summaryrefslogtreecommitdiff
path: root/src/lib/libssl/t1_enc.c
diff options
context:
space:
mode:
Diffstat (limited to '')
-rw-r--r--src/lib/libssl/t1_enc.c1186
1 files changed, 582 insertions, 604 deletions
diff --git a/src/lib/libssl/t1_enc.c b/src/lib/libssl/t1_enc.c
index 0c4cddedf8..e59e883424 100644
--- a/src/lib/libssl/t1_enc.c
+++ b/src/lib/libssl/t1_enc.c
@@ -149,15 +149,12 @@
149#endif 149#endif
150 150
151/* seed1 through seed5 are virtually concatenated */ 151/* seed1 through seed5 are virtually concatenated */
152static int tls1_P_hash(const EVP_MD *md, const unsigned char *sec, 152static int
153 int sec_len, 153tls1_P_hash(const EVP_MD *md, const unsigned char *sec, int sec_len,
154 const void *seed1, int seed1_len, 154 const void *seed1, int seed1_len, const void *seed2, int seed2_len,
155 const void *seed2, int seed2_len, 155 const void *seed3, int seed3_len, const void *seed4, int seed4_len,
156 const void *seed3, int seed3_len, 156 const void *seed5, int seed5_len, unsigned char *out, int olen)
157 const void *seed4, int seed4_len, 157{
158 const void *seed5, int seed5_len,
159 unsigned char *out, int olen)
160 {
161 int chunk; 158 int chunk;
162 size_t j; 159 size_t j;
163 EVP_MD_CTX ctx, ctx_tmp; 160 EVP_MD_CTX ctx, ctx_tmp;
@@ -165,8 +162,8 @@ static int tls1_P_hash(const EVP_MD *md, const unsigned char *sec,
165 unsigned char A1[EVP_MAX_MD_SIZE]; 162 unsigned char A1[EVP_MAX_MD_SIZE];
166 size_t A1_len; 163 size_t A1_len;
167 int ret = 0; 164 int ret = 0;
168 165
169 chunk=EVP_MD_size(md); 166 chunk = EVP_MD_size(md);
170 OPENSSL_assert(chunk >= 0); 167 OPENSSL_assert(chunk >= 0);
171 168
172 EVP_MD_CTX_init(&ctx); 169 EVP_MD_CTX_init(&ctx);
@@ -176,114 +173,109 @@ static int tls1_P_hash(const EVP_MD *md, const unsigned char *sec,
176 mac_key = EVP_PKEY_new_mac_key(EVP_PKEY_HMAC, NULL, sec, sec_len); 173 mac_key = EVP_PKEY_new_mac_key(EVP_PKEY_HMAC, NULL, sec, sec_len);
177 if (!mac_key) 174 if (!mac_key)
178 goto err; 175 goto err;
179 if (!EVP_DigestSignInit(&ctx,NULL,md, NULL, mac_key)) 176 if (!EVP_DigestSignInit(&ctx, NULL, md, NULL, mac_key))
180 goto err; 177 goto err;
181 if (!EVP_DigestSignInit(&ctx_tmp,NULL,md, NULL, mac_key)) 178 if (!EVP_DigestSignInit(&ctx_tmp, NULL, md, NULL, mac_key))
182 goto err; 179 goto err;
183 if (seed1 && !EVP_DigestSignUpdate(&ctx,seed1,seed1_len)) 180 if (seed1 && !EVP_DigestSignUpdate(&ctx, seed1, seed1_len))
184 goto err; 181 goto err;
185 if (seed2 && !EVP_DigestSignUpdate(&ctx,seed2,seed2_len)) 182 if (seed2 && !EVP_DigestSignUpdate(&ctx, seed2, seed2_len))
186 goto err; 183 goto err;
187 if (seed3 && !EVP_DigestSignUpdate(&ctx,seed3,seed3_len)) 184 if (seed3 && !EVP_DigestSignUpdate(&ctx, seed3, seed3_len))
188 goto err; 185 goto err;
189 if (seed4 && !EVP_DigestSignUpdate(&ctx,seed4,seed4_len)) 186 if (seed4 && !EVP_DigestSignUpdate(&ctx, seed4, seed4_len))
190 goto err; 187 goto err;
191 if (seed5 && !EVP_DigestSignUpdate(&ctx,seed5,seed5_len)) 188 if (seed5 && !EVP_DigestSignUpdate(&ctx, seed5, seed5_len))
192 goto err; 189 goto err;
193 if (!EVP_DigestSignFinal(&ctx,A1,&A1_len)) 190 if (!EVP_DigestSignFinal(&ctx, A1, &A1_len))
194 goto err; 191 goto err;
195 192
196 for (;;) 193 for (;;) {
197 {
198 /* Reinit mac contexts */ 194 /* Reinit mac contexts */
199 if (!EVP_DigestSignInit(&ctx,NULL,md, NULL, mac_key)) 195 if (!EVP_DigestSignInit(&ctx, NULL, md, NULL, mac_key))
200 goto err; 196 goto err;
201 if (!EVP_DigestSignInit(&ctx_tmp,NULL,md, NULL, mac_key)) 197 if (!EVP_DigestSignInit(&ctx_tmp, NULL, md, NULL, mac_key))
202 goto err; 198 goto err;
203 if (!EVP_DigestSignUpdate(&ctx,A1,A1_len)) 199 if (!EVP_DigestSignUpdate(&ctx, A1, A1_len))
204 goto err; 200 goto err;
205 if (!EVP_DigestSignUpdate(&ctx_tmp,A1,A1_len)) 201 if (!EVP_DigestSignUpdate(&ctx_tmp, A1, A1_len))
206 goto err; 202 goto err;
207 if (seed1 && !EVP_DigestSignUpdate(&ctx,seed1,seed1_len)) 203 if (seed1 && !EVP_DigestSignUpdate(&ctx, seed1, seed1_len))
208 goto err; 204 goto err;
209 if (seed2 && !EVP_DigestSignUpdate(&ctx,seed2,seed2_len)) 205 if (seed2 && !EVP_DigestSignUpdate(&ctx, seed2, seed2_len))
210 goto err; 206 goto err;
211 if (seed3 && !EVP_DigestSignUpdate(&ctx,seed3,seed3_len)) 207 if (seed3 && !EVP_DigestSignUpdate(&ctx, seed3, seed3_len))
212 goto err; 208 goto err;
213 if (seed4 && !EVP_DigestSignUpdate(&ctx,seed4,seed4_len)) 209 if (seed4 && !EVP_DigestSignUpdate(&ctx, seed4, seed4_len))
214 goto err; 210 goto err;
215 if (seed5 && !EVP_DigestSignUpdate(&ctx,seed5,seed5_len)) 211 if (seed5 && !EVP_DigestSignUpdate(&ctx, seed5, seed5_len))
216 goto err; 212 goto err;
217 213
218 if (olen > chunk) 214 if (olen > chunk) {
219 { 215 if (!EVP_DigestSignFinal(&ctx, out, &j))
220 if (!EVP_DigestSignFinal(&ctx,out,&j))
221 goto err; 216 goto err;
222 out+=j; 217 out += j;
223 olen-=j; 218 olen -= j;
224 /* calc the next A1 value */ 219 /* calc the next A1 value */
225 if (!EVP_DigestSignFinal(&ctx_tmp,A1,&A1_len)) 220 if (!EVP_DigestSignFinal(&ctx_tmp, A1, &A1_len))
226 goto err; 221 goto err;
227 } 222 }
228 else /* last one */ 223 else /* last one */
229 { 224 {
230 if (!EVP_DigestSignFinal(&ctx,A1,&A1_len)) 225 if (!EVP_DigestSignFinal(&ctx, A1, &A1_len))
231 goto err; 226 goto err;
232 memcpy(out,A1,olen); 227 memcpy(out, A1, olen);
233 break; 228 break;
234 }
235 } 229 }
230 }
236 ret = 1; 231 ret = 1;
237err: 232err:
238 EVP_PKEY_free(mac_key); 233 EVP_PKEY_free(mac_key);
239 EVP_MD_CTX_cleanup(&ctx); 234 EVP_MD_CTX_cleanup(&ctx);
240 EVP_MD_CTX_cleanup(&ctx_tmp); 235 EVP_MD_CTX_cleanup(&ctx_tmp);
241 OPENSSL_cleanse(A1,sizeof(A1)); 236 OPENSSL_cleanse(A1, sizeof(A1));
242 return ret; 237 return ret;
243 } 238}
244 239
245/* seed1 through seed5 are virtually concatenated */ 240/* seed1 through seed5 are virtually concatenated */
246static int tls1_PRF(long digest_mask, 241static int
247 const void *seed1, int seed1_len, 242tls1_PRF(long digest_mask, const void *seed1, int seed1_len, const void *seed2,
248 const void *seed2, int seed2_len, 243 int seed2_len, const void *seed3, int seed3_len, const void *seed4,
249 const void *seed3, int seed3_len, 244 int seed4_len, const void *seed5, int seed5_len, const unsigned char *sec,
250 const void *seed4, int seed4_len, 245 int slen, unsigned char *out1, unsigned char *out2, int olen)
251 const void *seed5, int seed5_len, 246{
252 const unsigned char *sec, int slen, 247 int len, i, idx, count;
253 unsigned char *out1,
254 unsigned char *out2, int olen)
255 {
256 int len,i,idx,count;
257 const unsigned char *S1; 248 const unsigned char *S1;
258 long m; 249 long m;
259 const EVP_MD *md; 250 const EVP_MD *md;
260 int ret = 0; 251 int ret = 0;
261 252
262 /* Count number of digests and partition sec evenly */ 253 /* Count number of digests and partition sec evenly */
263 count=0; 254 count = 0;
264 for (idx=0;ssl_get_handshake_digest(idx,&m,&md);idx++) { 255 for (idx = 0; ssl_get_handshake_digest(idx, &m, &md); idx++) {
265 if ((m<<TLS1_PRF_DGST_SHIFT) & digest_mask) count++; 256 if ((m << TLS1_PRF_DGST_SHIFT)
266 } 257 & digest_mask) count++;
267 len=slen/count; 258 }
259 len = slen/count;
268 if (count == 1) 260 if (count == 1)
269 slen = 0; 261 slen = 0;
270 S1=sec; 262 S1 = sec;
271 memset(out1,0,olen); 263 memset(out1, 0, olen);
272 for (idx=0;ssl_get_handshake_digest(idx,&m,&md);idx++) { 264 for (idx = 0; ssl_get_handshake_digest(idx, &m, &md); idx++) {
273 if ((m<<TLS1_PRF_DGST_SHIFT) & digest_mask) { 265 if ((m << TLS1_PRF_DGST_SHIFT) & digest_mask) {
274 if (!md) { 266 if (!md) {
275 SSLerr(SSL_F_TLS1_PRF, 267 SSLerr(SSL_F_TLS1_PRF,
276 SSL_R_UNSUPPORTED_DIGEST_TYPE); 268 SSL_R_UNSUPPORTED_DIGEST_TYPE);
277 goto err;
278 }
279 if (!tls1_P_hash(md ,S1,len+(slen&1),
280 seed1,seed1_len,seed2,seed2_len,seed3,seed3_len,seed4,seed4_len,seed5,seed5_len,
281 out2,olen))
282 goto err; 269 goto err;
283 S1+=len; 270
284 for (i=0; i<olen; i++) 271 }
285 { 272 if (!tls1_P_hash(md , S1, len + (slen&1),
286 out1[i]^=out2[i]; 273 seed1, seed1_len, seed2, seed2_len, seed3, seed3_len, seed4, seed4_len, seed5, seed5_len,
274 out2, olen))
275 goto err;
276 S1 += len;
277 for (i = 0; i < olen; i++) {
278 out1[i] ^= out2[i];
287 } 279 }
288 } 280 }
289 } 281 }
@@ -291,41 +283,43 @@ static int tls1_PRF(long digest_mask,
291err: 283err:
292 return ret; 284 return ret;
293} 285}
294static int tls1_generate_key_block(SSL *s, unsigned char *km, 286
295 unsigned char *tmp, int num) 287static int
296 { 288tls1_generate_key_block(SSL *s, unsigned char *km, unsigned char *tmp, int num)
289{
297 int ret; 290 int ret;
298 ret = tls1_PRF(ssl_get_algorithm2(s), 291 ret = tls1_PRF(ssl_get_algorithm2(s),
299 TLS_MD_KEY_EXPANSION_CONST,TLS_MD_KEY_EXPANSION_CONST_SIZE, 292 TLS_MD_KEY_EXPANSION_CONST, TLS_MD_KEY_EXPANSION_CONST_SIZE,
300 s->s3->server_random,SSL3_RANDOM_SIZE, 293 s->s3->server_random, SSL3_RANDOM_SIZE,
301 s->s3->client_random,SSL3_RANDOM_SIZE, 294 s->s3->client_random, SSL3_RANDOM_SIZE,
302 NULL,0,NULL,0, 295 NULL, 0, NULL, 0,
303 s->session->master_key,s->session->master_key_length, 296 s->session->master_key, s->session->master_key_length,
