < 2))
1349 return(NULL); 1374 return (NULL);
1350 1375
1351 sk=s->session->ciphers; 1376 sk = s->session->ciphers;
1352 buf[0] = '\0'; 1377 buf[0] = '\0';
1353 for (i=0; i<sk_SSL_CIPHER_num(sk); i++) 1378 for (i = 0; i < sk_SSL_CIPHER_num(sk); i++) {
1354 { 1379 c = sk_SSL_CIPHER_value(sk, i);
1355 c=sk_SSL_CIPHER_value(sk,i);
1356 end = buf + curlen; 1380 end = buf + curlen;
1357 if (strlcat(buf, c->name, len) >= len || 1381 if (strlcat(buf, c->name, len) >= len ||
1358 (curlen = strlcat(buf, ":", len)) >= len) 1382 (curlen = strlcat(buf, ":", len)) >= len) {
1359 {
1360 /* remove truncated cipher from list */ 1383 /* remove truncated cipher from list */
1361 *end = '\0'; 1384 *end = '\0';
1362 break; 1385 break;
1363 }
1364 } 1386 }
1387 }
1365 /* remove trailing colon */ 1388 /* remove trailing colon */
1366 if ((end = strrchr(buf, ':')) != NULL) 1389 if ((end = strrchr(buf, ':')) != NULL)
1367 *end = '\0'; 1390 *end = '\0';
1368 return(buf); 1391 return (buf);
1369 } 1392}
1370 1393
1371int ssl_cipher_list_to_bytes(SSL *s,STACK_OF(SSL_CIPHER) *sk,unsigned char *p, 1394int
1372 int (*put_cb)(const SSL_CIPHER *, unsigned char *)) 1395ssl_cipher_list_to_bytes(SSL *s, STACK_OF(SSL_CIPHER) *sk, unsigned char *p,
1373 { 1396 int (*put_cb)(const SSL_CIPHER *, unsigned char *))
1374 int i,j=0; 1397{
1398 int i, j = 0;
1375 SSL_CIPHER *c; 1399 SSL_CIPHER *c;
1376 unsigned char *q; 1400 unsigned char *q;
1377#ifndef OPENSSL_NO_KRB5 1401#ifndef OPENSSL_NO_KRB5
1378 int nokrb5 = !kssl_tgt_is_available(s->kssl_ctx); 1402 int nokrb5 = !kssl_tgt_is_available(s->kssl_ctx);
1379#endif /* OPENSSL_NO_KRB5 */ 1403#endif /* OPENSSL_NO_KRB5 */
1380 1404
1381 if (sk == NULL) return(0); 1405 if (sk == NULL)
1382 q=p; 1406 return (0);
1407 q = p;
1383 1408
1384 for (i=0; i<sk_SSL_CIPHER_num(sk); i++) 1409 for (i = 0; i < sk_SSL_CIPHER_num(sk); i++) {
1385 { 1410 c = sk_SSL_CIPHER_value(sk, i);
1386 c=sk_SSL_CIPHER_value(sk,i);
1387 /* Skip TLS v1.2 only ciphersuites if lower than v1.2 */ 1411 /* Skip TLS v1.2 only ciphersuites if lower than v1.2 */
1388 if ((c->algorithm_ssl & SSL_TLSV1_2) && 1412 if ((c->algorithm_ssl & SSL_TLSV1_2) &&
1389 (TLS1_get_client_version(s) < TLS1_2_VERSION)) 1413 (TLS1_get_client_version(s) < TLS1_2_VERSION))
1390 continue; 1414 continue;
1391#ifndef OPENSSL_NO_KRB5 1415#ifndef OPENSSL_NO_KRB5
1392 if (((c->algorithm_mkey & SSL_kKRB5) || (c->algorithm_auth & SSL_aKRB5)) && 1416 if (((c->algorithm_mkey & SSL_kKRB5) || (c->algorithm_auth & SSL_aKRB5)) &&
1393 nokrb5) 1417 nokrb5)
1394 continue; 1418 continue;
1395#endif /* OPENSSL_NO_KRB5 */ 1419#endif /* OPENSSL_NO_KRB5 */
1396#ifndef OPENSSL_NO_PSK 1420#ifndef OPENSSL_NO_PSK
1397 /* with PSK there must be client callback set */ 1421 /* with PSK there must be client callback set */
1398 if (((c->algorithm_mkey & SSL_kPSK) || (c->algorithm_auth & SSL_aPSK)) && 1422 if (((c->algorithm_mkey & SSL_kPSK) || (c->algorithm_auth & SSL_aPSK)) &&
1399 s->psk_client_callback == NULL) 1423 s->psk_client_callback == NULL)
1400 continue; 1424 continue;
1401#endif /* OPENSSL_NO_PSK */ 1425#endif /* OPENSSL_NO_PSK */
1402 j = put_cb ? put_cb(c,p) : ssl_put_cipher_by_char(s,c,p); 1426 j = put_cb ? put_cb(c, p) : ssl_put_cipher_by_char(s, c, p);
1403 p+=j; 1427 p += j;
1404 } 1428 }
1405 /* If p == q, no ciphers and caller indicates an error. Otherwise 1429 /* If p == q, no ciphers and caller indicates an error. Otherwise
1406 * add SCSV if not renegotiating. 1430 * add SCSV if not renegotiating.
1407 */ 1431 */
1408 if (p != q && !s->renegotiate) 1432 if (p != q && !s->renegotiate) {
1409 { 1433 static SSL_CIPHER scsv = {
1410 static SSL_CIPHER scsv =
1411 {
1412 0, NULL, SSL3_CK_SCSV, 0, 0, 0, 0, 0, 0, 0, 0, 0 1434 0, NULL, SSL3_CK_SCSV, 0, 0, 0, 0, 0, 0, 0, 0, 0
1413 }; 1435 };
1414 j = put_cb ? put_cb(&scsv,p) : ssl_put_cipher_by_char(s,&scsv,p); 1436 j = put_cb ? put_cb(&scsv, p) : ssl_put_cipher_by_char(s, &scsv, p);
1415 p+=j; 1437 p += j;
1416#ifdef OPENSSL_RI_DEBUG 1438#ifdef OPENSSL_RI_DEBUG
1417 fprintf(stderr, "SCSV sent by client\n"); 1439 fprintf(stderr, "SCSV sent by client\n");
1418#endif 1440#endif
1419 }
1420
1421 return(p-q);
1422 } 1441 }
1423 1442
1424STACK_OF(SSL_CIPHER) *ssl_bytes_to_cipher_list(SSL *s,unsigned char *p,int num, 1443 return (p - q);
1425 STACK_OF(SSL_CIPHER) **skp) 1444}
1426 { 1445
1446STACK_OF(SSL_CIPHER)
1447*ssl_bytes_to_cipher_list(SSL *s, unsigned char *p, int num,
1448STACK_OF(SSL_CIPHER) **skp)
1449{
1427 const SSL_CIPHER *c; 1450 const SSL_CIPHER *c;
1428 STACK_OF(SSL_CIPHER) *sk; 1451 STACK_OF(SSL_CIPHER) *sk;
1429 int i,n; 1452 int i, n;
1430 if (s->s3) 1453 if (s->s3)
1431 s->s3->send_connection_binding = 0; 1454 s->s3->send_connection_binding = 0;
1432 1455
1433 n=ssl_put_cipher_by_char(s,NULL,NULL); 1456 n = ssl_put_cipher_by_char(s, NULL, NULL);
1434 if ((num%n) != 0) 1457 if ((num % n) != 0) {
1435 { 1458 SSLerr(SSL_F_SSL_BYTES_TO_CIPHER_LIST, SSL_R_ERROR_IN_RECEIVED_CIPHER_LIST);
1436 SSLerr(SSL_F_SSL_BYTES_TO_CIPHER_LIST,SSL_R_ERROR_IN_RECEIVED_CIPHER_LIST); 1459 return (NULL);
1437 return(NULL); 1460 }
1438 }
1439 if ((skp == NULL) || (*skp == NULL)) 1461 if ((skp == NULL) || (*skp == NULL))
1440 sk=sk_SSL_CIPHER_new_null(); /* change perhaps later */ 1462 sk=sk_SSL_CIPHER_new_null(); /* change perhaps later */
1441 else 1463 else {
1442 {
1443 sk= *skp; 1464 sk= *skp;
1444 sk_SSL_CIPHER_zero(sk); 1465 sk_SSL_CIPHER_zero(sk);
1445 } 1466 }
1446 1467
1447 for (i=0; i<num; i+=n) 1468 for (i = 0; i < num; i += n) {
1448 {
1449 /* Check for SCSV */ 1469 /* Check for SCSV */
1450 if (s->s3 && (n != 3 || !p[0]) && 1470 if (s->s3 && (n != 3 || !p[0]) &&
1451 (p[n-2] == ((SSL3_CK_SCSV >> 8) & 0xff)) && 1471 (p[n - 2] == ((SSL3_CK_SCSV >> 8) & 0xff)) &&
1452 (p[n-1] == (SSL3_CK_SCSV & 0xff))) 1472 (p[n - 1] == (SSL3_CK_SCSV & 0xff))) {
1453 {
1454 /* SCSV fatal if renegotiating */ 1473 /* SCSV fatal if renegotiating */
1455 if (s->renegotiate) 1474 if (s->renegotiate) {
1456 { 1475 SSLerr(SSL_F_SSL_BYTES_TO_CIPHER_LIST, SSL_R_SCSV_RECEIVED_WHEN_RENEGOTIATING);
1457 SSLerr(SSL_F_SSL_BYTES_TO_CIPHER_LIST,SSL_R_SCSV_RECEIVED_WHEN_RENEGOTIATING); 1476 ssl3_send_alert(s, SSL3_AL_FATAL, SSL_AD_HANDSHAKE_FAILURE);
1458 ssl3_send_alert(s,SSL3_AL_FATAL,SSL_AD_HANDSHAKE_FAILURE); 1477
1459 goto err; 1478 goto err;
1460 } 1479 }
1461 s->s3->send_connection_binding = 1; 1480 s->s3->send_connection_binding = 1;
1462 p += n; 1481 p += n;
1463#ifdef OPENSSL_RI_DEBUG 1482#ifdef OPENSSL_RI_DEBUG
1464 fprintf(stderr, "SCSV received by server\n"); 1483 fprintf(stderr, "SCSV received by server\n");
1465#endif 1484#endif
1466 continue; 1485 continue;
1467 } 1486 }
1468 1487
1469 c=ssl_get_cipher_by_char(s,p); 1488 c = ssl_get_cipher_by_char(s, p);
1470 p+=n; 1489 p += n;
1471 if (c != NULL) 1490 if (c != NULL) {
1472 { 1491 if (!sk_SSL_CIPHER_push(sk, c)) {
1473 if (!sk_SSL_CIPHER_push(sk,c)) 1492 SSLerr(SSL_F_SSL_BYTES_TO_CIPHER_LIST, ERR_R_MALLOC_FAILURE);
1474 {
1475 SSLerr(SSL_F_SSL_BYTES_TO_CIPHER_LIST,ERR_R_MALLOC_FAILURE);
1476 goto err; 1493 goto err;
1477 }
1478 } 1494 }
1479 } 1495 }
1496 }
1480 1497
1481 if (skp != NULL) 1498 if (skp != NULL)
1482 *skp=sk; 1499 *skp = sk;
1483 return(sk); 1500 return (sk);
1484err: 1501err:
1485 if ((skp == NULL) || (*skp == NULL)) 1502 if ((skp == NULL) || (*skp == NULL))
1486 sk_SSL_CIPHER_free(sk); 1503 sk_SSL_CIPHER_free(sk);
1487 return(NULL); 1504 return (NULL);
1488 } 1505}
1489 1506
1490 1507
1491#ifndef OPENSSL_NO_TLSEXT 1508#ifndef OPENSSL_NO_TLSEXT
@@ -1493,22 +1510,24 @@ err:
1493 * So far, only host_name types are defined (RFC 3546). 1510 * So far, only host_name types are defined (RFC 3546).
1494 */ 1511 */
1495 1512
1496const char *SSL_get_servername(const SSL *s, const int type) 1513const char
1497 { 1514*SSL_get_servername(const SSL *s, const int type)
1515{
1498 if (type != TLSEXT_NAMETYPE_host_name) 1516 if (type != TLSEXT_NAMETYPE_host_name)
1499 return NULL; 1517 return NULL;
1500 1518
1501 return s->session && !s->tlsext_hostname ? 1519 return s->session && !s->tlsext_hostname ?
1502 s->session->tlsext_hostname : 1520 s->session->tlsext_hostname :
1503 s->tlsext_hostname; 1521 s->tlsext_hostname;
1504 } 1522}
1505 1523
1506int SSL_get_servername_type(const SSL *s) 1524int
1507 { 1525SSL_get_servername_type(const SSL *s)
1526{
1508 if (s->session && (!s->tlsext_hostname ? s->session->tlsext_hostname : s->tlsext_hostname)) 1527 if (s->session && (!s->tlsext_hostname ? s->session->tlsext_hostname : s->tlsext_hostname))
1509 return TLSEXT_NAMETYPE_host_name; 1528 return TLSEXT_NAMETYPE_host_name;
1510 return -1; 1529 return -1;
1511 } 1530}
1512 1531
1513# ifndef OPENSSL_NO_NEXTPROTONEG 1532# ifndef OPENSSL_NO_NEXTPROTONEG
1514/* SSL_select_next_proto implements the standard protocol selection. It is 1533/* SSL_select_next_proto implements the standard protocol selection. It is
@@ -1541,31 +1560,29 @@ int SSL_get_servername_type(const SSL *s)
1541 * OPENSSL_NPN_NEGOTIATED if a common protocol was found, or 1560 * OPENSSL_NPN_NEGOTIATED if a common protocol was found, or
1542 * OPENSSL_NPN_NO_OVERLAP if the fallback case was reached. 1561 * OPENSSL_NPN_NO_OVERLAP if the fallback case was reached.
1543 */ 1562 */
1544int SSL_select_next_proto(unsigned char **out, unsigned char *outlen, const unsigned char *server, unsigned int server_len, const unsigned char *client, unsigned int client_len) 1563int
1545 { 1564SSL_select_next_proto(unsigned char **out, unsigned char *outlen, const unsigned char *server, unsigned int server_len, const unsigned char *client, unsigned int client_len)
1565{
1546 unsigned int i, j; 1566 unsigned int i, j;
1547 const unsigned char *result; 1567 const unsigned char *result;
1548 int status = OPENSSL_NPN_UNSUPPORTED; 1568 int status = OPENSSL_NPN_UNSUPPORTED;
1549 1569
1550 /* For each protocol in server preference order, see if we support it. */ 1570 /* For each protocol in server preference order, see if we support it. */
1551 for (i = 0; i < server_len; ) 1571 for (i = 0; i < server_len; ) {
1552 { 1572 for (j = 0; j < client_len; ) {
1553 for (j = 0; j < client_len; )
1554 {
1555 if (server[i] == client[j] && 1573 if (server[i] == client[j] &&
1556 memcmp(&server[i+1], &client[j+1], server[i]) == 0) 1574 memcmp(&server[i + 1], &client[j + 1], server[i]) == 0) {
1557 {
1558 /* We found a match */ 1575 /* We found a match */
1559 result = &server[i]; 1576 result = &server[i];
1560 status = OPENSSL_NPN_NEGOTIATED; 1577 status = OPENSSL_NPN_NEGOTIATED;
1561 goto found; 1578 goto found;
1562 } 1579 }
1563 j += client[j]; 1580 j += client[j];
1564 j++; 1581 j++;
1565 } 1582 }
1566 i += server[i]; 1583 i += server[i];
1567 i++; 1584 i++;
1568 } 1585 }
1569 1586
1570 /* There's no overlap between our protocols and the server's list. */ 1587 /* There's no overlap between our protocols and the server's list. */
1571 result = client; 1588 result = client;
@@ -1575,7 +1592,7 @@ int SSL_select_next_proto(unsigned char **out, unsigned char *outlen, const unsi
1575 *out = (unsigned char *) result + 1; 1592 *out = (unsigned char *) result + 1;
1576 *outlen = result[0]; 1593 *outlen = result[0];
1577 return status; 1594 return status;
1578 } 1595}
1579 1596
1580/* SSL_get0_next_proto_negotiated sets *data and *len to point to the client's 1597/* SSL_get0_next_proto_negotiated sets *data and *len to point to the client's
1581 * requested protocol for this connection and returns 0. If the client didn't 1598 * requested protocol for this connection and returns 0. If the client didn't
@@ -1585,8 +1602,9 @@ int SSL_select_next_proto(unsigned char **out, unsigned char *outlen, const unsi
1585 * from this function need not be a member of the list of supported protocols 1602 * from this function need not be a member of the list of supported protocols
1586 * provided by the callback. 1603 * provided by the callback.
1587 */ 1604 */
1588void SSL_get0_next_proto_negotiated(const SSL *s, const unsigned char **data, unsigned *len) 1605void
1589 { 1606SSL_get0_next_proto_negotiated(const SSL *s, const unsigned char **data, unsigned *len)
1607{
1590 *data = s->next_proto_negotiated; 1608 *data = s->next_proto_negotiated;
1591 if (!*data) { 1609 if (!*data) {
1592 *len = 0; 1610 *len = 0;
@@ -1604,11 +1622,12 @@ void SSL_get0_next_proto_negotiated(const SSL *s, const unsigned char **data, un
1604 * 1622 *
1605 * The callback should return SSL_TLSEXT_ERR_OK if it wishes to advertise. Otherwise, no 1623 * The callback should return SSL_TLSEXT_ERR_OK if it wishes to advertise. Otherwise, no
1606 * such extension will be included in the ServerHello. */ 1624 * such extension will be included in the ServerHello. */
1607void SSL_CTX_set_next_protos_advertised_cb(SSL_CTX *ctx, int (*cb) (SSL *ssl, const unsigned char **out, unsigned int *outlen, void *arg), void *arg) 1625void
1608 { 1626SSL_CTX_set_next_protos_advertised_cb(SSL_CTX *ctx, int (*cb) (SSL *ssl, const unsigned char **out, unsigned int *outlen, void *arg), void *arg)
1627{
1609 ctx->next_protos_advertised_cb = cb; 1628 ctx->next_protos_advertised_cb = cb;
1610 ctx->next_protos_advertised_cb_arg = arg; 1629 ctx->next_protos_advertised_cb_arg = arg;
1611 } 1630}
1612 1631
1613/* SSL_CTX_set_next_proto_select_cb sets a callback that is called when a 1632/* SSL_CTX_set_next_proto_select_cb sets a callback that is called when a
1614 * client needs to select a protocol from the server's provided list. |out| 1633 * client needs to select a protocol from the server's provided list. |out|
@@ -1620,183 +1639,186 @@ void SSL_CTX_set_next_protos_advertised_cb(SSL_CTX *ctx, int (*cb) (SSL *ssl, co
1620 * The client must select a protocol. It is fatal to the connection if this 1639 * The client must select a protocol. It is fatal to the connection if this
1621 * callback returns a value other than SSL_TLSEXT_ERR_OK. 1640 * callback returns a value other than SSL_TLSEXT_ERR_OK.
1622 */ 1641 */
1623void SSL_CTX_set_next_proto_select_cb(SSL_CTX *ctx, int (*cb) (SSL *s, unsigned char **out, unsigned char *outlen, const unsigned char *in, unsigned int inlen, void *arg), void *arg) 1642void
1624 { 1643SSL_CTX_set_next_proto_select_cb(SSL_CTX *ctx, int (*cb) (SSL *s, unsigned char **out, unsigned char *outlen, const unsigned char *in, unsigned int inlen, void *arg), void *arg)
1644{
1625 ctx->next_proto_select_cb = cb; 1645 ctx->next_proto_select_cb = cb;
1626 ctx->next_proto_select_cb_arg = arg; 1646 ctx->next_proto_select_cb_arg = arg;
1627 } 1647}
1628# endif 1648# endif
1629#endif 1649#endif
1630 1650
1631int SSL_export_keying_material(SSL *s, unsigned char *out, size_t olen, 1651int
1632 const char *label, size_t llen, const unsigned char *p, size_t plen, 1652SSL_export_keying_material(SSL *s, unsigned char *out, size_t olen,
1633 int use_context) 1653 const char *label, size_t llen, const unsigned char *p, size_t plen,
1634 { 1654int use_context)
1655{
1635 if (s->version < TLS1_VERSION) 1656 if (s->version < TLS1_VERSION)
1636 return -1; 1657 return -1;
1637 1658
1638 return s->method->ssl3_enc->export_keying_material(s, out, olen, label, 1659 return s->method->ssl3_enc->export_keying_material(s, out, olen, label,
1639 llen, p, plen, 1660 llen, p, plen,
1640 use_context); 1661 use_context);
1641 } 1662}
1642 1663
1643static unsigned long ssl_session_hash(const SSL_SESSION *a) 1664static unsigned long
1644 { 1665ssl_session_hash(const SSL_SESSION *a)
1666{
1645 unsigned long l; 1667 unsigned long l;
1646 1668
1647 l=(unsigned long) 1669 l = (unsigned long)
1648 ((unsigned int) a->session_id[0] )| 1670 ((unsigned int) a->session_id[0] )|
1649 ((unsigned int) a->session_id[1]<< 8L)| 1671 ((unsigned int) a->session_id[1]<< 8L)|
1650 ((unsigned long)a->session_id[2]<<16L)| 1672 ((unsigned long)a->session_id[2]<<16L)|
1651 ((unsigned long)a->session_id[3]<<24L); 1673 ((unsigned long)a->session_id[3]<<24L);
1652 return(l); 1674 return (l);
1653 } 1675}
1654 1676
1655/* NB: If this function (or indeed the hash function which uses a sort of 1677/* NB: If this function (or indeed the hash function which uses a sort of
1656 * coarser function than this one) is changed, ensure 1678 * coarser function than this one) is changed, ensure
1657 * SSL_CTX_has_matching_session_id() is checked accordingly. It relies on being 1679 * SSL_CTX_has_matching_session_id() is checked accordingly. It relies on being
1658 * able to construct an SSL_SESSION that will collide with any existing session 1680 * able to construct an SSL_SESSION that will collide with any existing session
1659 * with a matching session ID. */ 1681 * with a matching session ID. */
1660static int ssl_session_cmp(const SSL_SESSION *a,const SSL_SESSION *b) 1682static int
1661 { 1683ssl_session_cmp(const SSL_SESSION *a, const SSL_SESSION *b)
1684{
1662 if (a->ssl_version != b->ssl_version) 1685 if (a->ssl_version != b->ssl_version)
1663 return(1); 1686 return (1);
1664 if (a->session_id_length != b->session_id_length) 1687 if (a->session_id_length != b->session_id_length)
1665 return(1); 1688 return (1);
1666 return(memcmp(a->session_id,b->session_id,a->session_id_length)); 1689 return (memcmp(a->session_id, b->session_id, a->session_id_length));
1667 } 1690}
1668 1691
1669/* These wrapper functions should remain rather than redeclaring 1692/* These wrapper functions should remain rather than redeclaring
1670 * SSL_SESSION_hash and SSL_SESSION_cmp for void* types and casting each 1693 * SSL_SESSION_hash and SSL_SESSION_cmp for void* types and casting each
1671 * variable. The reason is that the functions aren't static, they're exposed via 1694 * variable. The reason is that the functions aren't static, they're exposed via
1672 * ssl.h. */ 1695 * ssl.h. */
1673static IMPLEMENT_LHASH_HASH_FN(ssl_session, SSL_SESSION) 1696static
1674static IMPLEMENT_LHASH_COMP_FN(ssl_session, SSL_SESSION) 1697IMPLEMENT_LHASH_HASH_FN(ssl_session, SSL_SESSION)
1698static
1699IMPLEMENT_LHASH_COMP_FN(ssl_session, SSL_SESSION)
1675 1700
1676SSL_CTX *SSL_CTX_new(const SSL_METHOD *meth) 1701SSL_CTX
1677 { 1702*SSL_CTX_new(const SSL_METHOD *meth)
1678 SSL_CTX *ret=NULL; 1703{
1704 SSL_CTX *ret = NULL;
1679 1705
1680 if (meth == NULL) 1706 if (meth == NULL) {
1681 { 1707 SSLerr(SSL_F_SSL_CTX_NEW, SSL_R_NULL_SSL_METHOD_PASSED);
1682 SSLerr(SSL_F_SSL_CTX_NEW,SSL_R_NULL_SSL_METHOD_PASSED); 1708 return (NULL);
1683 return(NULL); 1709 }
1684 }
1685 1710
1686#ifdef OPENSSL_FIPS 1711#ifdef OPENSSL_FIPS
1687 if (FIPS_mode() && (meth->version < TLS1_VERSION)) 1712 if (FIPS_mode() && (meth->version < TLS1_VERSION)) {
1688 {
1689 SSLerr(SSL_F_SSL_CTX_NEW, SSL_R_ONLY_TLS_ALLOWED_IN_FIPS_MODE); 1713 SSLerr(SSL_F_SSL_CTX_NEW, SSL_R_ONLY_TLS_ALLOWED_IN_FIPS_MODE);
1690 return NULL; 1714 return NULL;
1691 } 1715 }
1692#endif 1716#endif
1693 1717
1694 if (SSL_get_ex_data_X509_STORE_CTX_idx() < 0) 1718 if (SSL_get_ex_data_X509_STORE_CTX_idx() < 0) {
1695 { 1719 SSLerr(SSL_F_SSL_CTX_NEW, SSL_R_X509_VERIFICATION_SETUP_PROBLEMS);
1696 SSLerr(SSL_F_SSL_CTX_NEW,SSL_R_X509_VERIFICATION_SETUP_PROBLEMS);
1697 goto err; 1720 goto err;
1698 } 1721 }
1699 ret=(SSL_CTX *)OPENSSL_malloc(sizeof(SSL_CTX)); 1722 ret = (SSL_CTX *)OPENSSL_malloc(sizeof(SSL_CTX));
1700 if (ret == NULL) 1723 if (ret == NULL)
1701 goto err; 1724 goto err;
1702 1725
1703 memset(ret,0,sizeof(SSL_CTX)); 1726 memset(ret, 0, sizeof(SSL_CTX));
1704 1727
1705 ret->method=meth; 1728 ret->method = meth;
1706 1729
1707 ret->cert_store=NULL; 1730 ret->cert_store = NULL;
1708 ret->session_cache_mode=SSL_SESS_CACHE_SERVER; 1731 ret->session_cache_mode = SSL_SESS_CACHE_SERVER;
1709 ret->session_cache_size=SSL_SESSION_CACHE_MAX_SIZE_DEFAULT; 1732 ret->session_cache_size = SSL_SESSION_CACHE_MAX_SIZE_DEFAULT;
1710 ret->session_cache_head=NULL; 1733 ret->session_cache_head = NULL;
1711 ret->session_cache_tail=NULL; 1734 ret->session_cache_tail = NULL;
1712 1735
1713 /* We take the system default */ 1736 /* We take the system default */
1714 ret->session_timeout=meth->get_timeout(); 1737 ret->session_timeout = meth->get_timeout();
1715 1738
1716 ret->new_session_cb=0; 1739 ret->new_session_cb = 0;
1717 ret->remove_session_cb=0; 1740 ret->remove_session_cb = 0;
1718 ret->get_session_cb=0; 1741 ret->get_session_cb = 0;
1719 ret->generate_session_id=0; 1742 ret->generate_session_id = 0;
1720 1743
1721 memset((char *)&ret->stats,0,sizeof(ret->stats)); 1744 memset((char *)&ret->stats, 0, sizeof(ret->stats));
1722 1745
1723 ret->references=1; 1746 ret->references = 1;
1724 ret->quiet_shutdown=0; 1747 ret->quiet_shutdown = 0;
1725 1748
1726/* ret->cipher=NULL;*/ 1749/* ret->cipher=NULL;*/
1727/* ret->s2->challenge=NULL; 1750/* ret->s2->challenge=NULL;
1728 ret->master_key=NULL; 1751 ret->master_key=NULL;
1729 ret->key_arg=NULL; 1752 ret->key_arg=NULL;
1730 ret->s2->conn_id=NULL; */ 1753 ret->s2->conn_id=NULL;
1754*/
1731 1755
1732 ret->info_callback=NULL; 1756 ret->info_callback = NULL;
1733 1757
1734 ret->app_verify_callback=0; 1758 ret->app_verify_callback = 0;
1735 ret->app_verify_arg=NULL; 1759 ret->app_verify_arg = NULL;
1736 1760
1737 ret->max_cert_list=SSL_MAX_CERT_LIST_DEFAULT; 1761 ret->max_cert_list = SSL_MAX_CERT_LIST_DEFAULT;
1738 ret->read_ahead=0; 1762 ret->read_ahead = 0;
1739 ret->msg_callback=0; 1763 ret->msg_callback = 0;
1740 ret->msg_callback_arg=NULL; 1764 ret->msg_callback_arg = NULL;
1741 ret->verify_mode=SSL_VERIFY_NONE; 1765 ret->verify_mode = SSL_VERIFY_NONE;
1742#if 0 1766#if 0
1743 ret->verify_depth=-1; /* Don't impose a limit (but x509_lu.c does) */ 1767 ret->verify_depth=-1; /* Don't impose a limit (but x509_lu.c does) */
1744#endif 1768#endif
1745 ret->sid_ctx_length=0; 1769 ret->sid_ctx_length = 0;
1746 ret->default_verify_callback=NULL; 1770 ret->default_verify_callback = NULL;
1747 if ((ret->cert=ssl_cert_new()) == NULL) 1771 if ((ret->cert = ssl_cert_new()) == NULL)
1748 goto err; 1772 goto err;
1749 1773
1750 ret->default_passwd_callback=0; 1774 ret->default_passwd_callback = 0;
1751 ret->default_passwd_callback_userdata=NULL; 1775 ret->default_passwd_callback_userdata = NULL;
1752 ret->client_cert_cb=0; 1776 ret->client_cert_cb = 0;
1753 ret->app_gen_cookie_cb=0; 1777 ret->app_gen_cookie_cb = 0;
1754 ret->app_verify_cookie_cb=0; 1778 ret->app_verify_cookie_cb = 0;
1755 1779
1756 ret->sessions=lh_SSL_SESSION_new(); 1780 ret->sessions = lh_SSL_SESSION_new();
1757 if (ret->sessions == NULL) goto err; 1781 if (ret->sessions == NULL)
1758 ret->cert_store=X509_STORE_new(); 1782 goto err;
1759 if (ret->cert_store == NULL) goto err; 1783 ret->cert_store = X509_STORE_new();
1784 if (ret->cert_store == NULL)
1785 goto err;
1760 1786
1761 ssl_create_cipher_list(ret->method, 1787 ssl_create_cipher_list(ret->method,
1762 &ret->cipher_list,&ret->cipher_list_by_id, 1788 &ret->cipher_list, &ret->cipher_list_by_id,
1763 meth->version == SSL2_VERSION ? "SSLv2" : SSL_DEFAULT_CIPHER_LIST); 1789 meth->version == SSL2_VERSION ? "SSLv2" : SSL_DEFAULT_CIPHER_LIST);
1764 if (ret->cipher_list == NULL 1790 if (ret->cipher_list == NULL
1765 || sk_SSL_CIPHER_num(ret->cipher_list) <= 0) 1791 || sk_SSL_CIPHER_num(ret->cipher_list) <= 0) {
1766 { 1792 SSLerr(SSL_F_SSL_CTX_NEW, SSL_R_LIBRARY_HAS_NO_CIPHERS);
1767 SSLerr(SSL_F_SSL_CTX_NEW,SSL_R_LIBRARY_HAS_NO_CIPHERS);
1768 goto err2; 1793 goto err2;
1769 } 1794 }
1770 1795
1771 ret->param = X509_VERIFY_PARAM_new(); 1796 ret->param = X509_VERIFY_PARAM_new();
1772 if (!ret->param) 1797 if (!ret->param)
1773 goto err; 1798 goto err;
1774 1799
1775 if ((ret->rsa_md5=EVP_get_digestbyname("ssl2-md5")) == NULL) 1800 if ((ret->rsa_md5 = EVP_get_digestbyname("ssl2-md5")) == NULL) {
1776 { 1801 SSLerr(SSL_F_SSL_CTX_NEW, SSL_R_UNABLE_TO_LOAD_SSL2_MD5_ROUTINES);
1777 SSLerr(SSL_F_SSL_CTX_NEW,SSL_R_UNABLE_TO_LOAD_SSL2_MD5_ROUTINES);
1778 goto err2; 1802 goto err2;
1779 } 1803 }
1780 if ((ret->md5=EVP_get_digestbyname("ssl3-md5")) == NULL) 1804 if ((ret->md5 = EVP_get_digestbyname("ssl3-md5")) == NULL) {
1781 { 1805 SSLerr(SSL_F_SSL_CTX_NEW, SSL_R_UNABLE_TO_LOAD_SSL3_MD5_ROUTINES);
1782 SSLerr(SSL_F_SSL_CTX_NEW,SSL_R_UNABLE_TO_LOAD_SSL3_MD5_ROUTINES);
1783 goto err2; 1806 goto err2;
1784 } 1807 }
1785 if ((ret->sha1=EVP_get_digestbyname("ssl3-sha1")) == NULL) 1808 if ((ret->sha1 = EVP_get_digestbyname("ssl3-sha1")) == NULL) {
1786 { 1809 SSLerr(SSL_F_SSL_CTX_NEW, SSL_R_UNABLE_TO_LOAD_SSL3_SHA1_ROUTINES);
1787 SSLerr(SSL_F_SSL_CTX_NEW,SSL_R_UNABLE_TO_LOAD_SSL3_SHA1_ROUTINES);
1788 goto err2; 1810 goto err2;
1789 } 1811 }
1790 1812
1791 if ((ret->client_CA=sk_X509_NAME_new_null()) == NULL) 1813 if ((ret->client_CA = sk_X509_NAME_new_null()) == NULL)
1792 goto err; 1814 goto err;
1793 1815
1794 CRYPTO_new_ex_data(CRYPTO_EX_INDEX_SSL_CTX, ret, &ret->ex_data); 1816 CRYPTO_new_ex_data(CRYPTO_EX_INDEX_SSL_CTX, ret, &ret->ex_data);
1795 1817
1796 ret->extra_certs=NULL; 1818 ret->extra_certs = NULL;
1797 /* No compression for DTLS */ 1819 /* No compression for DTLS */
1798 if (meth->version != DTLS1_VERSION) 1820 if (meth->version != DTLS1_VERSION)
1799 ret->comp_methods=SSL_COMP_get_compression_methods(); 1821 ret->comp_methods = SSL_COMP_get_compression_methods();
1800 1822
1801 ret->max_send_fragment = SSL3_RT_MAX_PLAIN_LENGTH; 1823 ret->max_send_fragment = SSL3_RT_MAX_PLAIN_LENGTH;
1802 1824
@@ -1806,8 +1828,8 @@ SSL_CTX *SSL_CTX_new(const SSL_METHOD *meth)
1806 /* Setup RFC4507 ticket keys */ 1828 /* Setup RFC4507 ticket keys */
1807 if ((RAND_pseudo_bytes(ret->tlsext_tick_key_name, 16) <= 0) 1829 if ((RAND_pseudo_bytes(ret->tlsext_tick_key_name, 16) <= 0)
1808 || (RAND_bytes(ret->tlsext_tick_hmac_key, 16) <= 0) 1830 || (RAND_bytes(ret->tlsext_tick_hmac_key, 16) <= 0)
1809 || (RAND_bytes(ret->tlsext_tick_aes_key, 16) <= 0)) 1831 || (RAND_bytes(ret->tlsext_tick_aes_key, 16) <= 0))
1810 ret->options |= SSL_OP_NO_TICKET; 1832 ret->options |= SSL_OP_NO_TICKET;
1811 1833
1812 ret->tlsext_status_cb = 0; 1834 ret->tlsext_status_cb = 0;
1813 ret->tlsext_status_arg = NULL; 1835 ret->tlsext_status_arg = NULL;
@@ -1818,9 +1840,9 @@ SSL_CTX *SSL_CTX_new(const SSL_METHOD *meth)
1818# endif 1840# endif
1819#endif 1841#endif
1820#ifndef OPENSSL_NO_PSK 1842#ifndef OPENSSL_NO_PSK
1821 ret->psk_identity_hint=NULL; 1843 ret->psk_identity_hint = NULL;
1822 ret->psk_client_callback=NULL; 1844 ret->psk_client_callback = NULL;
1823 ret->psk_server_callback=NULL; 1845 ret->psk_server_callback = NULL;
1824#endif 1846#endif
1825#ifndef OPENSSL_NO_SRP 1847#ifndef OPENSSL_NO_SRP
1826 SSL_CTX_SRP_CTX_init(ret); 1848 SSL_CTX_SRP_CTX_init(ret);
@@ -1834,11 +1856,10 @@ SSL_CTX *SSL_CTX_new(const SSL_METHOD *meth)
1834 ret->rbuf_freelist->len = 0; 1856 ret->rbuf_freelist->len = 0;
1835 ret->rbuf_freelist->head = NULL; 1857 ret->rbuf_freelist->head = NULL;
1836 ret->wbuf_freelist = OPENSSL_malloc(sizeof(SSL3_BUF_FREELIST)); 1858 ret->wbuf_freelist = OPENSSL_malloc(sizeof(SSL3_BUF_FREELIST));
1837 if (!ret->wbuf_freelist) 1859 if (!ret->wbuf_freelist) {
1838 {
1839 OPENSSL_free(ret->rbuf_freelist); 1860 OPENSSL_free(ret->rbuf_freelist);
1840 goto err; 1861 goto err;
1841 } 1862 }
1842 ret->wbuf_freelist->chunklen = 0; 1863 ret->wbuf_freelist->chunklen = 0;
1843 ret->wbuf_freelist->len = 0; 1864 ret->wbuf_freelist->len = 0;
1844 ret->wbuf_freelist->head = NULL; 1865 ret->wbuf_freelist->head = NULL;
@@ -1850,16 +1871,15 @@ SSL_CTX *SSL_CTX_new(const SSL_METHOD *meth)
1850#define eng_str(x) eng_strx(x) 1871#define eng_str(x) eng_strx(x)
1851 /* Use specific client engine automatically... ignore errors */ 1872 /* Use specific client engine automatically... ignore errors */
1852 { 1873 {
1853 ENGINE *eng; 1874 ENGINE *eng;
1854 eng = ENGINE_by_id(eng_str(OPENSSL_SSL_CLIENT_ENGINE_AUTO));
1855 if (!eng)
1856 {
1857 ERR_clear_error();
1858 ENGINE_load_builtin_engines();
1859 eng = ENGINE_by_id(eng_str(OPENSSL_SSL_CLIENT_ENGINE_AUTO)); 1875 eng = ENGINE_by_id(eng_str(OPENSSL_SSL_CLIENT_ENGINE_AUTO));
1876 if (!eng) {
1877 ERR_clear_error();
1878 ENGINE_load_builtin_engines();
1879 eng = ENGINE_by_id(eng_str(OPENSSL_SSL_CLIENT_ENGINE_AUTO));
1860 } 1880 }
1861 if (!eng || !SSL_CTX_set_client_cert_engine(ret, eng)) 1881 if (!eng || !SSL_CTX_set_client_cert_engine(ret, eng))
1862 ERR_clear_error(); 1882 ERR_clear_error();
1863 } 1883 }
1864#endif 1884#endif
1865#endif 1885#endif
@@ -1868,50 +1888,54 @@ SSL_CTX *SSL_CTX_new(const SSL_METHOD *meth)
1868 */ 1888 */
1869 ret->options |= SSL_OP_LEGACY_SERVER_CONNECT; 1889 ret->options |= SSL_OP_LEGACY_SERVER_CONNECT;
1870 1890
1871 return(ret); 1891 return (ret);
1872err: 1892err:
1873 SSLerr(SSL_F_SSL_CTX_NEW,ERR_R_MALLOC_FAILURE); 1893 SSLerr(SSL_F_SSL_CTX_NEW, ERR_R_MALLOC_FAILURE);
1874err2: 1894err2:
1875 if (ret != NULL) SSL_CTX_free(ret); 1895 if (ret != NULL)
1876 return(NULL); 1896 SSL_CTX_free(ret);
1877 } 1897 return (NULL);
1898}
1878 1899
1879#if 0 1900#if 0
1880static void SSL_COMP_free(SSL_COMP *comp) 1901static void
1881 { OPENSSL_free(comp); } 1902SSL_COMP_free(SSL_COMP *comp)
1903 { OPENSSL_free(comp);
1904}
1882#endif 1905#endif
1883 1906
1884#ifndef OPENSSL_NO_BUF_FREELISTS 1907#ifndef OPENSSL_NO_BUF_FREELISTS
1885static void 1908static void
1886ssl_buf_freelist_free(SSL3_BUF_FREELIST *list) 1909ssl_buf_freelist_free(SSL3_BUF_FREELIST *list)
1887 { 1910{
1888 SSL3_BUF_FREELIST_ENTRY *ent, *next; 1911 SSL3_BUF_FREELIST_ENTRY *ent, *next;
1889 for (ent = list->head; ent; ent = next) 1912 for (ent = list->head; ent; ent = next) {
1890 {
1891 next = ent->next; 1913 next = ent->next;
1892 OPENSSL_free(ent); 1914 OPENSSL_free(ent);
1893 }
1894 OPENSSL_free(list);
1895 } 1915 }
1916 OPENSSL_free(list);
1917}
1896#endif 1918#endif
1897 1919
1898void SSL_CTX_free(SSL_CTX *a) 1920void
1899 { 1921SSL_CTX_free(SSL_CTX *a)
1922{
1900 int i; 1923 int i;
1901 1924
1902 if (a == NULL) return; 1925 if (a == NULL)
1926 return;
1903 1927
1904 i=CRYPTO_add(&a->references,-1,CRYPTO_LOCK_SSL_CTX); 1928 i = CRYPTO_add(&a->references, -1, CRYPTO_LOCK_SSL_CTX);
1905#ifdef REF_PRINT 1929#ifdef REF_PRINT
1906 REF_PRINT("SSL_CTX",a); 1930 REF_PRINT("SSL_CTX", a);
1907#endif 1931#endif
1908 if (i > 0) return; 1932 if (i > 0)
1933 return;
1909#ifdef REF_CHECK 1934#ifdef REF_CHECK
1910 if (i < 0) 1935 if (i < 0) {
1911 { 1936 fprintf(stderr, "SSL_CTX_free, bad reference count\n");
1912 fprintf(stderr,"SSL_CTX_free, bad reference count\n");
1913 abort(); /* ok */ 1937 abort(); /* ok */
1914 } 1938 }
1915#endif 1939#endif
1916 1940
1917 if (a->param) 1941 if (a->param)
@@ -1927,7 +1951,7 @@ void SSL_CTX_free(SSL_CTX *a)
1927 * (See ticket [openssl.org #212].) 1951 * (See ticket [openssl.org #212].)