304 km,tmp,num); 297 km, tmp, num);
305#ifdef KSSL_DEBUG 298#ifdef KSSL_DEBUG
306 printf("tls1_generate_key_block() ==> %d byte master_key =\n\t", 299 printf("tls1_generate_key_block() ==> %d byte master_key =\n\t",
307 s->session->master_key_length); 300 s->session->master_key_length);
308 { 301 {
309 int i; 302 int i;
310 for (i=0; i < s->session->master_key_length; i++) 303 for (i = 0; i < s->session->master_key_length; i++) {
311 { 304 printf("%02X", s->session->master_key[i]);
312 printf("%02X", s->session->master_key[i]); 305 }
313 } 306 printf("\n");
314 printf("\n"); } 307 }
315#endif /* KSSL_DEBUG */ 308#endif /* KSSL_DEBUG */
316 return ret; 309 return ret;
317 } 310}
318 311
319int tls1_change_cipher_state(SSL *s, int which) 312int
320 { 313tls1_change_cipher_state(SSL *s, int which)
314{
321 static const unsigned char empty[]=""; 315 static const unsigned char empty[]="";
322 unsigned char *p,*mac_secret; 316 unsigned char *p, *mac_secret;
323 unsigned char *exp_label; 317 unsigned char *exp_label;
324 unsigned char tmp1[EVP_MAX_KEY_LENGTH]; 318 unsigned char tmp1[EVP_MAX_KEY_LENGTH];
325 unsigned char tmp2[EVP_MAX_KEY_LENGTH]; 319 unsigned char tmp2[EVP_MAX_KEY_LENGTH];
326 unsigned char iv1[EVP_MAX_IV_LENGTH*2]; 320 unsigned char iv1[EVP_MAX_IV_LENGTH*2];
327 unsigned char iv2[EVP_MAX_IV_LENGTH*2]; 321 unsigned char iv2[EVP_MAX_IV_LENGTH*2];
328 unsigned char *ms,*key,*iv; 322 unsigned char *ms, *key, *iv;
329 int client_write; 323 int client_write;
330 EVP_CIPHER_CTX *dd; 324 EVP_CIPHER_CTX *dd;
331 const EVP_CIPHER *c; 325 const EVP_CIPHER *c;
@@ -337,36 +331,35 @@ int tls1_change_cipher_state(SSL *s, int which)
337 int *mac_secret_size; 331 int *mac_secret_size;
338 EVP_MD_CTX *mac_ctx; 332 EVP_MD_CTX *mac_ctx;
339 EVP_PKEY *mac_key; 333 EVP_PKEY *mac_key;
340 int is_export,n,i,j,k,exp_label_len,cl; 334 int is_export, n, i, j, k, exp_label_len, cl;
341 int reuse_dd = 0; 335 int reuse_dd = 0;
342 336
343 is_export=SSL_C_IS_EXPORT(s->s3->tmp.new_cipher); 337 is_export = SSL_C_IS_EXPORT(s->s3->tmp.new_cipher);
344 c=s->s3->tmp.new_sym_enc; 338 c = s->s3->tmp.new_sym_enc;
345 m=s->s3->tmp.new_hash; 339 m = s->s3->tmp.new_hash;
346 mac_type = s->s3->tmp.new_mac_pkey_type; 340 mac_type = s->s3->tmp.new_mac_pkey_type;
347#ifndef OPENSSL_NO_COMP 341#ifndef OPENSSL_NO_COMP
348 comp=s->s3->tmp.new_compression; 342 comp = s->s3->tmp.new_compression;
349#endif 343#endif
350 344
351#ifdef KSSL_DEBUG 345#ifdef KSSL_DEBUG
352 printf("tls1_change_cipher_state(which= %d) w/\n", which); 346 printf("tls1_change_cipher_state(which= %d) w/\n", which);
353 printf("\talg= %ld/%ld, comp= %p\n", 347 printf("\talg= %ld/%ld, comp= %p\n",
354 s->s3->tmp.new_cipher->algorithm_mkey, 348 s->s3->tmp.new_cipher->algorithm_mkey,
355 s->s3->tmp.new_cipher->algorithm_auth, 349 s->s3->tmp.new_cipher->algorithm_auth,
356 comp); 350 comp);
357 printf("\tevp_cipher == %p ==? &d_cbc_ede_cipher3\n", c); 351 printf("\tevp_cipher == %p ==? &d_cbc_ede_cipher3\n", c);
358 printf("\tevp_cipher: nid, blksz= %d, %d, keylen=%d, ivlen=%d\n", 352 printf("\tevp_cipher: nid, blksz= %d, %d, keylen=%d, ivlen=%d\n",
359 c->nid,c->block_size,c->key_len,c->iv_len); 353 c->nid, c->block_size, c->key_len, c->iv_len);
360 printf("\tkey_block: len= %d, data= ", s->s3->tmp.key_block_length); 354 printf("\tkey_block: len= %d, data= ", s->s3->tmp.key_block_length);
361 { 355 {
362 int i; 356 int i;
363 for (i=0; i<s->s3->tmp.key_block_length; i++) 357 for (i = 0; i < s->s3->tmp.key_block_length; i++)
364 printf("%02x", s->s3->tmp.key_block[i]); printf("\n"); 358 printf("%02x", s->s3->tmp.key_block[i]); printf("\n");
365 } 359 }
366#endif /* KSSL_DEBUG */ 360#endif /* KSSL_DEBUG */
367 361
368 if (which & SSL3_CC_READ) 362 if (which & SSL3_CC_READ) {
369 {
370 if (s->s3->tmp.new_cipher->algorithm2 & TLS1_STREAM_MAC) 363 if (s->s3->tmp.new_cipher->algorithm2 & TLS1_STREAM_MAC)
371 s->mac_flags |= SSL_MAC_FLAG_READ_MAC_STREAM; 364 s->mac_flags |= SSL_MAC_FLAG_READ_MAC_STREAM;
372 else 365 else
@@ -374,303 +367,285 @@ int tls1_change_cipher_state(SSL *s, int which)
374 367
375 if (s->enc_read_ctx != NULL) 368 if (s->enc_read_ctx != NULL)
376 reuse_dd = 1; 369 reuse_dd = 1;
377 else if ((s->enc_read_ctx=OPENSSL_malloc(sizeof(EVP_CIPHER_CTX))) == NULL) 370 else if ((s->enc_read_ctx = OPENSSL_malloc(sizeof(EVP_CIPHER_CTX))) == NULL)
378 goto err; 371 goto err;
379 else 372 else
380 /* make sure it's intialized in case we exit later with an error */ 373 /* make sure it's intialized in case we exit later with an error */
381 EVP_CIPHER_CTX_init(s->enc_read_ctx); 374 EVP_CIPHER_CTX_init(s->enc_read_ctx);
382 dd= s->enc_read_ctx; 375 dd = s->enc_read_ctx;
383 mac_ctx=ssl_replace_hash(&s->read_hash,NULL); 376 mac_ctx = ssl_replace_hash(&s->read_hash, NULL);
384#ifndef OPENSSL_NO_COMP 377#ifndef OPENSSL_NO_COMP
385 if (s->expand != NULL) 378 if (s->expand != NULL) {
386 {
387 COMP_CTX_free(s->expand); 379 COMP_CTX_free(s->expand);
388 s->expand=NULL; 380 s->expand = NULL;
389 } 381 }
390 if (comp != NULL) 382 if (comp != NULL) {
391 { 383 s->expand = COMP_CTX_new(comp->method);
392 s->expand=COMP_CTX_new(comp->method); 384 if (s->expand == NULL) {
393 if (s->expand == NULL) 385 SSLerr(SSL_F_TLS1_CHANGE_CIPHER_STATE, SSL_R_COMPRESSION_LIBRARY_ERROR);
394 {
395 SSLerr(SSL_F_TLS1_CHANGE_CIPHER_STATE,SSL_R_COMPRESSION_LIBRARY_ERROR);
396 goto err2; 386 goto err2;
397 } 387 }
398 if (s->s3->rrec.comp == NULL) 388 if (s->s3->rrec.comp == NULL)
399 s->s3->rrec.comp=(unsigned char *) 389 s->s3->rrec.comp = (unsigned char *)
400 OPENSSL_malloc(SSL3_RT_MAX_ENCRYPTED_LENGTH); 390 OPENSSL_malloc(SSL3_RT_MAX_ENCRYPTED_LENGTH);
401 if (s->s3->rrec.comp == NULL) 391 if (s->s3->rrec.comp == NULL)
402 goto err; 392 goto err;
403 } 393 }
404#endif 394#endif
405 /* this is done by dtls1_reset_seq_numbers for DTLS1_VERSION */ 395 /* this is done by dtls1_reset_seq_numbers for DTLS1_VERSION */
406 if (s->version != DTLS1_VERSION) 396 if (s->version != DTLS1_VERSION)
407 memset(&(s->s3->read_sequence[0]),0,8); 397 memset(&(s->s3->read_sequence[0]), 0, 8);
408 mac_secret= &(s->s3->read_mac_secret[0]); 398 mac_secret = &(s->s3->read_mac_secret[0]);
409 mac_secret_size=&(s->s3->read_mac_secret_size); 399 mac_secret_size = &(s->s3->read_mac_secret_size);
410 } 400 } else {
411 else
412 {
413 if (s->s3->tmp.new_cipher->algorithm2 & TLS1_STREAM_MAC) 401 if (s->s3->tmp.new_cipher->algorithm2 & TLS1_STREAM_MAC)
414 s->mac_flags |= SSL_MAC_FLAG_WRITE_MAC_STREAM; 402 s->mac_flags |= SSL_MAC_FLAG_WRITE_MAC_STREAM;
415 else 403 else
416 s->mac_flags &= ~SSL_MAC_FLAG_WRITE_MAC_STREAM; 404 s->mac_flags &= ~SSL_MAC_FLAG_WRITE_MAC_STREAM;
417 if (s->enc_write_ctx != NULL && !SSL_IS_DTLS(s)) 405 if (s->enc_write_ctx != NULL && !SSL_IS_DTLS(s))
418 reuse_dd = 1; 406 reuse_dd = 1;
419 else if ((s->enc_write_ctx=EVP_CIPHER_CTX_new()) == NULL) 407 else if ((s->enc_write_ctx = EVP_CIPHER_CTX_new()) == NULL)
420 goto err; 408 goto err;
421 dd= s->enc_write_ctx; 409 dd = s->enc_write_ctx;
422 if (SSL_IS_DTLS(s)) 410 if (SSL_IS_DTLS(s)) {
423 {
424 mac_ctx = EVP_MD_CTX_create(); 411 mac_ctx = EVP_MD_CTX_create();
425 if (!mac_ctx) 412 if (!mac_ctx)
426 goto err; 413 goto err;
427 s->write_hash = mac_ctx; 414 s->write_hash = mac_ctx;
428 } 415 } else
429 else 416 mac_ctx = ssl_replace_hash(&s->write_hash, NULL);
430 mac_ctx = ssl_replace_hash(&s->write_hash,NULL);
431#ifndef OPENSSL_NO_COMP 417#ifndef OPENSSL_NO_COMP
432 if (s->compress != NULL) 418 if (s->compress != NULL) {
433 {
434 COMP_CTX_free(s->compress); 419 COMP_CTX_free(s->compress);
435 s->compress=NULL; 420 s->compress = NULL;
436 } 421 }
437 if (comp != NULL) 422 if (comp != NULL) {
438 { 423 s->compress = COMP_CTX_new(comp->method);
439 s->compress=COMP_CTX_new(comp->method); 424 if (s->compress == NULL) {
440 if (s->compress == NULL) 425 SSLerr(SSL_F_TLS1_CHANGE_CIPHER_STATE, SSL_R_COMPRESSION_LIBRARY_ERROR);
441 {
442 SSLerr(SSL_F_TLS1_CHANGE_CIPHER_STATE,SSL_R_COMPRESSION_LIBRARY_ERROR);
443 goto err2; 426 goto err2;
444 }
445 } 427 }
428 }
446#endif 429#endif
447 /* this is done by dtls1_reset_seq_numbers for DTLS1_VERSION */ 430 /* this is done by dtls1_reset_seq_numbers for DTLS1_VERSION */
448 if (s->version != DTLS1_VERSION) 431 if (s->version != DTLS1_VERSION)
449 memset(&(s->s3->write_sequence[0]),0,8); 432 memset(&(s->s3->write_sequence[0]), 0, 8);
450 mac_secret= &(s->s3->write_mac_secret[0]); 433 mac_secret = &(s->s3->write_mac_secret[0]);
451 mac_secret_size = &(s->s3->write_mac_secret_size); 434 mac_secret_size = &(s->s3->write_mac_secret_size);
452 } 435 }
453 436
454 if (reuse_dd) 437 if (reuse_dd)
455 EVP_CIPHER_CTX_cleanup(dd); 438 EVP_CIPHER_CTX_cleanup(dd);
456 439
457 p=s->s3->tmp.key_block; 440 p = s->s3->tmp.key_block;
458 i=*mac_secret_size=s->s3->tmp.new_mac_secret_size; 441 i=*mac_secret_size = s->s3->tmp.new_mac_secret_size;
459 442
460 cl=EVP_CIPHER_key_length(c); 443 cl = EVP_CIPHER_key_length(c);
461 j=is_export ? (cl < SSL_C_EXPORT_KEYLENGTH(s->s3->tmp.new_cipher) ? 444 j = is_export ? (cl < SSL_C_EXPORT_KEYLENGTH(s->s3->tmp.new_cipher) ?
462 cl : SSL_C_EXPORT_KEYLENGTH(s->s3->tmp.new_cipher)) : cl; 445 cl : SSL_C_EXPORT_KEYLENGTH(s->s3->tmp.new_cipher)) : cl;
463 /* Was j=(exp)?5:EVP_CIPHER_key_length(c); */ 446 /* Was j=(exp)?5:EVP_CIPHER_key_length(c); */
464 /* If GCM mode only part of IV comes from PRF */ 447 /* If GCM mode only part of IV comes from PRF */
465 if (EVP_CIPHER_mode(c) == EVP_CIPH_GCM_MODE) 448 if (EVP_CIPHER_mode(c) == EVP_CIPH_GCM_MODE)
466 k = EVP_GCM_TLS_FIXED_IV_LEN; 449 k = EVP_GCM_TLS_FIXED_IV_LEN;
467 else 450 else
468 k=EVP_CIPHER_iv_length(c); 451 k = EVP_CIPHER_iv_length(c);
469 if ( (which == SSL3_CHANGE_CIPHER_CLIENT_WRITE) || 452 if ((which == SSL3_CHANGE_CIPHER_CLIENT_WRITE) ||
470 (which == SSL3_CHANGE_CIPHER_SERVER_READ)) 453 (which == SSL3_CHANGE_CIPHER_SERVER_READ)) {
471 { 454 ms = &(p[0]);
472 ms= &(p[ 0]); n=i+i; 455 n = i + i;
473 key= &(p[ n]); n+=j+j; 456 key = &(p[n]);
474 iv= &(p[ n]); n+=k+k; 457 n += j + j;
475 exp_label=(unsigned char *)TLS_MD_CLIENT_WRITE_KEY_CONST; 458 iv = &(p[n]);
476 exp_label_len=TLS_MD_CLIENT_WRITE_KEY_CONST_SIZE; 459 n += k + k;
477 client_write=1; 460 exp_label = (unsigned char *)TLS_MD_CLIENT_WRITE_KEY_CONST;
478 } 461 exp_label_len = TLS_MD_CLIENT_WRITE_KEY_CONST_SIZE;
479 else 462 client_write = 1;
480 { 463 } else {
481 n=i; 464 n = i;
482 ms= &(p[ n]); n+=i+j; 465 ms = &(p[n]);
483 key= &(p[ n]); n+=j+k; 466 n += i + j;
484 iv= &(p[ n]); n+=k; 467 key = &(p[n]);
485 exp_label=(unsigned char *)TLS_MD_SERVER_WRITE_KEY_CONST; 468 n += j + k;
486 exp_label_len=TLS_MD_SERVER_WRITE_KEY_CONST_SIZE; 469 iv = &(p[n]);
487 client_write=0; 470 n += k;
488 } 471 exp_label = (unsigned char *)TLS_MD_SERVER_WRITE_KEY_CONST;
472 exp_label_len = TLS_MD_SERVER_WRITE_KEY_CONST_SIZE;
473 client_write = 0;
474 }
489 475
490 if (n > s->s3->tmp.key_block_length) 476 if (n > s->s3->tmp.key_block_length) {
491 { 477 SSLerr(SSL_F_TLS1_CHANGE_CIPHER_STATE, ERR_R_INTERNAL_ERROR);
492 SSLerr(SSL_F_TLS1_CHANGE_CIPHER_STATE,ERR_R_INTERNAL_ERROR);
493 goto err2; 478 goto err2;
494 } 479 }
495 480
496 memcpy(mac_secret,ms,i); 481 memcpy(mac_secret, ms, i);
497 482
498 if (!(EVP_CIPHER_flags(c)&EVP_CIPH_FLAG_AEAD_CIPHER)) 483 if (!(EVP_CIPHER_flags(c)&EVP_CIPH_FLAG_AEAD_CIPHER)) {
499 {
500 mac_key = EVP_PKEY_new_mac_key(mac_type, NULL, 484 mac_key = EVP_PKEY_new_mac_key(mac_type, NULL,
501 mac_secret,*mac_secret_size); 485 mac_secret, *mac_secret_size);
502 EVP_DigestSignInit(mac_ctx,NULL,m,NULL,mac_key); 486 EVP_DigestSignInit(mac_ctx, NULL, m, NULL, mac_key);
503 EVP_PKEY_free(mac_key); 487 EVP_PKEY_free(mac_key);
504 } 488 }
505#ifdef TLS_DEBUG 489#ifdef TLS_DEBUG
506printf("which = %04X\nmac key=",which); 490 printf("which = %04X\nmac key=", which);
507{ int z; for (z=0; z<i; z++) printf("%02X%c",ms[z],((z+1)%16)?' ':'\n'); } 491 { int z; for (z = 0; z<i; z++) printf("%02X%c", ms[z],((z+1)%16)?' ':'\n'); }
508#endif 492#endif
509 if (is_export) 493 if (is_export) {
510 {
511 /* In here I set both the read and write key/iv to the 494 /* In here I set both the read and write key/iv to the
512 * same value since only the correct one will be used :-). 495 * same value since only the correct one will be used :-).
513 */ 496 */
514 if (!tls1_PRF(ssl_get_algorithm2(s), 497 if (!tls1_PRF(ssl_get_algorithm2(s),
515 exp_label,exp_label_len, 498 exp_label, exp_label_len,
516 s->s3->client_random,SSL3_RANDOM_SIZE, 499 s->s3->client_random, SSL3_RANDOM_SIZE,
517 s->s3->server_random,SSL3_RANDOM_SIZE, 500 s->s3->server_random, SSL3_RANDOM_SIZE,
518 NULL,0,NULL,0, 501 NULL, 0, NULL, 0,
519 key,j,tmp1,tmp2,EVP_CIPHER_key_length(c))) 502 key, j, tmp1, tmp2, EVP_CIPHER_key_length(c)))
520 goto err2; 503 goto err2;
521 key=tmp1; 504 key = tmp1;
522 505
523 if (k > 0) 506 if (k > 0) {
524 {
525 if (!tls1_PRF(ssl_get_algorithm2(s), 507 if (!tls1_PRF(ssl_get_algorithm2(s),
526 TLS_MD_IV_BLOCK_CONST,TLS_MD_IV_BLOCK_CONST_SIZE, 508 TLS_MD_IV_BLOCK_CONST, TLS_MD_IV_BLOCK_CONST_SIZE,
527 s->s3->client_random,SSL3_RANDOM_SIZE, 509 s->s3->client_random, SSL3_RANDOM_SIZE,
528 s->s3->server_random,SSL3_RANDOM_SIZE, 510 s->s3->server_random, SSL3_RANDOM_SIZE,
529 NULL,0,NULL,0, 511 NULL, 0, NULL, 0,
530 empty,0,iv1,iv2,k*2)) 512 empty, 0, iv1, iv2, k*2))
531 goto err2; 513 goto err2;
532 if (client_write) 514 if (client_write)
533 iv=iv1; 515 iv = iv1;
534 else 516 else
535 iv= &(iv1[k]); 517 iv = &(iv1[k]);
536 }
537 } 518 }
519 }
538 520
539 s->session->key_arg_length=0; 521 s->session->key_arg_length = 0;
540#ifdef KSSL_DEBUG 522#ifdef KSSL_DEBUG
541 { 523 {
542 int i; 524 int i;
543 printf("EVP_CipherInit_ex(dd,c,key=,iv=,which)\n"); 525 printf("EVP_CipherInit_ex(dd, c, key=, iv=, which)\n");
544 printf("\tkey= "); for (i=0; i<c->key_len; i++) printf("%02x", key[i]); 526 printf("\tkey= "); for (i = 0; i<c->key_len; i++) printf("%02x", key[i]);
545 printf("\n"); 527 printf("\n");
546 printf("\t iv= "); for (i=0; i<c->iv_len; i++) printf("%02x", iv[i]); 528 printf("\t iv= "); for (i = 0; i<c->iv_len; i++) printf("%02x", iv[i]);
547 printf("\n"); 529 printf("\n");
548 } 530 }
549#endif /* KSSL_DEBUG */ 531#endif /* KSSL_DEBUG */
550 532
551 if (EVP_CIPHER_mode(c) == EVP_CIPH_GCM_MODE) 533 if (EVP_CIPHER_mode(c) == EVP_CIPH_GCM_MODE) {
552 { 534 EVP_CipherInit_ex(dd, c, NULL, key, NULL,(which & SSL3_CC_WRITE));
553 EVP_CipherInit_ex(dd,c,NULL,key,NULL,(which & SSL3_CC_WRITE));
554 EVP_CIPHER_CTX_ctrl(dd, EVP_CTRL_GCM_SET_IV_FIXED, k, iv); 535 EVP_CIPHER_CTX_ctrl(dd, EVP_CTRL_GCM_SET_IV_FIXED, k, iv);
555 } 536 } else
556 else 537 EVP_CipherInit_ex(dd, c, NULL, key, iv,(which & SSL3_CC_WRITE));
557 EVP_CipherInit_ex(dd,c,NULL,key,iv,(which & SSL3_CC_WRITE));
558 538
559 /* Needed for "composite" AEADs, such as RC4-HMAC-MD5 */ 539 /* Needed for "composite" AEADs, such as RC4-HMAC-MD5 */
560 if ((EVP_CIPHER_flags(c)&EVP_CIPH_FLAG_AEAD_CIPHER) && *mac_secret_size) 540 if ((EVP_CIPHER_flags(c)&EVP_CIPH_FLAG_AEAD_CIPHER) && *mac_secret_size)
561 EVP_CIPHER_CTX_ctrl(dd,EVP_CTRL_AEAD_SET_MAC_KEY, 541 EVP_CIPHER_CTX_ctrl(dd, EVP_CTRL_AEAD_SET_MAC_KEY,
562 *mac_secret_size,mac_secret); 542 *mac_secret_size, mac_secret);
563 543
564#ifdef TLS_DEBUG 544#ifdef TLS_DEBUG
565printf("which = %04X\nkey=",which); 545 printf("which = %04X\nkey=", which);
566{ int z; for (z=0; z<EVP_CIPHER_key_length(c); z++) printf("%02X%c",key[z],((z+1)%16)?' ':'\n'); } 546 { int z; for (z = 0; z<EVP_CIPHER_key_length(c); z++) printf("%02X%c", key[z],((z+1)%16)?' ':'\n'); }