1928 */ 1952 */
1929 if (a->sessions != NULL) 1953 if (a->sessions != NULL)
1930 SSL_CTX_flush_sessions(a,0); 1954 SSL_CTX_flush_sessions(a, 0);
1931 1955
1932 CRYPTO_free_ex_data(CRYPTO_EX_INDEX_SSL_CTX, a, &a->ex_data); 1956 CRYPTO_free_ex_data(CRYPTO_EX_INDEX_SSL_CTX, a, &a->ex_data);
1933 1957
@@ -1943,19 +1967,19 @@ void SSL_CTX_free(SSL_CTX *a)
1943 if (a->cert != NULL) 1967 if (a->cert != NULL)
1944 ssl_cert_free(a->cert); 1968 ssl_cert_free(a->cert);
1945 if (a->client_CA != NULL) 1969 if (a->client_CA != NULL)
1946 sk_X509_NAME_pop_free(a->client_CA,X509_NAME_free); 1970 sk_X509_NAME_pop_free(a->client_CA, X509_NAME_free);
1947 if (a->extra_certs != NULL) 1971 if (a->extra_certs != NULL)
1948 sk_X509_pop_free(a->extra_certs,X509_free); 1972 sk_X509_pop_free(a->extra_certs, X509_free);
1949#if 0 /* This should never be done, since it removes a global database */ 1973#if 0 /* This should never be done, since it removes a global database */
1950 if (a->comp_methods != NULL) 1974 if (a->comp_methods != NULL)
1951 sk_SSL_COMP_pop_free(a->comp_methods,SSL_COMP_free); 1975 sk_SSL_COMP_pop_free(a->comp_methods, SSL_COMP_free);
1952#else 1976#else
1953 a->comp_methods = NULL; 1977 a->comp_methods = NULL;
1954#endif 1978#endif
1955 1979
1956#ifndef OPENSSL_NO_SRTP 1980#ifndef OPENSSL_NO_SRTP
1957 if (a->srtp_profiles) 1981 if (a->srtp_profiles)
1958 sk_SRTP_PROTECTION_PROFILE_free(a->srtp_profiles); 1982 sk_SRTP_PROTECTION_PROFILE_free(a->srtp_profiles);
1959#endif 1983#endif
1960 1984
1961#ifndef OPENSSL_NO_PSK 1985#ifndef OPENSSL_NO_PSK
@@ -1978,42 +2002,48 @@ void SSL_CTX_free(SSL_CTX *a)
1978#endif 2002#endif
1979 2003
1980 OPENSSL_free(a); 2004 OPENSSL_free(a);
1981 } 2005}
1982 2006
1983void SSL_CTX_set_default_passwd_cb(SSL_CTX *ctx, pem_password_cb *cb) 2007void
1984 { 2008SSL_CTX_set_default_passwd_cb(SSL_CTX *ctx, pem_password_cb *cb)
1985 ctx->default_passwd_callback=cb; 2009{
1986 } 2010 ctx->default_passwd_callback = cb;
2011}
1987 2012
1988void SSL_CTX_set_default_passwd_cb_userdata(SSL_CTX *ctx,void *u) 2013void
1989 { 2014SSL_CTX_set_default_passwd_cb_userdata(SSL_CTX *ctx, void *u)
1990 ctx->default_passwd_callback_userdata=u; 2015{
1991 } 2016 ctx->default_passwd_callback_userdata = u;
2017}
1992 2018
1993void SSL_CTX_set_cert_verify_callback(SSL_CTX *ctx, int (*cb)(X509_STORE_CTX *,void *), void *arg) 2019void
1994 { 2020SSL_CTX_set_cert_verify_callback(SSL_CTX *ctx, int (*cb)(X509_STORE_CTX *, void *), void *arg)
1995 ctx->app_verify_callback=cb; 2021{
1996 ctx->app_verify_arg=arg; 2022 ctx->app_verify_callback = cb;
1997 } 2023 ctx->app_verify_arg = arg;
2024}
1998 2025
1999void SSL_CTX_set_verify(SSL_CTX *ctx,int mode,int (*cb)(int, X509_STORE_CTX *)) 2026void
2000 { 2027SSL_CTX_set_verify(SSL_CTX *ctx, int mode, int (*cb)(int, X509_STORE_CTX *))
2001 ctx->verify_mode=mode; 2028{
2002 ctx->default_verify_callback=cb; 2029 ctx->verify_mode = mode;
2003 } 2030 ctx->default_verify_callback = cb;
2031}
2004 2032
2005void SSL_CTX_set_verify_depth(SSL_CTX *ctx,int depth) 2033void
2006 { 2034SSL_CTX_set_verify_depth(SSL_CTX *ctx, int depth)
2035{
2007 X509_VERIFY_PARAM_set_depth(ctx->param, depth); 2036 X509_VERIFY_PARAM_set_depth(ctx->param, depth);
2008 } 2037}
2009 2038
2010void ssl_set_cert_masks(CERT *c, const SSL_CIPHER *cipher) 2039void
2011 { 2040ssl_set_cert_masks(CERT *c, const SSL_CIPHER *cipher)
2041{
2012 CERT_PKEY *cpk; 2042 CERT_PKEY *cpk;
2013 int rsa_enc,rsa_tmp,rsa_sign,dh_tmp,dh_rsa,dh_dsa,dsa_sign; 2043 int rsa_enc, rsa_tmp, rsa_sign, dh_tmp, dh_rsa, dh_dsa, dsa_sign;
2014 int rsa_enc_export,dh_rsa_export,dh_dsa_export; 2044 int rsa_enc_export, dh_rsa_export, dh_dsa_export;
2015 int rsa_tmp_export,dh_tmp_export,kl; 2045 int rsa_tmp_export, dh_tmp_export, kl;
2016 unsigned long mask_k,mask_a,emask_k,emask_a; 2046 unsigned long mask_k, mask_a, emask_k, emask_a;
2017 int have_ecc_cert, ecdh_ok, ecdsa_ok, ecc_pkey_size; 2047 int have_ecc_cert, ecdh_ok, ecdsa_ok, ecc_pkey_size;
2018#ifndef OPENSSL_NO_ECDH 2048#ifndef OPENSSL_NO_ECDH
2019 int have_ecdh_tmp; 2049 int have_ecdh_tmp;
@@ -2022,57 +2052,58 @@ void ssl_set_cert_masks(CERT *c, const SSL_CIPHER *cipher)
2022 EVP_PKEY *ecc_pkey = NULL; 2052 EVP_PKEY *ecc_pkey = NULL;
2023 int signature_nid = 0, pk_nid = 0, md_nid = 0; 2053 int signature_nid = 0, pk_nid = 0, md_nid = 0;
2024 2054
2025 if (c == NULL) return; 2055 if (c == NULL)
2056 return;
2026 2057
2027 kl=SSL_C_EXPORT_PKEYLENGTH(cipher); 2058 kl = SSL_C_EXPORT_PKEYLENGTH(cipher);
2028 2059
2029#ifndef OPENSSL_NO_RSA 2060#ifndef OPENSSL_NO_RSA
2030 rsa_tmp=(c->rsa_tmp != NULL || c->rsa_tmp_cb != NULL); 2061 rsa_tmp = (c->rsa_tmp != NULL || c->rsa_tmp_cb != NULL);
2031 rsa_tmp_export=(c->rsa_tmp_cb != NULL || 2062 rsa_tmp_export = (c->rsa_tmp_cb != NULL ||
2032 (rsa_tmp && RSA_size(c->rsa_tmp)*8 <= kl)); 2063 (rsa_tmp && RSA_size(c->rsa_tmp)*8 <= kl));
2033#else 2064#else
2034 rsa_tmp=rsa_tmp_export=0; 2065 rsa_tmp = rsa_tmp_export = 0;
2035#endif 2066#endif
2036#ifndef OPENSSL_NO_DH 2067#ifndef OPENSSL_NO_DH
2037 dh_tmp=(c->dh_tmp != NULL || c->dh_tmp_cb != NULL); 2068 dh_tmp = (c->dh_tmp != NULL || c->dh_tmp_cb != NULL);
2038 dh_tmp_export=(c->dh_tmp_cb != NULL || 2069 dh_tmp_export = (c->dh_tmp_cb != NULL ||
2039 (dh_tmp && DH_size(c->dh_tmp)*8 <= kl)); 2070 (dh_tmp && DH_size(c->dh_tmp)*8 <= kl));
2040#else 2071#else
2041 dh_tmp=dh_tmp_export=0; 2072 dh_tmp = dh_tmp_export = 0;
2042#endif 2073#endif
2043 2074
2044#ifndef OPENSSL_NO_ECDH 2075#ifndef OPENSSL_NO_ECDH
2045 have_ecdh_tmp=(c->ecdh_tmp != NULL || c->ecdh_tmp_cb != NULL); 2076 have_ecdh_tmp = (c->ecdh_tmp != NULL || c->ecdh_tmp_cb != NULL);
2046#endif 2077#endif
2047 cpk= &(c->pkeys[SSL_PKEY_RSA_ENC]); 2078 cpk = &(c->pkeys[SSL_PKEY_RSA_ENC]);
2048 rsa_enc= (cpk->x509 != NULL && cpk->privatekey != NULL); 2079 rsa_enc = (cpk->x509 != NULL && cpk->privatekey != NULL);
2049 rsa_enc_export=(rsa_enc && EVP_PKEY_size(cpk->privatekey)*8 <= kl); 2080 rsa_enc_export = (rsa_enc && EVP_PKEY_size(cpk->privatekey)*8 <= kl);
2050 cpk= &(c->pkeys[SSL_PKEY_RSA_SIGN]); 2081 cpk = &(c->pkeys[SSL_PKEY_RSA_SIGN]);
2051 rsa_sign=(cpk->x509 != NULL && cpk->privatekey != NULL); 2082 rsa_sign = (cpk->x509 != NULL && cpk->privatekey != NULL);
2052 cpk= &(c->pkeys[SSL_PKEY_DSA_SIGN]); 2083 cpk = &(c->pkeys[SSL_PKEY_DSA_SIGN]);
2053 dsa_sign=(cpk->x509 != NULL && cpk->privatekey != NULL); 2084 dsa_sign = (cpk->x509 != NULL && cpk->privatekey != NULL);
2054 cpk= &(c->pkeys[SSL_PKEY_DH_RSA]); 2085 cpk = &(c->pkeys[SSL_PKEY_DH_RSA]);
2055 dh_rsa= (cpk->x509 != NULL && cpk->privatekey != NULL); 2086 dh_rsa = (cpk->x509 != NULL && cpk->privatekey != NULL);
2056 dh_rsa_export=(dh_rsa && EVP_PKEY_size(cpk->privatekey)*8 <= kl); 2087 dh_rsa_export = (dh_rsa && EVP_PKEY_size(cpk->privatekey)*8 <= kl);
2057 cpk= &(c->pkeys[SSL_PKEY_DH_DSA]); 2088 cpk = &(c->pkeys[SSL_PKEY_DH_DSA]);
2058/* FIX THIS EAY EAY EAY */ 2089/* FIX THIS EAY EAY EAY */
2059 dh_dsa= (cpk->x509 != NULL && cpk->privatekey != NULL); 2090 dh_dsa = (cpk->x509 != NULL && cpk->privatekey != NULL);
2060 dh_dsa_export=(dh_dsa && EVP_PKEY_size(cpk->privatekey)*8 <= kl); 2091 dh_dsa_export = (dh_dsa && EVP_PKEY_size(cpk->privatekey)*8 <= kl);
2061 cpk= &(c->pkeys[SSL_PKEY_ECC]); 2092 cpk = &(c->pkeys[SSL_PKEY_ECC]);
2062 have_ecc_cert= (cpk->x509 != NULL && cpk->privatekey != NULL); 2093 have_ecc_cert = (cpk->x509 != NULL && cpk->privatekey != NULL);
2063 mask_k=0; 2094 mask_k = 0;
2064 mask_a=0; 2095 mask_a = 0;
2065 emask_k=0; 2096 emask_k = 0;
2066 emask_a=0; 2097 emask_a = 0;
2098
2067 2099
2068
2069 2100
2070#ifdef CIPHER_DEBUG 2101#ifdef CIPHER_DEBUG
2071 printf("rt=%d rte=%d dht=%d ecdht=%d re=%d ree=%d rs=%d ds=%d dhr=%d dhd=%d\n", 2102 printf("rt=%d rte=%d dht=%d ecdht=%d re=%d ree=%d rs=%d ds=%d dhr=%d dhd=%d\n",
2072 rsa_tmp,rsa_tmp_export,dh_tmp,have_ecdh_tmp, 2103 rsa_tmp, rsa_tmp_export, dh_tmp, have_ecdh_tmp,
2073 rsa_enc,rsa_enc_export,rsa_sign,dsa_sign,dh_rsa,dh_dsa); 2104 rsa_enc, rsa_enc_export, rsa_sign, dsa_sign, dh_rsa, dh_dsa);
2074#endif 2105#endif
2075 2106
2076 cpk = &(c->pkeys[SSL_PKEY_GOST01]); 2107 cpk = &(c->pkeys[SSL_PKEY_GOST01]);
2077 if (cpk->x509 != NULL && cpk->privatekey !=NULL) { 2108 if (cpk->x509 != NULL && cpk->privatekey !=NULL) {
2078 mask_k |= SSL_kGOST; 2109 mask_k |= SSL_kGOST;
@@ -2091,12 +2122,12 @@ void ssl_set_cert_masks(CERT *c, const SSL_CIPHER *cipher)
2091 2122
2092#if 0 2123#if 0
2093 /* The match needs to be both kEDH and aRSA or aDSA, so don't worry */ 2124 /* The match needs to be both kEDH and aRSA or aDSA, so don't worry */
2094 if ( (dh_tmp || dh_rsa || dh_dsa) && 2125 if ((dh_tmp || dh_rsa || dh_dsa) &&
2095 (rsa_enc || rsa_sign || dsa_sign)) 2126 (rsa_enc || rsa_sign || dsa_sign))
2096 mask_k|=SSL_kEDH; 2127 mask_k|=SSL_kEDH;
2097 if ((dh_tmp_export || dh_rsa_export || dh_dsa_export) && 2128 if ((dh_tmp_export || dh_rsa_export || dh_dsa_export) &&
2098 (rsa_enc || rsa_sign || dsa_sign)) 2129 (rsa_enc || rsa_sign || dsa_sign))
2099 emask_k|=SSL_kEDH; 2130 emask_k|=SSL_kEDH;
2100#endif 2131#endif
2101 2132
2102 if (dh_tmp_export) 2133 if (dh_tmp_export)
@@ -2105,23 +2136,25 @@ void ssl_set_cert_masks(CERT *c, const SSL_CIPHER *cipher)
2105 if (dh_tmp) 2136 if (dh_tmp)
2106 mask_k|=SSL_kEDH; 2137 mask_k|=SSL_kEDH;
2107 2138
2108 if (dh_rsa) mask_k|=SSL_kDHr; 2139 if (dh_rsa)
2109 if (dh_rsa_export) emask_k|=SSL_kDHr; 2140 mask_k|=SSL_kDHr;
2141 if (dh_rsa_export)
2142 emask_k|=SSL_kDHr;
2110 2143
2111 if (dh_dsa) mask_k|=SSL_kDHd; 2144 if (dh_dsa)
2112 if (dh_dsa_export) emask_k|=SSL_kDHd; 2145 mask_k|=SSL_kDHd;
2146 if (dh_dsa_export)
2147 emask_k|=SSL_kDHd;
2113 2148
2114 if (rsa_enc || rsa_sign) 2149 if (rsa_enc || rsa_sign) {
2115 {
2116 mask_a|=SSL_aRSA; 2150 mask_a|=SSL_aRSA;
2117 emask_a|=SSL_aRSA; 2151 emask_a|=SSL_aRSA;
2118 } 2152 }
2119 2153
2120 if (dsa_sign) 2154 if (dsa_sign) {
2121 {
2122 mask_a|=SSL_aDSS; 2155 mask_a|=SSL_aDSS;
2123 emask_a|=SSL_aDSS; 2156 emask_a|=SSL_aDSS;
2124 } 2157 }
2125 2158
2126 mask_a|=SSL_aNULL; 2159 mask_a|=SSL_aNULL;
2127 emask_a|=SSL_aNULL; 2160 emask_a|=SSL_aNULL;
@@ -2136,66 +2169,57 @@ void ssl_set_cert_masks(CERT *c, const SSL_CIPHER *cipher)
2136 /* An ECC certificate may be usable for ECDH and/or 2169 /* An ECC certificate may be usable for ECDH and/or
2137 * ECDSA cipher suites depending on the key usage extension. 2170 * ECDSA cipher suites depending on the key usage extension.
2138 */ 2171 */
2139 if (have_ecc_cert) 2172 if (have_ecc_cert) {
2140 {
2141 /* This call populates extension flags (ex_flags) */ 2173 /* This call populates extension flags (ex_flags) */
2142 x = (c->pkeys[SSL_PKEY_ECC]).x509; 2174 x = (c->pkeys[SSL_PKEY_ECC]).x509;
2143 X509_check_purpose(x, -1, 0); 2175 X509_check_purpose(x, -1, 0);
2144 ecdh_ok = (x->ex_flags & EXFLAG_KUSAGE) ? 2176 ecdh_ok = (x->ex_flags & EXFLAG_KUSAGE) ?
2145 (x->ex_kusage & X509v3_KU_KEY_AGREEMENT) : 1; 2177 (x->ex_kusage & X509v3_KU_KEY_AGREEMENT) : 1;
2146 ecdsa_ok = (x->ex_flags & EXFLAG_KUSAGE) ? 2178 ecdsa_ok = (x->ex_flags & EXFLAG_KUSAGE) ?
2147 (x->ex_kusage & X509v3_KU_DIGITAL_SIGNATURE) : 1; 2179 (x->ex_kusage & X509v3_KU_DIGITAL_SIGNATURE) : 1;
2148 ecc_pkey = X509_get_pubkey(x); 2180 ecc_pkey = X509_get_pubkey(x);
2149 ecc_pkey_size = (ecc_pkey != NULL) ? 2181 ecc_pkey_size = (ecc_pkey != NULL) ?
2150 EVP_PKEY_bits(ecc_pkey) : 0; 2182 EVP_PKEY_bits(ecc_pkey) : 0;
2151 EVP_PKEY_free(ecc_pkey); 2183 EVP_PKEY_free(ecc_pkey);
2152 if ((x->sig_alg) && (x->sig_alg->algorithm)) 2184 if ((x->sig_alg) && (x->sig_alg->algorithm)) {
2153 {
2154 signature_nid = OBJ_obj2nid(x->sig_alg->algorithm); 2185 signature_nid = OBJ_obj2nid(x->sig_alg->algorithm);
2155 OBJ_find_sigid_algs(signature_nid, &md_nid, &pk_nid); 2186 OBJ_find_sigid_algs(signature_nid, &md_nid, &pk_nid);
2156 } 2187 }
2157#ifndef OPENSSL_NO_ECDH 2188#ifndef OPENSSL_NO_ECDH
2158 if (ecdh_ok) 2189 if (ecdh_ok) {
2159 {
2160 2190
2161 if (pk_nid == NID_rsaEncryption || pk_nid == NID_rsa) 2191 if (pk_nid == NID_rsaEncryption || pk_nid == NID_rsa) {
2162 {
2163 mask_k|=SSL_kECDHr; 2192 mask_k|=SSL_kECDHr;
2164 mask_a|=SSL_aECDH; 2193 mask_a|=SSL_aECDH;
2165 if (ecc_pkey_size <= 163) 2194 if (ecc_pkey_size <= 163) {
2166 {
2167 emask_k|=SSL_kECDHr; 2195 emask_k|=SSL_kECDHr;
2168 emask_a|=SSL_aECDH; 2196 emask_a|=SSL_aECDH;
2169 }
2170 } 2197 }
2198 }
2171 2199
2172 if (pk_nid == NID_X9_62_id_ecPublicKey) 2200 if (pk_nid == NID_X9_62_id_ecPublicKey) {
2173 {
2174 mask_k|=SSL_kECDHe; 2201 mask_k|=SSL_kECDHe;
2175 mask_a|=SSL_aECDH; 2202 mask_a|=SSL_aECDH;
2176 if (ecc_pkey_size <= 163) 2203 if (ecc_pkey_size <= 163) {
2177 {
2178 emask_k|=SSL_kECDHe; 2204 emask_k|=SSL_kECDHe;
2179 emask_a|=SSL_aECDH; 2205 emask_a|=SSL_aECDH;
2180 }
2181 } 2206 }
2182 } 2207 }
2208 }
2183#endif 2209#endif
2184#ifndef OPENSSL_NO_ECDSA 2210#ifndef OPENSSL_NO_ECDSA
2185 if (ecdsa_ok) 2211 if (ecdsa_ok) {
2186 {
2187 mask_a|=SSL_aECDSA; 2212 mask_a|=SSL_aECDSA;
2188 emask_a|=SSL_aECDSA; 2213 emask_a|=SSL_aECDSA;
2189 }
2190#endif
2191 } 2214 }
2215#endif
2216 }
2192 2217
2193#ifndef OPENSSL_NO_ECDH 2218#ifndef OPENSSL_NO_ECDH
2194 if (have_ecdh_tmp) 2219 if (have_ecdh_tmp) {
2195 {
2196 mask_k|=SSL_kEECDH; 2220 mask_k|=SSL_kEECDH;
2197 emask_k|=SSL_kEECDH; 2221 emask_k|=SSL_kEECDH;
2198 } 2222 }
2199#endif 2223#endif
2200 2224
2201#ifndef OPENSSL_NO_PSK 2225#ifndef OPENSSL_NO_PSK
@@ -2205,12 +2229,12 @@ void ssl_set_cert_masks(CERT *c, const SSL_CIPHER *cipher)
2205 emask_a |= SSL_aPSK; 2229 emask_a |= SSL_aPSK;
2206#endif 2230#endif
2207 2231
2208 c->mask_k=mask_k; 2232 c->mask_k = mask_k;
2209 c->mask_a=mask_a; 2233 c->mask_a = mask_a;
2210 c->export_mask_k=emask_k; 2234 c->export_mask_k = emask_k;
2211 c->export_mask_a=emask_a; 2235 c->export_mask_a = emask_a;
2212 c->valid=1; 2236 c->valid = 1;
2213 } 2237}
2214 2238
2215/* This handy macro borrowed from crypto/x509v3/v3_purp.c */ 2239/* This handy macro borrowed from crypto/x509v3/v3_purp.c */
2216#define ku_reject(x, usage) \ 2240#define ku_reject(x, usage) \
@@ -2218,8 +2242,9 @@ void ssl_set_cert_masks(CERT *c, const SSL_CIPHER *cipher)
2218 2242
2219#ifndef OPENSSL_NO_EC 2243#ifndef OPENSSL_NO_EC
2220 2244
2221int ssl_check_srvr_ecc_cert_and_alg(X509 *x, SSL *s) 2245int
2222 { 2246ssl_check_srvr_ecc_cert_and_alg(X509 *x, SSL *s)
2247{
2223 unsigned long alg_k, alg_a; 2248 unsigned long alg_k, alg_a;
2224 EVP_PKEY *pkey = NULL; 2249 EVP_PKEY *pkey = NULL;
2225 int keysize = 0; 2250 int keysize = 0;
@@ -2229,81 +2254,74 @@ int ssl_check_srvr_ecc_cert_and_alg(X509 *x, SSL *s)
2229 alg_k = cs->algorithm_mkey; 2254 alg_k = cs->algorithm_mkey;
2230 alg_a = cs->algorithm_auth; 2255 alg_a = cs->algorithm_auth;
2231 2256
2232 if (SSL_C_IS_EXPORT(cs)) 2257 if (SSL_C_IS_EXPORT(cs)) {
2233 {
2234 /* ECDH key length in export ciphers must be <= 163 bits */ 2258 /* ECDH key length in export ciphers must be <= 163 bits */
2235 pkey = X509_get_pubkey(x); 2259 pkey = X509_get_pubkey(x);
2236 if (pkey == NULL) return 0; 2260 if (pkey == NULL)
2261 return 0;
2237 keysize = EVP_PKEY_bits(pkey); 2262 keysize = EVP_PKEY_bits(pkey);
2238 EVP_PKEY_free(pkey); 2263 EVP_PKEY_free(pkey);
2239 if (keysize > 163) return 0; 2264 if (keysize > 163)
2240 } 2265 return 0;
2266 }
2241 2267
2242 /* This call populates the ex_flags field correctly */ 2268 /* This call populates the ex_flags field correctly */
2243 X509_check_purpose(x, -1, 0); 2269 X509_check_purpose(x, -1, 0);
2244 if ((x->sig_alg) && (x->sig_alg->algorithm)) 2270 if ((x->sig_alg) && (x->sig_alg->algorithm)) {
2245 {
2246 signature_nid = OBJ_obj2nid(x->sig_alg->algorithm); 2271 signature_nid = OBJ_obj2nid(x->sig_alg->algorithm);
2247 OBJ_find_sigid_algs(signature_nid, &md_nid, &pk_nid); 2272 OBJ_find_sigid_algs(signature_nid, &md_nid, &pk_nid);
2248 } 2273 }
2249 if (alg_k & SSL_kECDHe || alg_k & SSL_kECDHr) 2274 if (alg_k & SSL_kECDHe || alg_k & SSL_kECDHr) {
2250 {
2251 /* key usage, if present, must allow key agreement */ 2275 /* key usage, if present, must allow key agreement */
2252 if (ku_reject(x, X509v3_KU_KEY_AGREEMENT)) 2276 if (ku_reject(x, X509v3_KU_KEY_AGREEMENT)) {
2253 {
2254 SSLerr(SSL_F_SSL_CHECK_SRVR_ECC_CERT_AND_ALG, SSL_R_ECC_CERT_NOT_FOR_KEY_AGREEMENT); 2277 SSLerr(SSL_F_SSL_CHECK_SRVR_ECC_CERT_AND_ALG, SSL_R_ECC_CERT_NOT_FOR_KEY_AGREEMENT);
2255 return 0; 2278 return 0;
2256 } 2279 }
2257 if ((alg_k & SSL_kECDHe) && TLS1_get_version(s) < TLS1_2_VERSION) 2280 if ((alg_k & SSL_kECDHe) && TLS1_get_version(s) < TLS1_2_VERSION) {
2258 {
2259 /* signature alg must be ECDSA */ 2281 /* signature alg must be ECDSA */
2260 if (pk_nid != NID_X9_62_id_ecPublicKey) 2282 if (pk_nid != NID_X9_62_id_ecPublicKey) {
2261 {
2262 SSLerr(SSL_F_SSL_CHECK_SRVR_ECC_CERT_AND_ALG, SSL_R_ECC_CERT_SHOULD_HAVE_SHA1_SIGNATURE); 2283 SSLerr(SSL_F_SSL_CHECK_SRVR_ECC_CERT_AND_ALG, SSL_R_ECC_CERT_SHOULD_HAVE_SHA1_SIGNATURE);
2263 return 0; 2284 return 0;
2264 }
2265 } 2285 }
2266 if ((alg_k & SSL_kECDHr) && TLS1_get_version(s) < TLS1_2_VERSION) 2286 }
2267 { 2287 if ((alg_k & SSL_kECDHr) && TLS1_get_version(s) < TLS1_2_VERSION) {
2268 /* signature alg must be RSA */ 2288 /* signature alg must be RSA */
2269 2289
2270 if (pk_nid != NID_rsaEncryption && pk_nid != NID_rsa) 2290 if (pk_nid != NID_rsaEncryption && pk_nid != NID_rsa) {
2271 {
2272 SSLerr(SSL_F_SSL_CHECK_SRVR_ECC_CERT_AND_ALG, SSL_R_ECC_CERT_SHOULD_HAVE_RSA_SIGNATURE); 2291 SSLerr(SSL_F_SSL_CHECK_SRVR_ECC_CERT_AND_ALG, SSL_R_ECC_CERT_SHOULD_HAVE_RSA_SIGNATURE);
2273 return 0; 2292 return 0;
2274 }
2275 } 2293 }
2276 } 2294 }
2277 if (alg_a & SSL_aECDSA) 2295 }
2278 { 2296 if (alg_a & SSL_aECDSA) {
2279 /* key usage, if present, must allow signing */ 2297 /* key usage, if present, must allow signing */
2280 if (ku_reject(x, X509v3_KU_DIGITAL_SIGNATURE)) 2298 if (ku_reject(x, X509v3_KU_DIGITAL_SIGNATURE)) {
2281 {
2282 SSLerr(SSL_F_SSL_CHECK_SRVR_ECC_CERT_AND_ALG, SSL_R_ECC_CERT_NOT_FOR_SIGNING); 2299 SSLerr(SSL_F_SSL_CHECK_SRVR_ECC_CERT_AND_ALG, SSL_R_ECC_CERT_NOT_FOR_SIGNING);
2283 return 0; 2300 return 0;
2284 }
2285 } 2301 }
2286
2287 return 1; /* all checks are ok */
2288 } 2302 }
2289 2303
2304 return 1;
2305 /* all checks are ok */
2306}
2307
2290#endif 2308#endif
2291 2309
2292/* THIS NEEDS CLEANING UP */ 2310/* THIS NEEDS CLEANING UP */
2293CERT_PKEY *ssl_get_server_send_pkey(const SSL *s) 2311CERT_PKEY
2294 { 2312*ssl_get_server_send_pkey(const SSL *s)
2295 unsigned long alg_k,alg_a; 2313{
2314 unsigned long alg_k, alg_a;
2296 CERT *c; 2315 CERT *c;
2297 int i; 2316 int i;
2298 2317
2299 c=s->cert; 2318 c = s->cert;
2300 ssl_set_cert_masks(c, s->s3->tmp.new_cipher); 2319 ssl_set_cert_masks(c, s->s3->tmp.new_cipher);
2301 2320
2302 alg_k = s->s3->tmp.new_cipher->algorithm_mkey; 2321 alg_k = s->s3->tmp.new_cipher->algorithm_mkey;
2303 alg_a = s->s3->tmp.new_cipher->algorithm_auth; 2322 alg_a = s->s3->tmp.new_cipher->algorithm_auth;
2304 2323
2305 if (alg_k & (SSL_kECDHr|SSL_kECDHe)) 2324 if (alg_k & (SSL_kECDHr|SSL_kECDHe)) {
2306 {
2307 /* we don't need to look at SSL_kEECDH 2325 /* we don't need to look at SSL_kEECDH
2308 * since no certificate is needed for 2326 * since no certificate is needed for
2309 * anon ECDH and for authenticated 2327 * anon ECDH and for authenticated
@@ -2315,171 +2333,162 @@ CERT_PKEY *ssl_get_server_send_pkey(const SSL *s)
2315 * checks for SSL_kECDH before RSA 2333 * checks for SSL_kECDH before RSA
2316 * checks ensures the correct cert is chosen. 2334 * checks ensures the correct cert is chosen.
2317 */ 2335 */
2318 i=SSL_PKEY_ECC; 2336 i = SSL_PKEY_ECC;
2319 } 2337 } else if (alg_a & SSL_aECDSA) {
2320 else if (alg_a & SSL_aECDSA) 2338 i = SSL_PKEY_ECC;
2321 { 2339 } else if (alg_k & SSL_kDHr)
2322 i=SSL_PKEY_ECC; 2340 i = SSL_PKEY_DH_RSA;
2323 }
2324 else if (alg_k & SSL_kDHr)
2325 i=SSL_PKEY_DH_RSA;
2326 else if (alg_k & SSL_kDHd) 2341 else if (alg_k & SSL_kDHd)
2327 i=SSL_PKEY_DH_DSA; 2342 i = SSL_PKEY_DH_DSA;
2328 else if (alg_a & SSL_aDSS) 2343 else if (alg_a & SSL_aDSS)
2329 i=SSL_PKEY_DSA_SIGN; 2344 i = SSL_PKEY_DSA_SIGN;
2330 else if (alg_a & SSL_aRSA) 2345 else if (alg_a & SSL_aRSA) {
2331 {
2332 if (c->pkeys[SSL_PKEY_RSA_ENC].x509 == NULL) 2346 if (c->pkeys[SSL_PKEY_RSA_ENC].x509 == NULL)
2333 i=SSL_PKEY_RSA_SIGN; 2347 i = SSL_PKEY_RSA_SIGN;
2334 else 2348 else
2335 i=SSL_PKEY_RSA_ENC; 2349 i = SSL_PKEY_RSA_ENC;
2336 } 2350 } else if (alg_a & SSL_aKRB5) {
2337 else if (alg_a & SSL_aKRB5)
2338 {
2339 /* VRS something else here? */ 2351 /* VRS something else here? */
2340 return(NULL); 2352 return (NULL);
2341 } 2353 } else if (alg_a & SSL_aGOST94)
2342 else if (alg_a & SSL_aGOST94) 2354 i = SSL_PKEY_GOST94;
2343 i=SSL_PKEY_GOST94;
2344 else if (alg_a & SSL_aGOST01) 2355 else if (alg_a & SSL_aGOST01)
2345 i=SSL_PKEY_GOST01; 2356 i = SSL_PKEY_GOST01;
2346 else /* if (alg_a & SSL_aNULL) */ 2357 else /* if (alg_a & SSL_aNULL) */
2347 { 2358 {
2348 SSLerr(SSL_F_SSL_GET_SERVER_SEND_PKEY,ERR_R_INTERNAL_ERROR); 2359 SSLerr(SSL_F_SSL_GET_SERVER_SEND_PKEY, ERR_R_INTERNAL_ERROR);
2349 return(NULL); 2360 return (NULL);
2350 } 2361 }
2351 2362
2352 return c->pkeys + i; 2363 return c->pkeys + i;
2353 } 2364}
2354 2365
2355X509 *ssl_get_server_send_cert(const SSL *s) 2366X509
2356 { 2367*ssl_get_server_send_cert(const SSL *s)
2368{
2357 CERT_PKEY *cpk; 2369 CERT_PKEY *cpk;
2358 cpk = ssl_get_server_send_pkey(s); 2370 cpk = ssl_get_server_send_pkey(s);
2359 if (!cpk) 2371 if (!cpk)
2360 return NULL; 2372 return NULL;
2361 return cpk->x509; 2373 return cpk->x509;
2362 } 2374}
2363 2375
2364EVP_PKEY *ssl_get_sign_pkey(SSL *s,const SSL_CIPHER *cipher, const EVP_MD **pmd) 2376EVP_PKEY
2365 { 2377*ssl_get_sign_pkey(SSL *s, const SSL_CIPHER *cipher, const EVP_MD **pmd)
2378{
2366 unsigned long alg_a; 2379 unsigned long alg_a;
2367 CERT *c; 2380 CERT *c;
2368 int idx = -1; 2381 int idx = -1;
2369 2382
2370 alg_a = cipher->algorithm_auth; 2383 alg_a = cipher->algorithm_auth;
2371 c=s->cert; 2384 c = s->cert;
2372 2385
2373 if ((alg_a & SSL_aDSS) && 2386 if ((alg_a & SSL_aDSS) &&
2374 (c->pkeys[SSL_PKEY_DSA_SIGN].privatekey != NULL)) 2387 (c->pkeys[SSL_PKEY_DSA_SIGN].privatekey != NULL))
2375 idx = SSL_PKEY_DSA_SIGN; 2388 idx = SSL_PKEY_DSA_SIGN;
2376 else if (alg_a & SSL_aRSA) 2389 else if (alg_a & SSL_aRSA) {
2377 {
2378 if (c->pkeys[SSL_PKEY_RSA_SIGN].privatekey != NULL) 2390 if (c->pkeys[SSL_PKEY_RSA_SIGN].privatekey != NULL)
2379 idx = SSL_PKEY_RSA_SIGN; 2391 idx = SSL_PKEY_RSA_SIGN;
2380 else if (c->pkeys[SSL_PKEY_RSA_ENC].privatekey != NULL) 2392 else if (c->pkeys[SSL_PKEY_RSA_ENC].privatekey != NULL)
2381 idx = SSL_PKEY_RSA_ENC; 2393 idx = SSL_PKEY_RSA_ENC;
2382 } 2394 } else if ((alg_a & SSL_aECDSA) &&
2383 else if ((alg_a & SSL_aECDSA) && 2395 (c->pkeys[SSL_PKEY_ECC].privatekey != NULL))
2384 (c->pkeys[SSL_PKEY_ECC].privatekey != NULL)) 2396 idx = SSL_PKEY_ECC;
2385 idx = SSL_PKEY_ECC; 2397 if (idx == -1) {
2386 if (idx == -1) 2398 SSLerr(SSL_F_SSL_GET_SIGN_PKEY, ERR_R_INTERNAL_ERROR);
2387 { 2399 return (NULL);
2388 SSLerr(SSL_F_SSL_GET_SIGN_PKEY,ERR_R_INTERNAL_ERROR); 2400 }
2389 return(NULL);
2390 }
2391 if (pmd) 2401 if (pmd)
2392 *pmd = c->pkeys[idx].digest; 2402 *pmd = c->pkeys[idx].digest;
2393 return c->pkeys[idx].privatekey; 2403 return c->pkeys[idx].privatekey;
2394 } 2404}
2395 2405
2396void ssl_update_cache(SSL *s,int mode) 2406void
2397 { 2407ssl_update_cache(SSL *s, int mode)
2408{
2398 int i; 2409 int i;
2399 2410
2400 /* If the session_id_length is 0, we are not supposed to cache it, 2411 /* If the session_id_length is 0, we are not supposed to cache it,
2401 * and it would be rather hard to do anyway :-) */ 2412 * and it would be rather hard to do anyway :-) */
2402 if (s->session->session_id_length == 0) return; 2413 if (s->session->session_id_length == 0)
2414 return;
2403 2415
2404 i=s->session_ctx->session_cache_mode; 2416 i = s->session_ctx->session_cache_mode;
2405 if ((i & mode) && (!s->hit) 2417 if ((i & mode) && (!s->hit)
2406 && ((i & SSL_SESS_CACHE_NO_INTERNAL_STORE) 2418 && ((i & SSL_SESS_CACHE_NO_INTERNAL_STORE)
2407 || SSL_CTX_add_session(s->session_ctx,s->session)) 2419 || SSL_CTX_add_session(s->session_ctx, s->session))
2408 && (s->session_ctx->new_session_cb != NULL)) 2420 && (s->session_ctx->new_session_cb != NULL)) {
2409 { 2421 CRYPTO_add(&s->session->references, 1, CRYPTO_LOCK_SSL_SESSION);
2410 CRYPTO_add(&s->session->references,1,CRYPTO_LOCK_SSL_SESSION); 2422 if (!s->session_ctx->new_session_cb(s, s->session))
2411 if (!s->session_ctx->new_session_cb(s,s->session))
2412 SSL_SESSION_free(s->session); 2423 SSL_SESSION_free(s->session);
2413 } 2424 }
2414 2425
2415 /* auto flush every 255 connections */ 2426 /* auto flush every 255 connections */
2416 if ((!(i & SSL_SESS_CACHE_NO_AUTO_CLEAR)) && 2427 if ((!(i & SSL_SESS_CACHE_NO_AUTO_CLEAR)) &&
2417 ((i & mode) == mode)) 2428 ((i & mode) == mode)) {
2418 { 2429 if ((((mode & SSL_SESS_CACHE_CLIENT)
2419 if ( (((mode & SSL_SESS_CACHE_CLIENT)
2420 ?s->session_ctx->stats.sess_connect_good 2430 ?s->session_ctx->stats.sess_connect_good
2421 :s->session_ctx->stats.sess_accept_good) & 0xff) == 0xff) 2431 :s->session_ctx->stats.sess_accept_good) & 0xff) == 0xff) {
2422 {
2423 SSL_CTX_flush_sessions(s->session_ctx,(unsigned long)time(NULL)); 2432 SSL_CTX_flush_sessions(s->session_ctx,(unsigned long)time(NULL));
2424 }
2425 } 2433 }
2426 } 2434 }
2435}
2427 2436
2428const SSL_METHOD *SSL_get_ssl_method(SSL *s) 2437const SSL_METHOD
2429 { 2438*SSL_get_ssl_method(SSL *s)
2430 return(s->method); 2439{
2431 } 2440 return (s->method);
2441}
2432 2442
2433int SSL_set_ssl_method(SSL *s, const SSL_METHOD *meth) 2443int
2434 { 2444SSL_set_ssl_method(SSL *s, const SSL_METHOD *meth)
2435 int conn= -1; 2445{
2436 int ret=1; 2446 int conn = -1;
2447 int ret = 1;
2437 2448
2438 if (s->method != meth) 2449 if (s->method != meth) {
2439 {
2440 if (s->handshake_func != NULL) 2450 if (s->handshake_func != NULL)
2441 conn=(s->handshake_func == s->method->ssl_connect); 2451 conn = (s->handshake_func == s->method->ssl_connect);
2442 2452
2443 if (s->method->version == meth->version) 2453 if (s->method->version == meth->version)
2444 s->method=meth; 2454 s->method = meth;
2445 else 2455 else {
2446 {
2447 s->method->ssl_free(s); 2456 s->method->ssl_free(s);
2448 s->method=meth; 2457 s->method = meth;
2449 ret=s->method->ssl_new(s); 2458 ret = s->method->ssl_new(s);
2450 } 2459 }
2451 2460
2452 if (conn == 1) 2461 if (conn == 1)
2453 s->handshake_func=meth->ssl_connect; 2462 s->handshake_func = meth->ssl_connect;
2454 else if (conn == 0) 2463 else if (conn == 0)
2455 s->handshake_func=meth->ssl_accept; 2464 s->handshake_func = meth->ssl_accept;
2456 }
2457 return(ret);
2458 } 2465 }
2466 return (ret);
2467}
2459 2468
2460int SSL_get_error(const SSL *s,int i) 2469int
2461 { 2470SSL_get_error(const SSL *s, int i)
2471{
2462 int reason; 2472 int reason;
2463 unsigned long l; 2473 unsigned long l;
2464 BIO *bio; 2474 BIO *bio;
2465 2475
2466 if (i > 0) return(SSL_ERROR_NONE); 2476 if (i > 0)
2477 return (SSL_ERROR_NONE);
2467 2478
2468 /* Make things return SSL_ERROR_SYSCALL when doing SSL_do_handshake 2479 /* Make things return SSL_ERROR_SYSCALL when doing SSL_do_handshake
2469 * etc, where we do encode the error */ 2480 * etc, where we do encode the error */
2470 if ((l=ERR_peek_error()) != 0) 2481 if ((l = ERR_peek_error()) != 0) {
2471 {
2472 if (ERR_GET_LIB(l) == ERR_LIB_SYS) 2482 if (ERR_GET_LIB(l) == ERR_LIB_SYS)
2473 return(SSL_ERROR_SYSCALL); 2483 return (SSL_ERROR_SYSCALL);
2474 else 2484 else
2475 return(SSL_ERROR_SSL); 2485 return (SSL_ERROR_SSL);
2476 } 2486 }
2477 2487
2478 if ((i < 0) && SSL_want_read(s)) 2488 if ((i < 0) && SSL_want_read(s)) {
2479 { 2489 bio = SSL_get_rbio(s);
2480 bio=SSL_get_rbio(s);
2481 if (BIO_should_read(bio)) 2490 if (BIO_should_read(bio))
2482 return(SSL_ERROR_WANT_READ); 2491 return (SSL_ERROR_WANT_READ);
2483 else if (BIO_should_write(bio)) 2492 else if (BIO_should_write(bio))
2484 /* This one doesn't make too much sense ... We never try 2493 /* This one doesn't make too much sense ... We never try
2485 * to write to the rbio, and an application program where 2494 * to write to the rbio, and an application program where
@@ -2490,131 +2499,129 @@ int SSL_get_error(const SSL *s,int i)
2490 * SSL_want_write(s)) and rbio and wbio *are* the same, 2499 * SSL_want_write(s)) and rbio and wbio *are* the same,
2491 * this test works around that bug; so it might be safer 2500 * this test works around that bug; so it might be safer
2492 * to keep it. */ 2501 * to keep it. */
2493 return(SSL_ERROR_WANT_WRITE); 2502 return (SSL_ERROR_WANT_WRITE);
2494 else if (BIO_should_io_special(bio)) 2503 else if (BIO_should_io_special(bio)) {
2495 { 2504 reason = BIO_get_retry_reason(bio);
2496 reason=BIO_get_retry_reason(bio);
2497 if (reason == BIO_RR_CONNECT) 2505 if (reason == BIO_RR_CONNECT)
2498 return(SSL_ERROR_WANT_CONNECT); 2506 return (SSL_ERROR_WANT_CONNECT);
2499 else if (reason == BIO_RR_ACCEPT) 2507 else if (reason == BIO_RR_ACCEPT)
2500 return(SSL_ERROR_WANT_ACCEPT); 2508 return (SSL_ERROR_WANT_ACCEPT);
2501 else 2509 else
2502 return(SSL_ERROR_SYSCALL); /* unknown */ 2510 return(SSL_ERROR_SYSCALL); /* unknown */
2503 }
2504 } 2511 }
2512 }
2505 2513
2506 if ((i < 0) && SSL_want_write(s)) 2514 if ((i < 0) && SSL_want_write(s)) {
2507 { 2515 bio = SSL_get_wbio(s);
2508 bio=SSL_get_wbio(s);
2509 if (BIO_should_write(bio)) 2516 if (BIO_should_write(bio))
2510 return(SSL_ERROR_WANT_WRITE); 2517 return (SSL_ERROR_WANT_WRITE);
2511 else if (BIO_should_read(bio)) 2518 else if (BIO_should_read(bio))
2512 /* See above (SSL_want_read(s) with BIO_should_write(bio)) */ 2519 /* See above (SSL_want_read(s) with BIO_should_write(bio)) */
2513 return(SSL_ERROR_WANT_READ); 2520 return (SSL_ERROR_WANT_READ);
2514 else if (BIO_should_io_special(bio)) 2521 else if (BIO_should_io_special(bio)) {
2515 { 2522 reason = BIO_get_retry_reason(bio);
2516 reason=BIO_get_retry_reason(bio);
2517 if (reason == BIO_RR_CONNECT) 2523 if (reason == BIO_RR_CONNECT)
2518 return(SSL_ERROR_WANT_CONNECT); 2524 return (SSL_ERROR_WANT_CONNECT);
2519 else if (reason == BIO_RR_ACCEPT) 2525 else if (reason == BIO_RR_ACCEPT)
2520 return(SSL_ERROR_WANT_ACCEPT); 2526 return (SSL_ERROR_WANT_ACCEPT);
2521 else 2527 else
2522 return(SSL_ERROR_SYSCALL); 2528 return (SSL_ERROR_SYSCALL);
2523 }
2524 }
2525 if ((i < 0) && SSL_want_x509_lookup(s))
2526 {
2527 return(SSL_ERROR_WANT_X509_LOOKUP);
2528 } 2529 }
2530 }
2531 if ((i < 0) && SSL_want_x509_lookup(s)) {
2532 return (SSL_ERROR_WANT_X509_LOOKUP);
2533 }
2529 2534
2530 if (i == 0) 2535 if (i == 0) {
2531 { 2536 if (s->version == SSL2_VERSION) {
2532 if (s->version == SSL2_VERSION)
2533 {
2534 /* assume it is the socket being closed */ 2537 /* assume it is the socket being closed */
2535 return(SSL_ERROR_ZERO_RETURN); 2538 return (SSL_ERROR_ZERO_RETURN);
2536 } 2539 } else {
2537 else
2538 {
2539 if ((s->shutdown & SSL_RECEIVED_SHUTDOWN) && 2540 if ((s->shutdown & SSL_RECEIVED_SHUTDOWN) &&
2540 (s->s3->warn_alert == SSL_AD_CLOSE_NOTIFY)) 2541 (s->s3->warn_alert == SSL_AD_CLOSE_NOTIFY))
2541 return(SSL_ERROR_ZERO_RETURN); 2542 return (SSL_ERROR_ZERO_RETURN);
2542 }
2543 } 2543 }
2544 return(SSL_ERROR_SYSCALL);
2545 } 2544 }
2545 return (SSL_ERROR_SYSCALL);
2546}
2546 2547
2547int SSL_do_handshake(SSL *s) 2548int
2548 { 2549SSL_do_handshake(SSL *s)
2549 int ret=1; 2550{
2551 int ret = 1;
2550 2552
2551 if (s->handshake_func == NULL) 2553 if (s->handshake_func == NULL) {
2552 { 2554 SSLerr(SSL_F_SSL_DO_HANDSHAKE, SSL_R_CONNECTION_TYPE_NOT_SET);
2553 SSLerr(SSL_F_SSL_DO_HANDSHAKE,SSL_R_CONNECTION_TYPE_NOT_SET); 2555 return (-1);
2554 return(-1); 2556 }
2555 }
2556 2557
2557 s->method->ssl_renegotiate_check(s); 2558 s->method->ssl_renegotiate_check(s);
2558 2559
2559 if (SSL_in_init(s) || SSL_in_before(s)) 2560 if (SSL_in_init(s) || SSL_in_before(s)) {
2560 { 2561 ret = s->handshake_func(s);
2561 ret=s->handshake_func(s);
2562 }
2563 return(ret);
2564 } 2562 }
2563 return (ret);
2564}
2565 2565
2566/* For the next 2 functions, SSL_clear() sets shutdown and so 2566/* For the next 2 functions, SSL_clear() sets shutdown and so
2567 * one of these calls will reset it */ 2567 * one of these calls will reset it */
2568void SSL_set_accept_state(SSL *s) 2568void
2569 { 2569SSL_set_accept_state(SSL *s)
2570 s->server=1; 2570{
2571 s->shutdown=0; 2571 s->server = 1;
2572 s->state=SSL_ST_ACCEPT|SSL_ST_BEFORE; 2572 s->shutdown = 0;
2573 s->handshake_func=s->method->ssl_accept; 2573 s->state = SSL_ST_ACCEPT|SSL_ST_BEFORE;
2574 s->handshake_func = s->method->ssl_accept;
2574 /* clear the current cipher */ 2575 /* clear the current cipher */
2575 ssl_clear_cipher_ctx(s); 2576 ssl_clear_cipher_ctx(s);
2576 ssl_clear_hash_ctx(&s->read_hash); 2577 ssl_clear_hash_ctx(&s->read_hash);
2577 ssl_clear_hash_ctx(&s->write_hash); 2578 ssl_clear_hash_ctx(&s->write_hash);
2578 } 2579}
2579 2580
2580void SSL_set_connect_state(SSL *s) 2581void
2581 { 2582SSL_set_connect_state(SSL *s)
2582 s->server=0; 2583{
2583 s->shutdown=0; 2584 s->server = 0;
2584 s->state=SSL_ST_CONNECT|SSL_ST_BEFORE; 2585 s->shutdown = 0;
2585 s->handshake_func=s->method->ssl_connect; 2586 s->state = SSL_ST_CONNECT|SSL_ST_BEFORE;
2587 s->handshake_func = s->method->ssl_connect;
2586 /* clear the current cipher */ 2588 /* clear the current cipher */
2587 ssl_clear_cipher_ctx(s); 2589 ssl_clear_cipher_ctx(s);
2588 ssl_clear_hash_ctx(&s->read_hash); 2590 ssl_clear_hash_ctx(&s->read_hash);
2589 ssl_clear_hash_ctx(&s->write_hash); 2591 ssl_clear_hash_ctx(&s->write_hash);
2590 } 2592}
2591 2593
2592int ssl_undefined_function(SSL *s) 2594int
2593 { 2595ssl_undefined_function(SSL *s)
2594 SSLerr(SSL_F_SSL_UNDEFINED_FUNCTION,ERR_R_SHOULD_NOT_HAVE_BEEN_CALLED); 2596{
2595 return(0); 2597 SSLerr(SSL_F_SSL_UNDEFINED_FUNCTION, ERR_R_SHOULD_NOT_HAVE_BEEN_CALLED);
2596 } 2598 return (0);
2599}
2597 2600
2598int ssl_undefined_void_function(void) 2601int
2599 { 2602ssl_undefined_void_function(void)
2600 SSLerr(SSL_F_SSL_UNDEFINED_VOID_FUNCTION,ERR_R_SHOULD_NOT_HAVE_BEEN_CALLED); 2603{
2601 return(0); 2604 SSLerr(SSL_F_SSL_UNDEFINED_VOID_FUNCTION, ERR_R_SHOULD_NOT_HAVE_BEEN_CALLED);
2602 } 2605 return (0);
2606}
2603 2607
2604int ssl_undefined_const_function(const SSL *s) 2608int
2605 { 2609ssl_undefined_const_function(const SSL *s)
2606 SSLerr(SSL_F_SSL_UNDEFINED_CONST_FUNCTION,ERR_R_SHOULD_NOT_HAVE_BEEN_CALLED); 2610{
2607 return(0); 2611 SSLerr(SSL_F_SSL_UNDEFINED_CONST_FUNCTION, ERR_R_SHOULD_NOT_HAVE_BEEN_CALLED);
2608 } 2612 return (0);
2613}
2609 2614
2610SSL_METHOD *ssl_bad_method(int ver) 2615SSL_METHOD
2611 { 2616*ssl_bad_method(int ver)
2612 SSLerr(SSL_F_SSL_BAD_METHOD,ERR_R_SHOULD_NOT_HAVE_BEEN_CALLED); 2617{
2613 return(NULL); 2618 SSLerr(SSL_F_SSL_BAD_METHOD, ERR_R_SHOULD_NOT_HAVE_BEEN_CALLED);
2614 } 2619 return (NULL);
2620}
2615 2621
2616const char *SSL_get_version(const SSL *s) 2622const char
2617 { 2623*SSL_get_version(const SSL *s)
2624{
2618 if (s->version == TLS1_2_VERSION) 2625 if (s->version == TLS1_2_VERSION)
2619 return("TLSv1.2"); 2626 return("TLSv1.2");
2620 else if (s->version == TLS1_1_VERSION) 2627 else if (s->version == TLS1_1_VERSION)
@@ -2627,29 +2634,27 @@ const char *SSL_get_version(const SSL *s)
2627 return("SSLv2"); 2634 return("SSLv2");
2628 else 2635 else
2629 return("unknown"); 2636 return("unknown");
2630 } 2637}
2631 2638
2632SSL *SSL_dup(SSL *s) 2639SSL
2633 { 2640*SSL_dup(SSL *s)
2641{
2634 STACK_OF(X509_NAME) *sk; 2642 STACK_OF(X509_NAME) *sk;
2635 X509_NAME *xn; 2643 X509_NAME *xn;
2636 SSL *ret; 2644 SSL *ret;
2637 int i; 2645 int i;
2638 2646
2639 if ((ret=SSL_new(SSL_get_SSL_CTX(s))) == NULL) 2647 if ((ret = SSL_new(SSL_get_SSL_CTX(s))) == NULL)
2640 return(NULL); 2648 return (NULL);
2641 2649
2642 ret->version = s->version; 2650 ret->version = s->version;
2643 ret->type = s->type; 2651 ret->type = s->type;
2644 ret->method = s->method; 2652 ret->method = s->method;
2645 2653
2646 if (s->session != NULL) 2654 if (s->session != NULL) {
2647 {
2648 /* This copies session-id, SSL_METHOD, sid_ctx, and 'cert' */ 2655 /* This copies session-id, SSL_METHOD, sid_ctx, and 'cert' */
2649 SSL_copy_session_id(ret,s); 2656 SSL_copy_session_id(ret, s);
2650 } 2657 } else {
2651 else
2652 {
2653 /* No session has been established yet, so we have to expect 2658 /* No session has been established yet, so we have to expect
2654 * that s->cert or ret->cert will be changed later -- 2659 * that s->cert or ret->cert will be changed later --
2655 * they should not both point to the same object, 2660 * they should not both point to the same object,
@@ -2659,56 +2664,50 @@ SSL *SSL_dup(SSL *s)
2659 ret->method = s->method; 2664 ret->method = s->method;
2660 ret->method->ssl_new(ret); 2665 ret->method->ssl_new(ret);
2661 2666
2662 if (s->cert != NULL) 2667 if (s->cert != NULL) {
2663 { 2668 if (ret->cert != NULL) {
2664 if (ret->cert != NULL)
2665 {
2666 ssl_cert_free(ret->cert); 2669 ssl_cert_free(ret->cert);
2667 } 2670 }
2668 ret->cert = ssl_cert_dup(s->cert); 2671 ret->cert = ssl_cert_dup(s->cert);
2669 if (ret->cert == NULL) 2672 if (ret->cert == NULL)
2670 goto err; 2673 goto err;
2671 }
2672
2673 SSL_set_session_id_context(ret,
2674 s->sid_ctx, s->sid_ctx_length);
2675 } 2674 }
2676 2675
2677 ret->options=s->options; 2676 SSL_set_session_id_context(ret,
2678 ret->mode=s->mode; 2677 s->sid_ctx, s->sid_ctx_length);
2679 SSL_set_max_cert_list(ret,SSL_get_max_cert_list(s)); 2678 }
2680 SSL_set_read_ahead(ret,SSL_get_read_ahead(s)); 2679
2680 ret->options = s->options;
2681 ret->mode = s->mode;
2682 SSL_set_max_cert_list(ret, SSL_get_max_cert_list(s));
2683 SSL_set_read_ahead(ret, SSL_get_read_ahead(s));
2681 ret->msg_callback = s->msg_callback; 2684 ret->msg_callback = s->msg_callback;
2682 ret->msg_callback_arg = s->msg_callback_arg; 2685 ret->msg_callback_arg = s->msg_callback_arg;
2683 SSL_set_verify(ret,SSL_get_verify_mode(s), 2686 SSL_set_verify(ret, SSL_get_verify_mode(s),
2684 SSL_get_verify_callback(s)); 2687 SSL_get_verify_callback(s));
2685 SSL_set_verify_depth(ret,SSL_get_verify_depth(s)); 2688 SSL_set_verify_depth(ret, SSL_get_verify_depth(s));
2686 ret->generate_session_id = s->generate_session_id; 2689 ret->generate_session_id = s->generate_session_id;
2687 2690
2688 SSL_set_info_callback(ret,SSL_get_info_callback(s)); 2691 SSL_set_info_callback(ret, SSL_get_info_callback(s));
2689 2692
2690 ret->debug=s->debug; 2693 ret->debug = s->debug;
2691 2694
2692 /* copy app data, a little dangerous perhaps */ 2695 /* copy app data, a little dangerous perhaps */
2693 if (!CRYPTO_dup_ex_data(CRYPTO_EX_INDEX_SSL, &ret->ex_data, &s->ex_data)) 2696 if (!CRYPTO_dup_ex_data(CRYPTO_EX_INDEX_SSL, &ret->ex_data, &s->ex_data))
2694 goto err; 2697 goto err;
2695 2698
2696 /* setup rbio, and wbio */ 2699 /* setup rbio, and wbio */
2697 if (s->rbio != NULL) 2700 if (s->rbio != NULL) {
2698 {
2699 if (!BIO_dup_state(s->rbio,(char *)&ret->rbio)) 2701 if (!BIO_dup_state(s->rbio,(char *)&ret->rbio))
2700 goto err; 2702 goto err;
2701 } 2703 }
2702 if (s->wbio != NULL) 2704 if (s->wbio != NULL) {
2703 { 2705 if (s->wbio != s->rbio) {
2704 if (s->wbio != s->rbio)
2705 {
2706 if (!BIO_dup_state(s->wbio,(char *)&ret->wbio)) 2706 if (!BIO_dup_state(s->wbio,(char *)&ret->wbio))
2707 goto err; 2707 goto err;
2708 } 2708 } else
2709 else 2709 ret->wbio = ret->rbio;
2710 ret->wbio=ret->rbio; 2710 }
2711 }
2712 ret->rwstate = s->rwstate; 2711 ret->rwstate = s->rwstate;
2713 ret->in_handshake = s->in_handshake; 2712 ret->in_handshake = s->in_handshake;
2714 ret->handshake_func = s->handshake_func; 2713 ret->handshake_func = s->handshake_func;
@@ -2716,222 +2715,228 @@ SSL *SSL_dup(SSL *s)
2716 ret->renegotiate = s->renegotiate; 2715 ret->renegotiate = s->renegotiate;
2717 ret->new_session = s->new_session; 2716 ret->new_session = s->new_session;
2718 ret->quiet_shutdown = s->quiet_shutdown; 2717 ret->quiet_shutdown = s->quiet_shutdown;
2719 ret->shutdown=s->shutdown; 2718 ret->shutdown = s->shutdown;
2720 ret->state=s->state; /* SSL_dup does not really work at any state, though */ 2719 ret->state=s->state; /* SSL_dup does not really work at any state, though */
2721 ret->rstate=s->rstate; 2720 ret->rstate = s->rstate;
2722 ret->init_num = 0; /* would have to copy ret->init_buf, ret->init_msg, ret->init_num, ret->init_off */ 2721 ret->init_num = 0; /* would have to copy ret->init_buf, ret->init_msg, ret->init_num, ret->init_off */
2723 ret->hit=s->hit; 2722 ret->hit = s->hit;
2724 2723
2725 X509_VERIFY_PARAM_inherit(ret->param, s->param); 2724 X509_VERIFY_PARAM_inherit(ret->param, s->param);
2726 2725
2727 /* dup the cipher_list and cipher_list_by_id stacks */ 2726 /* dup the cipher_list and cipher_list_by_id stacks */
2728 if (s->cipher_list != NULL) 2727 if (s->cipher_list != NULL) {
2729 { 2728 if ((ret->cipher_list = sk_SSL_CIPHER_dup(s->cipher_list)) == NULL)
2730 if ((ret->cipher_list=sk_SSL_CIPHER_dup(s->cipher_list)) == NULL)
2731 goto err; 2729 goto err;
2732 } 2730 }
2733 if (s->cipher_list_by_id != NULL) 2731 if (s->cipher_list_by_id != NULL)
2734 if ((ret->cipher_list_by_id=sk_SSL_CIPHER_dup(s->cipher_list_by_id)) 2732 if ((ret->cipher_list_by_id = sk_SSL_CIPHER_dup(s->cipher_list_by_id))
2735 == NULL) 2733 == NULL)
2736 goto err; 2734 goto err;
2737 2735
2738 /* Dup the client_CA list */ 2736 /* Dup the client_CA list */
2739 if (s->client_CA != NULL) 2737 if (s->client_CA != NULL) {
2740 { 2738 if ((sk = sk_X509_NAME_dup(s->client_CA)) == NULL) goto err;
2741 if ((sk=sk_X509_NAME_dup(s->client_CA)) == NULL) goto err; 2739 ret->client_CA = sk;
2742 ret->client_CA=sk; 2740 for (i = 0; i < sk_X509_NAME_num(sk); i++) {
2743 for (i=0; i<sk_X509_NAME_num(sk); i++) 2741 xn = sk_X509_NAME_value(sk, i);
2744 { 2742 if (sk_X509_NAME_set(sk, i, X509_NAME_dup(xn)) == NULL) {
2745 xn=sk_X509_NAME_value(sk,i);
2746 if (sk_X509_NAME_set(sk,i,X509_NAME_dup(xn)) == NULL)
2747 {
2748 X509_NAME_free(xn); 2743 X509_NAME_free(xn);
2749 goto err; 2744 goto err;
2750 }
2751 } 2745 }
2752 } 2746 }
2747 }
2753 2748
2754 if (0) 2749 if (0) {
2755 {
2756err: 2750err:
2757 if (ret != NULL) SSL_free(ret); 2751 if (ret != NULL)
2758 ret=NULL; 2752 SSL_free(ret);
2759 } 2753 ret = NULL;
2760 return(ret);
2761 } 2754 }
2755 return (ret);
2756}
2762 2757
2763void ssl_clear_cipher_ctx(SSL *s) 2758void
2764 { 2759ssl_clear_cipher_ctx(SSL *s)
2765 if (s->enc_read_ctx != NULL) 2760{
2766 { 2761 if (s->enc_read_ctx != NULL) {
2767 EVP_CIPHER_CTX_cleanup(s->enc_read_ctx); 2762 EVP_CIPHER_CTX_cleanup(s->enc_read_ctx);
2768 OPENSSL_free(s->enc_read_ctx); 2763 OPENSSL_free(s->enc_read_ctx);
2769 s->enc_read_ctx=NULL; 2764 s->enc_read_ctx = NULL;
2770 } 2765 }
2771 if (s->enc_write_ctx != NULL) 2766 if (s->enc_write_ctx != NULL) {
2772 {
2773 EVP_CIPHER_CTX_cleanup(s->enc_write_ctx); 2767 EVP_CIPHER_CTX_cleanup(s->enc_write_ctx);
2774 OPENSSL_free(s->enc_write_ctx); 2768 OPENSSL_free(s->enc_write_ctx);
2775 s->enc_write_ctx=NULL; 2769 s->enc_write_ctx = NULL;
2776 } 2770 }
2777#ifndef OPENSSL_NO_COMP 2771#ifndef OPENSSL_NO_COMP
2778 if (s->expand != NULL) 2772 if (s->expand != NULL) {
2779 {
2780 COMP_CTX_free(s->expand); 2773 COMP_CTX_free(s->expand);
2781 s->expand=NULL; 2774 s->expand = NULL;
2782 } 2775 }
2783 if (s->compress != NULL) 2776 if (s->compress != NULL) {
2784 {
2785 COMP_CTX_free(s->compress); 2777 COMP_CTX_free(s->compress);
2786 s->compress=NULL; 2778 s->compress = NULL;
2787 }
2788#endif
2789 } 2779 }
2780#endif
2781}
2790 2782
2791/* Fix this function so that it takes an optional type parameter */ 2783/* Fix this function so that it takes an optional type parameter */
2792X509 *SSL_get_certificate(const SSL *s) 2784X509
2793 { 2785*SSL_get_certificate(const SSL *s)
2786{
2794 if (s->cert != NULL) 2787 if (s->cert != NULL)
2795 return(s->cert->key->x509); 2788 return (s->cert->key->x509);
2796 else 2789 else
2797 return(NULL); 2790 return (NULL);
2798 } 2791}
2799 2792
2800/* Fix this function so that it takes an optional type parameter */ 2793/* Fix this function so that it takes an optional type parameter */
2801EVP_PKEY *SSL_get_privatekey(SSL *s) 2794EVP_PKEY
2802 { 2795*SSL_get_privatekey(SSL *s)
2796{
2803 if (s->cert != NULL) 2797 if (s->cert != NULL)
2804 return(s->cert->key->privatekey); 2798 return (s->cert->key->privatekey);
2805 else 2799 else
2806 return(NULL); 2800 return (NULL);
2807 } 2801}
2808 2802
2809const SSL_CIPHER *SSL_get_current_cipher(const SSL *s) 2803const SSL_CIPHER
2810 { 2804*SSL_get_current_cipher(const SSL *s)
2805{
2811 if ((s->session != NULL) && (s->session->cipher != NULL)) 2806 if ((s->session != NULL) && (s->session->cipher != NULL))
2812 return(s->session->cipher); 2807 return (s->session->cipher);
2813 return(NULL); 2808 return (NULL);
2814 } 2809}
2815#ifdef OPENSSL_NO_COMP 2810#ifdef OPENSSL_NO_COMP
2816const void *SSL_get_current_compression(SSL *s) 2811const void
2817 { 2812*SSL_get_current_compression(SSL *s)
2813{
2818 return NULL; 2814 return NULL;
2819 } 2815}
2820const void *SSL_get_current_expansion(SSL *s) 2816
2821 { 2817const void
2818*SSL_get_current_expansion(SSL *s)
2819{
2822 return NULL; 2820 return NULL;
2823 } 2821}
2824#else 2822#else
2825 2823
2826const COMP_METHOD *SSL_get_current_compression(SSL *s) 2824const COMP_METHOD
2827 { 2825*SSL_get_current_compression(SSL *s)
2826{
2828 if (s->compress != NULL) 2827 if (s->compress != NULL)
2829 return(s->compress->meth); 2828 return (s->compress->meth);
2830 return(NULL); 2829 return (NULL);
2831 } 2830}
2832 2831
2833const COMP_METHOD *SSL_get_current_expansion(SSL *s) 2832const COMP_METHOD
2834 { 2833*SSL_get_current_expansion(SSL *s)
2834{
2835 if (s->expand != NULL) 2835 if (s->expand != NULL)
2836 return(s->expand->meth); 2836 return (s->expand->meth);
2837 return(NULL); 2837 return (NULL);
2838 } 2838}
2839#endif 2839#endif
2840 2840
2841int ssl_init_wbio_buffer(SSL *s,int push) 2841int
2842 { 2842ssl_init_wbio_buffer(SSL *s, int push)
2843{
2843 BIO *bbio; 2844 BIO *bbio;
2844 2845
2845 if (s->bbio == NULL) 2846 if (s->bbio == NULL) {
2846 { 2847 bbio = BIO_new(BIO_f_buffer());
2847 bbio=BIO_new(BIO_f_buffer()); 2848 if (bbio == NULL)
2848 if (bbio == NULL) return(0); 2849 return (0);
2849 s->bbio=bbio; 2850 s->bbio = bbio;
2850 } 2851 } else {
2851 else 2852 bbio = s->bbio;
2852 {
2853 bbio=s->bbio;
2854 if (s->bbio == s->wbio) 2853 if (s->bbio == s->wbio)
2855 s->wbio=BIO_pop(s->wbio); 2854 s->wbio = BIO_pop(s->wbio);
2856 } 2855 }
2857 (void)BIO_reset(bbio); 2856 (void)BIO_reset(bbio);
2858/* if (!BIO_set_write_buffer_size(bbio,16*1024)) */ 2857/* if (!BIO_set_write_buffer_size(bbio,16*1024)) */
2859 if (!BIO_set_read_buffer_size(bbio,1)) 2858 if (!BIO_set_read_buffer_size(bbio, 1)) {
2860 { 2859 SSLerr(SSL_F_SSL_INIT_WBIO_BUFFER, ERR_R_BUF_LIB);
2861 SSLerr(SSL_F_SSL_INIT_WBIO_BUFFER,ERR_R_BUF_LIB); 2860 return (0);
2862 return(0); 2861 }
2863 } 2862 if (push) {
2864 if (push)
2865 {
2866 if (s->wbio != bbio) 2863 if (s->wbio != bbio)
2867 s->wbio=BIO_push(bbio,s->wbio); 2864 s->wbio = BIO_push(bbio, s->wbio);
2868 } 2865 } else {
2869 else
2870 {
2871 if (s->wbio == bbio) 2866 if (s->wbio == bbio)
2872 s->wbio=BIO_pop(bbio); 2867 s->wbio = BIO_pop(bbio);
2873 }
2874 return(1);
2875 } 2868 }
2869 return (1);
2870}
2876 2871
2877void ssl_free_wbio_buffer(SSL *s) 2872void
2878 { 2873ssl_free_wbio_buffer(SSL *s)
2879 if (s->bbio == NULL) return; 2874{
2875 if (s->bbio == NULL)
2876 return;
2880 2877
2881 if (s->bbio == s->wbio) 2878 if (s->bbio == s->wbio) {
2882 {
2883 /* remove buffering */ 2879 /* remove buffering */
2884 s->wbio=BIO_pop(s->wbio); 2880 s->wbio = BIO_pop(s->wbio);
2885#ifdef REF_CHECK /* not the usual REF_CHECK, but this avoids adding one more preprocessor symbol */ 2881#ifdef REF_CHECK /* not the usual REF_CHECK, but this avoids adding one more preprocessor symbol */
2886 assert(s->wbio != NULL); 2882 assert(s->wbio != NULL);
2887#endif 2883#endif
2888 } 2884 }
2889 BIO_free(s->bbio); 2885 BIO_free(s->bbio);
2890 s->bbio=NULL; 2886 s->bbio = NULL;
2891 } 2887}
2892
2893void SSL_CTX_set_quiet_shutdown(SSL_CTX *ctx,int mode)
2894 {
2895 ctx->quiet_shutdown=mode;
2896 }
2897 2888
2898int SSL_CTX_get_quiet_shutdown(const SSL_CTX *ctx) 2889void
2899 { 2890SSL_CTX_set_quiet_shutdown(SSL_CTX *ctx, int mode)
2900 return(ctx->quiet_shutdown); 2891{
2901 } 2892 ctx->quiet_shutdown = mode;
2893}
2902 2894
2903void SSL_set_quiet_shutdown(SSL *s,int mode) 2895int
2904 { 2896SSL_CTX_get_quiet_shutdown(const SSL_CTX *ctx)
2905 s->quiet_shutdown=mode; 2897{
2906 } 2898 return (ctx->quiet_shutdown);
2899}
2907 2900
2908int SSL_get_quiet_shutdown(const SSL *s) 2901void
2909 { 2902SSL_set_quiet_shutdown(SSL *s, int mode)
2910 return(s->quiet_shutdown); 2903{
2911 } 2904 s->quiet_shutdown = mode;
2905}
2912 2906
2913void SSL_set_shutdown(SSL *s,int mode) 2907int
2914 { 2908SSL_get_quiet_shutdown(const SSL *s)
2915 s->shutdown=mode; 2909{
2916 } 2910 return (s->quiet_shutdown);
2911}
2917 2912
2918int SSL_get_shutdown(const SSL *s) 2913void
2919 { 2914SSL_set_shutdown(SSL *s, int mode)
2920 return(s->shutdown); 2915{
2921 } 2916 s->shutdown = mode;
2917}
2922 2918
2923int SSL_version(const SSL *s) 2919int
2924 { 2920SSL_get_shutdown(const SSL *s)
2925 return(s->version); 2921{
2926 } 2922 return (s->shutdown);
2923}
2927 2924
2928SSL_CTX *SSL_get_SSL_CTX(const SSL *ssl) 2925int
2929 { 2926SSL_version(const SSL *s)
2930 return(ssl->ctx); 2927{
2931 } 2928 return (s->version);
2929}
2932 2930
2933SSL_CTX *SSL_set_SSL_CTX(SSL *ssl, SSL_CTX* ctx) 2931SSL_CTX
2934 { 2932*SSL_get_SSL_CTX(const SSL *ssl)
2933{
2934 return (ssl->ctx);
2935}
2936
2937SSL_CTX
2938*SSL_set_SSL_CTX(SSL *ssl, SSL_CTX* ctx)
2939{
2935 if (ssl->ctx == ctx) 2940 if (ssl->ctx == ctx)
2936 return ssl->ctx; 2941 return ssl->ctx;
2937#ifndef OPENSSL_NO_TLSEXT 2942#ifndef OPENSSL_NO_TLSEXT
@@ -2941,114 +2946,131 @@ SSL_CTX *SSL_set_SSL_CTX(SSL *ssl, SSL_CTX* ctx)
2941 if (ssl->cert != NULL) 2946 if (ssl->cert != NULL)
2942 ssl_cert_free(ssl->cert); 2947 ssl_cert_free(ssl->cert);
2943 ssl->cert = ssl_cert_dup(ctx->cert); 2948 ssl->cert = ssl_cert_dup(ctx->cert);
2944 CRYPTO_add(&ctx->references,1,CRYPTO_LOCK_SSL_CTX); 2949 CRYPTO_add(&ctx->references, 1, CRYPTO_LOCK_SSL_CTX);
2945 if (ssl->ctx != NULL) 2950 if (ssl->ctx != NULL)
2946 SSL_CTX_free(ssl->ctx); /* decrement reference count */ 2951 SSL_CTX_free(ssl->ctx); /* decrement reference count */
2947 ssl->ctx = ctx; 2952 ssl->ctx = ctx;
2948 return(ssl->ctx); 2953 return (ssl->ctx);
2949 } 2954}
2950 2955
2951#ifndef OPENSSL_NO_STDIO 2956#ifndef OPENSSL_NO_STDIO
2952int SSL_CTX_set_default_verify_paths(SSL_CTX *ctx) 2957int
2953 { 2958SSL_CTX_set_default_verify_paths(SSL_CTX *ctx)
2954 return(X509_STORE_set_default_paths(ctx->cert_store)); 2959{
2955 } 2960 return (X509_STORE_set_default_paths(ctx->cert_store));
2961}
2956 2962
2957int SSL_CTX_load_verify_locations(SSL_CTX *ctx, const char *CAfile, 2963int
2958 const char *CApath) 2964SSL_CTX_load_verify_locations(SSL_CTX *ctx, const char *CAfile,
2959 { 2965 const char *CApath)
2960 return(X509_STORE_load_locations(ctx->cert_store,CAfile,CApath)); 2966{
2961 } 2967 return (X509_STORE_load_locations(ctx->cert_store, CAfile, CApath));
2968}
2962#endif 2969#endif
2963 2970
2964void SSL_set_info_callback(SSL *ssl, 2971void
2965 void (*cb)(const SSL *ssl,int type,int val)) 2972SSL_set_info_callback(SSL *ssl,
2966 { 2973 void (*cb)(const SSL *ssl, int type, int val))
2967 ssl->info_callback=cb; 2974{
2968 } 2975 ssl->info_callback = cb;
2976}
2969 2977
2970/* One compiler (Diab DCC) doesn't like argument names in returned 2978/* One compiler (Diab DCC) doesn't like argument names in returned
2971 function pointer. */ 2979 function pointer. */
2972void (*SSL_get_info_callback(const SSL *ssl))(const SSL * /*ssl*/,int /*type*/,int /*val*/) 2980void (*SSL_get_info_callback(const SSL *ssl))(const SSL * /*ssl*/,int /*type*/,int /*val*/)
2973 { 2981{
2974 return ssl->info_callback; 2982 return ssl->info_callback;
2975 } 2983}
2976 2984
2977int SSL_state(const SSL *ssl) 2985int
2978 { 2986SSL_state(const SSL *ssl)
2979 return(ssl->state); 2987{
2980 } 2988 return (ssl->state);
2989}
2981 2990
2982void SSL_set_state(SSL *ssl, int state) 2991void
2983 { 2992SSL_set_state(SSL *ssl, int state)
2993{
2984 ssl->state = state; 2994 ssl->state = state;
2985 } 2995}
2986 2996
2987void SSL_set_verify_result(SSL *ssl,long arg) 2997void
2988 { 2998SSL_set_verify_result(SSL *ssl, long arg)
2989 ssl->verify_result=arg; 2999{
2990 } 3000 ssl->verify_result = arg;
3001}
2991 3002
2992long SSL_get_verify_result(const SSL *ssl) 3003long
2993 { 3004SSL_get_verify_result(const SSL *ssl)
2994 return(ssl->verify_result); 3005{
2995 } 3006 return (ssl->verify_result);
3007}
2996 3008
2997int SSL_get_ex_new_index(long argl,void *argp,CRYPTO_EX_new *new_func, 3009int
2998 CRYPTO_EX_dup *dup_func,CRYPTO_EX_free *free_func) 3010SSL_get_ex_new_index(long argl, void *argp, CRYPTO_EX_new *new_func,
2999 { 3011 CRYPTO_EX_dup *dup_func, CRYPTO_EX_free *free_func)
3012{
3000 return CRYPTO_get_ex_new_index(CRYPTO_EX_INDEX_SSL, argl, argp, 3013 return CRYPTO_get_ex_new_index(CRYPTO_EX_INDEX_SSL, argl, argp,
3001 new_func, dup_func, free_func); 3014 new_func, dup_func, free_func);
3002 } 3015}
3003 3016
3004int SSL_set_ex_data(SSL *s,int idx,void *arg) 3017int
3005 { 3018SSL_set_ex_data(SSL *s, int idx, void *arg)
3006 return(CRYPTO_set_ex_data(&s->ex_data,idx,arg)); 3019{
3007 } 3020 return (CRYPTO_set_ex_data(&s->ex_data, idx, arg));
3021}
3008 3022
3009void *SSL_get_ex_data(const SSL *s,int idx) 3023void
3010 { 3024*SSL_get_ex_data(const SSL *s, int idx)
3011 return(CRYPTO_get_ex_data(&s->ex_data,idx)); 3025{
3012 } 3026 return (CRYPTO_get_ex_data(&s->ex_data, idx));
3027}
3013 3028
3014int SSL_CTX_get_ex_new_index(long argl,void *argp,CRYPTO_EX_new *new_func, 3029int
3015 CRYPTO_EX_dup *dup_func,CRYPTO_EX_free *free_func) 3030SSL_CTX_get_ex_new_index(long argl, void *argp, CRYPTO_EX_new *new_func,
3016 { 3031 CRYPTO_EX_dup *dup_func, CRYPTO_EX_free *free_func)
3032{
3017 return CRYPTO_get_ex_new_index(CRYPTO_EX_INDEX_SSL_CTX, argl, argp, 3033 return CRYPTO_get_ex_new_index(CRYPTO_EX_INDEX_SSL_CTX, argl, argp,
3018 new_func, dup_func, free_func); 3034 new_func, dup_func, free_func);
3019 } 3035}
3020 3036
3021int SSL_CTX_set_ex_data(SSL_CTX *s,int idx,void *arg) 3037int
3022 { 3038SSL_CTX_set_ex_data(SSL_CTX *s, int idx, void *arg)
3023 return(CRYPTO_set_ex_data(&s->ex_data,idx,arg)); 3039{
3024 } 3040 return (CRYPTO_set_ex_data(&s->ex_data, idx, arg));
3041}
3025 3042
3026void *SSL_CTX_get_ex_data(const SSL_CTX *s,int idx) 3043void
3027 { 3044*SSL_CTX_get_ex_data(const SSL_CTX *s, int idx)
3028 return(CRYPTO_get_ex_data(&s->ex_data,idx)); 3045{
3029 } 3046 return (CRYPTO_get_ex_data(&s->ex_data, idx));
3047}
3030 3048
3031int ssl_ok(SSL *s) 3049int
3032 { 3050ssl_ok(SSL *s)
3033 return(1); 3051{
3034 } 3052 return (1);
3053}
3035 3054
3036X509_STORE *SSL_CTX_get_cert_store(const SSL_CTX *ctx) 3055X509_STORE
3037 { 3056*SSL_CTX_get_cert_store(const SSL_CTX *ctx)
3038 return(ctx->cert_store); 3057{
3039 } 3058 return (ctx->cert_store);
3059}
3040 3060
3041void SSL_CTX_set_cert_store(SSL_CTX *ctx,X509_STORE *store) 3061void
3042 { 3062SSL_CTX_set_cert_store(SSL_CTX *ctx, X509_STORE *store)
3063{
3043 if (ctx->cert_store != NULL) 3064 if (ctx->cert_store != NULL)
3044 X509_STORE_free(ctx->cert_store); 3065 X509_STORE_free(ctx->cert_store);
3045 ctx->cert_store=store; 3066 ctx->cert_store = store;
3046 } 3067}
3047 3068
3048int SSL_want(const SSL *s) 3069int
3049 { 3070SSL_want(const SSL *s)
3050 return(s->rwstate); 3071{
3051 } 3072 return (s->rwstate);
3073}
3052 3074
3053/*! 3075/*!
3054 * \brief Set the callback for generating temporary RSA keys. 3076 * \brief Set the callback for generating temporary RSA keys.
@@ -3057,19 +3079,21 @@ int SSL_want(const SSL *s)
3057 */ 3079 */
3058 3080
3059#ifndef OPENSSL_NO_RSA 3081#ifndef OPENSSL_NO_RSA
3060void SSL_CTX_set_tmp_rsa_callback(SSL_CTX *ctx,RSA *(*cb)(SSL *ssl, 3082void
3061 int is_export, 3083SSL_CTX_set_tmp_rsa_callback(SSL_CTX *ctx, RSA *(*cb)(SSL *ssl,
3062 int keylength)) 3084 int is_export,
3063 { 3085int keylength))
3064 SSL_CTX_callback_ctrl(ctx,SSL_CTRL_SET_TMP_RSA_CB,(void (*)(void))cb); 3086{
3065 } 3087 SSL_CTX_callback_ctrl(ctx, SSL_CTRL_SET_TMP_RSA_CB,(void (*)(void))cb);
3066 3088}
3067void SSL_set_tmp_rsa_callback(SSL *ssl,RSA *(*cb)(SSL *ssl, 3089
3068 int is_export, 3090void
3069 int keylength)) 3091SSL_set_tmp_rsa_callback(SSL *ssl, RSA *(*cb)(SSL *ssl,
3070 { 3092 int is_export,
3071 SSL_callback_ctrl(ssl,SSL_CTRL_SET_TMP_RSA_CB,(void (*)(void))cb); 3093int keylength))
3072 } 3094{
3095 SSL_callback_ctrl(ssl, SSL_CTRL_SET_TMP_RSA_CB,(void (*)(void))cb);
3096}
3073#endif 3097#endif
3074 3098
3075#ifdef DOXYGEN 3099#ifdef DOXYGEN
@@ -3083,8 +3107,9 @@ void SSL_set_tmp_rsa_callback(SSL *ssl,RSA *(*cb)(SSL *ssl,
3083 * \sa SSL_CTX_set_tmp_rsa_callback, SSL_set_tmp_rsa_callback 3107 * \sa SSL_CTX_set_tmp_rsa_callback, SSL_set_tmp_rsa_callback
3084 */ 3108 */
3085 3109
3086RSA *cb(SSL *ssl,int is_export,int keylength) 3110RSA
3087 {} 3111*cb(SSL *ssl, int is_export, int keylength)
3112{}
3088#endif 3113#endif
3089 3114
3090/*! 3115/*!