567printf("\niv="); 547 printf("\niv=");
568{ int z; for (z=0; z<k; z++) printf("%02X%c",iv[z],((z+1)%16)?' ':'\n'); } 548 { int z; for (z = 0; z<k; z++) printf("%02X%c", iv[z],((z+1)%16)?' ':'\n'); }
569printf("\n"); 549 printf("\n");
570#endif 550#endif
571 551
572 OPENSSL_cleanse(tmp1,sizeof(tmp1)); 552 OPENSSL_cleanse(tmp1, sizeof(tmp1));
573 OPENSSL_cleanse(tmp2,sizeof(tmp1)); 553 OPENSSL_cleanse(tmp2, sizeof(tmp1));
574 OPENSSL_cleanse(iv1,sizeof(iv1)); 554 OPENSSL_cleanse(iv1, sizeof(iv1));
575 OPENSSL_cleanse(iv2,sizeof(iv2)); 555 OPENSSL_cleanse(iv2, sizeof(iv2));
576 return(1); 556 return (1);
577err: 557err:
578 SSLerr(SSL_F_TLS1_CHANGE_CIPHER_STATE,ERR_R_MALLOC_FAILURE); 558 SSLerr(SSL_F_TLS1_CHANGE_CIPHER_STATE, ERR_R_MALLOC_FAILURE);
579err2: 559err2:
580 return(0); 560 return (0);
581 } 561}
582 562
583int tls1_setup_key_block(SSL *s) 563int
584 { 564tls1_setup_key_block(SSL *s)
585 unsigned char *p1,*p2=NULL; 565{
566 unsigned char *p1, *p2 = NULL;
586 const EVP_CIPHER *c; 567 const EVP_CIPHER *c;
587 const EVP_MD *hash; 568 const EVP_MD *hash;
588 int num; 569 int num;
589 SSL_COMP *comp; 570 SSL_COMP *comp;
590 int mac_type= NID_undef,mac_secret_size=0; 571 int mac_type = NID_undef, mac_secret_size = 0;
591 int ret=0; 572 int ret = 0;
592 573
593#ifdef KSSL_DEBUG 574#ifdef KSSL_DEBUG
594 printf ("tls1_setup_key_block()\n"); 575 printf ("tls1_setup_key_block()\n");
595#endif /* KSSL_DEBUG */ 576#endif /* KSSL_DEBUG */
596 577
597 if (s->s3->tmp.key_block_length != 0) 578 if (s->s3->tmp.key_block_length != 0)
598 return(1); 579 return (1);
599 580
600 if (!ssl_cipher_get_evp(s->session,&c,&hash,&mac_type,&mac_secret_size,&comp)) 581 if (!ssl_cipher_get_evp(s->session, &c, &hash, &mac_type, &mac_secret_size, &comp)) {
601 { 582 SSLerr(SSL_F_TLS1_SETUP_KEY_BLOCK, SSL_R_CIPHER_OR_HASH_UNAVAILABLE);
602 SSLerr(SSL_F_TLS1_SETUP_KEY_BLOCK,SSL_R_CIPHER_OR_HASH_UNAVAILABLE); 583 return (0);
603 return(0); 584 }
604 }
605 585
606 s->s3->tmp.new_sym_enc=c; 586 s->s3->tmp.new_sym_enc = c;
607 s->s3->tmp.new_hash=hash; 587 s->s3->tmp.new_hash = hash;
608 s->s3->tmp.new_mac_pkey_type = mac_type; 588 s->s3->tmp.new_mac_pkey_type = mac_type;
609 s->s3->tmp.new_mac_secret_size = mac_secret_size; 589 s->s3->tmp.new_mac_secret_size = mac_secret_size;
610 num=EVP_CIPHER_key_length(c)+mac_secret_size+EVP_CIPHER_iv_length(c); 590 num = EVP_CIPHER_key_length(c) + mac_secret_size + EVP_CIPHER_iv_length(c);
611 num*=2; 591 num*=2;
612 592
613 ssl3_cleanup_key_block(s); 593 ssl3_cleanup_key_block(s);
614 594
615 if ((p1=(unsigned char *)OPENSSL_malloc(num)) == NULL) 595 if ((p1 = (unsigned char *)OPENSSL_malloc(num)) == NULL) {
616 { 596 SSLerr(SSL_F_TLS1_SETUP_KEY_BLOCK, ERR_R_MALLOC_FAILURE);
617 SSLerr(SSL_F_TLS1_SETUP_KEY_BLOCK,ERR_R_MALLOC_FAILURE);
618 goto err; 597 goto err;
619 } 598 }
620 599
621 s->s3->tmp.key_block_length=num; 600 s->s3->tmp.key_block_length = num;
622 s->s3->tmp.key_block=p1; 601 s->s3->tmp.key_block = p1;
623 602
624 if ((p2=(unsigned char *)OPENSSL_malloc(num)) == NULL) 603 if ((p2 = (unsigned char *)OPENSSL_malloc(num)) == NULL) {
625 { 604 SSLerr(SSL_F_TLS1_SETUP_KEY_BLOCK, ERR_R_MALLOC_FAILURE);
626 SSLerr(SSL_F_TLS1_SETUP_KEY_BLOCK,ERR_R_MALLOC_FAILURE);
627 goto err; 605 goto err;
628 } 606 }
629 607
630#ifdef TLS_DEBUG 608#ifdef TLS_DEBUG
631printf("client random\n"); 609 printf("client random\n");
632{ int z; for (z=0; z<SSL3_RANDOM_SIZE; z++) printf("%02X%c",s->s3->client_random[z],((z+1)%16)?' ':'\n'); } 610 { int z; for (z = 0; z<SSL3_RANDOM_SIZE; z++) printf("%02X%c", s->s3->client_random[z],((z+1)%16)?' ':'\n'); }
633printf("server random\n"); 611 printf("server random\n");
634{ int z; for (z=0; z<SSL3_RANDOM_SIZE; z++) printf("%02X%c",s->s3->server_random[z],((z+1)%16)?' ':'\n'); } 612 { int z; for (z = 0; z<SSL3_RANDOM_SIZE; z++) printf("%02X%c", s->s3->server_random[z],((z+1)%16)?' ':'\n'); }
635printf("pre-master\n"); 613 printf("pre-master\n");
636{ int z; for (z=0; z<s->session->master_key_length; z++) printf("%02X%c",s->session->master_key[z],((z+1)%16)?' ':'\n'); } 614 { int z; for (z = 0; z<s->session->master_key_length; z++) printf("%02X%c", s->session->master_key[z],((z+1)%16)?' ':'\n'); }
637#endif 615#endif
638 if (!tls1_generate_key_block(s,p1,p2,num)) 616 if (!tls1_generate_key_block(s, p1, p2, num))
639 goto err; 617 goto err;
640#ifdef TLS_DEBUG 618#ifdef TLS_DEBUG
641printf("\nkey block\n"); 619 printf("\nkey block\n");
642{ int z; for (z=0; z<num; z++) printf("%02X%c",p1[z],((z+1)%16)?' ':'\n'); } 620 { int z; for (z = 0; z<num; z++) printf("%02X%c", p1[z],((z+1)%16)?' ':'\n'); }
643#endif 621#endif
644 622
645 if (!(s->options & SSL_OP_DONT_INSERT_EMPTY_FRAGMENTS) 623 if (!(s->options & SSL_OP_DONT_INSERT_EMPTY_FRAGMENTS)
646 && s->method->version <= TLS1_VERSION) 624 && s->method->version <= TLS1_VERSION) {
647 {
648 /* enable vulnerability countermeasure for CBC ciphers with 625 /* enable vulnerability countermeasure for CBC ciphers with
649 * known-IV problem (http://www.openssl.org/~bodo/tls-cbc.txt) 626 * known-IV problem (http://www.openssl.org/~bodo/tls-cbc.txt)
650 */ 627 */
651 s->s3->need_empty_fragments = 1; 628 s->s3->need_empty_fragments = 1;
652 629
653 if (s->session->cipher != NULL) 630 if (s->session->cipher != NULL) {
654 {
655 if (s->session->cipher->algorithm_enc == SSL_eNULL) 631 if (s->session->cipher->algorithm_enc == SSL_eNULL)
656 s->s3->need_empty_fragments = 0; 632 s->s3->need_empty_fragments = 0;
657 633
658#ifndef OPENSSL_NO_RC4 634#ifndef OPENSSL_NO_RC4
659 if (s->session->cipher->algorithm_enc == SSL_RC4) 635 if (s->session->cipher->algorithm_enc == SSL_RC4)
660 s->s3->need_empty_fragments = 0; 636 s->s3->need_empty_fragments = 0;
661#endif 637#endif
662 }
663 } 638 }
664 639 }
640
665 ret = 1; 641 ret = 1;
666err: 642err:
667 if (p2) 643 if (p2) {
668 { 644 OPENSSL_cleanse(p2, num);
669 OPENSSL_cleanse(p2,num);
670 OPENSSL_free(p2); 645 OPENSSL_free(p2);
671 }
672 return(ret);
673 } 646 }
647 return (ret);
648}
674 649
675/* tls1_enc encrypts/decrypts the record in |s->wrec| / |s->rrec|, respectively. 650/* tls1_enc encrypts/decrypts the record in |s->wrec| / |s->rrec|, respectively.
676 * 651 *
@@ -681,176 +656,161 @@ err:
681 * -1: if the record's padding/AEAD-authenticator is invalid or, if sending, 656 * -1: if the record's padding/AEAD-authenticator is invalid or, if sending,
682 * an internal error occured. 657 * an internal error occured.
683 */ 658 */
684int tls1_enc(SSL *s, int send) 659int
685 { 660tls1_enc(SSL *s, int send)
661{
686 SSL3_RECORD *rec; 662 SSL3_RECORD *rec;
687 EVP_CIPHER_CTX *ds; 663 EVP_CIPHER_CTX *ds;
688 unsigned long l; 664 unsigned long l;
689 int bs,i,j,k,pad=0,ret,mac_size=0; 665 int bs, i, j, k, pad = 0, ret, mac_size = 0;
690 const EVP_CIPHER *enc; 666 const EVP_CIPHER *enc;
691 667
692 if (send) 668 if (send) {
693 { 669 if (EVP_MD_CTX_md(s->write_hash)) {
694 if (EVP_MD_CTX_md(s->write_hash)) 670 int n = EVP_MD_CTX_size(s->write_hash);
695 {
696 int n=EVP_MD_CTX_size(s->write_hash);
697 OPENSSL_assert(n >= 0); 671 OPENSSL_assert(n >= 0);
698 } 672 }
699 ds=s->enc_write_ctx; 673 ds = s->enc_write_ctx;
700 rec= &(s->s3->wrec); 674 rec = &(s->s3->wrec);
701 if (s->enc_write_ctx == NULL) 675 if (s->enc_write_ctx == NULL)
702 enc=NULL; 676 enc = NULL;
703 else 677 else {
704 {
705 int ivlen; 678 int ivlen;
706 enc=EVP_CIPHER_CTX_cipher(s->enc_write_ctx); 679 enc = EVP_CIPHER_CTX_cipher(s->enc_write_ctx);
707 /* For TLSv1.1 and later explicit IV */ 680 /* For TLSv1.1 and later explicit IV */
708 if (s->version >= TLS1_1_VERSION 681 if (s->version >= TLS1_1_VERSION
709 && EVP_CIPHER_mode(enc) == EVP_CIPH_CBC_MODE) 682 && EVP_CIPHER_mode(enc) == EVP_CIPH_CBC_MODE)
710 ivlen = EVP_CIPHER_iv_length(enc); 683 ivlen = EVP_CIPHER_iv_length(enc);
711 else 684 else
712 ivlen = 0; 685 ivlen = 0;
713 if (ivlen > 1) 686 if (ivlen > 1) {
714 { 687 if (rec->data != rec->input)
715 if ( rec->data != rec->input)
716 /* we can't write into the input stream: 688 /* we can't write into the input stream:
717 * Can this ever happen?? (steve) 689 * Can this ever happen?? (steve)
718 */ 690 */
719 fprintf(stderr, 691 fprintf(stderr,
720 "%s:%d: rec->data != rec->input\n", 692 "%s:%d: rec->data != rec->input\n",
721 __FILE__, __LINE__); 693 __FILE__, __LINE__);
722 else if (RAND_bytes(rec->input, ivlen) <= 0) 694 else if (RAND_bytes(rec->input, ivlen) <= 0)
723 return -1; 695 return -1;
724 }
725 } 696 }
726 } 697 }
727 else 698 } else {
728 { 699 if (EVP_MD_CTX_md(s->read_hash)) {
729 if (EVP_MD_CTX_md(s->read_hash)) 700 int n = EVP_MD_CTX_size(s->read_hash);
730 {
731 int n=EVP_MD_CTX_size(s->read_hash);
732 OPENSSL_assert(n >= 0); 701 OPENSSL_assert(n >= 0);
733 } 702 }
734 ds=s->enc_read_ctx; 703 ds = s->enc_read_ctx;
735 rec= &(s->s3->rrec); 704 rec = &(s->s3->rrec);
736 if (s->enc_read_ctx == NULL) 705 if (s->enc_read_ctx == NULL)
737 enc=NULL; 706 enc = NULL;
738 else 707 else
739 enc=EVP_CIPHER_CTX_cipher(s->enc_read_ctx); 708 enc = EVP_CIPHER_CTX_cipher(s->enc_read_ctx);
740 } 709 }
741 710
742#ifdef KSSL_DEBUG 711#ifdef KSSL_DEBUG
743 printf("tls1_enc(%d)\n", send); 712 printf("tls1_enc(%d)\n", send);
744#endif /* KSSL_DEBUG */ 713#endif /* KSSL_DEBUG */
745 714
746 if ((s->session == NULL) || (ds == NULL) || (enc == NULL)) 715 if ((s->session == NULL) || (ds == NULL) || (enc == NULL)) {
747 { 716 memmove(rec->data, rec->input, rec->length);
748 memmove(rec->data,rec->input,rec->length); 717 rec->input = rec->data;
749 rec->input=rec->data;
750 ret = 1; 718 ret = 1;
751 } 719 } else {
752 else 720 l = rec->length;
753 { 721 bs = EVP_CIPHER_block_size(ds->cipher);
754 l=rec->length; 722
755 bs=EVP_CIPHER_block_size(ds->cipher); 723 if (EVP_CIPHER_flags(ds->cipher)&EVP_CIPH_FLAG_AEAD_CIPHER) {
756 724 unsigned char buf[13], *seq;
757 if (EVP_CIPHER_flags(ds->cipher)&EVP_CIPH_FLAG_AEAD_CIPHER) 725
758 { 726 seq = send ? s->s3->write_sequence : s->s3->read_sequence;
759 unsigned char buf[13],*seq; 727
760 728 if (s->version == DTLS1_VERSION || s->version == DTLS1_BAD_VER) {
761 seq = send?s->s3->write_sequence:s->s3->read_sequence; 729 unsigned char dtlsseq[9], *p = dtlsseq;
762 730
763 if (s->version == DTLS1_VERSION || s->version == DTLS1_BAD_VER) 731 s2n(send ? s->d1->w_epoch : s->d1->r_epoch, p);
764 { 732 memcpy(p, &seq[2], 6);
765 unsigned char dtlsseq[9],*p=dtlsseq; 733 memcpy(buf, dtlsseq, 8);
766 734 } else {
767 s2n(send?s->d1->w_epoch:s->d1->r_epoch,p); 735 memcpy(buf, seq, 8);
768 memcpy(p,&seq[2],6); 736 for (i = 7;
769 memcpy(buf,dtlsseq,8); 737 i >= 0;
770 } 738 i--) /* increment */
771 else
772 { 739 {
773 memcpy(buf,seq,8);
774 for (i=7; i>=0; i--) /* increment */
775 {
776 ++seq[i]; 740 ++seq[i];
777 if (seq[i] != 0) break; 741 if (seq[i] != 0)
778 } 742 break;
779 }
780 743
781 buf[8]=rec->type;
782 buf[9]=(unsigned char)(s->version>>8);
783 buf[10]=(unsigned char)(s->version);
784 buf[11]=rec->length>>8;
785 buf[12]=rec->length&0xff;
786 pad=EVP_CIPHER_CTX_ctrl(ds,EVP_CTRL_AEAD_TLS1_AAD,13,buf);
787 if (send)
788 {
789 l+=pad;
790 rec->length+=pad;
791 } 744 }
792 } 745 }
793 else if ((bs != 1) && send) 746
794 { 747 buf[8] = rec->type;
795 i=bs-((int)l%bs); 748 buf[9] = (unsigned char)(s->version >> 8);
749 buf[10] = (unsigned char)(s->version);
750 buf[11] = rec->length >> 8;
751 buf[12] = rec->length&0xff;
752 pad = EVP_CIPHER_CTX_ctrl(ds, EVP_CTRL_AEAD_TLS1_AAD, 13, buf);
753 if (send) {
754 l += pad;
755 rec->length += pad;
756 }
757 } else if ((bs != 1) && send) {
758 i = bs - ((int)l % bs);
796 759
797 /* Add weird padding of upto 256 bytes */ 760 /* Add weird padding of upto 256 bytes */
798 761
799 /* we need to add 'i' padding bytes of value j */ 762 /* we need to add 'i' padding bytes of value j */
800 j=i-1; 763 j = i - 1;
801 if (s->options & SSL_OP_TLS_BLOCK_PADDING_BUG) 764 if (s->options & SSL_OP_TLS_BLOCK_PADDING_BUG) {
802 {
803 if (s->s3->flags & TLS1_FLAGS_TLS_PADDING_BUG) 765 if (s->s3->flags & TLS1_FLAGS_TLS_PADDING_BUG)
804 j++; 766 j++;
805 }
806 for (k=(int)l; k<(int)(l+i); k++)
807 rec->input[k]=j;
808 l+=i;
809 rec->length+=i;
810 } 767 }
768 for (k = (int)l; k < (int)(l + i); k++)
769 rec->input[k] = j;
770 l += i;
771 rec->length += i;
772 }
811 773
812#ifdef KSSL_DEBUG 774#ifdef KSSL_DEBUG
813 { 775 {
814 unsigned long ui; 776 unsigned long ui;
815 printf("EVP_Cipher(ds=%p,rec->data=%p,rec->input=%p,l=%ld) ==>\n", 777 printf("EVP_Cipher(ds=%p, rec->data=%p, rec->input=%p, l=%ld) ==>\n",
816 ds,rec->data,rec->input,l); 778 ds, rec->data, rec->input, l);
817 printf("\tEVP_CIPHER_CTX: %d buf_len, %d key_len [%d %d], %d iv_len\n", 779 printf("\tEVP_CIPHER_CTX: %d buf_len, %d key_len [%d %d], %d iv_len\n",
818 ds->buf_len, ds->cipher->key_len, 780 ds->buf_len, ds->cipher->key_len,
819 DES_KEY_SZ, DES_SCHEDULE_SZ, 781 DES_KEY_SZ, DES_SCHEDULE_SZ,
820 ds->cipher->iv_len); 782 ds->cipher->iv_len);
821 printf("\t\tIV: "); 783 printf("\t\tIV: ");
822 for (i=0; i<ds->cipher->iv_len; i++) printf("%02X", ds->iv[i]); 784 for (i = 0; i<ds->cipher->iv_len; i++) printf("%02X", ds->iv[i]);
823 printf("\n"); 785 printf("\n");
824 printf("\trec->input="); 786 printf("\trec->input=");
825 for (ui=0; ui<l; ui++) printf(" %02x", rec->input[ui]); 787 for (ui = 0; ui<l; ui++) printf(" %02x", rec->input[ui]);
826 printf("\n"); 788 printf("\n");
827 } 789 }
828#endif /* KSSL_DEBUG */ 790#endif /* KSSL_DEBUG */
829 791
830 if (!send) 792 if (!send) {
831 { 793 if (l == 0 || l % bs != 0)
832 if (l == 0 || l%bs != 0)
833 return 0; 794 return 0;
834 } 795 }
835 796
836 i = EVP_Cipher(ds,rec->data,rec->input,l); 797 i = EVP_Cipher(ds, rec->data, rec->input, l);
837 if ((EVP_CIPHER_flags(ds->cipher)&EVP_CIPH_FLAG_CUSTOM_CIPHER) 798 if ((EVP_CIPHER_flags(ds->cipher)&EVP_CIPH_FLAG_CUSTOM_CIPHER)
838 ?(i<0) 799 ?(i < 0)
839 :(i==0)) 800 :(i == 0))
840 return -1; /* AEAD can fail to verify MAC */ 801 return -1; /* AEAD can fail to verify MAC */
841 if (EVP_CIPHER_mode(enc) == EVP_CIPH_GCM_MODE && !send) 802 if (EVP_CIPHER_mode(enc) == EVP_CIPH_GCM_MODE && !send) {
842 {
843 rec->data += EVP_GCM_TLS_EXPLICIT_IV_LEN; 803 rec->data += EVP_GCM_TLS_EXPLICIT_IV_LEN;
844 rec->input += EVP_GCM_TLS_EXPLICIT_IV_LEN; 804 rec->input += EVP_GCM_TLS_EXPLICIT_IV_LEN;
845 rec->length -= EVP_GCM_TLS_EXPLICIT_IV_LEN; 805 rec->length -= EVP_GCM_TLS_EXPLICIT_IV_LEN;