@@ -3094,133 +3119,142 @@ RSA *cb(SSL *ssl,int is_export,int keylength)
3094 */ 3119 */
3095 3120
3096#ifndef OPENSSL_NO_DH 3121#ifndef OPENSSL_NO_DH
3097void SSL_CTX_set_tmp_dh_callback(SSL_CTX *ctx,DH *(*dh)(SSL *ssl,int is_export, 3122void
3098 int keylength)) 3123SSL_CTX_set_tmp_dh_callback(SSL_CTX *ctx, DH *(*dh)(SSL *ssl, int is_export,
3099 { 3124 int keylength))
3100 SSL_CTX_callback_ctrl(ctx,SSL_CTRL_SET_TMP_DH_CB,(void (*)(void))dh); 3125{
3101 } 3126 SSL_CTX_callback_ctrl(ctx, SSL_CTRL_SET_TMP_DH_CB,(void (*)(void))dh);
3127}
3102 3128
3103void SSL_set_tmp_dh_callback(SSL *ssl,DH *(*dh)(SSL *ssl,int is_export, 3129void
3104 int keylength)) 3130SSL_set_tmp_dh_callback(SSL *ssl, DH *(*dh)(SSL *ssl, int is_export,
3105 { 3131 int keylength))
3106 SSL_callback_ctrl(ssl,SSL_CTRL_SET_TMP_DH_CB,(void (*)(void))dh); 3132{
3107 } 3133 SSL_callback_ctrl(ssl, SSL_CTRL_SET_TMP_DH_CB,(void (*)(void))dh);
3134}
3108#endif 3135#endif
3109 3136
3110#ifndef OPENSSL_NO_ECDH 3137#ifndef OPENSSL_NO_ECDH
3111void SSL_CTX_set_tmp_ecdh_callback(SSL_CTX *ctx,EC_KEY *(*ecdh)(SSL *ssl,int is_export, 3138void
3112 int keylength)) 3139SSL_CTX_set_tmp_ecdh_callback(SSL_CTX *ctx, EC_KEY *(*ecdh)(SSL *ssl, int is_export,
3113 { 3140 int keylength))
3114 SSL_CTX_callback_ctrl(ctx,SSL_CTRL_SET_TMP_ECDH_CB,(void (*)(void))ecdh); 3141{
3115 } 3142 SSL_CTX_callback_ctrl(ctx, SSL_CTRL_SET_TMP_ECDH_CB,(void (*)(void))ecdh);
3143}
3116 3144
3117void SSL_set_tmp_ecdh_callback(SSL *ssl,EC_KEY *(*ecdh)(SSL *ssl,int is_export, 3145void
3118 int keylength)) 3146SSL_set_tmp_ecdh_callback(SSL *ssl, EC_KEY *(*ecdh)(SSL *ssl, int is_export,
3119 { 3147 int keylength))
3120 SSL_callback_ctrl(ssl,SSL_CTRL_SET_TMP_ECDH_CB,(void (*)(void))ecdh); 3148{
3121 } 3149 SSL_callback_ctrl(ssl, SSL_CTRL_SET_TMP_ECDH_CB,(void (*)(void))ecdh);
3150}
3122#endif 3151#endif
3123 3152
3124#ifndef OPENSSL_NO_PSK 3153#ifndef OPENSSL_NO_PSK
3125int SSL_CTX_use_psk_identity_hint(SSL_CTX *ctx, const char *identity_hint) 3154int
3126 { 3155SSL_CTX_use_psk_identity_hint(SSL_CTX *ctx, const char *identity_hint)
3127 if (identity_hint != NULL && strlen(identity_hint) > PSK_MAX_IDENTITY_LEN) 3156{
3128 { 3157 if (identity_hint != NULL && strlen(identity_hint) > PSK_MAX_IDENTITY_LEN) {
3129 SSLerr(SSL_F_SSL_CTX_USE_PSK_IDENTITY_HINT, SSL_R_DATA_LENGTH_TOO_LONG); 3158 SSLerr(SSL_F_SSL_CTX_USE_PSK_IDENTITY_HINT, SSL_R_DATA_LENGTH_TOO_LONG);
3130 return 0; 3159 return 0;
3131 } 3160 }
3132 if (ctx->psk_identity_hint != NULL) 3161 if (ctx->psk_identity_hint != NULL)
3133 OPENSSL_free(ctx->psk_identity_hint); 3162 OPENSSL_free(ctx->psk_identity_hint);
3134 if (identity_hint != NULL) 3163 if (identity_hint != NULL) {
3135 {
3136 ctx->psk_identity_hint = BUF_strdup(identity_hint); 3164 ctx->psk_identity_hint = BUF_strdup(identity_hint);
3137 if (ctx->psk_identity_hint == NULL) 3165 if (ctx->psk_identity_hint == NULL)
3138 return 0; 3166 return 0;
3139 } 3167 } else
3140 else
3141 ctx->psk_identity_hint = NULL; 3168 ctx->psk_identity_hint = NULL;
3142 return 1; 3169 return 1;
3143 } 3170}
3144 3171
3145int SSL_use_psk_identity_hint(SSL *s, const char *identity_hint) 3172int
3146 { 3173SSL_use_psk_identity_hint(SSL *s, const char *identity_hint)
3174{
3147 if (s == NULL) 3175 if (s == NULL)
3148 return 0; 3176 return 0;
3149 3177
3150 if (s->session == NULL) 3178 if (s->session == NULL)
3151 return 1; /* session not created yet, ignored */ 3179 return 1; /* session not created yet, ignored */
3152 3180
3153 if (identity_hint != NULL && strlen(identity_hint) > PSK_MAX_IDENTITY_LEN) 3181 if (identity_hint != NULL && strlen(identity_hint) > PSK_MAX_IDENTITY_LEN) {
3154 {
3155 SSLerr(SSL_F_SSL_USE_PSK_IDENTITY_HINT, SSL_R_DATA_LENGTH_TOO_LONG); 3182 SSLerr(SSL_F_SSL_USE_PSK_IDENTITY_HINT, SSL_R_DATA_LENGTH_TOO_LONG);
3156 return 0; 3183 return 0;
3157 } 3184 }
3158 if (s->session->psk_identity_hint != NULL) 3185 if (s->session->psk_identity_hint != NULL)
3159 OPENSSL_free(s->session->psk_identity_hint); 3186 OPENSSL_free(s->session->psk_identity_hint);
3160 if (identity_hint != NULL) 3187 if (identity_hint != NULL) {
3161 {
3162 s->session->psk_identity_hint = BUF_strdup(identity_hint); 3188 s->session->psk_identity_hint = BUF_strdup(identity_hint);
3163 if (s->session->psk_identity_hint == NULL) 3189 if (s->session->psk_identity_hint == NULL)
3164 return 0; 3190 return 0;
3165 } 3191 } else
3166 else
3167 s->session->psk_identity_hint = NULL; 3192 s->session->psk_identity_hint = NULL;
3168 return 1; 3193 return 1;
3169 } 3194}
3170 3195
3171const char *SSL_get_psk_identity_hint(const SSL *s) 3196const char
3172 { 3197*SSL_get_psk_identity_hint(const SSL *s)
3198{
3173 if (s == NULL || s->session == NULL) 3199 if (s == NULL || s->session == NULL)
3174 return NULL; 3200 return NULL;
3175 return(s->session->psk_identity_hint); 3201 return (s->session->psk_identity_hint);
3176 } 3202}
3177 3203
3178const char *SSL_get_psk_identity(const SSL *s) 3204const char
3179 { 3205*SSL_get_psk_identity(const SSL *s)
3206{
3180 if (s == NULL || s->session == NULL) 3207 if (s == NULL || s->session == NULL)
3181 return NULL; 3208 return NULL;
3182 return(s->session->psk_identity); 3209 return (s->session->psk_identity);
3183 } 3210}
3184 3211
3185void SSL_set_psk_client_callback(SSL *s, 3212void
3213SSL_set_psk_client_callback(SSL *s,
3186 unsigned int (*cb)(SSL *ssl, const char *hint, 3214 unsigned int (*cb)(SSL *ssl, const char *hint,
3187 char *identity, unsigned int max_identity_len, unsigned char *psk, 3215char *identity, unsigned int max_identity_len, unsigned char *psk,
3188 unsigned int max_psk_len)) 3216 unsigned int max_psk_len))
3189 { 3217{
3190 s->psk_client_callback = cb; 3218 s->psk_client_callback = cb;
3191 } 3219}
3192 3220
3193void SSL_CTX_set_psk_client_callback(SSL_CTX *ctx, 3221void
3222SSL_CTX_set_psk_client_callback(SSL_CTX *ctx,
3194 unsigned int (*cb)(SSL *ssl, const char *hint, 3223 unsigned int (*cb)(SSL *ssl, const char *hint,
3195 char *identity, unsigned int max_identity_len, unsigned char *psk, 3224char *identity, unsigned int max_identity_len, unsigned char *psk,
3196 unsigned int max_psk_len)) 3225 unsigned int max_psk_len))
3197 { 3226{
3198 ctx->psk_client_callback = cb; 3227 ctx->psk_client_callback = cb;
3199 } 3228}
3200 3229
3201void SSL_set_psk_server_callback(SSL *s, 3230void
3231SSL_set_psk_server_callback(SSL *s,
3202 unsigned int (*cb)(SSL *ssl, const char *identity, 3232 unsigned int (*cb)(SSL *ssl, const char *identity,
3203 unsigned char *psk, unsigned int max_psk_len)) 3233unsigned char *psk, unsigned int max_psk_len))
3204 { 3234{
3205 s->psk_server_callback = cb; 3235 s->psk_server_callback = cb;
3206 } 3236}
3207 3237
3208void SSL_CTX_set_psk_server_callback(SSL_CTX *ctx, 3238void
3239SSL_CTX_set_psk_server_callback(SSL_CTX *ctx,
3209 unsigned int (*cb)(SSL *ssl, const char *identity, 3240 unsigned int (*cb)(SSL *ssl, const char *identity,
3210 unsigned char *psk, unsigned int max_psk_len)) 3241unsigned char *psk, unsigned int max_psk_len))
3211 { 3242{
3212 ctx->psk_server_callback = cb; 3243 ctx->psk_server_callback = cb;
3213 } 3244}
3214#endif 3245#endif
3215 3246
3216void SSL_CTX_set_msg_callback(SSL_CTX *ctx, void (*cb)(int write_p, int version, int content_type, const void *buf, size_t len, SSL *ssl, void *arg)) 3247void
3217 { 3248SSL_CTX_set_msg_callback(SSL_CTX *ctx, void (*cb)(int write_p, int version, int content_type, const void *buf, size_t len, SSL *ssl, void *arg))
3249{
3218 SSL_CTX_callback_ctrl(ctx, SSL_CTRL_SET_MSG_CALLBACK, (void (*)(void))cb); 3250 SSL_CTX_callback_ctrl(ctx, SSL_CTRL_SET_MSG_CALLBACK, (void (*)(void))cb);
3219 } 3251}
3220void SSL_set_msg_callback(SSL *ssl, void (*cb)(int write_p, int version, int content_type, const void *buf, size_t len, SSL *ssl, void *arg)) 3252
3221 { 3253void
3254SSL_set_msg_callback(SSL *ssl, void (*cb)(int write_p, int version, int content_type, const void *buf, size_t len, SSL *ssl, void *arg))
3255{
3222 SSL_callback_ctrl(ssl, SSL_CTRL_SET_MSG_CALLBACK, (void (*)(void))cb); 3256 SSL_callback_ctrl(ssl, SSL_CTRL_SET_MSG_CALLBACK, (void (*)(void))cb);
3223 } 3257}
3224 3258
3225/* Allocates new EVP_MD_CTX and sets pointer to it into given pointer 3259/* Allocates new EVP_MD_CTX and sets pointer to it into given pointer
3226 * vairable, freeing EVP_MD_CTX previously stored in that variable, if 3260 * vairable, freeing EVP_MD_CTX previously stored in that variable, if
@@ -3228,31 +3262,38 @@ void SSL_set_msg_callback(SSL *ssl, void (*cb)(int write_p, int version, int con
3228 * Returns newly allocated ctx; 3262 * Returns newly allocated ctx;
3229 */ 3263 */
3230 3264
3231EVP_MD_CTX *ssl_replace_hash(EVP_MD_CTX **hash,const EVP_MD *md) 3265EVP_MD_CTX
3266*ssl_replace_hash(EVP_MD_CTX **hash, const EVP_MD *md)
3232{ 3267{
3233 ssl_clear_hash_ctx(hash); 3268 ssl_clear_hash_ctx(hash);
3234 *hash = EVP_MD_CTX_create(); 3269 *hash = EVP_MD_CTX_create();
3235 if (md) EVP_DigestInit_ex(*hash,md,NULL); 3270 if (md)
3271 EVP_DigestInit_ex(*hash, md, NULL);
3236 return *hash; 3272 return *hash;
3237} 3273}
3238void ssl_clear_hash_ctx(EVP_MD_CTX **hash) 3274
3275void
3276ssl_clear_hash_ctx(EVP_MD_CTX **hash)
3239{ 3277{
3240 3278
3241 if (*hash) EVP_MD_CTX_destroy(*hash); 3279 if (*hash)
3242 *hash=NULL; 3280 EVP_MD_CTX_destroy(*hash);
3281 *hash = NULL;
3243} 3282}
3244 3283
3245void SSL_set_debug(SSL *s, int debug) 3284void
3246 { 3285SSL_set_debug(SSL *s, int debug)
3286{
3247 s->debug = debug; 3287 s->debug = debug;
3248 } 3288}
3249 3289
3250int SSL_cache_hit(SSL *s) 3290int
3251 { 3291SSL_cache_hit(SSL *s)
3292{
3252 return s->hit; 3293 return s->hit;
3253 } 3294}
3254 3295
3255IMPLEMENT_STACK_OF(SSL_CIPHER) 3296IMPLEMENT_STACK_OF(SSL_CIPHER)
3256IMPLEMENT_STACK_OF(SSL_COMP) 3297IMPLEMENT_STACK_OF(SSL_COMP)
3257IMPLEMENT_OBJ_BSEARCH_GLOBAL_CMP_FN(SSL_CIPHER, SSL_CIPHER, 3298IMPLEMENT_OBJ_BSEARCH_GLOBAL_CMP_FN(SSL_CIPHER, SSL_CIPHER,
3258 ssl_cipher_id); 3299ssl_cipher_id);
diff --git a/src/lib/libssl/ssl_rsa.c b/src/lib/libssl/ssl_rsa.c
index 60e7b66859..078df55f06 100644
--- a/src/lib/libssl/ssl_rsa.c
+++ b/src/lib/libssl/ssl_rsa.c
@@ -66,135 +66,126 @@
66 66
67static int ssl_set_cert(CERT *c, X509 *x509); 67static int ssl_set_cert(CERT *c, X509 *x509);
68static int ssl_set_pkey(CERT *c, EVP_PKEY *pkey); 68static int ssl_set_pkey(CERT *c, EVP_PKEY *pkey);
69int SSL_use_certificate(SSL *ssl, X509 *x) 69int
70 { 70SSL_use_certificate(SSL *ssl, X509 *x)
71 if (x == NULL) 71{
72 { 72 if (x == NULL) {
73 SSLerr(SSL_F_SSL_USE_CERTIFICATE,ERR_R_PASSED_NULL_PARAMETER); 73 SSLerr(SSL_F_SSL_USE_CERTIFICATE, ERR_R_PASSED_NULL_PARAMETER);
74 return(0); 74 return (0);
75 } 75 }
76 if (!ssl_cert_inst(&ssl->cert)) 76 if (!ssl_cert_inst(&ssl->cert)) {
77 { 77 SSLerr(SSL_F_SSL_USE_CERTIFICATE, ERR_R_MALLOC_FAILURE);
78 SSLerr(SSL_F_SSL_USE_CERTIFICATE,ERR_R_MALLOC_FAILURE); 78 return (0);
79 return(0);
80 }
81 return(ssl_set_cert(ssl->cert,x));
82 } 79 }
80 return (ssl_set_cert(ssl->cert, x));
81}
83 82
84#ifndef OPENSSL_NO_STDIO 83#ifndef OPENSSL_NO_STDIO
85int SSL_use_certificate_file(SSL *ssl, const char *file, int type) 84int
86 { 85SSL_use_certificate_file(SSL *ssl, const char *file, int type)
86{
87 int j; 87 int j;
88 BIO *in; 88 BIO *in;
89 int ret=0; 89 int ret = 0;
90 X509 *x=NULL; 90 X509 *x = NULL;
91 91
92 in=BIO_new(BIO_s_file_internal()); 92 in = BIO_new(BIO_s_file_internal());
93 if (in == NULL) 93 if (in == NULL) {
94 { 94 SSLerr(SSL_F_SSL_USE_CERTIFICATE_FILE, ERR_R_BUF_LIB);
95 SSLerr(SSL_F_SSL_USE_CERTIFICATE_FILE,ERR_R_BUF_LIB);
96 goto end; 95 goto end;
97 } 96 }
98 97
99 if (BIO_read_filename(in,file) <= 0) 98 if (BIO_read_filename(in, file) <= 0) {
100 { 99 SSLerr(SSL_F_SSL_USE_CERTIFICATE_FILE, ERR_R_SYS_LIB);
101 SSLerr(SSL_F_SSL_USE_CERTIFICATE_FILE,ERR_R_SYS_LIB);
102 goto end; 100 goto end;
103 } 101 }
104 if (type == SSL_FILETYPE_ASN1) 102 if (type == SSL_FILETYPE_ASN1) {
105 { 103 j = ERR_R_ASN1_LIB;
106 j=ERR_R_ASN1_LIB; 104 x = d2i_X509_bio(in, NULL);
107 x=d2i_X509_bio(in,NULL); 105 } else if (type == SSL_FILETYPE_PEM) {
108 } 106 j = ERR_R_PEM_LIB;
109 else if (type == SSL_FILETYPE_PEM) 107 x = PEM_read_bio_X509(in, NULL, ssl->ctx->default_passwd_callback, ssl->ctx->default_passwd_callback_userdata);
110 { 108 } else {
111 j=ERR_R_PEM_LIB; 109 SSLerr(SSL_F_SSL_USE_CERTIFICATE_FILE, SSL_R_BAD_SSL_FILETYPE);
112 x=PEM_read_bio_X509(in,NULL,ssl->ctx->default_passwd_callback,ssl->ctx->default_passwd_callback_userdata);
113 }
114 else
115 {
116 SSLerr(SSL_F_SSL_USE_CERTIFICATE_FILE,SSL_R_BAD_SSL_FILETYPE);
117 goto end; 110 goto end;
118 } 111 }
119 112
120 if (x == NULL) 113 if (x == NULL) {
121 { 114 SSLerr(SSL_F_SSL_USE_CERTIFICATE_FILE, j);
122 SSLerr(SSL_F_SSL_USE_CERTIFICATE_FILE,j);
123 goto end; 115 goto end;
124 } 116 }
125 117
126 ret=SSL_use_certificate(ssl,x); 118 ret = SSL_use_certificate(ssl, x);
127end: 119end:
128 if (x != NULL) X509_free(x); 120 if (x != NULL)
129 if (in != NULL) BIO_free(in); 121 X509_free(x);
130 return(ret); 122 if (in != NULL)
131 } 123 BIO_free(in);
124 return (ret);
125}
132#endif 126#endif
133 127
134int SSL_use_certificate_ASN1(SSL *ssl, const unsigned char *d, int len) 128int
135 { 129SSL_use_certificate_ASN1(SSL *ssl, const unsigned char *d, int len)
130{
136 X509 *x; 131 X509 *x;
137 int ret; 132 int ret;
138 133
139 x=d2i_X509(NULL,&d,(long)len); 134 x = d2i_X509(NULL, &d,(long)len);
140 if (x == NULL) 135 if (x == NULL) {
141 { 136 SSLerr(SSL_F_SSL_USE_CERTIFICATE_ASN1, ERR_R_ASN1_LIB);
142 SSLerr(SSL_F_SSL_USE_CERTIFICATE_ASN1,ERR_R_ASN1_LIB); 137 return (0);
143 return(0); 138 }
144 }
145 139
146 ret=SSL_use_certificate(ssl,x); 140 ret = SSL_use_certificate(ssl, x);
147 X509_free(x); 141 X509_free(x);
148 return(ret); 142 return (ret);
149 } 143}
150 144
151#ifndef OPENSSL_NO_RSA 145#ifndef OPENSSL_NO_RSA
152int SSL_use_RSAPrivateKey(SSL *ssl, RSA *rsa) 146int
153 { 147SSL_use_RSAPrivateKey(SSL *ssl, RSA *rsa)
148{
154 EVP_PKEY *pkey; 149 EVP_PKEY *pkey;
155 int ret; 150 int ret;
156 151
157 if (rsa == NULL) 152 if (rsa == NULL) {
158 { 153 SSLerr(SSL_F_SSL_USE_RSAPRIVATEKEY, ERR_R_PASSED_NULL_PARAMETER);
159 SSLerr(SSL_F_SSL_USE_RSAPRIVATEKEY,ERR_R_PASSED_NULL_PARAMETER); 154 return (0);
160 return(0); 155 }
161 } 156 if (!ssl_cert_inst(&ssl->cert)) {
162 if (!ssl_cert_inst(&ssl->cert)) 157 SSLerr(SSL_F_SSL_USE_RSAPRIVATEKEY, ERR_R_MALLOC_FAILURE);
163 { 158 return (0);
164 SSLerr(SSL_F_SSL_USE_RSAPRIVATEKEY,ERR_R_MALLOC_FAILURE); 159 }
165 return(0); 160 if ((pkey = EVP_PKEY_new()) == NULL) {
166 } 161 SSLerr(SSL_F_SSL_USE_RSAPRIVATEKEY, ERR_R_EVP_LIB);
167 if ((pkey=EVP_PKEY_new()) == NULL) 162 return (0);
168 { 163 }
169 SSLerr(SSL_F_SSL_USE_RSAPRIVATEKEY,ERR_R_EVP_LIB);
170 return(0);
171 }
172 164
173 RSA_up_ref(rsa); 165 RSA_up_ref(rsa);
174 EVP_PKEY_assign_RSA(pkey,rsa); 166 EVP_PKEY_assign_RSA(pkey, rsa);
175 167
176 ret=ssl_set_pkey(ssl->cert,pkey); 168 ret = ssl_set_pkey(ssl->cert, pkey);
177 EVP_PKEY_free(pkey); 169 EVP_PKEY_free(pkey);
178 return(ret); 170 return (ret);
179 } 171}
180#endif 172#endif
181 173
182static int ssl_set_pkey(CERT *c, EVP_PKEY *pkey) 174static int
183 { 175ssl_set_pkey(CERT *c, EVP_PKEY *pkey)
176{
184 int i; 177 int i;
185 178
186 i=ssl_cert_type(NULL,pkey); 179 i = ssl_cert_type(NULL, pkey);
187 if (i < 0) 180 if (i < 0) {
188 { 181 SSLerr(SSL_F_SSL_SET_PKEY, SSL_R_UNKNOWN_CERTIFICATE_TYPE);
189 SSLerr(SSL_F_SSL_SET_PKEY,SSL_R_UNKNOWN_CERTIFICATE_TYPE); 182 return (0);
190 return(0); 183 }
191 }
192 184
193 if (c->pkeys[i].x509 != NULL) 185 if (c->pkeys[i].x509 != NULL) {
194 {
195 EVP_PKEY *pktmp; 186 EVP_PKEY *pktmp;
196 pktmp = X509_get_pubkey(c->pkeys[i].x509); 187 pktmp = X509_get_pubkey(c->pkeys[i].x509);
197 EVP_PKEY_copy_parameters(pktmp,pkey); 188 EVP_PKEY_copy_parameters(pktmp, pkey);
198 EVP_PKEY_free(pktmp); 189 EVP_PKEY_free(pktmp);
199 ERR_clear_error(); 190 ERR_clear_error();
200 191
@@ -203,217 +194,200 @@ static int ssl_set_pkey(CERT *c, EVP_PKEY *pkey)
203 * for smart cards. */ 194 * for smart cards. */
204 if ((pkey->type == EVP_PKEY_RSA) && 195 if ((pkey->type == EVP_PKEY_RSA) &&
205 (RSA_flags(pkey->pkey.rsa) & RSA_METHOD_FLAG_NO_CHECK)) 196 (RSA_flags(pkey->pkey.rsa) & RSA_METHOD_FLAG_NO_CHECK))
206 ; 197;
207 else 198 else
208#endif 199#endif
209 if (!X509_check_private_key(c->pkeys[i].x509,pkey)) 200 if (!X509_check_private_key(c->pkeys[i].x509, pkey)) {
210 {
211 X509_free(c->pkeys[i].x509); 201 X509_free(c->pkeys[i].x509);
212 c->pkeys[i].x509 = NULL; 202 c->pkeys[i].x509 = NULL;
213 return 0; 203 return 0;
214 }
215 } 204 }
205 }
216 206
217 if (c->pkeys[i].privatekey != NULL) 207 if (c->pkeys[i].privatekey != NULL)
218 EVP_PKEY_free(c->pkeys[i].privatekey); 208 EVP_PKEY_free(c->pkeys[i].privatekey);
219 CRYPTO_add(&pkey->references,1,CRYPTO_LOCK_EVP_PKEY); 209 CRYPTO_add(&pkey->references, 1, CRYPTO_LOCK_EVP_PKEY);
220 c->pkeys[i].privatekey=pkey; 210 c->pkeys[i].privatekey = pkey;
221 c->key= &(c->pkeys[i]); 211 c->key = &(c->pkeys[i]);
222 212
223 c->valid=0; 213 c->valid = 0;
224 return(1); 214 return (1);
225 } 215}
226 216
227#ifndef OPENSSL_NO_RSA 217#ifndef OPENSSL_NO_RSA
228#ifndef OPENSSL_NO_STDIO 218#ifndef OPENSSL_NO_STDIO
229int SSL_use_RSAPrivateKey_file(SSL *ssl, const char *file, int type) 219int
230 { 220SSL_use_RSAPrivateKey_file(SSL *ssl, const char *file, int type)
231 int j,ret=0; 221{
222 int j, ret = 0;
232 BIO *in; 223 BIO *in;
233 RSA *rsa=NULL; 224 RSA *rsa = NULL;
234 225
235 in=BIO_new(BIO_s_file_internal()); 226 in = BIO_new(BIO_s_file_internal());
236 if (in == NULL) 227 if (in == NULL) {
237 { 228 SSLerr(SSL_F_SSL_USE_RSAPRIVATEKEY_FILE, ERR_R_BUF_LIB);
238 SSLerr(SSL_F_SSL_USE_RSAPRIVATEKEY_FILE,ERR_R_BUF_LIB);
239 goto end; 229 goto end;
240 } 230 }
241 231
242 if (BIO_read_filename(in,file) <= 0) 232 if (BIO_read_filename(in, file) <= 0) {
243 { 233 SSLerr(SSL_F_SSL_USE_RSAPRIVATEKEY_FILE, ERR_R_SYS_LIB);
244 SSLerr(SSL_F_SSL_USE_RSAPRIVATEKEY_FILE,ERR_R_SYS_LIB);
245 goto end; 234 goto end;
246 } 235 }
247 if (type == SSL_FILETYPE_ASN1) 236 if (type == SSL_FILETYPE_ASN1) {
248 { 237 j = ERR_R_ASN1_LIB;
249 j=ERR_R_ASN1_LIB; 238 rsa = d2i_RSAPrivateKey_bio(in, NULL);
250 rsa=d2i_RSAPrivateKey_bio(in,NULL); 239 } else if (type == SSL_FILETYPE_PEM) {
251 } 240 j = ERR_R_PEM_LIB;
252 else if (type == SSL_FILETYPE_PEM) 241 rsa = PEM_read_bio_RSAPrivateKey(in, NULL,
253 { 242 ssl->ctx->default_passwd_callback, ssl->ctx->default_passwd_callback_userdata);
254 j=ERR_R_PEM_LIB; 243 } else {
255 rsa=PEM_read_bio_RSAPrivateKey(in,NULL, 244 SSLerr(SSL_F_SSL_USE_RSAPRIVATEKEY_FILE, SSL_R_BAD_SSL_FILETYPE);
256 ssl->ctx->default_passwd_callback,ssl->ctx->default_passwd_callback_userdata);
257 }
258 else
259 {
260 SSLerr(SSL_F_SSL_USE_RSAPRIVATEKEY_FILE,SSL_R_BAD_SSL_FILETYPE);
261 goto end; 245 goto end;
262 } 246 }
263 if (rsa == NULL) 247 if (rsa == NULL) {
264 { 248 SSLerr(SSL_F_SSL_USE_RSAPRIVATEKEY_FILE, j);
265 SSLerr(SSL_F_SSL_USE_RSAPRIVATEKEY_FILE,j);
266 goto end; 249 goto end;
267 } 250 }
268 ret=SSL_use_RSAPrivateKey(ssl,rsa); 251 ret = SSL_use_RSAPrivateKey(ssl, rsa);
269 RSA_free(rsa); 252 RSA_free(rsa);
270end: 253end:
271 if (in != NULL) BIO_free(in); 254 if (in != NULL)
272 return(ret); 255 BIO_free(in);
273 } 256 return (ret);
257}
274#endif 258#endif
275 259
276int SSL_use_RSAPrivateKey_ASN1(SSL *ssl, unsigned char *d, long len) 260int
277 { 261SSL_use_RSAPrivateKey_ASN1(SSL *ssl, unsigned char *d, long len)
262{
278 int ret; 263 int ret;
279 const unsigned char *p; 264 const unsigned char *p;
280 RSA *rsa; 265 RSA *rsa;
281 266
282 p=d; 267 p = d;
283 if ((rsa=d2i_RSAPrivateKey(NULL,&p,(long)len)) == NULL) 268 if ((rsa = d2i_RSAPrivateKey(NULL, &p,(long)len)) == NULL) {
284 { 269 SSLerr(SSL_F_SSL_USE_RSAPRIVATEKEY_ASN1, ERR_R_ASN1_LIB);
285 SSLerr(SSL_F_SSL_USE_RSAPRIVATEKEY_ASN1,ERR_R_ASN1_LIB); 270 return (0);
286 return(0); 271 }
287 }
288 272
289 ret=SSL_use_RSAPrivateKey(ssl,rsa); 273 ret = SSL_use_RSAPrivateKey(ssl, rsa);
290 RSA_free(rsa); 274 RSA_free(rsa);
291 return(ret); 275 return (ret);
292 } 276}
293#endif /* !OPENSSL_NO_RSA */ 277#endif /* !OPENSSL_NO_RSA */
294 278
295int SSL_use_PrivateKey(SSL *ssl, EVP_PKEY *pkey) 279int
296 { 280SSL_use_PrivateKey(SSL *ssl, EVP_PKEY *pkey)
281{
297 int ret; 282 int ret;
298 283
299 if (pkey == NULL) 284 if (pkey == NULL) {
300 { 285 SSLerr(SSL_F_SSL_USE_PRIVATEKEY, ERR_R_PASSED_NULL_PARAMETER);
301 SSLerr(SSL_F_SSL_USE_PRIVATEKEY,ERR_R_PASSED_NULL_PARAMETER); 286 return (0);
302 return(0); 287 }
303 } 288 if (!ssl_cert_inst(&ssl->cert)) {
304 if (!ssl_cert_inst(&ssl->cert)) 289 SSLerr(SSL_F_SSL_USE_PRIVATEKEY, ERR_R_MALLOC_FAILURE);
305 { 290 return (0);
306 SSLerr(SSL_F_SSL_USE_PRIVATEKEY,ERR_R_MALLOC_FAILURE);
307 return(0);
308 }
309 ret=ssl_set_pkey(ssl->cert,pkey);
310 return(ret);
311 } 291 }
292 ret = ssl_set_pkey(ssl->cert, pkey);
293 return (ret);
294}
312 295
313#ifndef OPENSSL_NO_STDIO 296#ifndef OPENSSL_NO_STDIO
314int SSL_use_PrivateKey_file(SSL *ssl, const char *file, int type) 297int
315 { 298SSL_use_PrivateKey_file(SSL *ssl, const char *file, int type)
316 int j,ret=0; 299{
300 int j, ret = 0;
317 BIO *in; 301 BIO *in;
318 EVP_PKEY *pkey=NULL; 302 EVP_PKEY *pkey = NULL;
319 303
320 in=BIO_new(BIO_s_file_internal()); 304 in = BIO_new(BIO_s_file_internal());
321 if (in == NULL) 305 if (in == NULL) {
322 { 306 SSLerr(SSL_F_SSL_USE_PRIVATEKEY_FILE, ERR_R_BUF_LIB);
323 SSLerr(SSL_F_SSL_USE_PRIVATEKEY_FILE,ERR_R_BUF_LIB);
324 goto end; 307 goto end;
325 } 308 }
326 309
327 if (BIO_read_filename(in,file) <= 0) 310 if (BIO_read_filename(in, file) <= 0) {
328 { 311 SSLerr(SSL_F_SSL_USE_PRIVATEKEY_FILE, ERR_R_SYS_LIB);
329 SSLerr(SSL_F_SSL_USE_PRIVATEKEY_FILE,ERR_R_SYS_LIB);
330 goto end; 312 goto end;
331 } 313 }
332 if (type == SSL_FILETYPE_PEM) 314 if (type == SSL_FILETYPE_PEM) {
333 { 315 j = ERR_R_PEM_LIB;
334 j=ERR_R_PEM_LIB; 316 pkey = PEM_read_bio_PrivateKey(in, NULL,
335 pkey=PEM_read_bio_PrivateKey(in,NULL, 317 ssl->ctx->default_passwd_callback, ssl->ctx->default_passwd_callback_userdata);
336 ssl->ctx->default_passwd_callback,ssl->ctx->default_passwd_callback_userdata); 318 } else if (type == SSL_FILETYPE_ASN1) {
337 }
338 else if (type == SSL_FILETYPE_ASN1)
339 {
340 j = ERR_R_ASN1_LIB; 319 j = ERR_R_ASN1_LIB;
341 pkey = d2i_PrivateKey_bio(in,NULL); 320 pkey = d2i_PrivateKey_bio(in, NULL);
342 } 321 } else {
343 else 322 SSLerr(SSL_F_SSL_USE_PRIVATEKEY_FILE, SSL_R_BAD_SSL_FILETYPE);
344 {
345 SSLerr(SSL_F_SSL_USE_PRIVATEKEY_FILE,SSL_R_BAD_SSL_FILETYPE);
346 goto end; 323 goto end;
347 } 324 }
348 if (pkey == NULL) 325 if (pkey == NULL) {
349 { 326 SSLerr(SSL_F_SSL_USE_PRIVATEKEY_FILE, j);
350 SSLerr(SSL_F_SSL_USE_PRIVATEKEY_FILE,j);
351 goto end; 327 goto end;
352 } 328 }
353 ret=SSL_use_PrivateKey(ssl,pkey); 329 ret = SSL_use_PrivateKey(ssl, pkey);
354 EVP_PKEY_free(pkey); 330 EVP_PKEY_free(pkey);
355end: 331end:
356 if (in != NULL) BIO_free(in); 332 if (in != NULL)
357 return(ret); 333 BIO_free(in);
358 } 334 return (ret);
335}
359#endif 336#endif
360 337
361int SSL_use_PrivateKey_ASN1(int type, SSL *ssl, const unsigned char *d, long len) 338int
362 { 339SSL_use_PrivateKey_ASN1(int type, SSL *ssl, const unsigned char *d, long len)
340{
363 int ret; 341 int ret;
364 const unsigned char *p; 342 const unsigned char *p;
365 EVP_PKEY *pkey; 343 EVP_PKEY *pkey;
366 344
367 p=d; 345 p = d;
368 if ((pkey=d2i_PrivateKey(type,NULL,&p,(long)len)) == NULL) 346 if ((pkey = d2i_PrivateKey(type, NULL, &p,(long)len)) == NULL) {
369 { 347 SSLerr(SSL_F_SSL_USE_PRIVATEKEY_ASN1, ERR_R_ASN1_LIB);
370 SSLerr(SSL_F_SSL_USE_PRIVATEKEY_ASN1,ERR_R_ASN1_LIB); 348 return (0);
371 return(0); 349 }
372 }
373 350
374 ret=SSL_use_PrivateKey(ssl,pkey); 351 ret = SSL_use_PrivateKey(ssl, pkey);
375 EVP_PKEY_free(pkey); 352 EVP_PKEY_free(pkey);
376 return(ret); 353 return (ret);
354}
355
356int
357SSL_CTX_use_certificate(SSL_CTX *ctx, X509 *x)
358{
359 if (x == NULL) {
360 SSLerr(SSL_F_SSL_CTX_USE_CERTIFICATE, ERR_R_PASSED_NULL_PARAMETER);
361 return (0);
377 } 362 }
378 363 if (!ssl_cert_inst(&ctx->cert)) {
379int SSL_CTX_use_certificate(SSL_CTX *ctx, X509 *x) 364 SSLerr(SSL_F_SSL_CTX_USE_CERTIFICATE, ERR_R_MALLOC_FAILURE);
380 { 365 return (0);
381 if (x == NULL)
382 {
383 SSLerr(SSL_F_SSL_CTX_USE_CERTIFICATE,ERR_R_PASSED_NULL_PARAMETER);
384 return(0);
385 }
386 if (!ssl_cert_inst(&ctx->cert))
387 {
388 SSLerr(SSL_F_SSL_CTX_USE_CERTIFICATE,ERR_R_MALLOC_FAILURE);
389 return(0);
390 }
391 return(ssl_set_cert(ctx->cert, x));
392 } 366 }
367 return (ssl_set_cert(ctx->cert, x));
368}
393 369
394static int ssl_set_cert(CERT *c, X509 *x) 370static int
395 { 371ssl_set_cert(CERT *c, X509 *x)
372{
396 EVP_PKEY *pkey; 373 EVP_PKEY *pkey;
397 int i; 374 int i;
398 375
399 pkey=X509_get_pubkey(x); 376 pkey = X509_get_pubkey(x);
400 if (pkey == NULL) 377 if (pkey == NULL) {
401 { 378 SSLerr(SSL_F_SSL_SET_CERT, SSL_R_X509_LIB);
402 SSLerr(SSL_F_SSL_SET_CERT,SSL_R_X509_LIB); 379 return (0);
403 return(0); 380 }
404 }
405 381
406 i=ssl_cert_type(x,pkey); 382 i = ssl_cert_type(x, pkey);
407 if (i < 0) 383 if (i < 0) {
408 { 384 SSLerr(SSL_F_SSL_SET_CERT, SSL_R_UNKNOWN_CERTIFICATE_TYPE);
409 SSLerr(SSL_F_SSL_SET_CERT,SSL_R_UNKNOWN_CERTIFICATE_TYPE);
410 EVP_PKEY_free(pkey); 385 EVP_PKEY_free(pkey);
411 return(0); 386 return (0);
412 } 387 }
413 388
414 if (c->pkeys[i].privatekey != NULL) 389 if (c->pkeys[i].privatekey != NULL) {
415 { 390 EVP_PKEY_copy_parameters(pkey, c->pkeys[i].privatekey);
416 EVP_PKEY_copy_parameters(pkey,c->pkeys[i].privatekey);
417 ERR_clear_error(); 391 ERR_clear_error();
418 392
419#ifndef OPENSSL_NO_RSA 393#ifndef OPENSSL_NO_RSA
@@ -421,280 +395,259 @@ static int ssl_set_cert(CERT *c, X509 *x)
421 * for smart cards. */ 395 * for smart cards. */
422 if ((c->pkeys[i].privatekey->type == EVP_PKEY_RSA) && 396 if ((c->pkeys[i].privatekey->type == EVP_PKEY_RSA) &&
423 (RSA_flags(c->pkeys[i].privatekey->pkey.rsa) & 397 (RSA_flags(c->pkeys[i].privatekey->pkey.rsa) &
424 RSA_METHOD_FLAG_NO_CHECK)) 398 RSA_METHOD_FLAG_NO_CHECK))
425 ; 399;
426 else 400 else
427#endif /* OPENSSL_NO_RSA */ 401#endif /* OPENSSL_NO_RSA */
428 if (!X509_check_private_key(x,c->pkeys[i].privatekey)) 402 if (!X509_check_private_key(x, c->pkeys[i].privatekey)) {
429 {
430 /* don't fail for a cert/key mismatch, just free 403 /* don't fail for a cert/key mismatch, just free
431 * current private key (when switching to a different 404 * current private key (when switching to a different
432 * cert & key, first this function should be used, 405 * cert & key, first this function should be used,
433 * then ssl_set_pkey */ 406 * then ssl_set_pkey */
434 EVP_PKEY_free(c->pkeys[i].privatekey); 407 EVP_PKEY_free(c->pkeys[i].privatekey);
435 c->pkeys[i].privatekey=NULL; 408 c->pkeys[i].privatekey = NULL;
436 /* clear error queue */ 409 /* clear error queue */
437 ERR_clear_error(); 410 ERR_clear_error();
438 }
439 } 411 }
412 }
440 413
441 EVP_PKEY_free(pkey); 414 EVP_PKEY_free(pkey);
442 415
443 if (c->pkeys[i].x509 != NULL) 416 if (c->pkeys[i].x509 != NULL)
444 X509_free(c->pkeys[i].x509); 417 X509_free(c->pkeys[i].x509);
445 CRYPTO_add(&x->references,1,CRYPTO_LOCK_X509); 418 CRYPTO_add(&x->references, 1, CRYPTO_LOCK_X509);
446 c->pkeys[i].x509=x; 419 c->pkeys[i].x509 = x;
447 c->key= &(c->pkeys[i]); 420 c->key = &(c->pkeys[i]);
448 421
449 c->valid=0; 422 c->valid = 0;
450 return(1); 423 return (1);
451 } 424}
452 425
453#ifndef OPENSSL_NO_STDIO 426#ifndef OPENSSL_NO_STDIO
454int SSL_CTX_use_certificate_file(SSL_CTX *ctx, const char *file, int type) 427int
455 { 428SSL_CTX_use_certificate_file(SSL_CTX *ctx, const char *file, int type)
429{
456 int j; 430 int j;
457 BIO *in; 431 BIO *in;
458 int ret=0; 432 int ret = 0;
459 X509 *x=NULL; 433 X509 *x = NULL;
460 434
461 in=BIO_new(BIO_s_file_internal()); 435 in = BIO_new(BIO_s_file_internal());
462 if (in == NULL) 436 if (in == NULL) {
463 { 437 SSLerr(SSL_F_SSL_CTX_USE_CERTIFICATE_FILE, ERR_R_BUF_LIB);
464 SSLerr(SSL_F_SSL_CTX_USE_CERTIFICATE_FILE,ERR_R_BUF_LIB);
465 goto end; 438 goto end;
466 } 439 }
467 440
468 if (BIO_read_filename(in,file) <= 0) 441 if (BIO_read_filename(in, file) <= 0) {
469 { 442 SSLerr(SSL_F_SSL_CTX_USE_CERTIFICATE_FILE, ERR_R_SYS_LIB);
470 SSLerr(SSL_F_SSL_CTX_USE_CERTIFICATE_FILE,ERR_R_SYS_LIB);
471 goto end; 443 goto end;
472 } 444 }
473 if (type == SSL_FILETYPE_ASN1) 445 if (type == SSL_FILETYPE_ASN1) {
474 { 446 j = ERR_R_ASN1_LIB;
475 j=ERR_R_ASN1_LIB; 447 x = d2i_X509_bio(in, NULL);
476 x=d2i_X509_bio(in,NULL); 448 } else if (type == SSL_FILETYPE_PEM) {
477 } 449 j = ERR_R_PEM_LIB;
478 else if (type == SSL_FILETYPE_PEM) 450 x = PEM_read_bio_X509(in, NULL, ctx->default_passwd_callback, ctx->default_passwd_callback_userdata);
479 { 451 } else {
480 j=ERR_R_PEM_LIB; 452 SSLerr(SSL_F_SSL_CTX_USE_CERTIFICATE_FILE, SSL_R_BAD_SSL_FILETYPE);
481 x=PEM_read_bio_X509(in,NULL,ctx->default_passwd_callback,ctx->default_passwd_callback_userdata);
482 }
483 else
484 {
485 SSLerr(SSL_F_SSL_CTX_USE_CERTIFICATE_FILE,SSL_R_BAD_SSL_FILETYPE);
486 goto end; 453 goto end;
487 } 454 }
488 455
489 if (x == NULL) 456 if (x == NULL) {
490 { 457 SSLerr(SSL_F_SSL_CTX_USE_CERTIFICATE_FILE, j);
491 SSLerr(SSL_F_SSL_CTX_USE_CERTIFICATE_FILE,j);
492 goto end; 458 goto end;
493 } 459 }
494 460
495 ret=SSL_CTX_use_certificate(ctx,x); 461 ret = SSL_CTX_use_certificate(ctx, x);
496end: 462end:
497 if (x != NULL) X509_free(x); 463 if (x != NULL)
498 if (in != NULL) BIO_free(in); 464 X509_free(x);
499 return(ret); 465 if (in != NULL)
500 } 466 BIO_free(in);
467 return (ret);
468}
501#endif 469#endif
502 470
503int SSL_CTX_use_certificate_ASN1(SSL_CTX *ctx, int len, const unsigned char *d) 471int
504 { 472SSL_CTX_use_certificate_ASN1(SSL_CTX *ctx, int len, const unsigned char *d)
473{
505 X509 *x; 474 X509 *x;
506 int ret; 475 int ret;
507 476
508 x=d2i_X509(NULL,&d,(long)len); 477 x = d2i_X509(NULL, &d,(long)len);
509 if (x == NULL) 478 if (x == NULL) {
510 { 479 SSLerr(SSL_F_SSL_CTX_USE_CERTIFICATE_ASN1, ERR_R_ASN1_LIB);
511 SSLerr(SSL_F_SSL_CTX_USE_CERTIFICATE_ASN1,ERR_R_ASN1_LIB); 480 return (0);
512 return(0); 481 }
513 }
514 482
515 ret=SSL_CTX_use_certificate(ctx,x); 483 ret = SSL_CTX_use_certificate(ctx, x);
516 X509_free(x); 484 X509_free(x);
517 return(ret); 485 return (ret);
518 } 486}
519 487
520#ifndef OPENSSL_NO_RSA 488#ifndef OPENSSL_NO_RSA
521int SSL_CTX_use_RSAPrivateKey(SSL_CTX *ctx, RSA *rsa) 489int
522 { 490SSL_CTX_use_RSAPrivateKey(SSL_CTX *ctx, RSA *rsa)
491{
523 int ret; 492 int ret;
524 EVP_PKEY *pkey; 493 EVP_PKEY *pkey;
525 494
526 if (rsa == NULL) 495 if (rsa == NULL) {
527 { 496 SSLerr(SSL_F_SSL_CTX_USE_RSAPRIVATEKEY, ERR_R_PASSED_NULL_PARAMETER);
528 SSLerr(SSL_F_SSL_CTX_USE_RSAPRIVATEKEY,ERR_R_PASSED_NULL_PARAMETER); 497 return (0);
529 return(0); 498 }
530 } 499 if (!ssl_cert_inst(&ctx->cert)) {
531 if (!ssl_cert_inst(&ctx->cert)) 500 SSLerr(SSL_F_SSL_CTX_USE_RSAPRIVATEKEY, ERR_R_MALLOC_FAILURE);
532 { 501 return (0);
533 SSLerr(SSL_F_SSL_CTX_USE_RSAPRIVATEKEY,ERR_R_MALLOC_FAILURE); 502 }
534 return(0); 503 if ((pkey = EVP_PKEY_new()) == NULL) {
535 } 504 SSLerr(SSL_F_SSL_CTX_USE_RSAPRIVATEKEY, ERR_R_EVP_LIB);
536 if ((pkey=EVP_PKEY_new()) == NULL) 505 return (0);
537 { 506 }
538 SSLerr(SSL_F_SSL_CTX_USE_RSAPRIVATEKEY,ERR_R_EVP_LIB);
539 return(0);
540 }
541 507
542 RSA_up_ref(rsa); 508 RSA_up_ref(rsa);
543 EVP_PKEY_assign_RSA(pkey,rsa); 509 EVP_PKEY_assign_RSA(pkey, rsa);
544 510
545 ret=ssl_set_pkey(ctx->cert, pkey); 511 ret = ssl_set_pkey(ctx->cert, pkey);
546 EVP_PKEY_free(pkey); 512 EVP_PKEY_free(pkey);
547 return(ret); 513 return (ret);
548 } 514}
549 515
550#ifndef OPENSSL_NO_STDIO 516#ifndef OPENSSL_NO_STDIO
551int SSL_CTX_use_RSAPrivateKey_file(SSL_CTX *ctx, const char *file, int type) 517int
552 { 518SSL_CTX_use_RSAPrivateKey_file(SSL_CTX *ctx, const char *file, int type)
553 int j,ret=0; 519{
520 int j, ret = 0;
554 BIO *in; 521 BIO *in;
555 RSA *rsa=NULL; 522 RSA *rsa = NULL;
556 523
557 in=BIO_new(BIO_s_file_internal()); 524 in = BIO_new(BIO_s_file_internal());
558 if (in == NULL) 525 if (in == NULL) {
559 { 526 SSLerr(SSL_F_SSL_CTX_USE_RSAPRIVATEKEY_FILE, ERR_R_BUF_LIB);
560 SSLerr(SSL_F_SSL_CTX_USE_RSAPRIVATEKEY_FILE,ERR_R_BUF_LIB);
561 goto end; 527 goto end;
562 } 528 }
563 529
564 if (BIO_read_filename(in,file) <= 0) 530 if (BIO_read_filename(in, file) <= 0) {
565 { 531 SSLerr(SSL_F_SSL_CTX_USE_RSAPRIVATEKEY_FILE, ERR_R_SYS_LIB);
566 SSLerr(SSL_F_SSL_CTX_USE_RSAPRIVATEKEY_FILE,ERR_R_SYS_LIB);
567 goto end; 532 goto end;
568 } 533 }
569 if (type == SSL_FILETYPE_ASN1) 534 if (type == SSL_FILETYPE_ASN1) {
570 { 535 j = ERR_R_ASN1_LIB;
571 j=ERR_R_ASN1_LIB; 536 rsa = d2i_RSAPrivateKey_bio(in, NULL);
572 rsa=d2i_RSAPrivateKey_bio(in,NULL); 537 } else if (type == SSL_FILETYPE_PEM) {
573 } 538 j = ERR_R_PEM_LIB;
574 else if (type == SSL_FILETYPE_PEM) 539 rsa = PEM_read_bio_RSAPrivateKey(in, NULL,
575 { 540 ctx->default_passwd_callback, ctx->default_passwd_callback_userdata);
576 j=ERR_R_PEM_LIB; 541 } else {
577 rsa=PEM_read_bio_RSAPrivateKey(in,NULL, 542 SSLerr(SSL_F_SSL_CTX_USE_RSAPRIVATEKEY_FILE, SSL_R_BAD_SSL_FILETYPE);
578 ctx->default_passwd_callback,ctx->default_passwd_callback_userdata);
579 }
580 else
581 {
582 SSLerr(SSL_F_SSL_CTX_USE_RSAPRIVATEKEY_FILE,SSL_R_BAD_SSL_FILETYPE);
583 goto end; 543 goto end;
584 } 544 }
585 if (rsa == NULL) 545 if (rsa == NULL) {
586 { 546 SSLerr(SSL_F_SSL_CTX_USE_RSAPRIVATEKEY_FILE, j);
587 SSLerr(SSL_F_SSL_CTX_USE_RSAPRIVATEKEY_FILE,j);
588 goto end; 547 goto end;
589 } 548 }
590 ret=SSL_CTX_use_RSAPrivateKey(ctx,rsa); 549 ret = SSL_CTX_use_RSAPrivateKey(ctx, rsa);
591 RSA_free(rsa); 550 RSA_free(rsa);
592end: 551end:
593 if (in != NULL) BIO_free(in); 552 if (in != NULL)
594 return(ret); 553 BIO_free(in);
595 } 554 return (ret);
555}
596#endif 556#endif
597 557
598int SSL_CTX_use_RSAPrivateKey_ASN1(SSL_CTX *ctx, const unsigned char *d, long len) 558int
599 { 559SSL_CTX_use_RSAPrivateKey_ASN1(SSL_CTX *ctx, const unsigned char *d, long len)
560{
600 int ret; 561 int ret;
601 const unsigned char *p; 562 const unsigned char *p;
602 RSA *rsa; 563 RSA *rsa;
603 564
604 p=d; 565 p = d;
605 if ((rsa=d2i_RSAPrivateKey(NULL,&p,(long)len)) == NULL) 566 if ((rsa = d2i_RSAPrivateKey(NULL, &p,(long)len)) == NULL) {
606 { 567 SSLerr(SSL_F_SSL_CTX_USE_RSAPRIVATEKEY_ASN1, ERR_R_ASN1_LIB);
607 SSLerr(SSL_F_SSL_CTX_USE_RSAPRIVATEKEY_ASN1,ERR_R_ASN1_LIB); 568 return (0);
608 return(0); 569 }
609 }
610 570
611 ret=SSL_CTX_use_RSAPrivateKey(ctx,rsa); 571 ret = SSL_CTX_use_RSAPrivateKey(ctx, rsa);
612 RSA_free(rsa); 572 RSA_free(rsa);
613 return(ret); 573 return (ret);
614 } 574}
615#endif /* !OPENSSL_NO_RSA */ 575#endif /* !OPENSSL_NO_RSA */
616 576
617int SSL_CTX_use_PrivateKey(SSL_CTX *ctx, EVP_PKEY *pkey) 577int
618 { 578SSL_CTX_use_PrivateKey(SSL_CTX *ctx, EVP_PKEY *pkey)
619 if (pkey == NULL) 579{
620 { 580 if (pkey == NULL) {
621 SSLerr(SSL_F_SSL_CTX_USE_PRIVATEKEY,ERR_R_PASSED_NULL_PARAMETER); 581 SSLerr(SSL_F_SSL_CTX_USE_PRIVATEKEY, ERR_R_PASSED_NULL_PARAMETER);
622 return(0); 582 return (0);
623 }
624 if (!ssl_cert_inst(&ctx->cert))
625 {
626 SSLerr(SSL_F_SSL_CTX_USE_PRIVATEKEY,ERR_R_MALLOC_FAILURE);
627 return(0);
628 }
629 return(ssl_set_pkey(ctx->cert,pkey));
630 } 583 }
584 if (!ssl_cert_inst(&ctx->cert)) {
585 SSLerr(SSL_F_SSL_CTX_USE_PRIVATEKEY, ERR_R_MALLOC_FAILURE);
586 return (0);
587 }
588 return (ssl_set_pkey(ctx->cert, pkey));
589}
631 590
632#ifndef OPENSSL_NO_STDIO 591#ifndef OPENSSL_NO_STDIO
633int SSL_CTX_use_PrivateKey_file(SSL_CTX *ctx, const char *file, int type) 592int
634 { 593SSL_CTX_use_PrivateKey_file(SSL_CTX *ctx, const char *file, int type)
635 int j,ret=0; 594{
595 int j, ret = 0;
636 BIO *in; 596 BIO *in;
637 EVP_PKEY *pkey=NULL; 597 EVP_PKEY *pkey = NULL;
638 598
639 in=BIO_new(BIO_s_file_internal()); 599 in = BIO_new(BIO_s_file_internal());
640 if (in == NULL) 600 if (in == NULL) {
641 { 601 SSLerr(SSL_F_SSL_CTX_USE_PRIVATEKEY_FILE, ERR_R_BUF_LIB);
642 SSLerr(SSL_F_SSL_CTX_USE_PRIVATEKEY_FILE,ERR_R_BUF_LIB);
643 goto end; 602 goto end;
644 } 603 }
645 604
646 if (BIO_read_filename(in,file) <= 0) 605 if (BIO_read_filename(in, file) <= 0) {
647 { 606 SSLerr(SSL_F_SSL_CTX_USE_PRIVATEKEY_FILE, ERR_R_SYS_LIB);
648 SSLerr(SSL_F_SSL_CTX_USE_PRIVATEKEY_FILE,ERR_R_SYS_LIB);
649 goto end; 607 goto end;
650 } 608 }
651 if (type == SSL_FILETYPE_PEM) 609 if (type == SSL_FILETYPE_PEM) {
652 { 610 j = ERR_R_PEM_LIB;
653 j=ERR_R_PEM_LIB; 611 pkey = PEM_read_bio_PrivateKey(in, NULL,
654 pkey=PEM_read_bio_PrivateKey(in,NULL, 612 ctx->default_passwd_callback, ctx->default_passwd_callback_userdata);
655 ctx->default_passwd_callback,ctx->default_passwd_callback_userdata); 613 } else if (type == SSL_FILETYPE_ASN1) {
656 }
657 else if (type == SSL_FILETYPE_ASN1)
658 {
659 j = ERR_R_ASN1_LIB; 614 j = ERR_R_ASN1_LIB;
660 pkey = d2i_PrivateKey_bio(in,NULL); 615 pkey = d2i_PrivateKey_bio(in, NULL);
661 } 616 } else {
662 else 617 SSLerr(SSL_F_SSL_CTX_USE_PRIVATEKEY_FILE, SSL_R_BAD_SSL_FILETYPE);
663 {
664 SSLerr(SSL_F_SSL_CTX_USE_PRIVATEKEY_FILE,SSL_R_BAD_SSL_FILETYPE);
665 goto end; 618 goto end;
666 } 619 }
667 if (pkey == NULL) 620 if (pkey == NULL) {
668 { 621 SSLerr(SSL_F_SSL_CTX_USE_PRIVATEKEY_FILE, j);
669 SSLerr(SSL_F_SSL_CTX_USE_PRIVATEKEY_FILE,j);
670 goto end; 622 goto end;
671 } 623 }
672 ret=SSL_CTX_use_PrivateKey(ctx,pkey); 624 ret = SSL_CTX_use_PrivateKey(ctx, pkey);
673 EVP_PKEY_free(pkey); 625 EVP_PKEY_free(pkey);
674end: 626end:
675 if (in != NULL) BIO_free(in); 627 if (in != NULL)
676 return(ret); 628 BIO_free(in);
677 } 629 return (ret);
630}
678#endif 631#endif
679 632
680int SSL_CTX_use_PrivateKey_ASN1(int type, SSL_CTX *ctx, const unsigned char *d, 633int
681 long len) 634SSL_CTX_use_PrivateKey_ASN1(int type, SSL_CTX *ctx, const unsigned char *d,
682 { 635 long len)
636{
683 int ret; 637 int ret;
684 const unsigned char *p; 638 const unsigned char *p;
685 EVP_PKEY *pkey; 639 EVP_PKEY *pkey;
686 640
687 p=d; 641 p = d;
688 if ((pkey=d2i_PrivateKey(type,NULL,&p,(long)len)) == NULL) 642 if ((pkey = d2i_PrivateKey(type, NULL, &p,(long)len)) == NULL) {
689 { 643 SSLerr(SSL_F_SSL_CTX_USE_PRIVATEKEY_ASN1, ERR_R_ASN1_LIB);
690 SSLerr(SSL_F_SSL_CTX_USE_PRIVATEKEY_ASN1,ERR_R_ASN1_LIB); 644 return (0);
691 return(0); 645 }
692 }
693 646
694 ret=SSL_CTX_use_PrivateKey(ctx,pkey); 647 ret = SSL_CTX_use_PrivateKey(ctx, pkey);
695 EVP_PKEY_free(pkey); 648 EVP_PKEY_free(pkey);
696 return(ret); 649 return (ret);
697 } 650}
698 651
699 652
700#ifndef OPENSSL_NO_STDIO 653#ifndef OPENSSL_NO_STDIO
@@ -702,82 +655,79 @@ int SSL_CTX_use_PrivateKey_ASN1(int type, SSL_CTX *ctx, const unsigned char *d,
702 * possibly followed by a sequence of CA certificates that should be 655 * possibly followed by a sequence of CA certificates that should be
703 * sent to the peer in the Certificate message. 656 * sent to the peer in the Certificate message.
704 */ 657 */
705int SSL_CTX_use_certificate_chain_file(SSL_CTX *ctx, const char *file) 658int
706 { 659SSL_CTX_use_certificate_chain_file(SSL_CTX *ctx, const char *file)
660{
707 BIO *in; 661 BIO *in;
708 int ret=0; 662 int ret = 0;
709 X509 *x=NULL; 663 X509 *x = NULL;
710 664
711 ERR_clear_error(); /* clear error stack for SSL_CTX_use_certificate() */ 665 ERR_clear_error(); /* clear error stack for SSL_CTX_use_certificate() */
712 666
713 in = BIO_new(BIO_s_file_internal()); 667 in = BIO_new(BIO_s_file_internal());
714 if (in == NULL) 668 if (in == NULL) {
715 { 669 SSLerr(SSL_F_SSL_CTX_USE_CERTIFICATE_CHAIN_FILE, ERR_R_BUF_LIB);
716 SSLerr(SSL_F_SSL_CTX_USE_CERTIFICATE_CHAIN_FILE,ERR_R_BUF_LIB);
717 goto end; 670 goto end;
718 } 671 }
719 672
720 if (BIO_read_filename(in,file) <= 0) 673 if (BIO_read_filename(in, file) <= 0) {
721 { 674 SSLerr(SSL_F_SSL_CTX_USE_CERTIFICATE_CHAIN_FILE, ERR_R_SYS_LIB);
722 SSLerr(SSL_F_SSL_CTX_USE_CERTIFICATE_CHAIN_FILE,ERR_R_SYS_LIB);
723 goto end; 675 goto end;
724 } 676 }
725 677
726 x=PEM_read_bio_X509_AUX(in,NULL,ctx->default_passwd_callback, 678 x = PEM_read_bio_X509_AUX(in, NULL, ctx->default_passwd_callback,
727 ctx->default_passwd_callback_userdata); 679 ctx->default_passwd_callback_userdata);
728 if (x == NULL) 680 if (x == NULL) {
729 { 681 SSLerr(SSL_F_SSL_CTX_USE_CERTIFICATE_CHAIN_FILE, ERR_R_PEM_LIB);
730 SSLerr(SSL_F_SSL_CTX_USE_CERTIFICATE_CHAIN_FILE,ERR_R_PEM_LIB);
731 goto end; 682 goto end;
732 } 683 }
733 684
734 ret = SSL_CTX_use_certificate(ctx, x); 685 ret = SSL_CTX_use_certificate(ctx, x);
735 686
736 if (ERR_peek_error() != 0) 687 if (ERR_peek_error() != 0)
737 ret = 0; /* Key/certificate mismatch doesn't imply ret==0 ... */ 688 ret = 0;
738 if (ret) 689 /* Key/certificate mismatch doesn't imply ret==0 ... */
739 { 690 if (ret) {
740 /* If we could set up our certificate, now proceed to 691 /* If we could set up our certificate, now proceed to
741 * the CA certificates. 692 * the CA certificates.
742 */ 693 */
743 X509 *ca; 694 X509 *ca;
744 int r; 695 int r;
745 unsigned long err; 696 unsigned long err;
746 697
747 if (ctx->extra_certs != NULL) 698 if (ctx->extra_certs != NULL) {
748 {
749 sk_X509_pop_free(ctx->extra_certs, X509_free); 699 sk_X509_pop_free(ctx->extra_certs, X509_free);
750 ctx->extra_certs = NULL; 700 ctx->extra_certs = NULL;
751 } 701 }
752 702
753 while ((ca = PEM_read_bio_X509(in, NULL, 703 while ((ca = PEM_read_bio_X509(in, NULL,
754 ctx->default_passwd_callback, 704 ctx->default_passwd_callback,
755 ctx->default_passwd_callback_userdata)) 705 ctx->default_passwd_callback_userdata))
756 != NULL) 706 != NULL) {
757 {
758 r = SSL_CTX_add_extra_chain_cert(ctx, ca); 707 r = SSL_CTX_add_extra_chain_cert(ctx, ca);
759 if (!r) 708 if (!r) {
760 {
761 X509_free(ca); 709 X509_free(ca);
762 ret = 0; 710 ret = 0;
763 goto end; 711 goto end;
764 } 712 }
765 /* Note that we must not free r if it was successfully 713 /* Note that we must not free r if it was successfully
766 * added to the chain (while we must free the main 714 * added to the chain (while we must free the main
767 * certificate, since its reference count is increased 715 * certificate, since its reference count is increased
768 * by SSL_CTX_use_certificate). */ 716 * by SSL_CTX_use_certificate). */
769 } 717 }
770 /* When the while loop ends, it's usually just EOF. */ 718 /* When the while loop ends, it's usually just EOF. */
771 err = ERR_peek_last_error(); 719 err = ERR_peek_last_error();
772 if (ERR_GET_LIB(err) == ERR_LIB_PEM && ERR_GET_REASON(err) == PEM_R_NO_START_LINE) 720 if (ERR_GET_LIB(err) == ERR_LIB_PEM && ERR_GET_REASON(err) == PEM_R_NO_START_LINE)
773 ERR_clear_error(); 721 ERR_clear_error();
774 else 722 else
775 ret = 0; /* some real error */ 723 ret = 0; /* some real error */
776 } 724 }
777 725
778end: 726end:
779 if (x != NULL) X509_free(x); 727 if (x != NULL)
780 if (in != NULL) BIO_free(in); 728 X509_free(x);
781 return(ret); 729 if (in != NULL)
782 } 730 BIO_free(in);
731 return (ret);
732}
783#endif 733#endif
diff --git a/src/lib/libssl/ssl_sess.c b/src/lib/libssl/ssl_sess.c
index ad40fadd02..b29115862b 100644
--- a/src/lib/libssl/ssl_sess.c
+++ b/src/lib/libssl/ssl_sess.c
@@ -144,68 +144,74 @@
144#include "ssl_locl.h" 144#include "ssl_locl.h"
145 145
146static void SSL_SESSION_list_remove(SSL_CTX *ctx, SSL_SESSION *s); 146static void SSL_SESSION_list_remove(SSL_CTX *ctx, SSL_SESSION *s);
147static void SSL_SESSION_list_add(SSL_CTX *ctx,SSL_SESSION *s); 147static void SSL_SESSION_list_add(SSL_CTX *ctx, SSL_SESSION *s);
148static int remove_session_lock(SSL_CTX *ctx, SSL_SESSION *c, int lck); 148static int remove_session_lock(SSL_CTX *ctx, SSL_SESSION *c, int lck);
149 149
150SSL_SESSION *SSL_get_session(const SSL *ssl) 150SSL_SESSION
151*SSL_get_session(const SSL *ssl)
151/* aka SSL_get0_session; gets 0 objects, just returns a copy of the pointer */ 152/* aka SSL_get0_session; gets 0 objects, just returns a copy of the pointer */
152 { 153{
153 return(ssl->session); 154 return (ssl->session);
154 } 155}
155 156
156SSL_SESSION *SSL_get1_session(SSL *ssl) 157SSL_SESSION
158*SSL_get1_session(SSL *ssl)
157/* variant of SSL_get_session: caller really gets something */ 159/* variant of SSL_get_session: caller really gets something */
158 { 160{
159 SSL_SESSION *sess; 161 SSL_SESSION *sess;
160 /* Need to lock this all up rather than just use CRYPTO_add so that 162 /* Need to lock this all up rather than just use CRYPTO_add so that
161 * somebody doesn't free ssl->session between when we check it's 163 * somebody doesn't free ssl->session between when we check it's
162 * non-null and when we up the reference count. */ 164 * non-null and when we up the reference count. */
163 CRYPTO_w_lock(CRYPTO_LOCK_SSL_SESSION); 165 CRYPTO_w_lock(CRYPTO_LOCK_SSL_SESSION);
164 sess = ssl->session; 166 sess = ssl->session;
165 if(sess) 167 if (sess)
166 sess->references++; 168 sess->references++;
167 CRYPTO_w_unlock(CRYPTO_LOCK_SSL_SESSION); 169 CRYPTO_w_unlock(CRYPTO_LOCK_SSL_SESSION);
168 return(sess); 170 return (sess);
169 } 171}
170 172
171int SSL_SESSION_get_ex_new_index(long argl, void *argp, CRYPTO_EX_new *new_func, 173int
172 CRYPTO_EX_dup *dup_func, CRYPTO_EX_free *free_func) 174SSL_SESSION_get_ex_new_index(long argl, void *argp, CRYPTO_EX_new *new_func,
173 { 175 CRYPTO_EX_dup *dup_func, CRYPTO_EX_free *free_func)
176{
174 return CRYPTO_get_ex_new_index(CRYPTO_EX_INDEX_SSL_SESSION, argl, argp, 177 return CRYPTO_get_ex_new_index(CRYPTO_EX_INDEX_SSL_SESSION, argl, argp,
175 new_func, dup_func, free_func); 178 new_func, dup_func, free_func);
176 } 179}
177 180
178int SSL_SESSION_set_ex_data(SSL_SESSION *s, int idx, void *arg) 181int
179 { 182SSL_SESSION_set_ex_data(SSL_SESSION *s, int idx, void *arg)
180 return(CRYPTO_set_ex_data(&s->ex_data,idx,arg)); 183{
181 } 184 return (CRYPTO_set_ex_data(&s->ex_data, idx, arg));
185}
182 186
183void *SSL_SESSION_get_ex_data(const SSL_SESSION *s, int idx) 187void
184 { 188*SSL_SESSION_get_ex_data(const SSL_SESSION *s, int idx)
185 return(CRYPTO_get_ex_data(&s->ex_data,idx)); 189{
186 } 190 return (CRYPTO_get_ex_data(&s->ex_data, idx));
191}
187 192
188SSL_SESSION *SSL_SESSION_new(void) 193SSL_SESSION
189 { 194*SSL_SESSION_new(void)
195{
190 SSL_SESSION *ss; 196 SSL_SESSION *ss;
191 197
192 ss=(SSL_SESSION *)OPENSSL_malloc(sizeof(SSL_SESSION)); 198 ss = (SSL_SESSION *)OPENSSL_malloc(sizeof(SSL_SESSION));
193 if (ss == NULL) 199 if (ss == NULL) {
194 { 200 SSLerr(SSL_F_SSL_SESSION_NEW, ERR_R_MALLOC_FAILURE);
195 SSLerr(SSL_F_SSL_SESSION_NEW,ERR_R_MALLOC_FAILURE); 201 return (0);
196 return(0); 202 }
197 } 203 memset(ss, 0, sizeof(SSL_SESSION));
198 memset(ss,0,sizeof(SSL_SESSION));
199 204
200 ss->verify_result = 1; /* avoid 0 (= X509_V_OK) just in case */ 205 ss->verify_result = 1; /* avoid 0 (= X509_V_OK) just in case */
201 ss->references=1; 206 ss->references = 1;
202 ss->timeout=60*5+4; /* 5 minute timeout by default */ 207 ss->timeout=60*5+4; /* 5 minute timeout by default */
203 ss->time=(unsigned long)time(NULL); 208 ss->time = (unsigned long)time(NULL);
204 ss->prev=NULL; 209 ss->prev = NULL;
205 ss->next=NULL; 210 ss->next = NULL;
206 ss->compress_meth=0; 211 ss->compress_meth = 0;
207#ifndef OPENSSL_NO_TLSEXT 212#ifndef OPENSSL_NO_TLSEXT
208 ss->tlsext_hostname = NULL; 213 ss->tlsext_hostname = NULL;
214
209#ifndef OPENSSL_NO_EC 215#ifndef OPENSSL_NO_EC
210 ss->tlsext_ecpointformatlist_length = 0; 216 ss->tlsext_ecpointformatlist_length = 0;
211 ss->tlsext_ecpointformatlist = NULL; 217 ss->tlsext_ecpointformatlist = NULL;
@@ -215,26 +221,28 @@ SSL_SESSION *SSL_SESSION_new(void)
215#endif 221#endif
216 CRYPTO_new_ex_data(CRYPTO_EX_INDEX_SSL_SESSION, ss, &ss->ex_data); 222 CRYPTO_new_ex_data(CRYPTO_EX_INDEX_SSL_SESSION, ss, &ss->ex_data);
217#ifndef OPENSSL_NO_PSK 223#ifndef OPENSSL_NO_PSK
218 ss->psk_identity_hint=NULL; 224 ss->psk_identity_hint = NULL;
219 ss->psk_identity=NULL; 225 ss->psk_identity = NULL;
220#endif 226#endif
221#ifndef OPENSSL_NO_SRP 227#ifndef OPENSSL_NO_SRP
222 ss->srp_username=NULL; 228 ss->srp_username = NULL;
223#endif 229#endif
224 return(ss); 230 return (ss);
225 } 231}
226 232
227const unsigned char *SSL_SESSION_get_id(const SSL_SESSION *s, unsigned int *len) 233const unsigned char
228 { 234*SSL_SESSION_get_id(const SSL_SESSION *s, unsigned int *len)
229 if(len) 235{
236 if (len)
230 *len = s->session_id_length; 237 *len = s->session_id_length;
231 return s->session_id; 238 return s->session_id;
232 } 239}
233 240
234unsigned int SSL_SESSION_get_compress_id(const SSL_SESSION *s) 241unsigned int
235 { 242SSL_SESSION_get_compress_id(const SSL_SESSION *s)
243{
236 return s->compress_meth; 244 return s->compress_meth;
237 } 245}
238 246
239/* Even with SSLv2, we have 16 bytes (128 bits) of session ID space. SSLv3/TLSv1 247/* Even with SSLv2, we have 16 bytes (128 bits) of session ID space. SSLv3/TLSv1
240 * has 32 bytes (256 bits). As such, filling the ID with random gunk repeatedly 248 * has 32 bytes (256 bits). As such, filling the ID with random gunk repeatedly
@@ -246,16 +254,17 @@ unsigned int SSL_SESSION_get_compress_id(const SSL_SESSION *s)
246 * store that many sessions is perhaps a more interesting question ... */ 254 * store that many sessions is perhaps a more interesting question ... */
247 255
248#define MAX_SESS_ID_ATTEMPTS 10 256#define MAX_SESS_ID_ATTEMPTS 10
249static int def_generate_session_id(const SSL *ssl, unsigned char *id, 257static int
250 unsigned int *id_len) 258def_generate_session_id(const SSL *ssl, unsigned char *id,
259 unsigned int *id_len)
251{ 260{
252 unsigned int retry = 0; 261 unsigned int retry = 0;
253 do 262 do
254 if (RAND_pseudo_bytes(id, *id_len) <= 0) 263 if (RAND_pseudo_bytes(id, *id_len) <= 0)
255 return 0; 264 return 0;
256 while(SSL_has_matching_session_id(ssl, id, *id_len) && 265 while (SSL_has_matching_session_id(ssl, id, *id_len) &&
257 (++retry < MAX_SESS_ID_ATTEMPTS)); 266 (++retry < MAX_SESS_ID_ATTEMPTS));
258 if(retry < MAX_SESS_ID_ATTEMPTS) 267 if (retry < MAX_SESS_ID_ATTEMPTS)
259 return 1; 268 return 1;
260 /* else - woops a session_id match */ 269 /* else - woops a session_id match */
261 /* XXX We should also check the external cache -- 270 /* XXX We should also check the external cache --
@@ -269,120 +278,100 @@ static int def_generate_session_id(const SSL *ssl, unsigned char *id,
269 return 0; 278 return 0;
270} 279}
271 280
272int ssl_get_new_session(SSL *s, int session) 281int
273 { 282ssl_get_new_session(SSL *s, int session)
283{
274 /* This gets used by clients and servers. */ 284 /* This gets used by clients and servers. */
275 285
276 unsigned int tmp; 286 unsigned int tmp;
277 SSL_SESSION *ss=NULL; 287 SSL_SESSION *ss = NULL;
278 GEN_SESSION_CB cb = def_generate_session_id; 288 GEN_SESSION_CB cb = def_generate_session_id;
279 289
280 if ((ss=SSL_SESSION_new()) == NULL) return(0); 290 if ((ss = SSL_SESSION_new()) == NULL) return (0);
281 291
282 /* If the context has a default timeout, use it */ 292 /* If the context has a default timeout, use it */
283 if (s->session_ctx->session_timeout == 0) 293 if (s->session_ctx->session_timeout == 0)
284 ss->timeout=SSL_get_default_timeout(s); 294 ss->timeout = SSL_get_default_timeout(s);
285 else 295 else
286 ss->timeout=s->session_ctx->session_timeout; 296 ss->timeout = s->session_ctx->session_timeout;
287 297
288 if (s->session != NULL) 298 if (s->session != NULL) {
289 {
290 SSL_SESSION_free(s->session); 299 SSL_SESSION_free(s->session);
291 s->session=NULL; 300 s->session = NULL;
292 } 301 }
293 302
294 if (session) 303 if (session) {
295 { 304 if (s->version == SSL2_VERSION) {
296 if (s->version == SSL2_VERSION) 305 ss->ssl_version = SSL2_VERSION;
297 { 306 ss->session_id_length = SSL2_SSL_SESSION_ID_LENGTH;
298 ss->ssl_version=SSL2_VERSION; 307 } else if (s->version == SSL3_VERSION) {
299 ss->session_id_length=SSL2_SSL_SESSION_ID_LENGTH; 308 ss->ssl_version = SSL3_VERSION;
300 } 309 ss->session_id_length = SSL3_SSL_SESSION_ID_LENGTH;
301 else if (s->version == SSL3_VERSION) 310 } else if (s->version == TLS1_VERSION) {
302 { 311 ss->ssl_version = TLS1_VERSION;
303 ss->ssl_version=SSL3_VERSION; 312 ss->session_id_length = SSL3_SSL_SESSION_ID_LENGTH;
304 ss->session_id_length=SSL3_SSL_SESSION_ID_LENGTH; 313 } else if (s->version == TLS1_1_VERSION) {
305 } 314 ss->ssl_version = TLS1_1_VERSION;
306 else if (s->version == TLS1_VERSION) 315 ss->session_id_length = SSL3_SSL_SESSION_ID_LENGTH;
307 { 316 } else if (s->version == TLS1_2_VERSION) {
308 ss->ssl_version=TLS1_VERSION; 317 ss->ssl_version = TLS1_2_VERSION;
309 ss->session_id_length=SSL3_SSL_SESSION_ID_LENGTH; 318 ss->session_id_length = SSL3_SSL_SESSION_ID_LENGTH;
310 } 319 } else if (s->version == DTLS1_BAD_VER) {
311 else if (s->version == TLS1_1_VERSION) 320 ss->ssl_version = DTLS1_BAD_VER;
312 { 321 ss->session_id_length = SSL3_SSL_SESSION_ID_LENGTH;
313 ss->ssl_version=TLS1_1_VERSION; 322 } else if (s->version == DTLS1_VERSION) {
314 ss->session_id_length=SSL3_SSL_SESSION_ID_LENGTH; 323 ss->ssl_version = DTLS1_VERSION;
315 } 324 ss->session_id_length = SSL3_SSL_SESSION_ID_LENGTH;
316 else if (s->version == TLS1_2_VERSION) 325 } else {
317 { 326 SSLerr(SSL_F_SSL_GET_NEW_SESSION, SSL_R_UNSUPPORTED_SSL_VERSION);
318 ss->ssl_version=TLS1_2_VERSION;
319 ss->session_id_length=SSL3_SSL_SESSION_ID_LENGTH;
320 }
321 else if (s->version == DTLS1_BAD_VER)
322 {
323 ss->ssl_version=DTLS1_BAD_VER;
324 ss->session_id_length=SSL3_SSL_SESSION_ID_LENGTH;
325 }
326 else if (s->version == DTLS1_VERSION)
327 {
328 ss->ssl_version=DTLS1_VERSION;
329 ss->session_id_length=SSL3_SSL_SESSION_ID_LENGTH;
330 }
331 else
332 {
333 SSLerr(SSL_F_SSL_GET_NEW_SESSION,SSL_R_UNSUPPORTED_SSL_VERSION);
334 SSL_SESSION_free(ss); 327 SSL_SESSION_free(ss);
335 return(0); 328 return (0);
336 } 329 }
337#ifndef OPENSSL_NO_TLSEXT 330#ifndef OPENSSL_NO_TLSEXT
338 /* If RFC4507 ticket use empty session ID */ 331 /* If RFC4507 ticket use empty session ID */
339 if (s->tlsext_ticket_expected) 332 if (s->tlsext_ticket_expected) {
340 {
341 ss->session_id_length = 0; 333 ss->session_id_length = 0;
342 goto sess_id_done; 334 goto sess_id_done;
343 } 335 }
344#endif 336#endif
345 /* Choose which callback will set the session ID */ 337 /* Choose which callback will set the session ID */
346 CRYPTO_r_lock(CRYPTO_LOCK_SSL_CTX); 338 CRYPTO_r_lock(CRYPTO_LOCK_SSL_CTX);
347 if(s->generate_session_id) 339 if (s->generate_session_id)
348 cb = s->generate_session_id; 340 cb = s->generate_session_id;
349 else if(s->session_ctx->generate_session_id) 341 else if (s->session_ctx->generate_session_id)
350 cb = s->session_ctx->generate_session_id; 342 cb = s->session_ctx->generate_session_id;
351 CRYPTO_r_unlock(CRYPTO_LOCK_SSL_CTX); 343 CRYPTO_r_unlock(CRYPTO_LOCK_SSL_CTX);
352 /* Choose a session ID */ 344 /* Choose a session ID */
353 tmp = ss->session_id_length; 345 tmp = ss->session_id_length;
354 if(!cb(s, ss->session_id, &tmp)) 346 if (!cb(s, ss->session_id, &tmp)) {
355 {
356 /* The callback failed */ 347 /* The callback failed */
357 SSLerr(SSL_F_SSL_GET_NEW_SESSION, 348 SSLerr(SSL_F_SSL_GET_NEW_SESSION,
358 SSL_R_SSL_SESSION_ID_CALLBACK_FAILED); 349 SSL_R_SSL_SESSION_ID_CALLBACK_FAILED);
359 SSL_SESSION_free(ss); 350 SSL_SESSION_free(ss);
360 return(0); 351 return (0);
361 } 352 }
362 /* Don't allow the callback to set the session length to zero. 353 /* Don't allow the callback to set the session length to zero.