846 } 806 }
847 807
848#ifdef KSSL_DEBUG 808#ifdef KSSL_DEBUG
849 { 809 {
850 unsigned long i; 810 unsigned long i;
851 printf("\trec->data="); 811 printf("\trec->data=");
852 for (i=0; i<l; i++) 812 for (i = 0; i < l; i++)
853 printf(" %02x", rec->data[i]); printf("\n"); 813 printf(" %02x", rec->data[i]); printf("\n");
854 } 814 }
855#endif /* KSSL_DEBUG */ 815#endif /* KSSL_DEBUG */
856 816
@@ -861,97 +821,93 @@ int tls1_enc(SSL *s, int send)
861 ret = tls1_cbc_remove_padding(s, rec, bs, mac_size); 821 ret = tls1_cbc_remove_padding(s, rec, bs, mac_size);
862 if (pad && !send) 822 if (pad && !send)
863 rec->length -= pad; 823 rec->length -= pad;
864 }
865 return ret;
866 } 824 }
825 return ret;
826}
867 827
868int tls1_cert_verify_mac(SSL *s, int md_nid, unsigned char *out) 828int
869 { 829tls1_cert_verify_mac(SSL *s, int md_nid, unsigned char *out)
830{
870 unsigned int ret; 831 unsigned int ret;
871 EVP_MD_CTX ctx, *d=NULL; 832 EVP_MD_CTX ctx, *d = NULL;
872 int i; 833 int i;
873 834
874 if (s->s3->handshake_buffer) 835 if (s->s3->handshake_buffer)
875 if (!ssl3_digest_cached_records(s)) 836 if (!ssl3_digest_cached_records(s))
876 return 0; 837 return 0;
877 838
878 for (i=0;i<SSL_MAX_DIGEST;i++) 839 for (i = 0; i < SSL_MAX_DIGEST; i++) {
879 { 840 if (s->s3->handshake_dgst[i]&&EVP_MD_CTX_type(s->s3->handshake_dgst[i]) == md_nid) {
880 if (s->s3->handshake_dgst[i]&&EVP_MD_CTX_type(s->s3->handshake_dgst[i])==md_nid) 841 d = s->s3->handshake_dgst[i];
881 {
882 d=s->s3->handshake_dgst[i];
883 break; 842 break;
884 }
885 } 843 }
844 }
886 if (!d) { 845 if (!d) {
887 SSLerr(SSL_F_TLS1_CERT_VERIFY_MAC,SSL_R_NO_REQUIRED_DIGEST); 846 SSLerr(SSL_F_TLS1_CERT_VERIFY_MAC, SSL_R_NO_REQUIRED_DIGEST);
888 return 0; 847 return 0;
889 } 848 }
890 849
891 EVP_MD_CTX_init(&ctx); 850 EVP_MD_CTX_init(&ctx);
892 EVP_MD_CTX_copy_ex(&ctx,d); 851 EVP_MD_CTX_copy_ex(&ctx, d);
893 EVP_DigestFinal_ex(&ctx,out,&ret); 852 EVP_DigestFinal_ex(&ctx, out, &ret);
894 EVP_MD_CTX_cleanup(&ctx); 853 EVP_MD_CTX_cleanup(&ctx);
895 return((int)ret); 854 return ((int)ret);
896 } 855}
897 856
898int tls1_final_finish_mac(SSL *s, 857int
899 const char *str, int slen, unsigned char *out) 858tls1_final_finish_mac(SSL *s, const char *str, int slen, unsigned char *out)
900 { 859{
901 unsigned int i; 860 unsigned int i;
902 EVP_MD_CTX ctx; 861 EVP_MD_CTX ctx;
903 unsigned char buf[2*EVP_MAX_MD_SIZE]; 862 unsigned char buf[2*EVP_MAX_MD_SIZE];
904 unsigned char *q,buf2[12]; 863 unsigned char *q, buf2[12];
905 int idx; 864 int idx;
906 long mask; 865 long mask;
907 int err=0; 866 int err = 0;
908 const EVP_MD *md; 867 const EVP_MD *md;
868
909 869
910 q=buf; 870 q = buf;
911 871
912 if (s->s3->handshake_buffer) 872 if (s->s3->handshake_buffer)
913 if (!ssl3_digest_cached_records(s)) 873 if (!ssl3_digest_cached_records(s))
914 return 0; 874 return 0;
915 875
916 EVP_MD_CTX_init(&ctx); 876 EVP_MD_CTX_init(&ctx);
917 877
918 for (idx=0;ssl_get_handshake_digest(idx,&mask,&md);idx++) 878 for (idx = 0; ssl_get_handshake_digest(idx, &mask, &md); idx++) {
919 { 879 if (mask & ssl_get_algorithm2(s)) {
920 if (mask & ssl_get_algorithm2(s))
921 {
922 int hashsize = EVP_MD_size(md); 880 int hashsize = EVP_MD_size(md);
923 EVP_MD_CTX *hdgst = s->s3->handshake_dgst[idx]; 881 EVP_MD_CTX *hdgst = s->s3->handshake_dgst[idx];
924 if (!hdgst || hashsize < 0 || hashsize > (int)(sizeof buf - (size_t)(q-buf))) 882 if (!hdgst || hashsize < 0 || hashsize > (int)(sizeof buf - (size_t)(q - buf))) {
925 {
926 /* internal error: 'buf' is too small for this cipersuite! */ 883 /* internal error: 'buf' is too small for this cipersuite! */
927 err = 1; 884 err = 1;
928 } 885 } else {
929 else
930 {
931 if (!EVP_MD_CTX_copy_ex(&ctx, hdgst) || 886 if (!EVP_MD_CTX_copy_ex(&ctx, hdgst) ||
932 !EVP_DigestFinal_ex(&ctx,q,&i) || 887 !EVP_DigestFinal_ex(&ctx, q, &i) ||
933 (i != (unsigned int)hashsize)) 888 (i != (unsigned int)hashsize))
934 err = 1; 889 err = 1;
935 q+=hashsize; 890 q += hashsize;
936 }
937 } 891 }
938 } 892 }
939 893 }
894
940 if (!tls1_PRF(ssl_get_algorithm2(s), 895 if (!tls1_PRF(ssl_get_algorithm2(s),
941 str,slen, buf,(int)(q-buf), NULL,0, NULL,0, NULL,0, 896 str, slen, buf,(int)(q - buf), NULL, 0, NULL, 0, NULL, 0,
942 s->session->master_key,s->session->master_key_length, 897 s->session->master_key, s->session->master_key_length,
943 out,buf2,sizeof buf2)) 898 out, buf2, sizeof buf2))
944 err = 1; 899 err = 1;
945 EVP_MD_CTX_cleanup(&ctx); 900 EVP_MD_CTX_cleanup(&ctx);
946 901
947 if (err) 902 if (err)
948 return 0; 903 return 0;
949 else 904 else
950 return sizeof buf2; 905 return sizeof buf2;
951 } 906}
952 907
953int tls1_mac(SSL *ssl, unsigned char *md, int send) 908int
954 { 909tls1_mac(SSL *ssl, unsigned char *md, int send)
910{
955 SSL3_RECORD *rec; 911 SSL3_RECORD *rec;
956 unsigned char *seq; 912 unsigned char *seq;
957 EVP_MD_CTX *hash; 913 EVP_MD_CTX *hash;
@@ -959,152 +915,141 @@ int tls1_mac(SSL *ssl, unsigned char *md, int send)
959 int i; 915 int i;
960 EVP_MD_CTX hmac, *mac_ctx; 916 EVP_MD_CTX hmac, *mac_ctx;
961 unsigned char header[13]; 917 unsigned char header[13];
962 int stream_mac = (send?(ssl->mac_flags & SSL_MAC_FLAG_WRITE_MAC_STREAM):(ssl->mac_flags&SSL_MAC_FLAG_READ_MAC_STREAM)); 918 int stream_mac = (send ? (ssl->mac_flags & SSL_MAC_FLAG_WRITE_MAC_STREAM) : (ssl->mac_flags&SSL_MAC_FLAG_READ_MAC_STREAM));
963 int t; 919 int t;
964 920
965 if (send) 921 if (send) {
966 { 922 rec = &(ssl->s3->wrec);
967 rec= &(ssl->s3->wrec); 923 seq = &(ssl->s3->write_sequence[0]);
968 seq= &(ssl->s3->write_sequence[0]); 924 hash = ssl->write_hash;
969 hash=ssl->write_hash; 925 } else {
970 } 926 rec = &(ssl->s3->rrec);
971 else 927 seq = &(ssl->s3->read_sequence[0]);
972 { 928 hash = ssl->read_hash;
973 rec= &(ssl->s3->rrec); 929 }
974 seq= &(ssl->s3->read_sequence[0]);
975 hash=ssl->read_hash;
976 }
977 930
978 t=EVP_MD_CTX_size(hash); 931 t = EVP_MD_CTX_size(hash);
979 OPENSSL_assert(t >= 0); 932 OPENSSL_assert(t >= 0);
980 md_size=t; 933 md_size = t;
981 934
982 /* I should fix this up TLS TLS TLS TLS TLS XXXXXXXX */ 935 /* I should fix this up TLS TLS TLS TLS TLS XXXXXXXX */
983 if (stream_mac) 936 if (stream_mac) {
984 { 937 mac_ctx = hash;
985 mac_ctx = hash; 938 } else {
986 } 939 if (!EVP_MD_CTX_copy(&hmac, hash))
987 else 940 return -1;
988 { 941 mac_ctx = &hmac;
989 if (!EVP_MD_CTX_copy(&hmac,hash)) 942 }
990 return -1;
991 mac_ctx = &hmac;
992 }
993 943
994 if (ssl->version == DTLS1_VERSION || ssl->version == DTLS1_BAD_VER) 944 if (ssl->version == DTLS1_VERSION || ssl->version == DTLS1_BAD_VER) {
995 { 945 unsigned char dtlsseq[8], *p = dtlsseq;
996 unsigned char dtlsseq[8],*p=dtlsseq;
997 946
998 s2n(send?ssl->d1->w_epoch:ssl->d1->r_epoch, p); 947 s2n(send ? ssl->d1->w_epoch : ssl->d1->r_epoch, p);
999 memcpy (p,&seq[2],6); 948 memcpy (p, &seq[2], 6);
1000 949
1001 memcpy(header, dtlsseq, 8); 950 memcpy(header, dtlsseq, 8);
1002 } 951 } else
1003 else
1004 memcpy(header, seq, 8); 952 memcpy(header, seq, 8);
1005 953
1006 /* kludge: tls1_cbc_remove_padding passes padding length in rec->type */ 954 /* kludge: tls1_cbc_remove_padding passes padding length in rec->type */
1007 orig_len = rec->length+md_size+((unsigned int)rec->type>>8); 955 orig_len = rec->length + md_size + ((unsigned int)rec->type >> 8);
1008 rec->type &= 0xff; 956 rec->type &= 0xff;
1009 957
1010 header[8]=rec->type; 958 header[8] = rec->type;
1011 header[9]=(unsigned char)(ssl->version>>8); 959 header[9] = (unsigned char)(ssl->version >> 8);
1012 header[10]=(unsigned char)(ssl->version); 960 header[10] = (unsigned char)(ssl->version);
1013 header[11]=(rec->length)>>8; 961 header[11] = (rec->length) >> 8;
1014 header[12]=(rec->length)&0xff; 962 header[12] = (rec->length)&0xff;
1015 963
1016 if (!send && 964 if (!send &&