363 * nor set it higher than it was. */ 354 * nor set it higher than it was. */
364 if(!tmp || (tmp > ss->session_id_length)) 355 if (!tmp || (tmp > ss->session_id_length)) {
365 {
366 /* The callback set an illegal length */ 356 /* The callback set an illegal length */
367 SSLerr(SSL_F_SSL_GET_NEW_SESSION, 357 SSLerr(SSL_F_SSL_GET_NEW_SESSION,
368 SSL_R_SSL_SESSION_ID_HAS_BAD_LENGTH); 358 SSL_R_SSL_SESSION_ID_HAS_BAD_LENGTH);
369 SSL_SESSION_free(ss); 359 SSL_SESSION_free(ss);
370 return(0); 360 return (0);
371 } 361 }
372 /* If the session length was shrunk and we're SSLv2, pad it */ 362 /* If the session length was shrunk and we're SSLv2, pad it */
373 if((tmp < ss->session_id_length) && (s->version == SSL2_VERSION)) 363 if ((tmp < ss->session_id_length) && (s->version == SSL2_VERSION))
374 memset(ss->session_id + tmp, 0, ss->session_id_length - tmp); 364 memset(ss->session_id + tmp, 0, ss->session_id_length - tmp);
375 else 365 else
376 ss->session_id_length = tmp; 366 ss->session_id_length = tmp;
377 /* Finally, check for a conflict */ 367 /* Finally, check for a conflict */
378 if(SSL_has_matching_session_id(s, ss->session_id, 368 if (SSL_has_matching_session_id(s, ss->session_id,
379 ss->session_id_length)) 369 ss->session_id_length)) {
380 {
381 SSLerr(SSL_F_SSL_GET_NEW_SESSION, 370 SSLerr(SSL_F_SSL_GET_NEW_SESSION,
382 SSL_R_SSL_SESSION_ID_CONFLICT); 371 SSL_R_SSL_SESSION_ID_CONFLICT);
383 SSL_SESSION_free(ss); 372 SSL_SESSION_free(ss);
384 return(0); 373 return (0);
385 } 374 }
386#ifndef OPENSSL_NO_TLSEXT 375#ifndef OPENSSL_NO_TLSEXT
387 sess_id_done: 376 sess_id_done:
388 if (s->tlsext_hostname) { 377 if (s->tlsext_hostname) {
@@ -391,55 +380,50 @@ int ssl_get_new_session(SSL *s, int session)
391 SSLerr(SSL_F_SSL_GET_NEW_SESSION, ERR_R_INTERNAL_ERROR); 380 SSLerr(SSL_F_SSL_GET_NEW_SESSION, ERR_R_INTERNAL_ERROR);
392 SSL_SESSION_free(ss); 381 SSL_SESSION_free(ss);
393 return 0; 382 return 0;
394 }
395 } 383 }
384 }
396#ifndef OPENSSL_NO_EC 385#ifndef OPENSSL_NO_EC
397 if (s->tlsext_ecpointformatlist) 386 if (s->tlsext_ecpointformatlist) {
398 { 387 if (ss->tlsext_ecpointformatlist != NULL)
399 if (ss->tlsext_ecpointformatlist != NULL) OPENSSL_free(ss->tlsext_ecpointformatlist); 388 OPENSSL_free(ss->tlsext_ecpointformatlist);
400 if ((ss->tlsext_ecpointformatlist = OPENSSL_malloc(s->tlsext_ecpointformatlist_length)) == NULL) 389 if ((ss->tlsext_ecpointformatlist = OPENSSL_malloc(s->tlsext_ecpointformatlist_length)) == NULL) {
401 {
402 SSLerr(SSL_F_SSL_GET_NEW_SESSION, ERR_R_MALLOC_FAILURE); 390 SSLerr(SSL_F_SSL_GET_NEW_SESSION, ERR_R_MALLOC_FAILURE);
403 SSL_SESSION_free(ss); 391 SSL_SESSION_free(ss);
404 return 0; 392 return 0;
405 } 393 }
406 ss->tlsext_ecpointformatlist_length = s->tlsext_ecpointformatlist_length; 394 ss->tlsext_ecpointformatlist_length = s->tlsext_ecpointformatlist_length;
407 memcpy(ss->tlsext_ecpointformatlist, s->tlsext_ecpointformatlist, s->tlsext_ecpointformatlist_length); 395 memcpy(ss->tlsext_ecpointformatlist, s->tlsext_ecpointformatlist, s->tlsext_ecpointformatlist_length);
408 } 396 }
409 if (s->tlsext_ellipticcurvelist) 397 if (s->tlsext_ellipticcurvelist) {
410 { 398 if (ss->tlsext_ellipticcurvelist != NULL)
411 if (ss->tlsext_ellipticcurvelist != NULL) OPENSSL_free(ss->tlsext_ellipticcurvelist); 399 OPENSSL_free(ss->tlsext_ellipticcurvelist);
412 if ((ss->tlsext_ellipticcurvelist = OPENSSL_malloc(s->tlsext_ellipticcurvelist_length)) == NULL) 400 if ((ss->tlsext_ellipticcurvelist = OPENSSL_malloc(s->tlsext_ellipticcurvelist_length)) == NULL) {
413 {
414 SSLerr(SSL_F_SSL_GET_NEW_SESSION, ERR_R_MALLOC_FAILURE); 401 SSLerr(SSL_F_SSL_GET_NEW_SESSION, ERR_R_MALLOC_FAILURE);
415 SSL_SESSION_free(ss); 402 SSL_SESSION_free(ss);
416 return 0; 403 return 0;
417 } 404 }
418 ss->tlsext_ellipticcurvelist_length = s->tlsext_ellipticcurvelist_length; 405 ss->tlsext_ellipticcurvelist_length = s->tlsext_ellipticcurvelist_length;
419 memcpy(ss->tlsext_ellipticcurvelist, s->tlsext_ellipticcurvelist, s->tlsext_ellipticcurvelist_length); 406 memcpy(ss->tlsext_ellipticcurvelist, s->tlsext_ellipticcurvelist, s->tlsext_ellipticcurvelist_length);
420 } 407 }
421#endif 408#endif
422#endif 409#endif
423 } 410 } else {
424 else 411 ss->session_id_length = 0;
425 { 412 }
426 ss->session_id_length=0;
427 }
428 413
429 if (s->sid_ctx_length > sizeof ss->sid_ctx) 414 if (s->sid_ctx_length > sizeof ss->sid_ctx) {
430 {
431 SSLerr(SSL_F_SSL_GET_NEW_SESSION, ERR_R_INTERNAL_ERROR); 415 SSLerr(SSL_F_SSL_GET_NEW_SESSION, ERR_R_INTERNAL_ERROR);
432 SSL_SESSION_free(ss); 416 SSL_SESSION_free(ss);
433 return 0; 417 return 0;
434 } 418 }
435 memcpy(ss->sid_ctx,s->sid_ctx,s->sid_ctx_length); 419 memcpy(ss->sid_ctx, s->sid_ctx, s->sid_ctx_length);
436 ss->sid_ctx_length=s->sid_ctx_length; 420 ss->sid_ctx_length = s->sid_ctx_length;
437 s->session=ss; 421 s->session = ss;
438 ss->ssl_version=s->version; 422 ss->ssl_version = s->version;
439 ss->verify_result = X509_V_OK; 423 ss->verify_result = X509_V_OK;
440 424
441 return(1); 425 return (1);
442 } 426}
443 427
444/* ssl_get_prev attempts to find an SSL_SESSION to be used to resume this 428/* ssl_get_prev attempts to find an SSL_SESSION to be used to resume this
445 * connection. It is only called by servers. 429 * connection. It is only called by servers.
@@ -460,12 +444,13 @@ int ssl_get_new_session(SSL *s, int session)
460 * - Both for new and resumed sessions, s->tlsext_ticket_expected is set to 1 444 * - Both for new and resumed sessions, s->tlsext_ticket_expected is set to 1
461 * if the server should issue a new session ticket (to 0 otherwise). 445 * if the server should issue a new session ticket (to 0 otherwise).
462 */ 446 */
463int ssl_get_prev_session(SSL *s, unsigned char *session_id, int len, 447int
464 const unsigned char *limit) 448ssl_get_prev_session(SSL *s, unsigned char *session_id, int len,
465 { 449 const unsigned char *limit)
450{
466 /* This is used only by servers. */ 451 /* This is used only by servers. */
467 452
468 SSL_SESSION *ret=NULL; 453 SSL_SESSION *ret = NULL;
469 int fatal = 0; 454 int fatal = 0;
470 int try_session_cache = 1; 455 int try_session_cache = 1;
471#ifndef OPENSSL_NO_TLSEXT 456#ifndef OPENSSL_NO_TLSEXT
@@ -480,8 +465,7 @@ int ssl_get_prev_session(SSL *s, unsigned char *session_id, int len,
480 465
481#ifndef OPENSSL_NO_TLSEXT 466#ifndef OPENSSL_NO_TLSEXT
482 r = tls1_process_ticket(s, session_id, len, limit, &ret); /* sets s->tlsext_ticket_expected */ 467 r = tls1_process_ticket(s, session_id, len, limit, &ret); /* sets s->tlsext_ticket_expected */
483 switch (r) 468 switch (r) {
484 {
485 case -1: /* Error during processing */ 469 case -1: /* Error during processing */
486 fatal = 1; 470 fatal = 1;
487 goto err; 471 goto err;
@@ -494,39 +478,35 @@ int ssl_get_prev_session(SSL *s, unsigned char *session_id, int len,
494 break; 478 break;
495 default: 479 default:
496 abort(); 480 abort();
497 } 481 }
498#endif 482#endif
499 483
500 if (try_session_cache && 484 if (try_session_cache &&
501 ret == NULL && 485 ret == NULL &&
502 !(s->session_ctx->session_cache_mode & SSL_SESS_CACHE_NO_INTERNAL_LOOKUP)) 486 !(s->session_ctx->session_cache_mode & SSL_SESS_CACHE_NO_INTERNAL_LOOKUP)) {
503 {
504 SSL_SESSION data; 487 SSL_SESSION data;
505 data.ssl_version=s->version; 488 data.ssl_version = s->version;
506 data.session_id_length=len; 489 data.session_id_length = len;
507 if (len == 0) 490 if (len == 0)
508 return 0; 491 return 0;
509 memcpy(data.session_id,session_id,len); 492 memcpy(data.session_id, session_id, len);
510 CRYPTO_r_lock(CRYPTO_LOCK_SSL_CTX); 493 CRYPTO_r_lock(CRYPTO_LOCK_SSL_CTX);
511 ret=lh_SSL_SESSION_retrieve(s->session_ctx->sessions,&data); 494 ret = lh_SSL_SESSION_retrieve(s->session_ctx->sessions, &data);
512 if (ret != NULL) 495 if (ret != NULL) {
513 {
514 /* don't allow other threads to steal it: */ 496 /* don't allow other threads to steal it: */
515 CRYPTO_add(&ret->references,1,CRYPTO_LOCK_SSL_SESSION); 497 CRYPTO_add(&ret->references, 1, CRYPTO_LOCK_SSL_SESSION);
516 } 498 }
517 CRYPTO_r_unlock(CRYPTO_LOCK_SSL_CTX); 499 CRYPTO_r_unlock(CRYPTO_LOCK_SSL_CTX);
518 if (ret == NULL) 500 if (ret == NULL)
519 s->session_ctx->stats.sess_miss++; 501 s->session_ctx->stats.sess_miss++;
520 } 502 }
521 503
522 if (try_session_cache && 504 if (try_session_cache &&
523 ret == NULL && 505 ret == NULL &&
524 s->session_ctx->get_session_cb != NULL) 506 s->session_ctx->get_session_cb != NULL) {
525 { 507 int copy = 1;
526 int copy=1; 508
527 509 if ((ret = s->session_ctx->get_session_cb(s, session_id, len, &copy))) {
528 if ((ret=s->session_ctx->get_session_cb(s,session_id,len,&copy)))
529 {
530 s->session_ctx->stats.sess_cb_hit++; 510 s->session_ctx->stats.sess_cb_hit++;
531 511
532 /* Increment reference count now if the session callback 512 /* Increment reference count now if the session callback
@@ -535,16 +515,16 @@ int ssl_get_prev_session(SSL *s, unsigned char *session_id, int len,
535 * it must handle the reference count itself [i.e. copy == 0], 515 * it must handle the reference count itself [i.e. copy == 0],
536 * or things won't be thread-safe). */ 516 * or things won't be thread-safe). */
537 if (copy) 517 if (copy)
538 CRYPTO_add(&ret->references,1,CRYPTO_LOCK_SSL_SESSION); 518 CRYPTO_add(&ret->references, 1, CRYPTO_LOCK_SSL_SESSION);
539 519
540 /* Add the externally cached session to the internal 520 /* Add the externally cached session to the internal
541 * cache as well if and only if we are supposed to. */ 521 * cache as well if and only if we are supposed to. */
542 if(!(s->session_ctx->session_cache_mode & SSL_SESS_CACHE_NO_INTERNAL_STORE)) 522 if (!(s->session_ctx->session_cache_mode & SSL_SESS_CACHE_NO_INTERNAL_STORE))
543 /* The following should not return 1, otherwise, 523 /* The following should not return 1, otherwise,
544 * things are very strange */ 524 * things are very strange */
545 SSL_CTX_add_session(s->session_ctx,ret); 525 SSL_CTX_add_session(s->session_ctx, ret);
546 }
547 } 526 }
527 }
548 528
549 if (ret == NULL) 529 if (ret == NULL)
550 goto err; 530 goto err;
@@ -552,15 +532,13 @@ int ssl_get_prev_session(SSL *s, unsigned char *session_id, int len,
552 /* Now ret is non-NULL and we own one of its reference counts. */ 532 /* Now ret is non-NULL and we own one of its reference counts. */
553 533
554 if (ret->sid_ctx_length != s->sid_ctx_length 534 if (ret->sid_ctx_length != s->sid_ctx_length
555 || memcmp(ret->sid_ctx,s->sid_ctx,ret->sid_ctx_length)) 535 || memcmp(ret->sid_ctx, s->sid_ctx, ret->sid_ctx_length)) {
556 {
557 /* We have the session requested by the client, but we don't 536 /* We have the session requested by the client, but we don't
558 * want to use it in this context. */ 537 * want to use it in this context. */
559 goto err; /* treat like cache miss */ 538 goto err; /* treat like cache miss */
560 } 539 }
561 540
562 if((s->verify_mode & SSL_VERIFY_PEER) && s->sid_ctx_length == 0) 541 if ((s->verify_mode & SSL_VERIFY_PEER) && s->sid_ctx_length == 0) {
563 {
564 /* We can't be sure if this session is being used out of 542 /* We can't be sure if this session is being used out of
565 * context, which is especially important for SSL_VERIFY_PEER. 543 * context, which is especially important for SSL_VERIFY_PEER.
566 * The application should have used SSL[_CTX]_set_session_id_context. 544 * The application should have used SSL[_CTX]_set_session_id_context.
@@ -570,87 +548,83 @@ int ssl_get_prev_session(SSL *s, unsigned char *session_id, int len,
570 * applications to effectively disable the session cache by 548 * applications to effectively disable the session cache by
571 * accident without anyone noticing). 549 * accident without anyone noticing).
572 */ 550 */
573 551
574 SSLerr(SSL_F_SSL_GET_PREV_SESSION,SSL_R_SESSION_ID_CONTEXT_UNINITIALIZED); 552 SSLerr(SSL_F_SSL_GET_PREV_SESSION, SSL_R_SESSION_ID_CONTEXT_UNINITIALIZED);
575 fatal = 1; 553 fatal = 1;
576 goto err; 554 goto err;
577 } 555 }
578 556
579 if (ret->cipher == NULL) 557 if (ret->cipher == NULL) {
580 { 558 unsigned char buf[5], *p;
581 unsigned char buf[5],*p;
582 unsigned long l; 559 unsigned long l;
583 560
584 p=buf; 561 p = buf;
585 l=ret->cipher_id; 562 l = ret->cipher_id;
586 l2n(l,p); 563 l2n(l, p);
587 if ((ret->ssl_version>>8) >= SSL3_VERSION_MAJOR) 564 if ((ret->ssl_version >> 8) >= SSL3_VERSION_MAJOR)
588 ret->cipher=ssl_get_cipher_by_char(s,&(buf[2])); 565 ret->cipher = ssl_get_cipher_by_char(s, &(buf[2]));
589 else 566 else
590 ret->cipher=ssl_get_cipher_by_char(s,&(buf[1])); 567 ret->cipher = ssl_get_cipher_by_char(s, &(buf[1]));
591 if (ret->cipher == NULL) 568 if (ret->cipher == NULL)
592 goto err; 569 goto err;
593 } 570 }
594 571
595 if (ret->timeout < (long)(time(NULL) - ret->time)) /* timeout */ 572 if (ret->timeout < (long)(time(NULL) - ret->time)) /* timeout */
596 { 573 {
597 s->session_ctx->stats.sess_timeout++; 574 s->session_ctx->stats.sess_timeout++;
598 if (try_session_cache) 575 if (try_session_cache) {
599 {
600 /* session was from the cache, so remove it */ 576 /* session was from the cache, so remove it */
601 SSL_CTX_remove_session(s->session_ctx,ret); 577 SSL_CTX_remove_session(s->session_ctx, ret);
602 }
603 goto err;
604 } 578 }
579 goto err;
580 }
605 581
606 s->session_ctx->stats.sess_hit++; 582 s->session_ctx->stats.sess_hit++;
607 583
608 if (s->session != NULL) 584 if (s->session != NULL)
609 SSL_SESSION_free(s->session); 585 SSL_SESSION_free(s->session);
610 s->session=ret; 586 s->session = ret;
611 s->verify_result = s->session->verify_result; 587 s->verify_result = s->session->verify_result;
612 return 1; 588 return 1;
613 589
614 err: 590 err:
615 if (ret != NULL) 591 if (ret != NULL) {
616 {
617 SSL_SESSION_free(ret); 592 SSL_SESSION_free(ret);
618#ifndef OPENSSL_NO_TLSEXT 593#ifndef OPENSSL_NO_TLSEXT
619 if (!try_session_cache) 594 if (!try_session_cache) {
620 {
621 /* The session was from a ticket, so we should 595 /* The session was from a ticket, so we should
622 * issue a ticket for the new session */ 596 * issue a ticket for the new session */
623 s->tlsext_ticket_expected = 1; 597 s->tlsext_ticket_expected = 1;
624 }
625#endif
626 } 598 }
599#endif
600 }
627 if (fatal) 601 if (fatal)
628 return -1; 602 return -1;
629 else 603 else
630 return 0; 604 return 0;
631 } 605}
632 606
633int SSL_CTX_add_session(SSL_CTX *ctx, SSL_SESSION *c) 607int
634 { 608SSL_CTX_add_session(SSL_CTX *ctx, SSL_SESSION *c)
635 int ret=0; 609{
610 int ret = 0;
636 SSL_SESSION *s; 611 SSL_SESSION *s;
637 612
638 /* add just 1 reference count for the SSL_CTX's session cache 613 /* add just 1 reference count for the SSL_CTX's session cache
639 * even though it has two ways of access: each session is in a 614 * even though it has two ways of access: each session is in a
640 * doubly linked list and an lhash */ 615 * doubly linked list and an lhash */
641 CRYPTO_add(&c->references,1,CRYPTO_LOCK_SSL_SESSION); 616 CRYPTO_add(&c->references, 1, CRYPTO_LOCK_SSL_SESSION);
642 /* if session c is in already in cache, we take back the increment later */ 617 /* if session c is in already in cache, we take back the increment later */
643 618
644 CRYPTO_w_lock(CRYPTO_LOCK_SSL_CTX); 619 CRYPTO_w_lock(CRYPTO_LOCK_SSL_CTX);
645 s=lh_SSL_SESSION_insert(ctx->sessions,c); 620 s = lh_SSL_SESSION_insert(ctx->sessions, c);
646 621
647 /* s != NULL iff we already had a session with the given PID. 622 /* s != NULL iff we already had a session with the given PID.
648 * In this case, s == c should hold (then we did not really modify 623 * In this case, s == c should hold (then we did not really modify
649 * ctx->sessions), or we're in trouble. */ 624 * ctx->sessions), or we're in trouble. */
650 if (s != NULL && s != c) 625 if (s != NULL && s != c) {
651 {
652 /* We *are* in trouble ... */ 626 /* We *are* in trouble ... */
653 SSL_SESSION_list_remove(ctx,s); 627 SSL_SESSION_list_remove(ctx, s);
654 SSL_SESSION_free(s); 628 SSL_SESSION_free(s);
655 /* ... so pretend the other session did not exist in cache 629 /* ... so pretend the other session did not exist in cache
656 * (we cannot handle two SSL_SESSION structures with identical 630 * (we cannot handle two SSL_SESSION structures with identical
@@ -658,114 +632,117 @@ int SSL_CTX_add_session(SSL_CTX *ctx, SSL_SESSION *c)
658 * two threads concurrently obtain the same session from an external 632 * two threads concurrently obtain the same session from an external
659 * cache) */ 633 * cache) */
660 s = NULL; 634 s = NULL;
661 } 635 }
662 636
663 /* Put at the head of the queue unless it is already in the cache */ 637 /* Put at the head of the queue unless it is already in the cache */
664 if (s == NULL) 638 if (s == NULL)
665 SSL_SESSION_list_add(ctx,c); 639 SSL_SESSION_list_add(ctx, c);
666 640
667 if (s != NULL) 641 if (s != NULL) {
668 {
669 /* existing cache entry -- decrement previously incremented reference 642 /* existing cache entry -- decrement previously incremented reference
670 * count because it already takes into account the cache */ 643 * count because it already takes into account the cache */
671 644
672 SSL_SESSION_free(s); /* s == c */ 645 SSL_SESSION_free(s); /* s == c */
673 ret=0; 646 ret = 0;
674 } 647 } else {
675 else
676 {
677 /* new cache entry -- remove old ones if cache has become too large */ 648 /* new cache entry -- remove old ones if cache has become too large */
678
679 ret=1;
680 649
681 if (SSL_CTX_sess_get_cache_size(ctx) > 0) 650 ret = 1;
682 { 651
652 if (SSL_CTX_sess_get_cache_size(ctx) > 0) {
683 while (SSL_CTX_sess_number(ctx) > 653 while (SSL_CTX_sess_number(ctx) >
684 SSL_CTX_sess_get_cache_size(ctx)) 654 SSL_CTX_sess_get_cache_size(ctx)) {
685 {
686 if (!remove_session_lock(ctx, 655 if (!remove_session_lock(ctx,
687 ctx->session_cache_tail, 0)) 656 ctx->session_cache_tail, 0))
688 break; 657 break;
689 else 658 else
690 ctx->stats.sess_cache_full++; 659 ctx->stats.sess_cache_full++;
691 }
692 } 660 }
693 } 661 }
694 CRYPTO_w_unlock(CRYPTO_LOCK_SSL_CTX);
695 return(ret);
696 } 662 }
663 CRYPTO_w_unlock(CRYPTO_LOCK_SSL_CTX);
664 return (ret);
665}
697 666
698int SSL_CTX_remove_session(SSL_CTX *ctx, SSL_SESSION *c) 667int
668SSL_CTX_remove_session(SSL_CTX *ctx, SSL_SESSION *c)
699{ 669{
700 return remove_session_lock(ctx, c, 1); 670 return remove_session_lock(ctx, c, 1);
701} 671}
702 672
703static int remove_session_lock(SSL_CTX *ctx, SSL_SESSION *c, int lck) 673static int
704 { 674remove_session_lock(SSL_CTX *ctx, SSL_SESSION *c, int lck)
675{
705 SSL_SESSION *r; 676 SSL_SESSION *r;
706 int ret=0; 677 int ret = 0;
707 678
708 if ((c != NULL) && (c->session_id_length != 0)) 679 if ((c != NULL) && (c->session_id_length != 0)) {
709 { 680 if (lck)
710 if(lck) CRYPTO_w_lock(CRYPTO_LOCK_SSL_CTX); 681 CRYPTO_w_lock(CRYPTO_LOCK_SSL_CTX);
711 if ((r = lh_SSL_SESSION_retrieve(ctx->sessions,c)) == c) 682 if ((r = lh_SSL_SESSION_retrieve(ctx->sessions, c)) == c) {
712 { 683 ret = 1;
713 ret=1; 684 r = lh_SSL_SESSION_delete(ctx->sessions, c);
714 r=lh_SSL_SESSION_delete(ctx->sessions,c); 685 SSL_SESSION_list_remove(ctx, c);
715 SSL_SESSION_list_remove(ctx,c); 686 }
716 }
717 687
718 if(lck) CRYPTO_w_unlock(CRYPTO_LOCK_SSL_CTX); 688 if (lck)
689 CRYPTO_w_unlock(CRYPTO_LOCK_SSL_CTX);
719 690
720 if (ret) 691 if (ret) {
721 { 692 r->not_resumable = 1;
722 r->not_resumable=1;
723 if (ctx->remove_session_cb != NULL) 693 if (ctx->remove_session_cb != NULL)
724 ctx->remove_session_cb(ctx,r); 694 ctx->remove_session_cb(ctx, r);
725 SSL_SESSION_free(r); 695 SSL_SESSION_free(r);
726 }
727 } 696 }
728 else 697 } else
729 ret=0; 698 ret = 0;
730 return(ret); 699 return (ret);
731 } 700}
732 701
733void SSL_SESSION_free(SSL_SESSION *ss) 702void
734 { 703SSL_SESSION_free(SSL_SESSION *ss)
704{
735 int i; 705 int i;
736 706
737 if(ss == NULL) 707 if (ss == NULL)
738 return; 708 return;
739 709
740 i=CRYPTO_add(&ss->references,-1,CRYPTO_LOCK_SSL_SESSION); 710 i = CRYPTO_add(&ss->references, -1, CRYPTO_LOCK_SSL_SESSION);
741#ifdef REF_PRINT 711#ifdef REF_PRINT
742 REF_PRINT("SSL_SESSION",ss); 712 REF_PRINT("SSL_SESSION", ss);
743#endif 713#endif
744 if (i > 0) return; 714 if (i > 0)
715 return;
745#ifdef REF_CHECK 716#ifdef REF_CHECK
746 if (i < 0) 717 if (i < 0) {
747 { 718 fprintf(stderr, "SSL_SESSION_free, bad reference count\n");
748 fprintf(stderr,"SSL_SESSION_free, bad reference count\n");
749 abort(); /* ok */ 719 abort(); /* ok */
750 } 720 }
751#endif 721#endif
752 722
753 CRYPTO_free_ex_data(CRYPTO_EX_INDEX_SSL_SESSION, ss, &ss->ex_data); 723 CRYPTO_free_ex_data(CRYPTO_EX_INDEX_SSL_SESSION, ss, &ss->ex_data);
754 724
755 OPENSSL_cleanse(ss->key_arg,sizeof ss->key_arg); 725 OPENSSL_cleanse(ss->key_arg, sizeof ss->key_arg);
756 OPENSSL_cleanse(ss->master_key,sizeof ss->master_key); 726 OPENSSL_cleanse(ss->master_key, sizeof ss->master_key);
757 OPENSSL_cleanse(ss->session_id,sizeof ss->session_id); 727 OPENSSL_cleanse(ss->session_id, sizeof ss->session_id);
758 if (ss->sess_cert != NULL) ssl_sess_cert_free(ss->sess_cert); 728 if (ss->sess_cert != NULL)
759 if (ss->peer != NULL) X509_free(ss->peer); 729 ssl_sess_cert_free(ss->sess_cert);
760 if (ss->ciphers != NULL) sk_SSL_CIPHER_free(ss->ciphers); 730 if (ss->peer != NULL)
731 X509_free(ss->peer);
732 if (ss->ciphers != NULL)
733 sk_SSL_CIPHER_free(ss->ciphers);
761#ifndef OPENSSL_NO_TLSEXT 734#ifndef OPENSSL_NO_TLSEXT
762 if (ss->tlsext_hostname != NULL) OPENSSL_free(ss->tlsext_hostname); 735 if (ss->tlsext_hostname != NULL)
763 if (ss->tlsext_tick != NULL) OPENSSL_free(ss->tlsext_tick); 736 OPENSSL_free(ss->tlsext_hostname);
737 if (ss->tlsext_tick != NULL)
738 OPENSSL_free(ss->tlsext_tick);
764#ifndef OPENSSL_NO_EC 739#ifndef OPENSSL_NO_EC
765 ss->tlsext_ecpointformatlist_length = 0; 740 ss->tlsext_ecpointformatlist_length = 0;
766 if (ss->tlsext_ecpointformatlist != NULL) OPENSSL_free(ss->tlsext_ecpointformatlist); 741 if (ss->tlsext_ecpointformatlist != NULL)
742 OPENSSL_free(ss->tlsext_ecpointformatlist);
767 ss->tlsext_ellipticcurvelist_length = 0; 743 ss->tlsext_ellipticcurvelist_length = 0;
768 if (ss->tlsext_ellipticcurvelist != NULL) OPENSSL_free(ss->tlsext_ellipticcurvelist); 744 if (ss->tlsext_ellipticcurvelist != NULL)
745 OPENSSL_free(ss->tlsext_ellipticcurvelist);
769#endif /* OPENSSL_NO_EC */ 746#endif /* OPENSSL_NO_EC */
770#endif 747#endif
771#ifndef OPENSSL_NO_PSK 748#ifndef OPENSSL_NO_PSK
@@ -778,382 +755,389 @@ void SSL_SESSION_free(SSL_SESSION *ss)
778 if (ss->srp_username != NULL) 755 if (ss->srp_username != NULL)
779 OPENSSL_free(ss->srp_username); 756 OPENSSL_free(ss->srp_username);
780#endif 757#endif
781 OPENSSL_cleanse(ss,sizeof(*ss)); 758 OPENSSL_cleanse(ss, sizeof(*ss));
782 OPENSSL_free(ss); 759 OPENSSL_free(ss);
783 } 760}
784 761
785int SSL_set_session(SSL *s, SSL_SESSION *session) 762int
786 { 763SSL_set_session(SSL *s, SSL_SESSION *session)
787 int ret=0; 764{
765 int ret = 0;
788 const SSL_METHOD *meth; 766 const SSL_METHOD *meth;
789 767
790 if (session != NULL) 768 if (session != NULL) {
791 { 769 meth = s->ctx->method->get_ssl_method(session->ssl_version);
792 meth=s->ctx->method->get_ssl_method(session->ssl_version);
793 if (meth == NULL) 770 if (meth == NULL)
794 meth=s->method->get_ssl_method(session->ssl_version); 771 meth = s->method->get_ssl_method(session->ssl_version);
795 if (meth == NULL) 772 if (meth == NULL) {
796 { 773 SSLerr(SSL_F_SSL_SET_SESSION, SSL_R_UNABLE_TO_FIND_SSL_METHOD);
797 SSLerr(SSL_F_SSL_SET_SESSION,SSL_R_UNABLE_TO_FIND_SSL_METHOD); 774 return (0);
798 return(0); 775 }
799 }
800 776
801 if (meth != s->method) 777 if (meth != s->method) {
802 { 778 if (!SSL_set_ssl_method(s, meth))
803 if (!SSL_set_ssl_method(s,meth)) 779 return (0);
804 return(0); 780 }
805 }
806 781
807#ifndef OPENSSL_NO_KRB5 782#ifndef OPENSSL_NO_KRB5
808 if (s->kssl_ctx && !s->kssl_ctx->client_princ && 783 if (s->kssl_ctx && !s->kssl_ctx->client_princ &&
809 session->krb5_client_princ_len > 0) 784 session->krb5_client_princ_len > 0) {
810 { 785 s->kssl_ctx->client_princ = (char *)OPENSSL_malloc(session->krb5_client_princ_len + 1);
811 s->kssl_ctx->client_princ = (char *)OPENSSL_malloc(session->krb5_client_princ_len + 1); 786 memcpy(s->kssl_ctx->client_princ, session->krb5_client_princ,
812 memcpy(s->kssl_ctx->client_princ,session->krb5_client_princ, 787 session->krb5_client_princ_len);
813 session->krb5_client_princ_len); 788 s->kssl_ctx->client_princ[session->krb5_client_princ_len] = '\0';
814 s->kssl_ctx->client_princ[session->krb5_client_princ_len] = '\0'; 789 }
815 }
816#endif /* OPENSSL_NO_KRB5 */ 790#endif /* OPENSSL_NO_KRB5 */
817 791
818 /* CRYPTO_w_lock(CRYPTO_LOCK_SSL);*/ 792 /* CRYPTO_w_lock(CRYPTO_LOCK_SSL);*/
819 CRYPTO_add(&session->references,1,CRYPTO_LOCK_SSL_SESSION); 793 CRYPTO_add(&session->references, 1, CRYPTO_LOCK_SSL_SESSION);
820 if (s->session != NULL) 794 if (s->session != NULL)
821 SSL_SESSION_free(s->session); 795 SSL_SESSION_free(s->session);
822 s->session=session; 796 s->session = session;
823 s->verify_result = s->session->verify_result; 797 s->verify_result = s->session->verify_result;
824 /* CRYPTO_w_unlock(CRYPTO_LOCK_SSL);*/ 798 /* CRYPTO_w_unlock(CRYPTO_LOCK_SSL);*/
825 ret=1; 799 ret = 1;
826 } 800 } else {
827 else 801 if (s->session != NULL) {
828 {
829 if (s->session != NULL)
830 {
831 SSL_SESSION_free(s->session); 802 SSL_SESSION_free(s->session);
832 s->session=NULL; 803 s->session = NULL;
833 } 804 }
834 805
835 meth=s->ctx->method; 806 meth = s->ctx->method;
836 if (meth != s->method) 807 if (meth != s->method) {
837 { 808 if (!SSL_set_ssl_method(s, meth))
838 if (!SSL_set_ssl_method(s,meth)) 809 return (0);
839 return(0);
840 }
841 ret=1;
842 } 810 }
843 return(ret); 811 ret = 1;
844 } 812 }
813 return (ret);
814}
845 815
846long SSL_SESSION_set_timeout(SSL_SESSION *s, long t) 816long
847 { 817SSL_SESSION_set_timeout(SSL_SESSION *s, long t)
848 if (s == NULL) return(0); 818{
849 s->timeout=t; 819 if (s == NULL)
850 return(1); 820 return (0);
851 } 821 s->timeout = t;
822 return (1);
823}
852 824
853long SSL_SESSION_get_timeout(const SSL_SESSION *s) 825long
854 { 826SSL_SESSION_get_timeout(const SSL_SESSION *s)
855 if (s == NULL) return(0); 827{
856 return(s->timeout); 828 if (s == NULL)
857 } 829 return (0);
830 return (s->timeout);
831}
858 832
859long SSL_SESSION_get_time(const SSL_SESSION *s) 833long
860 { 834SSL_SESSION_get_time(const SSL_SESSION *s)
861 if (s == NULL) return(0); 835{
862 return(s->time); 836 if (s == NULL)
863 } 837 return (0);
838 return (s->time);
839}
864 840
865long SSL_SESSION_set_time(SSL_SESSION *s, long t) 841long
866 { 842SSL_SESSION_set_time(SSL_SESSION *s, long t)
867 if (s == NULL) return(0); 843{
868 s->time=t; 844 if (s == NULL)
869 return(t); 845 return (0);
870 } 846 s->time = t;
847 return (t);
848}
871 849
872X509 *SSL_SESSION_get0_peer(SSL_SESSION *s) 850X509
873 { 851*SSL_SESSION_get0_peer(SSL_SESSION *s)
852{
874 return s->peer; 853 return s->peer;
875 } 854}
876 855
877int SSL_SESSION_set1_id_context(SSL_SESSION *s,const unsigned char *sid_ctx, 856int
878 unsigned int sid_ctx_len) 857SSL_SESSION_set1_id_context(SSL_SESSION *s, const unsigned char *sid_ctx,
879 { 858 unsigned int sid_ctx_len)
880 if(sid_ctx_len > SSL_MAX_SID_CTX_LENGTH) 859{
881 { 860 if (sid_ctx_len > SSL_MAX_SID_CTX_LENGTH) {
882 SSLerr(SSL_F_SSL_SESSION_SET1_ID_CONTEXT,SSL_R_SSL_SESSION_ID_CONTEXT_TOO_LONG); 861 SSLerr(SSL_F_SSL_SESSION_SET1_ID_CONTEXT, SSL_R_SSL_SESSION_ID_CONTEXT_TOO_LONG);
883 return 0; 862 return 0;
884 } 863 }
885 s->sid_ctx_length=sid_ctx_len; 864 s->sid_ctx_length = sid_ctx_len;
886 memcpy(s->sid_ctx,sid_ctx,sid_ctx_len); 865 memcpy(s->sid_ctx, sid_ctx, sid_ctx_len);
887 866
888 return 1; 867 return 1;
889 } 868}
890 869
891long SSL_CTX_set_timeout(SSL_CTX *s, long t) 870long
892 { 871SSL_CTX_set_timeout(SSL_CTX *s, long t)
872{
893 long l; 873 long l;
894 if (s == NULL) return(0); 874 if (s == NULL)
895 l=s->session_timeout; 875 return (0);
896 s->session_timeout=t; 876 l = s->session_timeout;
897 return(l); 877 s->session_timeout = t;
898 } 878 return (l);
879}
899 880
900long SSL_CTX_get_timeout(const SSL_CTX *s) 881long
901 { 882SSL_CTX_get_timeout(const SSL_CTX *s)
902 if (s == NULL) return(0); 883{
903 return(s->session_timeout); 884 if (s == NULL)
904 } 885 return (0);
886 return (s->session_timeout);
887}
905 888
906#ifndef OPENSSL_NO_TLSEXT 889#ifndef OPENSSL_NO_TLSEXT
907int SSL_set_session_secret_cb(SSL *s, int (*tls_session_secret_cb)(SSL *s, void *secret, int *secret_len, 890int
908 STACK_OF(SSL_CIPHER) *peer_ciphers, SSL_CIPHER **cipher, void *arg), void *arg) 891SSL_set_session_secret_cb(SSL *s, int (*tls_session_secret_cb)(SSL *s, void *secret, int *secret_len,
909 { 892 STACK_OF(SSL_CIPHER) *peer_ciphers, SSL_CIPHER **cipher, void *arg), void *arg)
910 if (s == NULL) return(0); 893{
894 if (s == NULL)
895 return (0);
911 s->tls_session_secret_cb = tls_session_secret_cb; 896 s->tls_session_secret_cb = tls_session_secret_cb;
912 s->tls_session_secret_cb_arg = arg; 897 s->tls_session_secret_cb_arg = arg;
913 return(1); 898 return (1);
914 } 899}
915 900
916int SSL_set_session_ticket_ext_cb(SSL *s, tls_session_ticket_ext_cb_fn cb, 901int
917 void *arg) 902SSL_set_session_ticket_ext_cb(SSL *s, tls_session_ticket_ext_cb_fn cb,
918 { 903 void *arg)
919 if (s == NULL) return(0); 904{
905 if (s == NULL)
906 return (0);
920 s->tls_session_ticket_ext_cb = cb; 907 s->tls_session_ticket_ext_cb = cb;
921 s->tls_session_ticket_ext_cb_arg = arg; 908 s->tls_session_ticket_ext_cb_arg = arg;
922 return(1); 909 return (1);
923 } 910}
924 911
925int SSL_set_session_ticket_ext(SSL *s, void *ext_data, int ext_len) 912int
926 { 913SSL_set_session_ticket_ext(SSL *s, void *ext_data, int ext_len)
927 if (s->version >= TLS1_VERSION) 914{
928 { 915 if (s->version >= TLS1_VERSION) {
929 if (s->tlsext_session_ticket) 916 if (s->tlsext_session_ticket) {
930 {
931 OPENSSL_free(s->tlsext_session_ticket); 917 OPENSSL_free(s->tlsext_session_ticket);
932 s->tlsext_session_ticket = NULL; 918 s->tlsext_session_ticket = NULL;
933 } 919 }
934 920
935 s->tlsext_session_ticket = OPENSSL_malloc(sizeof(TLS_SESSION_TICKET_EXT) + ext_len); 921 s->tlsext_session_ticket = OPENSSL_malloc(sizeof(TLS_SESSION_TICKET_EXT) + ext_len);
936 if (!s->tlsext_session_ticket) 922 if (!s->tlsext_session_ticket) {
937 {
938 SSLerr(SSL_F_SSL_SET_SESSION_TICKET_EXT, ERR_R_MALLOC_FAILURE); 923 SSLerr(SSL_F_SSL_SET_SESSION_TICKET_EXT, ERR_R_MALLOC_FAILURE);
939 return 0; 924 return 0;
940 } 925 }
941 926
942 if (ext_data) 927 if (ext_data) {
943 {
944 s->tlsext_session_ticket->length = ext_len; 928 s->tlsext_session_ticket->length = ext_len;
945 s->tlsext_session_ticket->data = s->tlsext_session_ticket + 1; 929 s->tlsext_session_ticket->data = s->tlsext_session_ticket + 1;
946 memcpy(s->tlsext_session_ticket->data, ext_data, ext_len); 930 memcpy(s->tlsext_session_ticket->data, ext_data, ext_len);
947 } 931 } else {
948 else
949 {
950 s->tlsext_session_ticket->length = 0; 932 s->tlsext_session_ticket->length = 0;
951 s->tlsext_session_ticket->data = NULL; 933 s->tlsext_session_ticket->data = NULL;
952 } 934 }
953 935
954 return 1; 936 return 1;
955 } 937 }
956 938
957 return 0; 939 return 0;
958 } 940}
959#endif /* OPENSSL_NO_TLSEXT */ 941#endif /* OPENSSL_NO_TLSEXT */
960 942
961typedef struct timeout_param_st 943typedef struct timeout_param_st {
962 {
963 SSL_CTX *ctx; 944 SSL_CTX *ctx;
964 long time; 945 long time;
965 LHASH_OF(SSL_SESSION) *cache; 946 LHASH_OF(SSL_SESSION) *cache;
966 } TIMEOUT_PARAM; 947} TIMEOUT_PARAM;
967 948
968static void timeout_doall_arg(SSL_SESSION *s, TIMEOUT_PARAM *p) 949static void
969 { 950timeout_doall_arg(SSL_SESSION *s, TIMEOUT_PARAM *p)
951{
970 if ((p->time == 0) || (p->time > (s->time+s->timeout))) /* timeout */ 952 if ((p->time == 0) || (p->time > (s->time+s->timeout))) /* timeout */
971 { 953 {
972 /* The reason we don't call SSL_CTX_remove_session() is to 954 /* The reason we don't call SSL_CTX_remove_session() is to
973 * save on locking overhead */ 955 * save on locking overhead */
974 (void)lh_SSL_SESSION_delete(p->cache,s); 956 (void)lh_SSL_SESSION_delete(p->cache, s);
975 SSL_SESSION_list_remove(p->ctx,s); 957 SSL_SESSION_list_remove(p->ctx, s);
976 s->not_resumable=1; 958 s->not_resumable = 1;
977 if (p->ctx->remove_session_cb != NULL) 959 if (p->ctx->remove_session_cb != NULL)
978 p->ctx->remove_session_cb(p->ctx,s); 960 p->ctx->remove_session_cb(p->ctx, s);
979 SSL_SESSION_free(s); 961 SSL_SESSION_free(s);
980 }
981 } 962 }
963}
982 964
983static IMPLEMENT_LHASH_DOALL_ARG_FN(timeout, SSL_SESSION, TIMEOUT_PARAM) 965static
966IMPLEMENT_LHASH_DOALL_ARG_FN(timeout, SSL_SESSION, TIMEOUT_PARAM)
984 967
985void SSL_CTX_flush_sessions(SSL_CTX *s, long t) 968void
986 { 969SSL_CTX_flush_sessions(SSL_CTX *s, long t)
970{
987 unsigned long i; 971 unsigned long i;
988 TIMEOUT_PARAM tp; 972 TIMEOUT_PARAM tp;
989 973
990 tp.ctx=s; 974 tp.ctx = s;
991 tp.cache=s->sessions; 975 tp.cache = s->sessions;
992 if (tp.cache == NULL) return; 976 if (tp.cache == NULL)
993 tp.time=t; 977 return;
978 tp.time = t;
994 CRYPTO_w_lock(CRYPTO_LOCK_SSL_CTX); 979 CRYPTO_w_lock(CRYPTO_LOCK_SSL_CTX);
995 i=CHECKED_LHASH_OF(SSL_SESSION, tp.cache)->down_load; 980 i = CHECKED_LHASH_OF(SSL_SESSION, tp.cache)->down_load;
996 CHECKED_LHASH_OF(SSL_SESSION, tp.cache)->down_load=0; 981 CHECKED_LHASH_OF(SSL_SESSION, tp.cache)->down_load = 0;
997 lh_SSL_SESSION_doall_arg(tp.cache, LHASH_DOALL_ARG_FN(timeout), 982 lh_SSL_SESSION_doall_arg(tp.cache, LHASH_DOALL_ARG_FN(timeout),
998 TIMEOUT_PARAM, &tp); 983 TIMEOUT_PARAM, &tp);
999 CHECKED_LHASH_OF(SSL_SESSION, tp.cache)->down_load=i; 984 CHECKED_LHASH_OF(SSL_SESSION, tp.cache)->down_load = i;
1000 CRYPTO_w_unlock(CRYPTO_LOCK_SSL_CTX); 985 CRYPTO_w_unlock(CRYPTO_LOCK_SSL_CTX);
1001 } 986}
1002 987
1003int ssl_clear_bad_session(SSL *s) 988int
1004 { 989ssl_clear_bad_session(SSL *s)
1005 if ( (s->session != NULL) && 990{
991 if ((s->session != NULL) &&
1006 !(s->shutdown & SSL_SENT_SHUTDOWN) && 992 !(s->shutdown & SSL_SENT_SHUTDOWN) &&
1007 !(SSL_in_init(s) || SSL_in_before(s))) 993 !(SSL_in_init(s) || SSL_in_before(s))) {
1008 { 994 SSL_CTX_remove_session(s->ctx, s->session);
1009 SSL_CTX_remove_session(s->ctx,s->session); 995 return (1);
1010 return(1); 996 } else
1011 } 997 return (0);
1012 else 998}
1013 return(0);
1014 }
1015 999
1016/* locked by SSL_CTX in the calling function */ 1000/* locked by SSL_CTX in the calling function */
1017static void SSL_SESSION_list_remove(SSL_CTX *ctx, SSL_SESSION *s) 1001static void
1018 { 1002SSL_SESSION_list_remove(SSL_CTX *ctx, SSL_SESSION *s)
1019 if ((s->next == NULL) || (s->prev == NULL)) return; 1003{
1004 if ((s->next == NULL)
1005 || (s->prev == NULL)) return;
1020 1006
1021 if (s->next == (SSL_SESSION *)&(ctx->session_cache_tail)) 1007 if (s->next == (SSL_SESSION *)&(ctx->session_cache_tail))
1022 { /* last element in list */ 1008 { /* last element in list */
1023 if (s->prev == (SSL_SESSION *)&(ctx->session_cache_head)) 1009 if (s->prev == (SSL_SESSION *)&(ctx->session_cache_head))
1024 { /* only one element in list */ 1010 { /* only one element in list */
1025 ctx->session_cache_head=NULL; 1011 ctx->session_cache_head = NULL;
1026 ctx->session_cache_tail=NULL; 1012 ctx->session_cache_tail = NULL;
1027 } 1013 } else {
1028 else 1014 ctx->session_cache_tail = s->prev;
1029 { 1015 s->prev->next = (SSL_SESSION *)&(ctx->session_cache_tail);
1030 ctx->session_cache_tail=s->prev;
1031 s->prev->next=(SSL_SESSION *)&(ctx->session_cache_tail);
1032 }
1033 } 1016 }
1034 else 1017 } else {
1035 {
1036 if (s->prev == (SSL_SESSION *)&(ctx->session_cache_head)) 1018 if (s->prev == (SSL_SESSION *)&(ctx->session_cache_head))
1037 { /* first element in list */ 1019 { /* first element in list */
1038 ctx->session_cache_head=s->next; 1020 ctx->session_cache_head = s->next;
1039 s->next->prev=(SSL_SESSION *)&(ctx->session_cache_head); 1021 s->next->prev = (SSL_SESSION *)&(ctx->session_cache_head);
1040 } 1022 } else
1041 else 1023 { /* middle of list */
1042 { /* middle of list */ 1024 s->next->prev = s->prev;
1043 s->next->prev=s->prev; 1025 s->prev->next = s->next;
1044 s->prev->next=s->next;
1045 }
1046 } 1026 }
1047 s->prev=s->next=NULL;
1048 } 1027 }
1028 s->prev = s->next = NULL;
1029}
1049 1030
1050static void SSL_SESSION_list_add(SSL_CTX *ctx, SSL_SESSION *s) 1031static void
1051 { 1032SSL_SESSION_list_add(SSL_CTX *ctx, SSL_SESSION *s)
1033{
1052 if ((s->next != NULL) && (s->prev != NULL)) 1034 if ((s->next != NULL) && (s->prev != NULL))
1053 SSL_SESSION_list_remove(ctx,s); 1035 SSL_SESSION_list_remove(ctx, s);
1054 1036
1055 if (ctx->session_cache_head == NULL) 1037 if (ctx->session_cache_head == NULL) {
1056 { 1038 ctx->session_cache_head = s;
1057 ctx->session_cache_head=s; 1039 ctx->session_cache_tail = s;
1058 ctx->session_cache_tail=s; 1040 s->prev = (SSL_SESSION *)&(ctx->session_cache_head);
1059 s->prev=(SSL_SESSION *)&(ctx->session_cache_head); 1041 s->next = (SSL_SESSION *)&(ctx->session_cache_tail);
1060 s->next=(SSL_SESSION *)&(ctx->session_cache_tail); 1042 } else {
1061 } 1043 s->next = ctx->session_cache_head;
1062 else 1044 s->next->prev = s;
1063 { 1045 s->prev = (SSL_SESSION *)&(ctx->session_cache_head);
1064 s->next=ctx->session_cache_head; 1046 ctx->session_cache_head = s;
1065 s->next->prev=s;
1066 s->prev=(SSL_SESSION *)&(ctx->session_cache_head);
1067 ctx->session_cache_head=s;
1068 }
1069 } 1047 }
1048}
1070 1049
1071void SSL_CTX_sess_set_new_cb(SSL_CTX *ctx, 1050void
1072 int (*cb)(struct ssl_st *ssl,SSL_SESSION *sess)) 1051SSL_CTX_sess_set_new_cb(SSL_CTX *ctx,
1073 { 1052 int (*cb)(struct ssl_st *ssl, SSL_SESSION *sess)) {
1074 ctx->new_session_cb=cb; 1053 ctx->new_session_cb = cb;
1075 } 1054}
1076 1055
1077int (*SSL_CTX_sess_get_new_cb(SSL_CTX *ctx))(SSL *ssl, SSL_SESSION *sess) 1056int (*SSL_CTX_sess_get_new_cb(SSL_CTX *ctx))(SSL *ssl, SSL_SESSION *sess)
1078 { 1057{
1079 return ctx->new_session_cb; 1058 return ctx->new_session_cb;
1080 } 1059}
1081 1060
1082void SSL_CTX_sess_set_remove_cb(SSL_CTX *ctx, 1061void
1083 void (*cb)(SSL_CTX *ctx,SSL_SESSION *sess)) 1062SSL_CTX_sess_set_remove_cb(SSL_CTX *ctx,
1084 { 1063 void (*cb)(SSL_CTX *ctx, SSL_SESSION *sess))
1085 ctx->remove_session_cb=cb; 1064{
1086 } 1065 ctx->remove_session_cb = cb;
1066}
1087 1067
1088void (*SSL_CTX_sess_get_remove_cb(SSL_CTX *ctx))(SSL_CTX * ctx,SSL_SESSION *sess) 1068void (*SSL_CTX_sess_get_remove_cb(SSL_CTX *ctx))(SSL_CTX * ctx, SSL_SESSION *sess)
1089 { 1069{
1090 return ctx->remove_session_cb; 1070 return ctx->remove_session_cb;
1091 } 1071}
1092 1072
1093void SSL_CTX_sess_set_get_cb(SSL_CTX *ctx, 1073void
1094 SSL_SESSION *(*cb)(struct ssl_st *ssl, 1074SSL_CTX_sess_set_get_cb(SSL_CTX *ctx,
1095 unsigned char *data,int len,int *copy)) 1075 SSL_SESSION *(*cb)(struct ssl_st *ssl,
1096 { 1076unsigned char *data, int len, int *copy))
1097 ctx->get_session_cb=cb; 1077{
1098 } 1078 ctx->get_session_cb = cb;
1079}
1099 1080
1100SSL_SESSION * (*SSL_CTX_sess_get_get_cb(SSL_CTX *ctx))(SSL *ssl, 1081SSL_SESSION * (*SSL_CTX_sess_get_get_cb(SSL_CTX *ctx))(SSL *ssl,
1101 unsigned char *data,int len,int *copy) 1082 unsigned char *data, int len, int *copy)
1102 { 1083{
1103 return ctx->get_session_cb; 1084 return ctx->get_session_cb;
1104 } 1085}
1105 1086
1106void SSL_CTX_set_info_callback(SSL_CTX *ctx, 1087void
1107 void (*cb)(const SSL *ssl,int type,int val)) 1088SSL_CTX_set_info_callback(SSL_CTX *ctx,
1108 { 1089 void (*cb)(const SSL *ssl, int type, int val))
1109 ctx->info_callback=cb; 1090{
1110 } 1091 ctx->info_callback = cb;
1092}
1111 1093
1112void (*SSL_CTX_get_info_callback(SSL_CTX *ctx))(const SSL *ssl,int type,int val) 1094void (*SSL_CTX_get_info_callback(SSL_CTX *ctx))(const SSL *ssl, int type, int val)
1113 { 1095{
1114 return ctx->info_callback; 1096 return ctx->info_callback;
1115 } 1097}
1116 1098
1117void SSL_CTX_set_client_cert_cb(SSL_CTX *ctx, 1099void
1118 int (*cb)(SSL *ssl, X509 **x509, EVP_PKEY **pkey)) 1100SSL_CTX_set_client_cert_cb(SSL_CTX *ctx,
1119 { 1101 int (*cb)(SSL *ssl, X509 **x509, EVP_PKEY **pkey))
1120 ctx->client_cert_cb=cb; 1102{
1121 } 1103 ctx->client_cert_cb = cb;
1104}
1122 1105
1123int (*SSL_CTX_get_client_cert_cb(SSL_CTX *ctx))(SSL * ssl, X509 ** x509 , EVP_PKEY **pkey) 1106int (*SSL_CTX_get_client_cert_cb(SSL_CTX *ctx))(SSL * ssl, X509 ** x509 , EVP_PKEY **pkey)
1124 { 1107{
1125 return ctx->client_cert_cb; 1108 return ctx->client_cert_cb;
1126 } 1109}
1127 1110
1128#ifndef OPENSSL_NO_ENGINE 1111#ifndef OPENSSL_NO_ENGINE
1129int SSL_CTX_set_client_cert_engine(SSL_CTX *ctx, ENGINE *e) 1112int
1130 { 1113SSL_CTX_set_client_cert_engine(SSL_CTX *ctx, ENGINE *e)
1131 if (!ENGINE_init(e)) 1114{
1132 { 1115 if (!ENGINE_init(e)) {
1133 SSLerr(SSL_F_SSL_CTX_SET_CLIENT_CERT_ENGINE, ERR_R_ENGINE_LIB); 1116 SSLerr(SSL_F_SSL_CTX_SET_CLIENT_CERT_ENGINE, ERR_R_ENGINE_LIB);
1134 return 0; 1117 return 0;
1135 } 1118 }
1136 if(!ENGINE_get_ssl_client_cert_function(e)) 1119 if (!ENGINE_get_ssl_client_cert_function(e)) {
1137 {
1138 SSLerr(SSL_F_SSL_CTX_SET_CLIENT_CERT_ENGINE, SSL_R_NO_CLIENT_CERT_METHOD); 1120 SSLerr(SSL_F_SSL_CTX_SET_CLIENT_CERT_ENGINE, SSL_R_NO_CLIENT_CERT_METHOD);
1139 ENGINE_finish(e); 1121 ENGINE_finish(e);
1140 return 0; 1122 return 0;
1141 } 1123 }
1142 ctx->client_cert_engine = e; 1124 ctx->client_cert_engine = e;
1143 return 1; 1125 return 1;
1144 } 1126}
1145#endif 1127#endif
1146 1128
1147void SSL_CTX_set_cookie_generate_cb(SSL_CTX *ctx, 1129void
1148 int (*cb)(SSL *ssl, unsigned char *cookie, unsigned int *cookie_len)) 1130SSL_CTX_set_cookie_generate_cb(SSL_CTX *ctx,
1149 { 1131 int (*cb)(SSL *ssl, unsigned char *cookie, unsigned int *cookie_len))
1150 ctx->app_gen_cookie_cb=cb; 1132{
1151 } 1133 ctx->app_gen_cookie_cb = cb;
1134}
1152 1135
1153void SSL_CTX_set_cookie_verify_cb(SSL_CTX *ctx, 1136void
1154 int (*cb)(SSL *ssl, unsigned char *cookie, unsigned int cookie_len)) 1137SSL_CTX_set_cookie_verify_cb(SSL_CTX *ctx,
1155 { 1138 int (*cb)(SSL *ssl, unsigned char *cookie, unsigned int cookie_len))
1156 ctx->app_verify_cookie_cb=cb; 1139{
1157 } 1140 ctx->app_verify_cookie_cb = cb;
1141}
1158 1142
1159IMPLEMENT_PEM_rw(SSL_SESSION, SSL_SESSION, PEM_STRING_SSL_SESSION, SSL_SESSION) 1143IMPLEMENT_PEM_rw(SSL_SESSION, SSL_SESSION, PEM_STRING_SSL_SESSION, SSL_SESSION)
diff --git a/src/lib/libssl/ssl_stat.c b/src/lib/libssl/ssl_stat.c
index 144b81e55f..3d9371cdd7 100644
--- a/src/lib/libssl/ssl_stat.c
+++ b/src/lib/libssl/ssl_stat.c
@@ -85,311 +85,533 @@
85#include <stdio.h> 85#include <stdio.h>
86#include "ssl_locl.h" 86#include "ssl_locl.h"
87 87
88const char *SSL_state_string_long(const SSL *s) 88const char
89 { 89*SSL_state_string_long(const SSL *s)
90{
90 const char *str; 91 const char *str;
91 92
92 switch (s->state) 93 switch (s->state) {
93 { 94 case SSL_ST_BEFORE:
94case SSL_ST_BEFORE: str="before SSL initialization"; break; 95 str="before SSL initialization"; break;
95case SSL_ST_ACCEPT: str="before accept initialization"; break; 96 case SSL_ST_ACCEPT:
96case SSL_ST_CONNECT: str="before connect initialization"; break; 97 str="before accept initialization"; break;
97case SSL_ST_OK: str="SSL negotiation finished successfully"; break; 98 case SSL_ST_CONNECT:
98case SSL_ST_RENEGOTIATE: str="SSL renegotiate ciphers"; break; 99 str="before connect initialization"; break;
99case SSL_ST_BEFORE|SSL_ST_CONNECT: str="before/connect initialization"; break; 100 case SSL_ST_OK:
100case SSL_ST_OK|SSL_ST_CONNECT: str="ok/connect SSL initialization"; break; 101 str="SSL negotiation finished successfully"; break;
101case SSL_ST_BEFORE|SSL_ST_ACCEPT: str="before/accept initialization"; break; 102 case SSL_ST_RENEGOTIATE:
102case SSL_ST_OK|SSL_ST_ACCEPT: str="ok/accept SSL initialization"; break; 103 str="SSL renegotiate ciphers"; break;
104 case SSL_ST_BEFORE|SSL_ST_CONNECT:
105 str="before/connect initialization"; break;
106 case SSL_ST_OK|SSL_ST_CONNECT:
107 str="ok/connect SSL initialization"; break;
108 case SSL_ST_BEFORE|SSL_ST_ACCEPT:
109 str="before/accept initialization"; break;
110 case SSL_ST_OK|SSL_ST_ACCEPT:
111 str="ok/accept SSL initialization"; break;
103#ifndef OPENSSL_NO_SSL2 112#ifndef OPENSSL_NO_SSL2
104case SSL2_ST_CLIENT_START_ENCRYPTION: str="SSLv2 client start encryption"; break; 113 case SSL2_ST_CLIENT_START_ENCRYPTION:
105case SSL2_ST_SERVER_START_ENCRYPTION: str="SSLv2 server start encryption"; break; 114 str="SSLv2 client start encryption"; break;
106case SSL2_ST_SEND_CLIENT_HELLO_A: str="SSLv2 write client hello A"; break; 115 case SSL2_ST_SERVER_START_ENCRYPTION:
107case SSL2_ST_SEND_CLIENT_HELLO_B: str="SSLv2 write client hello B"; break; 116 str="SSLv2 server start encryption"; break;
108case SSL2_ST_GET_SERVER_HELLO_A: str="SSLv2 read server hello A"; break; 117 case SSL2_ST_SEND_CLIENT_HELLO_A:
109case SSL2_ST_GET_SERVER_HELLO_B: str="SSLv2 read server hello B"; break; 118 str="SSLv2 write client hello A"; break;
110case SSL2_ST_SEND_CLIENT_MASTER_KEY_A: str="SSLv2 write client master key A"; break; 119 case SSL2_ST_SEND_CLIENT_HELLO_B:
111case SSL2_ST_SEND_CLIENT_MASTER_KEY_B: str="SSLv2 write client master key B"; break; 120 str="SSLv2 write client hello B"; break;
112case SSL2_ST_SEND_CLIENT_FINISHED_A: str="SSLv2 write client finished A"; break; 121 case SSL2_ST_GET_SERVER_HELLO_A:
113case SSL2_ST_SEND_CLIENT_FINISHED_B: str="SSLv2 write client finished B"; break; 122 str="SSLv2 read server hello A"; break;
114case SSL2_ST_SEND_CLIENT_CERTIFICATE_A: str="SSLv2 write client certificate A"; break; 123 case SSL2_ST_GET_SERVER_HELLO_B:
115case SSL2_ST_SEND_CLIENT_CERTIFICATE_B: str="SSLv2 write client certificate B"; break; 124 str="SSLv2 read server hello B"; break;
116case SSL2_ST_SEND_CLIENT_CERTIFICATE_C: str="SSLv2 write client certificate C"; break; 125 case SSL2_ST_SEND_CLIENT_MASTER_KEY_A:
117case SSL2_ST_SEND_CLIENT_CERTIFICATE_D: str="SSLv2 write client certificate D"; break; 126 str="SSLv2 write client master key A"; break;
118case SSL2_ST_GET_SERVER_VERIFY_A: str="SSLv2 read server verify A"; break; 127 case SSL2_ST_SEND_CLIENT_MASTER_KEY_B:
119case SSL2_ST_GET_SERVER_VERIFY_B: str="SSLv2 read server verify B"; break; 128 str="SSLv2 write client master key B"; break;
120case SSL2_ST_GET_SERVER_FINISHED_A: str="SSLv2 read server finished A"; break; 129 case SSL2_ST_SEND_CLIENT_FINISHED_A:
121case SSL2_ST_GET_SERVER_FINISHED_B: str="SSLv2 read server finished B"; break; 130 str="SSLv2 write client finished A"; break;
122case SSL2_ST_GET_CLIENT_HELLO_A: str="SSLv2 read client hello A"; break; 131 case SSL2_ST_SEND_CLIENT_FINISHED_B:
123case SSL2_ST_GET_CLIENT_HELLO_B: str="SSLv2 read client hello B"; break; 132 str="SSLv2 write client finished B"; break;
124case SSL2_ST_GET_CLIENT_HELLO_C: str="SSLv2 read client hello C"; break; 133 case SSL2_ST_SEND_CLIENT_CERTIFICATE_A:
125case SSL2_ST_SEND_SERVER_HELLO_A: str="SSLv2 write server hello A"; break; 134 str="SSLv2 write client certificate A"; break;
126case SSL2_ST_SEND_SERVER_HELLO_B: str="SSLv2 write server hello B"; break; 135 case SSL2_ST_SEND_CLIENT_CERTIFICATE_B:
127case SSL2_ST_GET_CLIENT_MASTER_KEY_A: str="SSLv2 read client master key A"; break; 136 str="SSLv2 write client certificate B"; break;
128case SSL2_ST_GET_CLIENT_MASTER_KEY_B: str="SSLv2 read client master key B"; break; 137 case SSL2_ST_SEND_CLIENT_CERTIFICATE_C:
129case SSL2_ST_SEND_SERVER_VERIFY_A: str="SSLv2 write server verify A"; break; 138 str="SSLv2 write client certificate C"; break;
130case SSL2_ST_SEND_SERVER_VERIFY_B: str="SSLv2 write server verify B"; break; 139 case SSL2_ST_SEND_CLIENT_CERTIFICATE_D:
131case SSL2_ST_SEND_SERVER_VERIFY_C: str="SSLv2 write server verify C"; break; 140 str="SSLv2 write client certificate D"; break;
132case SSL2_ST_GET_CLIENT_FINISHED_A: str="SSLv2 read client finished A"; break; 141 case SSL2_ST_GET_SERVER_VERIFY_A:
133case SSL2_ST_GET_CLIENT_FINISHED_B: str="SSLv2 read client finished B"; break; 142 str="SSLv2 read server verify A"; break;
134case SSL2_ST_SEND_SERVER_FINISHED_A: str="SSLv2 write server finished A"; break; 143 case SSL2_ST_GET_SERVER_VERIFY_B:
135case SSL2_ST_SEND_SERVER_FINISHED_B: str="SSLv2 write server finished B"; break; 144 str="SSLv2 read server verify B"; break;
136case SSL2_ST_SEND_REQUEST_CERTIFICATE_A: str="SSLv2 write request certificate A"; break; 145 case SSL2_ST_GET_SERVER_FINISHED_A:
137case SSL2_ST_SEND_REQUEST_CERTIFICATE_B: str="SSLv2 write request certificate B"; break; 146 str="SSLv2 read server finished A"; break;
138case SSL2_ST_SEND_REQUEST_CERTIFICATE_C: str="SSLv2 write request certificate C"; break; 147 case SSL2_ST_GET_SERVER_FINISHED_B:
139case SSL2_ST_SEND_REQUEST_CERTIFICATE_D: str="SSLv2 write request certificate D"; break; 148 str="SSLv2 read server finished B"; break;
140case SSL2_ST_X509_GET_SERVER_CERTIFICATE: str="SSLv2 X509 read server certificate"; break; 149 case SSL2_ST_GET_CLIENT_HELLO_A:
141case SSL2_ST_X509_GET_CLIENT_CERTIFICATE: str="SSLv2 X509 read client certificate"; break; 150 str="SSLv2 read client hello A"; break;
151 case SSL2_ST_GET_CLIENT_HELLO_B:
152 str="SSLv2 read client hello B"; break;
153 case SSL2_ST_GET_CLIENT_HELLO_C:
154 str="SSLv2 read client hello C"; break;
155 case SSL2_ST_SEND_SERVER_HELLO_A:
156 str="SSLv2 write server hello A"; break;
157 case SSL2_ST_SEND_SERVER_HELLO_B:
158 str="SSLv2 write server hello B"; break;
159 case SSL2_ST_GET_CLIENT_MASTER_KEY_A:
160 str="SSLv2 read client master key A"; break;
161 case SSL2_ST_GET_CLIENT_MASTER_KEY_B:
162 str="SSLv2 read client master key B"; break;
163 case SSL2_ST_SEND_SERVER_VERIFY_A:
164 str="SSLv2 write server verify A"; break;
165 case SSL2_ST_SEND_SERVER_VERIFY_B:
166 str="SSLv2 write server verify B"; break;
167 case SSL2_ST_SEND_SERVER_VERIFY_C:
168 str="SSLv2 write server verify C"; break;
169 case SSL2_ST_GET_CLIENT_FINISHED_A:
170 str="SSLv2 read client finished A"; break;
171 case SSL2_ST_GET_CLIENT_FINISHED_B:
172 str="SSLv2 read client finished B"; break;
173 case SSL2_ST_SEND_SERVER_FINISHED_A:
174 str="SSLv2 write server finished A"; break;
175 case SSL2_ST_SEND_SERVER_FINISHED_B:
176 str="SSLv2 write server finished B"; break;
177 case SSL2_ST_SEND_REQUEST_CERTIFICATE_A:
178 str="SSLv2 write request certificate A"; break;
179 case SSL2_ST_SEND_REQUEST_CERTIFICATE_B:
180 str="SSLv2 write request certificate B"; break;
181 case SSL2_ST_SEND_REQUEST_CERTIFICATE_C:
182 str="SSLv2 write request certificate C"; break;
183 case SSL2_ST_SEND_REQUEST_CERTIFICATE_D:
184 str="SSLv2 write request certificate D"; break;
185 case SSL2_ST_X509_GET_SERVER_CERTIFICATE:
186 str="SSLv2 X509 read server certificate"; break;
187 case SSL2_ST_X509_GET_CLIENT_CERTIFICATE:
188 str="SSLv2 X509 read client certificate"; break;
142#endif 189#endif
143 190
144#ifndef OPENSSL_NO_SSL3 191#ifndef OPENSSL_NO_SSL3
145/* SSLv3 additions */ 192/* SSLv3 additions */
146case SSL3_ST_CW_CLNT_HELLO_A: str="SSLv3 write client hello A"; break; 193 case SSL3_ST_CW_CLNT_HELLO_A:
147case SSL3_ST_CW_CLNT_HELLO_B: str="SSLv3 write client hello B"; break; 194 str="SSLv3 write client hello A"; break;
148case SSL3_ST_CR_SRVR_HELLO_A: str="SSLv3 read server hello A"; break; 195 case SSL3_ST_CW_CLNT_HELLO_B:
149case SSL3_ST_CR_SRVR_HELLO_B: str="SSLv3 read server hello B"; break; 196 str="SSLv3 write client hello B"; break;
150case SSL3_ST_CR_CERT_A: str="SSLv3 read server certificate A"; break; 197 case SSL3_ST_CR_SRVR_HELLO_A:
151case SSL3_ST_CR_CERT_B: str="SSLv3 read server certificate B"; break; 198 str="SSLv3 read server hello A"; break;
152case SSL3_ST_CR_KEY_EXCH_A: str="SSLv3 read server key exchange A"; break; 199 case SSL3_ST_CR_SRVR_HELLO_B:
153case SSL3_ST_CR_KEY_EXCH_B: str="SSLv3 read server key exchange B"; break; 200 str="SSLv3 read server hello B"; break;
154case SSL3_ST_CR_CERT_REQ_A: str="SSLv3 read server certificate request A"; break; 201 case SSL3_ST_CR_CERT_A:
155case SSL3_ST_CR_CERT_REQ_B: str="SSLv3 read server certificate request B"; break; 202 str="SSLv3 read server certificate A"; break;
156case SSL3_ST_CR_SESSION_TICKET_A: str="SSLv3 read server session ticket A";break; 203 case SSL3_ST_CR_CERT_B:
157case SSL3_ST_CR_SESSION_TICKET_B: str="SSLv3 read server session ticket B";break; 204 str="SSLv3 read server certificate B"; break;
158case SSL3_ST_CR_SRVR_DONE_A: str="SSLv3 read server done A"; break; 205 case SSL3_ST_CR_KEY_EXCH_A:
159case SSL3_ST_CR_SRVR_DONE_B: str="SSLv3 read server done B"; break; 206 str="SSLv3 read server key exchange A"; break;
160case SSL3_ST_CW_CERT_A: str="SSLv3 write client certificate A"; break; 207 case SSL3_ST_CR_KEY_EXCH_B:
161case SSL3_ST_CW_CERT_B: str="SSLv3 write client certificate B"; break; 208 str="SSLv3 read server key exchange B"; break;
162case SSL3_ST_CW_CERT_C: str="SSLv3 write client certificate C"; break; 209 case SSL3_ST_CR_CERT_REQ_A:
163case SSL3_ST_CW_CERT_D: str="SSLv3 write client certificate D"; break; 210 str="SSLv3 read server certificate request A"; break;
164case SSL3_ST_CW_KEY_EXCH_A: str="SSLv3 write client key exchange A"; break; 211 case SSL3_ST_CR_CERT_REQ_B:
165case SSL3_ST_CW_KEY_EXCH_B: str="SSLv3 write client key exchange B"; break; 212 str="SSLv3 read server certificate request B"; break;
166case SSL3_ST_CW_CERT_VRFY_A: str="SSLv3 write certificate verify A"; break; 213 case SSL3_ST_CR_SESSION_TICKET_A:
167case SSL3_ST_CW_CERT_VRFY_B: str="SSLv3 write certificate verify B"; break; 214 str="SSLv3 read server session ticket A";break;
215 case SSL3_ST_CR_SESSION_TICKET_B:
216 str="SSLv3 read server session ticket B";break;
217 case SSL3_ST_CR_SRVR_DONE_A:
218 str="SSLv3 read server done A"; break;
219 case SSL3_ST_CR_SRVR_DONE_B:
220 str="SSLv3 read server done B"; break;
221 case SSL3_ST_CW_CERT_A:
222 str="SSLv3 write client certificate A"; break;
223 case SSL3_ST_CW_CERT_B:
224 str="SSLv3 write client certificate B"; break;
225 case SSL3_ST_CW_CERT_C:
226 str="SSLv3 write client certificate C"; break;
227 case SSL3_ST_CW_CERT_D:
228 str="SSLv3 write client certificate D"; break;
229 case SSL3_ST_CW_KEY_EXCH_A:
230 str="SSLv3 write client key exchange A"; break;
231 case SSL3_ST_CW_KEY_EXCH_B:
232 str="SSLv3 write client key exchange B"; break;
233 case SSL3_ST_CW_CERT_VRFY_A:
234 str="SSLv3 write certificate verify A"; break;
235 case SSL3_ST_CW_CERT_VRFY_B:
236 str="SSLv3 write certificate verify B"; break;
168 237
169case SSL3_ST_CW_CHANGE_A: 238 case SSL3_ST_CW_CHANGE_A:
170case SSL3_ST_SW_CHANGE_A: str="SSLv3 write change cipher spec A"; break; 239 case SSL3_ST_SW_CHANGE_A:
171case SSL3_ST_CW_CHANGE_B: 240 str="SSLv3 write change cipher spec A"; break;
172case SSL3_ST_SW_CHANGE_B: str="SSLv3 write change cipher spec B"; break; 241 case SSL3_ST_CW_CHANGE_B:
173case SSL3_ST_CW_FINISHED_A: 242 case SSL3_ST_SW_CHANGE_B:
174case SSL3_ST_SW_FINISHED_A: str="SSLv3 write finished A"; break; 243 str="SSLv3 write change cipher spec B"; break;
175case SSL3_ST_CW_FINISHED_B: 244 case SSL3_ST_CW_FINISHED_A:
176case SSL3_ST_SW_FINISHED_B: str="SSLv3 write finished B"; break; 245 case SSL3_ST_SW_FINISHED_A:
177case SSL3_ST_CR_CHANGE_A: 246 str="SSLv3 write finished A"; break;
178case SSL3_ST_SR_CHANGE_A: str="SSLv3 read change cipher spec A"; break; 247 case SSL3_ST_CW_FINISHED_B:
179case SSL3_ST_CR_CHANGE_B: 248 case SSL3_ST_SW_FINISHED_B:
180case SSL3_ST_SR_CHANGE_B: str="SSLv3 read change cipher spec B"; break; 249 str="SSLv3 write finished B"; break;
181case SSL3_ST_CR_FINISHED_A: 250 case SSL3_ST_CR_CHANGE_A:
182case SSL3_ST_SR_FINISHED_A: str="SSLv3 read finished A"; break; 251 case SSL3_ST_SR_CHANGE_A:
183case SSL3_ST_CR_FINISHED_B: 252 str="SSLv3 read change cipher spec A"; break;
184case SSL3_ST_SR_FINISHED_B: str="SSLv3 read finished B"; break; 253 case SSL3_ST_CR_CHANGE_B:
254 case SSL3_ST_SR_CHANGE_B:
255 str="SSLv3 read change cipher spec B"; break;
256 case SSL3_ST_CR_FINISHED_A:
257 case SSL3_ST_SR_FINISHED_A:
258 str="SSLv3 read finished A"; break;
259 case SSL3_ST_CR_FINISHED_B:
260 case SSL3_ST_SR_FINISHED_B:
261 str="SSLv3 read finished B"; break;
185 262
186case SSL3_ST_CW_FLUSH: 263 case SSL3_ST_CW_FLUSH:
187case SSL3_ST_SW_FLUSH: str="SSLv3 flush data"; break; 264 case SSL3_ST_SW_FLUSH:
265 str="SSLv3 flush data"; break;
188 266
189case SSL3_ST_SR_CLNT_HELLO_A: str="SSLv3 read client hello A"; break; 267 case SSL3_ST_SR_CLNT_HELLO_A:
190case SSL3_ST_SR_CLNT_HELLO_B: str="SSLv3 read client hello B"; break; 268 str="SSLv3 read client hello A"; break;
191case SSL3_ST_SR_CLNT_HELLO_C: str="SSLv3 read client hello C"; break; 269 case SSL3_ST_SR_CLNT_HELLO_B:
192case SSL3_ST_SW_HELLO_REQ_A: str="SSLv3 write hello request A"; break; 270 str="SSLv3 read client hello B"; break;
193case SSL3_ST_SW_HELLO_REQ_B: str="SSLv3 write hello request B"; break; 271 case SSL3_ST_SR_CLNT_HELLO_C:
194case SSL3_ST_SW_HELLO_REQ_C: str="SSLv3 write hello request C"; break; 272 str="SSLv3 read client hello C"; break;
195case SSL3_ST_SW_SRVR_HELLO_A: str="SSLv3 write server hello A"; break; 273 case SSL3_ST_SW_HELLO_REQ_A:
196case SSL3_ST_SW_SRVR_HELLO_B: str="SSLv3 write server hello B"; break; 274 str="SSLv3 write hello request A"; break;
197case SSL3_ST_SW_CERT_A: str="SSLv3 write certificate A"; break; 275 case SSL3_ST_SW_HELLO_REQ_B:
198case SSL3_ST_SW_CERT_B: str="SSLv3 write certificate B"; break; 276 str="SSLv3 write hello request B"; break;
199case SSL3_ST_SW_KEY_EXCH_A: str="SSLv3 write key exchange A"; break; 277 case SSL3_ST_SW_HELLO_REQ_C:
200case SSL3_ST_SW_KEY_EXCH_B: str="SSLv3 write key exchange B"; break; 278 str="SSLv3 write hello request C"; break;
201case SSL3_ST_SW_CERT_REQ_A: str="SSLv3 write certificate request A"; break; 279 case SSL3_ST_SW_SRVR_HELLO_A:
202case SSL3_ST_SW_CERT_REQ_B: str="SSLv3 write certificate request B"; break; 280 str="SSLv3 write server hello A"; break;
203case SSL3_ST_SW_SESSION_TICKET_A: str="SSLv3 write session ticket A"; break; 281 case SSL3_ST_SW_SRVR_HELLO_B:
204case SSL3_ST_SW_SESSION_TICKET_B: str="SSLv3 write session ticket B"; break; 282 str="SSLv3 write server hello B"; break;
205case SSL3_ST_SW_SRVR_DONE_A: str="SSLv3 write server done A"; break; 283 case SSL3_ST_SW_CERT_A:
206case SSL3_ST_SW_SRVR_DONE_B: str="SSLv3 write server done B"; break; 284 str="SSLv3 write certificate A"; break;
207case SSL3_ST_SR_CERT_A: str="SSLv3 read client certificate A"; break; 285 case SSL3_ST_SW_CERT_B:
208case SSL3_ST_SR_CERT_B: str="SSLv3 read client certificate B"; break; 286 str="SSLv3 write certificate B"; break;
209case SSL3_ST_SR_KEY_EXCH_A: str="SSLv3 read client key exchange A"; break; 287 case SSL3_ST_SW_KEY_EXCH_A:
210case SSL3_ST_SR_KEY_EXCH_B: str="SSLv3 read client key exchange B"; break; 288 str="SSLv3 write key exchange A"; break;
211case SSL3_ST_SR_CERT_VRFY_A: str="SSLv3 read certificate verify A"; break; 289 case SSL3_ST_SW_KEY_EXCH_B:
212case SSL3_ST_SR_CERT_VRFY_B: str="SSLv3 read certificate verify B"; break; 290 str="SSLv3 write key exchange B"; break;
291 case SSL3_ST_SW_CERT_REQ_A:
292 str="SSLv3 write certificate request A"; break;
293 case SSL3_ST_SW_CERT_REQ_B:
294 str="SSLv3 write certificate request B"; break;
295 case SSL3_ST_SW_SESSION_TICKET_A:
296 str="SSLv3 write session ticket A"; break;
297 case SSL3_ST_SW_SESSION_TICKET_B:
298 str="SSLv3 write session ticket B"; break;
299 case SSL3_ST_SW_SRVR_DONE_A:
300 str="SSLv3 write server done A"; break;
301 case SSL3_ST_SW_SRVR_DONE_B:
302 str="SSLv3 write server done B"; break;
303 case SSL3_ST_SR_CERT_A:
304 str="SSLv3 read client certificate A"; break;
305 case SSL3_ST_SR_CERT_B:
306 str="SSLv3 read client certificate B"; break;
307 case SSL3_ST_SR_KEY_EXCH_A:
308 str="SSLv3 read client key exchange A"; break;
309 case SSL3_ST_SR_KEY_EXCH_B:
310 str="SSLv3 read client key exchange B"; break;
311 case SSL3_ST_SR_CERT_VRFY_A:
312 str="SSLv3 read certificate verify A"; break;
313 case SSL3_ST_SR_CERT_VRFY_B:
314 str="SSLv3 read certificate verify B"; break;
213#endif 315#endif
214 316
215#if !defined(OPENSSL_NO_SSL2) && !defined(OPENSSL_NO_SSL3) 317#if !defined(OPENSSL_NO_SSL2) && !defined(OPENSSL_NO_SSL3)
216/* SSLv2/v3 compatibility states */ 318/* SSLv2/v3 compatibility states */
217/* client */ 319/* client */
218case SSL23_ST_CW_CLNT_HELLO_A: str="SSLv2/v3 write client hello A"; break; 320 case SSL23_ST_CW_CLNT_HELLO_A:
219case SSL23_ST_CW_CLNT_HELLO_B: str="SSLv2/v3 write client hello B"; break; 321 str="SSLv2/v3 write client hello A"; break;
220case SSL23_ST_CR_SRVR_HELLO_A: str="SSLv2/v3 read server hello A"; break; 322 case SSL23_ST_CW_CLNT_HELLO_B:
221case SSL23_ST_CR_SRVR_HELLO_B: str="SSLv2/v3 read server hello B"; break; 323 str="SSLv2/v3 write client hello B"; break;