1017 EVP_CIPHER_CTX_mode(ssl->enc_read_ctx) == EVP_CIPH_CBC_MODE && 965 EVP_CIPHER_CTX_mode(ssl->enc_read_ctx) == EVP_CIPH_CBC_MODE &&
1018 ssl3_cbc_record_digest_supported(mac_ctx)) 966 ssl3_cbc_record_digest_supported(mac_ctx)) {
1019 {
1020 /* This is a CBC-encrypted record. We must avoid leaking any 967 /* This is a CBC-encrypted record. We must avoid leaking any
1021 * timing-side channel information about how many blocks of 968 * timing-side channel information about how many blocks of
1022 * data we are hashing because that gives an attacker a 969 * data we are hashing because that gives an attacker a
1023 * timing-oracle. */ 970 * timing-oracle. */
1024 ssl3_cbc_digest_record( 971 ssl3_cbc_digest_record(
1025 mac_ctx, 972 mac_ctx,
1026 md, &md_size, 973 md, &md_size,
1027 header, rec->input, 974 header, rec->input,
1028 rec->length + md_size, orig_len, 975 rec->length + md_size, orig_len,
1029 ssl->s3->read_mac_secret, 976 ssl->s3->read_mac_secret,
1030 ssl->s3->read_mac_secret_size, 977 ssl->s3->read_mac_secret_size,
1031 0 /* not SSLv3 */); 978 0 /* not SSLv3 */);
1032 } 979 } else {
1033 else 980 EVP_DigestSignUpdate(mac_ctx, header, sizeof(header));
1034 { 981 EVP_DigestSignUpdate(mac_ctx, rec->input, rec->length);
1035 EVP_DigestSignUpdate(mac_ctx,header,sizeof(header)); 982 t = EVP_DigestSignFinal(mac_ctx, md, &md_size);
1036 EVP_DigestSignUpdate(mac_ctx,rec->input,rec->length);
1037 t=EVP_DigestSignFinal(mac_ctx,md,&md_size);
1038 OPENSSL_assert(t > 0); 983 OPENSSL_assert(t > 0);
1039#ifdef OPENSSL_FIPS 984#ifdef OPENSSL_FIPS
1040 if (!send && FIPS_mode()) 985 if (!send && FIPS_mode())
1041 tls_fips_digest_extra( 986 tls_fips_digest_extra(
1042 ssl->enc_read_ctx, 987 ssl->enc_read_ctx,
1043 mac_ctx, rec->input, 988 mac_ctx, rec->input,
1044 rec->length, orig_len); 989 rec->length, orig_len);
1045#endif 990#endif
1046 } 991 }
1047 992
1048 if (!stream_mac) 993 if (!stream_mac)
1049 EVP_MD_CTX_cleanup(&hmac); 994 EVP_MD_CTX_cleanup(&hmac);
1050#ifdef TLS_DEBUG 995#ifdef TLS_DEBUG
1051printf("sec="); 996 printf("sec=");
1052{unsigned int z; for (z=0; z<md_size; z++) printf("%02X ",mac_sec[z]); printf("\n"); } 997 {unsigned int z; for (z = 0; z<md_size; z++) printf("%02X ", mac_sec[z]); printf("\n"); }
1053printf("seq="); 998 printf("seq=");
1054{int z; for (z=0; z<8; z++) printf("%02X ",seq[z]); printf("\n"); } 999 {int z; for (z = 0; z<8; z++) printf("%02X ", seq[z]); printf("\n"); }
1055printf("buf="); 1000 printf("buf=");
1056{int z; for (z=0; z<5; z++) printf("%02X ",buf[z]); printf("\n"); } 1001 {int z; for (z = 0; z<5; z++) printf("%02X ", buf[z]); printf("\n"); }
1057printf("rec="); 1002 printf("rec=");
1058{unsigned int z; for (z=0; z<rec->length; z++) printf("%02X ",buf[z]); printf("\n"); } 1003 {unsigned int z; for (z = 0; z<rec->length; z++) printf("%02X ", buf[z]); printf("\n"); }
1059#endif 1004#endif
1060 1005
1061 if (ssl->version != DTLS1_VERSION && ssl->version != DTLS1_BAD_VER) 1006 if (ssl->version != DTLS1_VERSION && ssl->version != DTLS1_BAD_VER) {
1062 { 1007 for (i = 7; i >= 0; i--) {
1063 for (i=7; i>=0; i--)
1064 {
1065 ++seq[i]; 1008 ++seq[i];
1066 if (seq[i] != 0) break; 1009 if (seq[i] != 0)
1067 } 1010 break;
1011
1068 } 1012 }
1013 }
1069 1014
1070#ifdef TLS_DEBUG 1015#ifdef TLS_DEBUG
1071{unsigned int z; for (z=0; z<md_size; z++) printf("%02X ",md[z]); printf("\n"); } 1016 {unsigned int z; for (z = 0; z<md_size; z++) printf("%02X ", md[z]); printf("\n"); }
1072#endif 1017#endif
1073 return(md_size); 1018 return (md_size);
1074 } 1019}
1075 1020
1076int tls1_generate_master_secret(SSL *s, unsigned char *out, unsigned char *p, 1021int
1077 int len) 1022tls1_generate_master_secret(SSL *s, unsigned char *out, unsigned char *p,
1078 { 1023 int len)
1024{
1079 unsigned char buff[SSL_MAX_MASTER_KEY_LENGTH]; 1025 unsigned char buff[SSL_MAX_MASTER_KEY_LENGTH];
1080 const void *co = NULL, *so = NULL; 1026 const void *co = NULL, *so = NULL;
1081 int col = 0, sol = 0; 1027 int col = 0, sol = 0;
1082 1028
1083 1029
1084#ifdef KSSL_DEBUG 1030#ifdef KSSL_DEBUG
1085 printf ("tls1_generate_master_secret(%p,%p, %p, %d)\n", s,out, p,len); 1031 printf ("tls1_generate_master_secret(%p,%p, %p, %d)\n", s, out, p, len);
1086#endif /* KSSL_DEBUG */ 1032#endif /* KSSL_DEBUG */
1087 1033
1088#ifdef TLSEXT_TYPE_opaque_prf_input 1034#ifdef TLSEXT_TYPE_opaque_prf_input
1089 if (s->s3->client_opaque_prf_input != NULL && s->s3->server_opaque_prf_input != NULL && 1035 if (s->s3->client_opaque_prf_input != NULL && s->s3->server_opaque_prf_input != NULL &&
1090 s->s3->client_opaque_prf_input_len > 0 && 1036 s->s3->client_opaque_prf_input_len > 0 &&
1091 s->s3->client_opaque_prf_input_len == s->s3->server_opaque_prf_input_len) 1037 s->s3->client_opaque_prf_input_len == s->s3->server_opaque_prf_input_len) {
1092 {
1093 co = s->s3->client_opaque_prf_input; 1038 co = s->s3->client_opaque_prf_input;
1094 col = s->s3->server_opaque_prf_input_len; 1039 col = s->s3->server_opaque_prf_input_len;
1095 so = s->s3->server_opaque_prf_input; 1040 so = s->s3->server_opaque_prf_input;
1096 sol = s->s3->client_opaque_prf_input_len; /* must be same as col (see draft-rescorla-tls-opaque-prf-input-00.txt, section 3.1) */ 1041 sol = s->s3->client_opaque_prf_input_len; /* must be same as col (see draft-rescorla-tls-opaque-prf-input-00.txt, section 3.1) */
1097 } 1042 }
1098#endif 1043#endif
1099 1044
1100 tls1_PRF(ssl_get_algorithm2(s), 1045 tls1_PRF(ssl_get_algorithm2(s),
1101 TLS_MD_MASTER_SECRET_CONST,TLS_MD_MASTER_SECRET_CONST_SIZE, 1046 TLS_MD_MASTER_SECRET_CONST, TLS_MD_MASTER_SECRET_CONST_SIZE,
1102 s->s3->client_random,SSL3_RANDOM_SIZE, 1047 s->s3->client_random, SSL3_RANDOM_SIZE,
1103 co, col, 1048 co, col,
1104 s->s3->server_random,SSL3_RANDOM_SIZE, 1049 s->s3->server_random, SSL3_RANDOM_SIZE,
1105 so, sol, 1050 so, sol,
1106 p,len, 1051 p, len,
1107 s->session->master_key,buff,sizeof buff); 1052 s->session->master_key, buff, sizeof buff);
1108#ifdef SSL_DEBUG 1053#ifdef SSL_DEBUG
1109 fprintf(stderr, "Premaster Secret:\n"); 1054 fprintf(stderr, "Premaster Secret:\n");
1110 BIO_dump_fp(stderr, (char *)p, len); 1055 BIO_dump_fp(stderr, (char *)p, len);
@@ -1119,13 +1064,14 @@ int tls1_generate_master_secret(SSL *s, unsigned char *out, unsigned char *p,
1119#ifdef KSSL_DEBUG 1064#ifdef KSSL_DEBUG
1120 printf ("tls1_generate_master_secret() complete\n"); 1065 printf ("tls1_generate_master_secret() complete\n");
1121#endif /* KSSL_DEBUG */ 1066#endif /* KSSL_DEBUG */
1122 return(SSL3_MASTER_SECRET_SIZE); 1067 return (SSL3_MASTER_SECRET_SIZE);
1123 } 1068}
1124 1069
1125int tls1_export_keying_material(SSL *s, unsigned char *out, size_t olen, 1070int
1126 const char *label, size_t llen, const unsigned char *context, 1071tls1_export_keying_material(SSL *s, unsigned char *out, size_t olen,
1127 size_t contextlen, int use_context) 1072 const char *label, size_t llen, const unsigned char *context,
1128 { 1073 size_t contextlen, int use_context)
1074{
1129 unsigned char *buff; 1075 unsigned char *buff;
1130 unsigned char *val = NULL; 1076 unsigned char *val = NULL;
1131 size_t vallen, currentvalpos; 1077 size_t vallen, currentvalpos;
@@ -1136,7 +1082,8 @@ int tls1_export_keying_material(SSL *s, unsigned char *out, size_t olen,
1136#endif /* KSSL_DEBUG */ 1082#endif /* KSSL_DEBUG */
1137 1083
1138 buff = OPENSSL_malloc(olen); 1084 buff = OPENSSL_malloc(olen);
1139 if (buff == NULL) goto err2; 1085 if (buff == NULL)
1086 goto err2;
1140 1087
1141 /* construct PRF arguments 1088 /* construct PRF arguments
1142 * we construct the PRF argument ourself rather than passing separate 1089 * we construct the PRF argument ourself rather than passing separate
@@ -1144,13 +1091,13 @@ int tls1_export_keying_material(SSL *s, unsigned char *out, size_t olen,
1144 * does not create a prohibited label. 1091 * does not create a prohibited label.