324 case SSL23_ST_CR_SRVR_HELLO_A:
325 str="SSLv2/v3 read server hello A"; break;
326 case SSL23_ST_CR_SRVR_HELLO_B:
327 str="SSLv2/v3 read server hello B"; break;
222/* server */ 328/* server */
223case SSL23_ST_SR_CLNT_HELLO_A: str="SSLv2/v3 read client hello A"; break; 329 case SSL23_ST_SR_CLNT_HELLO_A:
224case SSL23_ST_SR_CLNT_HELLO_B: str="SSLv2/v3 read client hello B"; break; 330 str="SSLv2/v3 read client hello A"; break;
331 case SSL23_ST_SR_CLNT_HELLO_B:
332 str="SSLv2/v3 read client hello B"; break;
225#endif 333#endif
226 334
227/* DTLS */ 335/* DTLS */
228case DTLS1_ST_CR_HELLO_VERIFY_REQUEST_A: str="DTLS1 read hello verify request A"; break; 336 case DTLS1_ST_CR_HELLO_VERIFY_REQUEST_A:
229case DTLS1_ST_CR_HELLO_VERIFY_REQUEST_B: str="DTLS1 read hello verify request B"; break; 337 str="DTLS1 read hello verify request A"; break;
230case DTLS1_ST_SW_HELLO_VERIFY_REQUEST_A: str="DTLS1 write hello verify request A"; break; 338 case DTLS1_ST_CR_HELLO_VERIFY_REQUEST_B:
231case DTLS1_ST_SW_HELLO_VERIFY_REQUEST_B: str="DTLS1 write hello verify request B"; break; 339 str="DTLS1 read hello verify request B"; break;
340 case DTLS1_ST_SW_HELLO_VERIFY_REQUEST_A:
341 str="DTLS1 write hello verify request A"; break;
342 case DTLS1_ST_SW_HELLO_VERIFY_REQUEST_B:
343 str="DTLS1 write hello verify request B"; break;
232 344
233default: str="unknown state"; break; 345 default:
234 } 346 str="unknown state"; break;
235 return(str);
236 } 347 }
348 return (str);
349}
237 350
238const char *SSL_rstate_string_long(const SSL *s) 351const char
239 { 352*SSL_rstate_string_long(const SSL *s)
353{
240 const char *str; 354 const char *str;
241 355
242 switch (s->rstate) 356 switch (s->rstate) {
243 { 357 case SSL_ST_READ_HEADER:
244 case SSL_ST_READ_HEADER: str="read header"; break; 358 str="read header"; break;
245 case SSL_ST_READ_BODY: str="read body"; break; 359 case SSL_ST_READ_BODY:
246 case SSL_ST_READ_DONE: str="read done"; break; 360 str="read body"; break;
247 default: str="unknown"; break; 361 case SSL_ST_READ_DONE:
248 } 362 str="read done"; break;
249 return(str); 363 default:
364 str="unknown"; break;
250 } 365 }
366 return (str);
367}
251 368
252const char *SSL_state_string(const SSL *s) 369const char
253 { 370*SSL_state_string(const SSL *s)
371{
254 const char *str; 372 const char *str;
255 373
256 switch (s->state) 374 switch (s->state) {
257 { 375 case SSL_ST_BEFORE:
258case SSL_ST_BEFORE: str="PINIT "; break; 376 str="PINIT "; break;
259case SSL_ST_ACCEPT: str="AINIT "; break; 377 case SSL_ST_ACCEPT:
260case SSL_ST_CONNECT: str="CINIT "; break; 378 str="AINIT "; break;
261case SSL_ST_OK: str="SSLOK "; break; 379 case SSL_ST_CONNECT:
380 str="CINIT "; break;
381 case SSL_ST_OK:
382 str="SSLOK "; break;
262#ifndef OPENSSL_NO_SSL2 383#ifndef OPENSSL_NO_SSL2
263case SSL2_ST_CLIENT_START_ENCRYPTION: str="2CSENC"; break; 384 case SSL2_ST_CLIENT_START_ENCRYPTION:
264case SSL2_ST_SERVER_START_ENCRYPTION: str="2SSENC"; break; 385 str="2CSENC"; break;
265case SSL2_ST_SEND_CLIENT_HELLO_A: str="2SCH_A"; break; 386 case SSL2_ST_SERVER_START_ENCRYPTION:
266case SSL2_ST_SEND_CLIENT_HELLO_B: str="2SCH_B"; break; 387 str="2SSENC"; break;
267case SSL2_ST_GET_SERVER_HELLO_A: str="2GSH_A"; break; 388 case SSL2_ST_SEND_CLIENT_HELLO_A:
268case SSL2_ST_GET_SERVER_HELLO_B: str="2GSH_B"; break; 389 str="2SCH_A"; break;
269case SSL2_ST_SEND_CLIENT_MASTER_KEY_A: str="2SCMKA"; break; 390 case SSL2_ST_SEND_CLIENT_HELLO_B:
270case SSL2_ST_SEND_CLIENT_MASTER_KEY_B: str="2SCMKB"; break; 391 str="2SCH_B"; break;
271case SSL2_ST_SEND_CLIENT_FINISHED_A: str="2SCF_A"; break; 392 case SSL2_ST_GET_SERVER_HELLO_A:
272case SSL2_ST_SEND_CLIENT_FINISHED_B: str="2SCF_B"; break; 393 str="2GSH_A"; break;
273case SSL2_ST_SEND_CLIENT_CERTIFICATE_A: str="2SCC_A"; break; 394 case SSL2_ST_GET_SERVER_HELLO_B:
274case SSL2_ST_SEND_CLIENT_CERTIFICATE_B: str="2SCC_B"; break; 395 str="2GSH_B"; break;
275case SSL2_ST_SEND_CLIENT_CERTIFICATE_C: str="2SCC_C"; break; 396 case SSL2_ST_SEND_CLIENT_MASTER_KEY_A:
276case SSL2_ST_SEND_CLIENT_CERTIFICATE_D: str="2SCC_D"; break; 397 str="2SCMKA"; break;
277case SSL2_ST_GET_SERVER_VERIFY_A: str="2GSV_A"; break; 398 case SSL2_ST_SEND_CLIENT_MASTER_KEY_B:
278case SSL2_ST_GET_SERVER_VERIFY_B: str="2GSV_B"; break; 399 str="2SCMKB"; break;
279case SSL2_ST_GET_SERVER_FINISHED_A: str="2GSF_A"; break; 400 case SSL2_ST_SEND_CLIENT_FINISHED_A:
280case SSL2_ST_GET_SERVER_FINISHED_B: str="2GSF_B"; break; 401 str="2SCF_A"; break;
281case SSL2_ST_GET_CLIENT_HELLO_A: str="2GCH_A"; break; 402 case SSL2_ST_SEND_CLIENT_FINISHED_B:
282case SSL2_ST_GET_CLIENT_HELLO_B: str="2GCH_B"; break; 403 str="2SCF_B"; break;
283case SSL2_ST_GET_CLIENT_HELLO_C: str="2GCH_C"; break; 404 case SSL2_ST_SEND_CLIENT_CERTIFICATE_A:
284case SSL2_ST_SEND_SERVER_HELLO_A: str="2SSH_A"; break; 405 str="2SCC_A"; break;
285case SSL2_ST_SEND_SERVER_HELLO_B: str="2SSH_B"; break; 406 case SSL2_ST_SEND_CLIENT_CERTIFICATE_B:
286case SSL2_ST_GET_CLIENT_MASTER_KEY_A: str="2GCMKA"; break; 407 str="2SCC_B"; break;
287case SSL2_ST_GET_CLIENT_MASTER_KEY_B: str="2GCMKA"; break; 408 case SSL2_ST_SEND_CLIENT_CERTIFICATE_C:
288case SSL2_ST_SEND_SERVER_VERIFY_A: str="2SSV_A"; break; 409 str="2SCC_C"; break;
289case SSL2_ST_SEND_SERVER_VERIFY_B: str="2SSV_B"; break; 410 case SSL2_ST_SEND_CLIENT_CERTIFICATE_D:
290case SSL2_ST_SEND_SERVER_VERIFY_C: str="2SSV_C"; break; 411 str="2SCC_D"; break;
291case SSL2_ST_GET_CLIENT_FINISHED_A: str="2GCF_A"; break; 412 case SSL2_ST_GET_SERVER_VERIFY_A:
292case SSL2_ST_GET_CLIENT_FINISHED_B: str="2GCF_B"; break; 413 str="2GSV_A"; break;
293case SSL2_ST_SEND_SERVER_FINISHED_A: str="2SSF_A"; break; 414 case SSL2_ST_GET_SERVER_VERIFY_B:
294case SSL2_ST_SEND_SERVER_FINISHED_B: str="2SSF_B"; break; 415 str="2GSV_B"; break;
295case SSL2_ST_SEND_REQUEST_CERTIFICATE_A: str="2SRC_A"; break; 416 case SSL2_ST_GET_SERVER_FINISHED_A:
296case SSL2_ST_SEND_REQUEST_CERTIFICATE_B: str="2SRC_B"; break; 417 str="2GSF_A"; break;
297case SSL2_ST_SEND_REQUEST_CERTIFICATE_C: str="2SRC_C"; break; 418 case SSL2_ST_GET_SERVER_FINISHED_B:
298case SSL2_ST_SEND_REQUEST_CERTIFICATE_D: str="2SRC_D"; break; 419 str="2GSF_B"; break;
299case SSL2_ST_X509_GET_SERVER_CERTIFICATE: str="2X9GSC"; break; 420 case SSL2_ST_GET_CLIENT_HELLO_A:
300case SSL2_ST_X509_GET_CLIENT_CERTIFICATE: str="2X9GCC"; break; 421 str="2GCH_A"; break;
422 case SSL2_ST_GET_CLIENT_HELLO_B:
423 str="2GCH_B"; break;
424 case SSL2_ST_GET_CLIENT_HELLO_C:
425 str="2GCH_C"; break;
426 case SSL2_ST_SEND_SERVER_HELLO_A:
427 str="2SSH_A"; break;
428 case SSL2_ST_SEND_SERVER_HELLO_B:
429 str="2SSH_B"; break;
430 case SSL2_ST_GET_CLIENT_MASTER_KEY_A:
431 str="2GCMKA"; break;
432 case SSL2_ST_GET_CLIENT_MASTER_KEY_B:
433 str="2GCMKA"; break;
434 case SSL2_ST_SEND_SERVER_VERIFY_A:
435 str="2SSV_A"; break;
436 case SSL2_ST_SEND_SERVER_VERIFY_B:
437 str="2SSV_B"; break;
438 case SSL2_ST_SEND_SERVER_VERIFY_C:
439 str="2SSV_C"; break;
440 case SSL2_ST_GET_CLIENT_FINISHED_A:
441 str="2GCF_A"; break;
442 case SSL2_ST_GET_CLIENT_FINISHED_B:
443 str="2GCF_B"; break;
444 case SSL2_ST_SEND_SERVER_FINISHED_A:
445 str="2SSF_A"; break;
446 case SSL2_ST_SEND_SERVER_FINISHED_B:
447 str="2SSF_B"; break;
448 case SSL2_ST_SEND_REQUEST_CERTIFICATE_A:
449 str="2SRC_A"; break;
450 case SSL2_ST_SEND_REQUEST_CERTIFICATE_B:
451 str="2SRC_B"; break;
452 case SSL2_ST_SEND_REQUEST_CERTIFICATE_C:
453 str="2SRC_C"; break;
454 case SSL2_ST_SEND_REQUEST_CERTIFICATE_D:
455 str="2SRC_D"; break;
456 case SSL2_ST_X509_GET_SERVER_CERTIFICATE:
457 str="2X9GSC"; break;
458 case SSL2_ST_X509_GET_CLIENT_CERTIFICATE:
459 str="2X9GCC"; break;
301#endif 460#endif
302 461
303#ifndef OPENSSL_NO_SSL3 462#ifndef OPENSSL_NO_SSL3
304/* SSLv3 additions */ 463/* SSLv3 additions */
305case SSL3_ST_SW_FLUSH: 464 case SSL3_ST_SW_FLUSH:
306case SSL3_ST_CW_FLUSH: str="3FLUSH"; break; 465 case SSL3_ST_CW_FLUSH:
307case SSL3_ST_CW_CLNT_HELLO_A: str="3WCH_A"; break; 466 str="3FLUSH"; break;
308case SSL3_ST_CW_CLNT_HELLO_B: str="3WCH_B"; break; 467 case SSL3_ST_CW_CLNT_HELLO_A:
309case SSL3_ST_CR_SRVR_HELLO_A: str="3RSH_A"; break; 468 str="3WCH_A"; break;
310case SSL3_ST_CR_SRVR_HELLO_B: str="3RSH_B"; break; 469 case SSL3_ST_CW_CLNT_HELLO_B:
311case SSL3_ST_CR_CERT_A: str="3RSC_A"; break; 470 str="3WCH_B"; break;
312case SSL3_ST_CR_CERT_B: str="3RSC_B"; break; 471 case SSL3_ST_CR_SRVR_HELLO_A:
313case SSL3_ST_CR_KEY_EXCH_A: str="3RSKEA"; break; 472 str="3RSH_A"; break;
314case SSL3_ST_CR_KEY_EXCH_B: str="3RSKEB"; break; 473 case SSL3_ST_CR_SRVR_HELLO_B:
315case SSL3_ST_CR_CERT_REQ_A: str="3RCR_A"; break; 474 str="3RSH_B"; break;
316case SSL3_ST_CR_CERT_REQ_B: str="3RCR_B"; break; 475 case SSL3_ST_CR_CERT_A:
317case SSL3_ST_CR_SRVR_DONE_A: str="3RSD_A"; break; 476 str="3RSC_A"; break;
318case SSL3_ST_CR_SRVR_DONE_B: str="3RSD_B"; break; 477 case SSL3_ST_CR_CERT_B:
319case SSL3_ST_CW_CERT_A: str="3WCC_A"; break; 478 str="3RSC_B"; break;
320case SSL3_ST_CW_CERT_B: str="3WCC_B"; break; 479 case SSL3_ST_CR_KEY_EXCH_A:
321case SSL3_ST_CW_CERT_C: str="3WCC_C"; break; 480 str="3RSKEA"; break;
322case SSL3_ST_CW_CERT_D: str="3WCC_D"; break; 481 case SSL3_ST_CR_KEY_EXCH_B:
323case SSL3_ST_CW_KEY_EXCH_A: str="3WCKEA"; break; 482 str="3RSKEB"; break;
324case SSL3_ST_CW_KEY_EXCH_B: str="3WCKEB"; break; 483 case SSL3_ST_CR_CERT_REQ_A:
325case SSL3_ST_CW_CERT_VRFY_A: str="3WCV_A"; break; 484 str="3RCR_A"; break;
326case SSL3_ST_CW_CERT_VRFY_B: str="3WCV_B"; break; 485 case SSL3_ST_CR_CERT_REQ_B:
486 str="3RCR_B"; break;
487 case SSL3_ST_CR_SRVR_DONE_A:
488 str="3RSD_A"; break;
489 case SSL3_ST_CR_SRVR_DONE_B:
490 str="3RSD_B"; break;
491 case SSL3_ST_CW_CERT_A:
492 str="3WCC_A"; break;
493 case SSL3_ST_CW_CERT_B:
494 str="3WCC_B"; break;
495 case SSL3_ST_CW_CERT_C:
496 str="3WCC_C"; break;
497 case SSL3_ST_CW_CERT_D:
498 str="3WCC_D"; break;
499 case SSL3_ST_CW_KEY_EXCH_A:
500 str="3WCKEA"; break;
501 case SSL3_ST_CW_KEY_EXCH_B:
502 str="3WCKEB"; break;
503 case SSL3_ST_CW_CERT_VRFY_A:
504 str="3WCV_A"; break;
505 case SSL3_ST_CW_CERT_VRFY_B:
506 str="3WCV_B"; break;
327 507
328case SSL3_ST_SW_CHANGE_A: 508 case SSL3_ST_SW_CHANGE_A:
329case SSL3_ST_CW_CHANGE_A: str="3WCCSA"; break; 509 case SSL3_ST_CW_CHANGE_A:
330case SSL3_ST_SW_CHANGE_B: 510 str="3WCCSA"; break;
331case SSL3_ST_CW_CHANGE_B: str="3WCCSB"; break; 511 case SSL3_ST_SW_CHANGE_B:
332case SSL3_ST_SW_FINISHED_A: 512 case SSL3_ST_CW_CHANGE_B:
333case SSL3_ST_CW_FINISHED_A: str="3WFINA"; break; 513 str="3WCCSB"; break;
334case SSL3_ST_SW_FINISHED_B: 514 case SSL3_ST_SW_FINISHED_A:
335case SSL3_ST_CW_FINISHED_B: str="3WFINB"; break; 515 case SSL3_ST_CW_FINISHED_A:
336case SSL3_ST_SR_CHANGE_A: 516 str="3WFINA"; break;
337case SSL3_ST_CR_CHANGE_A: str="3RCCSA"; break; 517 case SSL3_ST_SW_FINISHED_B:
338case SSL3_ST_SR_CHANGE_B: 518 case SSL3_ST_CW_FINISHED_B:
339case SSL3_ST_CR_CHANGE_B: str="3RCCSB"; break; 519 str="3WFINB"; break;
340case SSL3_ST_SR_FINISHED_A: 520 case SSL3_ST_SR_CHANGE_A:
341case SSL3_ST_CR_FINISHED_A: str="3RFINA"; break; 521 case SSL3_ST_CR_CHANGE_A:
342case SSL3_ST_SR_FINISHED_B: 522 str="3RCCSA"; break;
343case SSL3_ST_CR_FINISHED_B: str="3RFINB"; break; 523 case SSL3_ST_SR_CHANGE_B:
524 case SSL3_ST_CR_CHANGE_B:
525 str="3RCCSB"; break;
526 case SSL3_ST_SR_FINISHED_A:
527 case SSL3_ST_CR_FINISHED_A:
528 str="3RFINA"; break;
529 case SSL3_ST_SR_FINISHED_B:
530 case SSL3_ST_CR_FINISHED_B:
531 str="3RFINB"; break;
344 532
345case SSL3_ST_SW_HELLO_REQ_A: str="3WHR_A"; break; 533 case SSL3_ST_SW_HELLO_REQ_A:
346case SSL3_ST_SW_HELLO_REQ_B: str="3WHR_B"; break; 534 str="3WHR_A"; break;
347case SSL3_ST_SW_HELLO_REQ_C: str="3WHR_C"; break; 535 case SSL3_ST_SW_HELLO_REQ_B:
348case SSL3_ST_SR_CLNT_HELLO_A: str="3RCH_A"; break; 536 str="3WHR_B"; break;
349case SSL3_ST_SR_CLNT_HELLO_B: str="3RCH_B"; break; 537 case SSL3_ST_SW_HELLO_REQ_C:
350case SSL3_ST_SR_CLNT_HELLO_C: str="3RCH_C"; break; 538 str="3WHR_C"; break;
351case SSL3_ST_SW_SRVR_HELLO_A: str="3WSH_A"; break; 539 case SSL3_ST_SR_CLNT_HELLO_A:
352case SSL3_ST_SW_SRVR_HELLO_B: str="3WSH_B"; break; 540 str="3RCH_A"; break;
353case SSL3_ST_SW_CERT_A: str="3WSC_A"; break; 541 case SSL3_ST_SR_CLNT_HELLO_B:
354case SSL3_ST_SW_CERT_B: str="3WSC_B"; break; 542 str="3RCH_B"; break;
355case SSL3_ST_SW_KEY_EXCH_A: str="3WSKEA"; break; 543 case SSL3_ST_SR_CLNT_HELLO_C:
356case SSL3_ST_SW_KEY_EXCH_B: str="3WSKEB"; break; 544 str="3RCH_C"; break;
357case SSL3_ST_SW_CERT_REQ_A: str="3WCR_A"; break; 545 case SSL3_ST_SW_SRVR_HELLO_A:
358case SSL3_ST_SW_CERT_REQ_B: str="3WCR_B"; break; 546 str="3WSH_A"; break;
359case SSL3_ST_SW_SRVR_DONE_A: str="3WSD_A"; break; 547 case SSL3_ST_SW_SRVR_HELLO_B:
360case SSL3_ST_SW_SRVR_DONE_B: str="3WSD_B"; break; 548 str="3WSH_B"; break;
361case SSL3_ST_SR_CERT_A: str="3RCC_A"; break; 549 case SSL3_ST_SW_CERT_A:
362case SSL3_ST_SR_CERT_B: str="3RCC_B"; break; 550 str="3WSC_A"; break;
363case SSL3_ST_SR_KEY_EXCH_A: str="3RCKEA"; break; 551 case SSL3_ST_SW_CERT_B:
364case SSL3_ST_SR_KEY_EXCH_B: str="3RCKEB"; break; 552 str="3WSC_B"; break;
365case SSL3_ST_SR_CERT_VRFY_A: str="3RCV_A"; break; 553 case SSL3_ST_SW_KEY_EXCH_A:
366case SSL3_ST_SR_CERT_VRFY_B: str="3RCV_B"; break; 554 str="3WSKEA"; break;
555 case SSL3_ST_SW_KEY_EXCH_B:
556 str="3WSKEB"; break;
557 case SSL3_ST_SW_CERT_REQ_A:
558 str="3WCR_A"; break;
559 case SSL3_ST_SW_CERT_REQ_B:
560 str="3WCR_B"; break;
561 case SSL3_ST_SW_SRVR_DONE_A:
562 str="3WSD_A"; break;
563 case SSL3_ST_SW_SRVR_DONE_B:
564 str="3WSD_B"; break;
565 case SSL3_ST_SR_CERT_A:
566 str="3RCC_A"; break;
567 case SSL3_ST_SR_CERT_B:
568 str="3RCC_B"; break;
569 case SSL3_ST_SR_KEY_EXCH_A:
570 str="3RCKEA"; break;
571 case SSL3_ST_SR_KEY_EXCH_B:
572 str="3RCKEB"; break;
573 case SSL3_ST_SR_CERT_VRFY_A:
574 str="3RCV_A"; break;
575 case SSL3_ST_SR_CERT_VRFY_B:
576 str="3RCV_B"; break;
367#endif 577#endif
368 578
369#if !defined(OPENSSL_NO_SSL2) && !defined(OPENSSL_NO_SSL3) 579#if !defined(OPENSSL_NO_SSL2) && !defined(OPENSSL_NO_SSL3)
370/* SSLv2/v3 compatibility states */ 580/* SSLv2/v3 compatibility states */
371/* client */ 581/* client */
372case SSL23_ST_CW_CLNT_HELLO_A: str="23WCHA"; break; 582 case SSL23_ST_CW_CLNT_HELLO_A:
373case SSL23_ST_CW_CLNT_HELLO_B: str="23WCHB"; break; 583 str="23WCHA"; break;
374case SSL23_ST_CR_SRVR_HELLO_A: str="23RSHA"; break; 584 case SSL23_ST_CW_CLNT_HELLO_B:
375case SSL23_ST_CR_SRVR_HELLO_B: str="23RSHA"; break; 585 str="23WCHB"; break;
586 case SSL23_ST_CR_SRVR_HELLO_A:
587 str="23RSHA"; break;
588 case SSL23_ST_CR_SRVR_HELLO_B:
589 str="23RSHA"; break;
376/* server */ 590/* server */
377case SSL23_ST_SR_CLNT_HELLO_A: str="23RCHA"; break; 591 case SSL23_ST_SR_CLNT_HELLO_A:
378case SSL23_ST_SR_CLNT_HELLO_B: str="23RCHB"; break; 592 str="23RCHA"; break;
593 case SSL23_ST_SR_CLNT_HELLO_B:
594 str="23RCHB"; break;
379#endif 595#endif
380/* DTLS */ 596/* DTLS */
381case DTLS1_ST_CR_HELLO_VERIFY_REQUEST_A: str="DRCHVA"; break; 597 case DTLS1_ST_CR_HELLO_VERIFY_REQUEST_A:
382case DTLS1_ST_CR_HELLO_VERIFY_REQUEST_B: str="DRCHVB"; break; 598 str="DRCHVA"; break;
383case DTLS1_ST_SW_HELLO_VERIFY_REQUEST_A: str="DWCHVA"; break; 599 case DTLS1_ST_CR_HELLO_VERIFY_REQUEST_B:
384case DTLS1_ST_SW_HELLO_VERIFY_REQUEST_B: str="DWCHVB"; break; 600 str="DRCHVB"; break;
601 case DTLS1_ST_SW_HELLO_VERIFY_REQUEST_A:
602 str="DWCHVA"; break;
603 case DTLS1_ST_SW_HELLO_VERIFY_REQUEST_B:
604 str="DWCHVB"; break;
385 605
386default: str="UNKWN "; break; 606 default:
387 } 607 str="UNKWN "; break;
388 return(str);
389 } 608 }
609 return (str);
610}
390 611
391const char *SSL_alert_type_string_long(int value) 612const char
392 { 613*SSL_alert_type_string_long(int value)
614{
393 value>>=8; 615 value>>=8;
394 if (value == SSL3_AL_WARNING) 616 if (value == SSL3_AL_WARNING)
395 return("warning"); 617 return("warning");
@@ -397,10 +619,11 @@ const char *SSL_alert_type_string_long(int value)
397 return("fatal"); 619 return("fatal");
398 else 620 else
399 return("unknown"); 621 return("unknown");
400 } 622}
401 623
402const char *SSL_alert_type_string(int value) 624const char
403 { 625*SSL_alert_type_string(int value)
626{
404 value>>=8; 627 value>>=8;
405 if (value == SSL3_AL_WARNING) 628 if (value == SSL3_AL_WARNING)
406 return("W"); 629 return("W");
@@ -408,55 +631,86 @@ const char *SSL_alert_type_string(int value)
408 return("F"); 631 return("F");
409 else 632 else
410 return("U"); 633 return("U");
411 } 634}
412 635
413const char *SSL_alert_desc_string(int value) 636const char
414 { 637*SSL_alert_desc_string(int value)
638{
415 const char *str; 639 const char *str;
416 640
417 switch (value & 0xff) 641 switch (value & 0xff) {
418 { 642 case SSL3_AD_CLOSE_NOTIFY:
419 case SSL3_AD_CLOSE_NOTIFY: str="CN"; break; 643 str="CN"; break;
420 case SSL3_AD_UNEXPECTED_MESSAGE: str="UM"; break; 644 case SSL3_AD_UNEXPECTED_MESSAGE:
421 case SSL3_AD_BAD_RECORD_MAC: str="BM"; break; 645 str="UM"; break;
422 case SSL3_AD_DECOMPRESSION_FAILURE: str="DF"; break; 646 case SSL3_AD_BAD_RECORD_MAC:
423 case SSL3_AD_HANDSHAKE_FAILURE: str="HF"; break; 647 str="BM"; break;
424 case SSL3_AD_NO_CERTIFICATE: str="NC"; break; 648 case SSL3_AD_DECOMPRESSION_FAILURE:
425 case SSL3_AD_BAD_CERTIFICATE: str="BC"; break; 649 str="DF"; break;
426 case SSL3_AD_UNSUPPORTED_CERTIFICATE: str="UC"; break; 650 case SSL3_AD_HANDSHAKE_FAILURE:
427 case SSL3_AD_CERTIFICATE_REVOKED: str="CR"; break; 651 str="HF"; break;
428 case SSL3_AD_CERTIFICATE_EXPIRED: str="CE"; break; 652 case SSL3_AD_NO_CERTIFICATE:
429 case SSL3_AD_CERTIFICATE_UNKNOWN: str="CU"; break; 653 str="NC"; break;
430 case SSL3_AD_ILLEGAL_PARAMETER: str="IP"; break; 654 case SSL3_AD_BAD_CERTIFICATE:
431 case TLS1_AD_DECRYPTION_FAILED: str="DC"; break; 655 str="BC"; break;
432 case TLS1_AD_RECORD_OVERFLOW: str="RO"; break; 656 case SSL3_AD_UNSUPPORTED_CERTIFICATE:
433 case TLS1_AD_UNKNOWN_CA: str="CA"; break; 657 str="UC"; break;
434 case TLS1_AD_ACCESS_DENIED: str="AD"; break; 658 case SSL3_AD_CERTIFICATE_REVOKED:
435 case TLS1_AD_DECODE_ERROR: str="DE"; break; 659 str="CR"; break;
436 case TLS1_AD_DECRYPT_ERROR: str="CY"; break; 660 case SSL3_AD_CERTIFICATE_EXPIRED:
437 case TLS1_AD_EXPORT_RESTRICTION: str="ER"; break; 661 str="CE"; break;
438 case TLS1_AD_PROTOCOL_VERSION: str="PV"; break; 662 case SSL3_AD_CERTIFICATE_UNKNOWN:
439 case TLS1_AD_INSUFFICIENT_SECURITY: str="IS"; break; 663 str="CU"; break;
440 case TLS1_AD_INTERNAL_ERROR: str="IE"; break; 664 case SSL3_AD_ILLEGAL_PARAMETER:
441 case TLS1_AD_USER_CANCELLED: str="US"; break; 665 str="IP"; break;
442 case TLS1_AD_NO_RENEGOTIATION: str="NR"; break; 666 case TLS1_AD_DECRYPTION_FAILED:
443 case TLS1_AD_UNSUPPORTED_EXTENSION: str="UE"; break; 667 str="DC"; break;
444 case TLS1_AD_CERTIFICATE_UNOBTAINABLE: str="CO"; break; 668 case TLS1_AD_RECORD_OVERFLOW:
445 case TLS1_AD_UNRECOGNIZED_NAME: str="UN"; break; 669 str="RO"; break;
446 case TLS1_AD_BAD_CERTIFICATE_STATUS_RESPONSE: str="BR"; break; 670 case TLS1_AD_UNKNOWN_CA:
447 case TLS1_AD_BAD_CERTIFICATE_HASH_VALUE: str="BH"; break; 671 str="CA"; break;
448 case TLS1_AD_UNKNOWN_PSK_IDENTITY: str="UP"; break; 672 case TLS1_AD_ACCESS_DENIED:
449 default: str="UK"; break; 673 str="AD"; break;
450 } 674 case TLS1_AD_DECODE_ERROR:
451 return(str); 675 str="DE"; break;
676 case TLS1_AD_DECRYPT_ERROR:
677 str="CY"; break;
678 case TLS1_AD_EXPORT_RESTRICTION:
679 str="ER"; break;
680 case TLS1_AD_PROTOCOL_VERSION:
681 str="PV"; break;
682 case TLS1_AD_INSUFFICIENT_SECURITY:
683 str="IS"; break;
684 case TLS1_AD_INTERNAL_ERROR:
685 str="IE"; break;
686 case TLS1_AD_USER_CANCELLED:
687 str="US"; break;
688 case TLS1_AD_NO_RENEGOTIATION:
689 str="NR"; break;
690 case TLS1_AD_UNSUPPORTED_EXTENSION:
691 str="UE"; break;
692 case TLS1_AD_CERTIFICATE_UNOBTAINABLE:
693 str="CO"; break;
694 case TLS1_AD_UNRECOGNIZED_NAME:
695 str="UN"; break;
696 case TLS1_AD_BAD_CERTIFICATE_STATUS_RESPONSE:
697 str="BR"; break;
698 case TLS1_AD_BAD_CERTIFICATE_HASH_VALUE:
699 str="BH"; break;
700 case TLS1_AD_UNKNOWN_PSK_IDENTITY:
701 str="UP"; break;
702 default:
703 str="UK"; break;
452 } 704 }
705 return (str);
706}
453 707
454const char *SSL_alert_desc_string_long(int value) 708const char
455 { 709*SSL_alert_desc_string_long(int value)
710{
456 const char *str; 711 const char *str;
457 712
458 switch (value & 0xff) 713 switch (value & 0xff) {
459 {
460 case SSL3_AD_CLOSE_NOTIFY: 714 case SSL3_AD_CLOSE_NOTIFY:
461 str="close notify"; 715 str="close notify";
462 break; 716 break;
@@ -547,21 +801,26 @@ const char *SSL_alert_desc_string_long(int value)
547 case TLS1_AD_UNKNOWN_PSK_IDENTITY: 801 case TLS1_AD_UNKNOWN_PSK_IDENTITY:
548 str="unknown PSK identity"; 802 str="unknown PSK identity";
549 break; 803 break;
550 default: str="unknown"; break; 804 default:
551 } 805 str="unknown"; break;
552 return(str);
553 } 806 }
807 return (str);
808}
554 809
555const char *SSL_rstate_string(const SSL *s) 810const char
556 { 811*SSL_rstate_string(const SSL *s)
812{
557 const char *str; 813 const char *str;
558 814
559 switch (s->rstate) 815 switch (s->rstate) {
560 { 816 case SSL_ST_READ_HEADER:
561 case SSL_ST_READ_HEADER:str="RH"; break; 817 str="RH"; break;
562 case SSL_ST_READ_BODY: str="RB"; break; 818 case SSL_ST_READ_BODY:
563 case SSL_ST_READ_DONE: str="RD"; break; 819 str="RB"; break;
564 default: str="unknown"; break; 820 case SSL_ST_READ_DONE:
565 } 821 str="RD"; break;
566 return(str); 822 default:
823 str="unknown"; break;
567 } 824 }
825 return (str);
826}
diff --git a/src/lib/libssl/ssl_txt.c b/src/lib/libssl/ssl_txt.c
index 6479d52c0c..5186e396ec 100644
--- a/src/lib/libssl/ssl_txt.c
+++ b/src/lib/libssl/ssl_txt.c
@@ -87,30 +87,33 @@
87#include "ssl_locl.h" 87#include "ssl_locl.h"
88 88
89#ifndef OPENSSL_NO_FP_API 89#ifndef OPENSSL_NO_FP_API
90int SSL_SESSION_print_fp(FILE *fp, const SSL_SESSION *x) 90int
91 { 91SSL_SESSION_print_fp(FILE *fp, const SSL_SESSION *x)
92{
92 BIO *b; 93 BIO *b;
93 int ret; 94 int ret;
94 95
95 if ((b=BIO_new(BIO_s_file_internal())) == NULL) 96 if ((b = BIO_new(BIO_s_file_internal())) == NULL) {
96 { 97 SSLerr(SSL_F_SSL_SESSION_PRINT_FP, ERR_R_BUF_LIB);
97 SSLerr(SSL_F_SSL_SESSION_PRINT_FP,ERR_R_BUF_LIB); 98 return (0);
98 return(0);
99 }
100 BIO_set_fp(b,fp,BIO_NOCLOSE);
101 ret=SSL_SESSION_print(b,x);
102 BIO_free(b);
103 return(ret);
104 } 99 }
100 BIO_set_fp(b, fp, BIO_NOCLOSE);
101 ret = SSL_SESSION_print(b, x);
102 BIO_free(b);
103 return (ret);
104}
105#endif 105#endif
106 106
107int SSL_SESSION_print(BIO *bp, const SSL_SESSION *x) 107int
108 { 108SSL_SESSION_print(BIO *bp, const SSL_SESSION *x)
109{
109 unsigned int i; 110 unsigned int i;
110 const char *s; 111 const char *s;
111 112
112 if (x == NULL) goto err; 113 if (x == NULL)
113 if (BIO_puts(bp,"SSL-Session:\n") <= 0) goto err; 114 goto err;
115 if (BIO_puts(bp, "SSL-Session:\n")
116 <= 0) goto err;
114 if (x->ssl_version == SSL2_VERSION) 117 if (x->ssl_version == SSL2_VERSION)
115 s="SSLv2"; 118 s="SSLv2";
116 else if (x->ssl_version == SSL3_VERSION) 119 else if (x->ssl_version == SSL3_VERSION)
@@ -127,122 +130,122 @@ int SSL_SESSION_print(BIO *bp, const SSL_SESSION *x)
127 s="DTLSv1-bad"; 130 s="DTLSv1-bad";
128 else 131 else
129 s="unknown"; 132 s="unknown";
130 if (BIO_printf(bp," Protocol : %s\n",s) <= 0) goto err; 133 if (BIO_printf(bp, " Protocol : %s\n", s)
134 <= 0) goto err;
131 135
132 if (x->cipher == NULL) 136 if (x->cipher == NULL) {
133 { 137 if (((x->cipher_id) & 0xff000000) == 0x02000000) {
134 if (((x->cipher_id) & 0xff000000) == 0x02000000) 138 if (BIO_printf(bp, " Cipher : %06lX\n", x->cipher_id&0xffffff) <= 0)
135 {
136 if (BIO_printf(bp," Cipher : %06lX\n",x->cipher_id&0xffffff) <= 0)
137 goto err; 139 goto err;
138 } 140 } else {
139 else 141 if (BIO_printf(bp, " Cipher : %04lX\n", x->cipher_id&0xffff) <= 0)
140 {
141 if (BIO_printf(bp," Cipher : %04lX\n",x->cipher_id&0xffff) <= 0)
142 goto err; 142 goto err;
143 }
144 } 143 }
145 else 144 } else {
146 { 145 if (BIO_printf(bp, " Cipher : %s\n",((x->cipher == NULL)?"unknown":x->cipher->name)) <= 0)
147 if (BIO_printf(bp," Cipher : %s\n",((x->cipher == NULL)?"unknown":x->cipher->name)) <= 0)
148 goto err; 146 goto err;
149 } 147 }
150 if (BIO_puts(bp," Session-ID: ") <= 0) goto err; 148 if (BIO_puts(bp, " Session-ID: ")
151 for (i=0; i<x->session_id_length; i++) 149 <= 0) goto err;
152 { 150 for (i = 0; i < x->session_id_length; i++) {
153 if (BIO_printf(bp,"%02X",x->session_id[i]) <= 0) goto err; 151 if (BIO_printf(bp, "%02X", x->session_id[i])
154 } 152 <= 0) goto err;
155 if (BIO_puts(bp,"\n Session-ID-ctx: ") <= 0) goto err; 153 }
156 for (i=0; i<x->sid_ctx_length; i++) 154 if (BIO_puts(bp, "\n Session-ID-ctx: ")
157 { 155 <= 0) goto err;
158 if (BIO_printf(bp,"%02X",x->sid_ctx[i]) <= 0) 156 for (i = 0; i < x->sid_ctx_length; i++) {
157 if (BIO_printf(bp, "%02X", x->sid_ctx[i]) <= 0)
159 goto err; 158 goto err;
160 } 159 }
161 if (BIO_puts(bp,"\n Master-Key: ") <= 0) goto err; 160 if (BIO_puts(bp, "\n Master-Key: ")
162 for (i=0; i<(unsigned int)x->master_key_length; i++) 161 <= 0) goto err;
163 { 162 for (i = 0; i < (unsigned int)x->master_key_length; i++) {
164 if (BIO_printf(bp,"%02X",x->master_key[i]) <= 0) goto err; 163 if (BIO_printf(bp, "%02X", x->master_key[i])
165 } 164 <= 0) goto err;
166 if (BIO_puts(bp,"\n Key-Arg : ") <= 0) goto err; 165 }
167 if (x->key_arg_length == 0) 166 if (BIO_puts(bp, "\n Key-Arg : ")
168 { 167 <= 0) goto err;
169 if (BIO_puts(bp,"None") <= 0) goto err; 168 if (x->key_arg_length == 0) {
170 } 169 if (BIO_puts(bp, "None")
171 else 170 <= 0) goto err;
172 for (i=0; i<x->key_arg_length; i++) 171 } else
173 { 172 for (i = 0; i < x->key_arg_length; i++) {
174 if (BIO_printf(bp,"%02X",x->key_arg[i]) <= 0) goto err; 173 if (BIO_printf(bp, "%02X", x->key_arg[i])
175 } 174 <= 0) goto err;
175 }
176#ifndef OPENSSL_NO_KRB5 176#ifndef OPENSSL_NO_KRB5
177 if (BIO_puts(bp,"\n Krb5 Principal: ") <= 0) goto err; 177 if (BIO_puts(bp, "\n Krb5 Principal: ")
178 if (x->krb5_client_princ_len == 0) 178 <= 0) goto err;
179 { 179 if (x->krb5_client_princ_len == 0) {
180 if (BIO_puts(bp,"None") <= 0) goto err; 180 if (BIO_puts(bp, "None")
181 } 181 <= 0) goto err;
182 else 182 } else
183 for (i=0; i<x->krb5_client_princ_len; i++) 183 for (i = 0; i < x->krb5_client_princ_len; i++) {
184 { 184 if (BIO_printf(bp, "%02X", x->krb5_client_princ[i])
185 if (BIO_printf(bp,"%02X",x->krb5_client_princ[i]) <= 0) goto err; 185 <= 0) goto err;
186 } 186 }
187#endif /* OPENSSL_NO_KRB5 */ 187#endif /* OPENSSL_NO_KRB5 */
188#ifndef OPENSSL_NO_PSK 188#ifndef OPENSSL_NO_PSK
189 if (BIO_puts(bp,"\n PSK identity: ") <= 0) goto err; 189 if (BIO_puts(bp, "\n PSK identity: ")
190 if (BIO_printf(bp, "%s", x->psk_identity ? x->psk_identity : "None") <= 0) goto err; 190 <= 0) goto err;
191 if (BIO_puts(bp,"\n PSK identity hint: ") <= 0) goto err; 191 if (BIO_printf(bp, "%s", x->psk_identity ? x->psk_identity : "None")
192 if (BIO_printf(bp, "%s", x->psk_identity_hint ? x->psk_identity_hint : "None") <= 0) goto err; 192 <= 0) goto err;
193 if (BIO_puts(bp, "\n PSK identity hint: ")
194 <= 0) goto err;
195 if (BIO_printf(bp, "%s", x->psk_identity_hint ? x->psk_identity_hint : "None")
196 <= 0) goto err;
193#endif 197#endif
194#ifndef OPENSSL_NO_SRP 198#ifndef OPENSSL_NO_SRP
195 if (BIO_puts(bp,"\n SRP username: ") <= 0) goto err; 199 if (BIO_puts(bp, "\n SRP username: ")
196 if (BIO_printf(bp, "%s", x->srp_username ? x->srp_username : "None") <= 0) goto err; 200 <= 0) goto err;
201 if (BIO_printf(bp, "%s", x->srp_username ? x->srp_username : "None")
202 <= 0) goto err;
197#endif 203#endif
198#ifndef OPENSSL_NO_TLSEXT 204#ifndef OPENSSL_NO_TLSEXT
199 if (x->tlsext_tick_lifetime_hint) 205 if (x->tlsext_tick_lifetime_hint) {
200 {
201 if (BIO_printf(bp, 206 if (BIO_printf(bp,
202 "\n TLS session ticket lifetime hint: %ld (seconds)", 207 "\n TLS session ticket lifetime hint: %ld (seconds)",
203 x->tlsext_tick_lifetime_hint) <=0) 208 x->tlsext_tick_lifetime_hint) <=0)
204 goto err; 209 goto err;
205 } 210 }
206 if (x->tlsext_tick) 211 if (x->tlsext_tick) {
207 { 212 if (BIO_puts(bp, "\n TLS session ticket:\n")
208 if (BIO_puts(bp, "\n TLS session ticket:\n") <= 0) goto err; 213 <= 0) goto err;
209 if (BIO_dump_indent(bp, (char *)x->tlsext_tick, x->tlsext_ticklen, 4) <= 0) 214 if (BIO_dump_indent(bp, (char *)x->tlsext_tick, x->tlsext_ticklen, 4) <= 0)
210 goto err; 215 goto err;
211 } 216 }
212#endif 217#endif
213 218
214#ifndef OPENSSL_NO_COMP 219#ifndef OPENSSL_NO_COMP
215 if (x->compress_meth != 0) 220 if (x->compress_meth != 0) {
216 {
217 SSL_COMP *comp = NULL; 221 SSL_COMP *comp = NULL;
218 222
219 ssl_cipher_get_evp(x,NULL,NULL,NULL,NULL,&comp); 223 ssl_cipher_get_evp(x, NULL, NULL, NULL, NULL, &comp);
220 if (comp == NULL) 224 if (comp == NULL) {
221 { 225 if (BIO_printf(bp, "\n Compression: %d", x->compress_meth)
222 if (BIO_printf(bp,"\n Compression: %d",x->compress_meth) <= 0) goto err; 226 <= 0) goto err;
227 } else {
228 if (BIO_printf(bp, "\n Compression: %d (%s)", comp->id, comp->method->name) <= 0) goto err;
223 } 229 }
224 else 230 }
225 {
226 if (BIO_printf(bp,"\n Compression: %d (%s)", comp->id,comp->method->name) <= 0) goto err;
227 }
228 }
229#endif 231#endif
230 if (x->time != 0L) 232 if (x->time != 0L) {
231 { 233 if (BIO_printf(bp, "\n Start Time: %ld", x->time)
232 if (BIO_printf(bp, "\n Start Time: %ld",x->time) <= 0) goto err; 234 <= 0) goto err;
233 } 235 }
234 if (x->timeout != 0L) 236 if (x->timeout != 0L) {
235 { 237 if (BIO_printf(bp, "\n Timeout : %ld (sec)", x->timeout) <= 0) goto err;
236 if (BIO_printf(bp, "\n Timeout : %ld (sec)",x->timeout) <= 0) goto err;
237 } 238 }
238 if (BIO_puts(bp,"\n") <= 0) goto err; 239 if (BIO_puts(bp, "\n")
240 <= 0) goto err;
239 241
240 if (BIO_puts(bp, " Verify return code: ") <= 0) goto err; 242 if (BIO_puts(bp, " Verify return code: ")
243 <= 0) goto err;
241 if (BIO_printf(bp, "%ld (%s)\n", x->verify_result, 244 if (BIO_printf(bp, "%ld (%s)\n", x->verify_result,
242 X509_verify_cert_error_string(x->verify_result)) <= 0) goto err; 245 X509_verify_cert_error_string(x->verify_result)) <= 0) goto err;
243 246
244 return(1); 247 return (1);
245err: 248err:
246 return(0); 249 return (0);
247 } 250}
248 251
generated by cgit v1.2.3-55-g6feb (git 2.39.1) at 2025-03-28 15:39:34 +0000