1145 */ 1092 */
1146 vallen = llen + SSL3_RANDOM_SIZE * 2; 1093 vallen = llen + SSL3_RANDOM_SIZE * 2;
1147 if (use_context) 1094 if (use_context) {
1148 {
1149 vallen += 2 + contextlen; 1095 vallen += 2 + contextlen;
1150 } 1096 }
1151 1097
1152 val = OPENSSL_malloc(vallen); 1098 val = OPENSSL_malloc(vallen);
1153 if (val == NULL) goto err2; 1099 if (val == NULL)
1100 goto err2;
1154 currentvalpos = 0; 1101 currentvalpos = 0;
1155 memcpy(val + currentvalpos, (unsigned char *) label, llen); 1102 memcpy(val + currentvalpos, (unsigned char *) label, llen);
1156 currentvalpos += llen; 1103 currentvalpos += llen;
@@ -1159,17 +1106,15 @@ int tls1_export_keying_material(SSL *s, unsigned char *out, size_t olen,
1159 memcpy(val + currentvalpos, s->s3->server_random, SSL3_RANDOM_SIZE); 1106 memcpy(val + currentvalpos, s->s3->server_random, SSL3_RANDOM_SIZE);
1160 currentvalpos += SSL3_RANDOM_SIZE; 1107 currentvalpos += SSL3_RANDOM_SIZE;
1161 1108
1162 if (use_context) 1109 if (use_context) {
1163 {
1164 val[currentvalpos] = (contextlen >> 8) & 0xff; 1110 val[currentvalpos] = (contextlen >> 8) & 0xff;
1165 currentvalpos++; 1111 currentvalpos++;
1166 val[currentvalpos] = contextlen & 0xff; 1112 val[currentvalpos] = contextlen & 0xff;
1167 currentvalpos++; 1113 currentvalpos++;
1168 if ((contextlen > 0) || (context != NULL)) 1114 if ((contextlen > 0) || (context != NULL)) {
1169 {
1170 memcpy(val + currentvalpos, context, contextlen); 1115 memcpy(val + currentvalpos, context, contextlen);
1171 }
1172 } 1116 }
1117 }
1173 1118
1174 /* disallow prohibited labels 1119 /* disallow prohibited labels
1175 * note that SSL3_RANDOM_SIZE > max(prohibited label len) = 1120 * note that SSL3_RANDOM_SIZE > max(prohibited label len) =
@@ -1177,22 +1122,22 @@ int tls1_export_keying_material(SSL *s, unsigned char *out, size_t olen,
1177 * comparisons won't have buffer overflow 1122 * comparisons won't have buffer overflow
1178 */ 1123 */
1179 if (memcmp(val, TLS_MD_CLIENT_FINISH_CONST, 1124 if (memcmp(val, TLS_MD_CLIENT_FINISH_CONST,
1180 TLS_MD_CLIENT_FINISH_CONST_SIZE) == 0) goto err1; 1125 TLS_MD_CLIENT_FINISH_CONST_SIZE) == 0) goto err1;
1181 if (memcmp(val, TLS_MD_SERVER_FINISH_CONST, 1126 if (memcmp(val, TLS_MD_SERVER_FINISH_CONST,
1182 TLS_MD_SERVER_FINISH_CONST_SIZE) == 0) goto err1; 1127 TLS_MD_SERVER_FINISH_CONST_SIZE) == 0) goto err1;
1183 if (memcmp(val, TLS_MD_MASTER_SECRET_CONST, 1128 if (memcmp(val, TLS_MD_MASTER_SECRET_CONST,
1184 TLS_MD_MASTER_SECRET_CONST_SIZE) == 0) goto err1; 1129 TLS_MD_MASTER_SECRET_CONST_SIZE) == 0) goto err1;
1185 if (memcmp(val, TLS_MD_KEY_EXPANSION_CONST, 1130 if (memcmp(val, TLS_MD_KEY_EXPANSION_CONST,
1186 TLS_MD_KEY_EXPANSION_CONST_SIZE) == 0) goto err1; 1131 TLS_MD_KEY_EXPANSION_CONST_SIZE) == 0) goto err1;
1187 1132
1188 rv = tls1_PRF(s->s3->tmp.new_cipher->algorithm2, 1133 rv = tls1_PRF(s->s3->tmp.new_cipher->algorithm2,
1189 val, vallen, 1134 val, vallen,
1190 NULL, 0, 1135 NULL, 0,
1191 NULL, 0, 1136 NULL, 0,
1192 NULL, 0, 1137 NULL, 0,
1193 NULL, 0, 1138 NULL, 0,
1194 s->session->master_key,s->session->master_key_length, 1139 s->session->master_key, s->session->master_key_length,
1195 out,buff,olen); 1140 out, buff, olen);
1196 1141
1197#ifdef KSSL_DEBUG 1142#ifdef KSSL_DEBUG
1198 printf ("tls1_export_keying_material() complete\n"); 1143 printf ("tls1_export_keying_material() complete\n");
@@ -1206,49 +1151,82 @@ err2:
1206 SSLerr(SSL_F_TLS1_EXPORT_KEYING_MATERIAL, ERR_R_MALLOC_FAILURE); 1151 SSLerr(SSL_F_TLS1_EXPORT_KEYING_MATERIAL, ERR_R_MALLOC_FAILURE);
1207 rv = 0; 1152 rv = 0;
1208ret: 1153ret:
1209 if (buff != NULL) OPENSSL_free(buff); 1154 if (buff != NULL)
1210 if (val != NULL) OPENSSL_free(val); 1155 OPENSSL_free(buff);
1211 return(rv); 1156 if (val != NULL)
1212 } 1157 OPENSSL_free(val);
1158 return (rv);
1159}
1213 1160
1214int tls1_alert_code(int code) 1161int
1215 { 1162tls1_alert_code(int code)
1216 switch (code) 1163{
1217 { 1164 switch (code) {
1218 case SSL_AD_CLOSE_NOTIFY: return(SSL3_AD_CLOSE_NOTIFY); 1165 case SSL_AD_CLOSE_NOTIFY:
1219 case SSL_AD_UNEXPECTED_MESSAGE: return(SSL3_AD_UNEXPECTED_MESSAGE); 1166 return (SSL3_AD_CLOSE_NOTIFY);
1220 case SSL_AD_BAD_RECORD_MAC: return(SSL3_AD_BAD_RECORD_MAC); 1167 case SSL_AD_UNEXPECTED_MESSAGE:
1221 case SSL_AD_DECRYPTION_FAILED: return(TLS1_AD_DECRYPTION_FAILED); 1168 return (SSL3_AD_UNEXPECTED_MESSAGE);
1222 case SSL_AD_RECORD_OVERFLOW: return(TLS1_AD_RECORD_OVERFLOW); 1169 case SSL_AD_BAD_RECORD_MAC:
1223 case SSL_AD_DECOMPRESSION_FAILURE:return(SSL3_AD_DECOMPRESSION_FAILURE); 1170 return (SSL3_AD_BAD_RECORD_MAC);
1224 case SSL_AD_HANDSHAKE_FAILURE: return(SSL3_AD_HANDSHAKE_FAILURE); 1171 case SSL_AD_DECRYPTION_FAILED:
1225 case SSL_AD_NO_CERTIFICATE: return(-1); 1172 return (TLS1_AD_DECRYPTION_FAILED);
1226 case SSL_AD_BAD_CERTIFICATE: return(SSL3_AD_BAD_CERTIFICATE); 1173 case SSL_AD_RECORD_OVERFLOW:
1227 case SSL_AD_UNSUPPORTED_CERTIFICATE:return(SSL3_AD_UNSUPPORTED_CERTIFICATE); 1174 return (TLS1_AD_RECORD_OVERFLOW);
1228 case SSL_AD_CERTIFICATE_REVOKED:return(SSL3_AD_CERTIFICATE_REVOKED); 1175 case SSL_AD_DECOMPRESSION_FAILURE:
1229 case SSL_AD_CERTIFICATE_EXPIRED:return(SSL3_AD_CERTIFICATE_EXPIRED); 1176 return (SSL3_AD_DECOMPRESSION_FAILURE);
1230 case SSL_AD_CERTIFICATE_UNKNOWN:return(SSL3_AD_CERTIFICATE_UNKNOWN); 1177 case SSL_AD_HANDSHAKE_FAILURE:
1231 case SSL_AD_ILLEGAL_PARAMETER: return(SSL3_AD_ILLEGAL_PARAMETER); 1178 return (SSL3_AD_HANDSHAKE_FAILURE);
1232 case SSL_AD_UNKNOWN_CA: return(TLS1_AD_UNKNOWN_CA); 1179 case SSL_AD_NO_CERTIFICATE:
1233 case SSL_AD_ACCESS_DENIED: return(TLS1_AD_ACCESS_DENIED); 1180 return (-1);
1234 case SSL_AD_DECODE_ERROR: return(TLS1_AD_DECODE_ERROR); 1181 case SSL_AD_BAD_CERTIFICATE:
1235 case SSL_AD_DECRYPT_ERROR: return(TLS1_AD_DECRYPT_ERROR); 1182 return (SSL3_AD_BAD_CERTIFICATE);
1236 case SSL_AD_EXPORT_RESTRICTION: return(TLS1_AD_EXPORT_RESTRICTION); 1183 case SSL_AD_UNSUPPORTED_CERTIFICATE:
1237 case SSL_AD_PROTOCOL_VERSION: return(TLS1_AD_PROTOCOL_VERSION); 1184 return (SSL3_AD_UNSUPPORTED_CERTIFICATE);
1238 case SSL_AD_INSUFFICIENT_SECURITY:return(TLS1_AD_INSUFFICIENT_SECURITY); 1185 case SSL_AD_CERTIFICATE_REVOKED:
1239 case SSL_AD_INTERNAL_ERROR: return(TLS1_AD_INTERNAL_ERROR); 1186 return (SSL3_AD_CERTIFICATE_REVOKED);
1240 case SSL_AD_USER_CANCELLED: return(TLS1_AD_USER_CANCELLED); 1187 case SSL_AD_CERTIFICATE_EXPIRED:
1241 case SSL_AD_NO_RENEGOTIATION: return(TLS1_AD_NO_RENEGOTIATION); 1188 return (SSL3_AD_CERTIFICATE_EXPIRED);
1242 case SSL_AD_UNSUPPORTED_EXTENSION: return(TLS1_AD_UNSUPPORTED_EXTENSION); 1189 case SSL_AD_CERTIFICATE_UNKNOWN:
1243 case SSL_AD_CERTIFICATE_UNOBTAINABLE: return(TLS1_AD_CERTIFICATE_UNOBTAINABLE); 1190 return (SSL3_AD_CERTIFICATE_UNKNOWN);
1244 case SSL_AD_UNRECOGNIZED_NAME: return(TLS1_AD_UNRECOGNIZED_NAME); 1191 case SSL_AD_ILLEGAL_PARAMETER:
1245 case SSL_AD_BAD_CERTIFICATE_STATUS_RESPONSE: return(TLS1_AD_BAD_CERTIFICATE_STATUS_RESPONSE); 1192 return (SSL3_AD_ILLEGAL_PARAMETER);
1246 case SSL_AD_BAD_CERTIFICATE_HASH_VALUE: return(TLS1_AD_BAD_CERTIFICATE_HASH_VALUE); 1193 case SSL_AD_UNKNOWN_CA:
1247 case SSL_AD_UNKNOWN_PSK_IDENTITY:return(TLS1_AD_UNKNOWN_PSK_IDENTITY); 1194 return (TLS1_AD_UNKNOWN_CA);
1195 case SSL_AD_ACCESS_DENIED:
1196 return (TLS1_AD_ACCESS_DENIED);
1197 case SSL_AD_DECODE_ERROR:
1198 return (TLS1_AD_DECODE_ERROR);
1199 case SSL_AD_DECRYPT_ERROR:
1200 return (TLS1_AD_DECRYPT_ERROR);
1201 case SSL_AD_EXPORT_RESTRICTION:
1202 return (TLS1_AD_EXPORT_RESTRICTION);
1203 case SSL_AD_PROTOCOL_VERSION:
1204 return (TLS1_AD_PROTOCOL_VERSION);
1205 case SSL_AD_INSUFFICIENT_SECURITY:
1206 return (TLS1_AD_INSUFFICIENT_SECURITY);
1207 case SSL_AD_INTERNAL_ERROR:
1208 return (TLS1_AD_INTERNAL_ERROR);
1209 case SSL_AD_USER_CANCELLED:
1210 return (TLS1_AD_USER_CANCELLED);
1211 case SSL_AD_NO_RENEGOTIATION:
1212 return (TLS1_AD_NO_RENEGOTIATION);
1213 case SSL_AD_UNSUPPORTED_EXTENSION:
1214 return (TLS1_AD_UNSUPPORTED_EXTENSION);
1215 case SSL_AD_CERTIFICATE_UNOBTAINABLE:
1216 return (TLS1_AD_CERTIFICATE_UNOBTAINABLE);
1217 case SSL_AD_UNRECOGNIZED_NAME:
1218 return (TLS1_AD_UNRECOGNIZED_NAME);
1219 case SSL_AD_BAD_CERTIFICATE_STATUS_RESPONSE:
1220 return (TLS1_AD_BAD_CERTIFICATE_STATUS_RESPONSE);
1221 case SSL_AD_BAD_CERTIFICATE_HASH_VALUE:
1222 return (TLS1_AD_BAD_CERTIFICATE_HASH_VALUE);
1223 case SSL_AD_UNKNOWN_PSK_IDENTITY:
1224 return (TLS1_AD_UNKNOWN_PSK_IDENTITY);
1248#if 0 /* not appropriate for TLS, not used for DTLS */ 1225#if 0 /* not appropriate for TLS, not used for DTLS */
1249 case DTLS1_AD_MISSING_HANDSHAKE_MESSAGE: return 1226 case DTLS1_AD_MISSING_HANDSHAKE_MESSAGE : return
1250 (DTLS1_AD_MISSING_HANDSHAKE_MESSAGE); 1227 (DTLS1_AD_MISSING_HANDSHAKE_MESSAGE);
1251#endif 1228#endif
1252 default: return(-1); 1229 default:
1253 } 1230 return (-1);
1254 } 1231 }
1232}
generated by cgit v1.2.3-55-g6feb (git 2.39.1) at 2025-10-27 16:06:26 +0000